diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json
index 5fc4091e8c..9fa201861f 100644
--- a/.openpublishing.redirection.json
+++ b/.openpublishing.redirection.json
@@ -1,13 +1,63 @@
{
"redirections": [
{
-"source_path": "windows/application-management/msix-app-packaging-tool-walkthrough.md",
-"redirect_url": "https://docs.microsoft.com/windows/msix/mpt-overview",
+"source_path": "devices/hololens/hololens-upgrade-enterprise.md",
+"redirect_url": "https://docs.microsoft.com/hololens/hololens-requirements#upgrade-to-windows-holographic-for-business",
"redirect_document_id": true
},
{
+"source_path": "devices/hololens/hololens-install-localized.md",
+"redirect_url": "https://docs.microsoft.com/hololens/hololens1-install-localized",
+"redirect_document_id": false
+},
+{
+"source_path": "devices/hololens/hololens-install-apps.md",
+"redirect_url": "https://docs.microsoft.com/hololens/holographic-store-apps",
+"redirect_document_id": false
+},
+{
+"source_path": "devices/hololens/hololens-setup.md",
+"redirect_url": "https://docs.microsoft.com/hololens/hololens1-setup",
+"redirect_document_id": true
+},
+{
+"source_path": "devices/hololens/hololens-use-apps.md",
+"redirect_url": "https://docs.microsoft.com/hololens/holographic-home#using-apps-on-hololens",
+"redirect_document_id": true
+},
+{
+"source_path": "devices/hololens/hololens-get-apps.md",
+"redirect_url": "https://docs.microsoft.com/hololens/holographic-store-apps",
+"redirect_document_id": true
+},
+{
+"source_path": "devices/hololens/hololens-spaces-on-hololens.md",
+"redirect_url": "https://docs.microsoft.com/hololens/hololens-spaces",
+"redirect_document_id": true
+},
+{
+"source_path": "devices/hololens/hololens-clicker.md",
+"redirect_url": "https://docs.microsoft.com/hololens/hololens1-clicker",
+"redirect_document_id": true
+},
+{
+"source_path": "devices/hololens/hololens-clicker-restart-recover.md",
+"redirect_url": "https://docs.microsoft.com/hololens/hololens1-clicker#restart-or-recover-the-clicker",
+"redirect_document_id": false
+},
+{
+"source_path": "devices/surface/manage-surface-pro-3-firmware-updates.md",
+"redirect_url": "https://docs.microsoft.com/surface/manage-surface-driver-and-firmware-updates",
+"redirect_document_id": true
+},
+{
+"source_path": "devices/surface/update.md",
+"redirect_url": "https://docs.microsoft.com/surface/manage-surface-driver-and-firmware-updates",
+"redirect_document_id": false
+},
+{
"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations",
"redirect_document_id": true
},
{
@@ -727,7 +777,7 @@
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package",
"redirect_document_id": true
},
{
@@ -742,62 +792,62 @@
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection",
+"redirect_url": "https://docs.microsoft.com/windows/security/microsoft-defender-atp/customize-exploit-protection",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/emet-exploit-protection",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-attack-surface-reduction",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-attack-surface-reduction",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-controlled-folder-access",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-network-protection",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection",
"redirect_document_id": true
},
{
@@ -807,22 +857,22 @@
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/event-views",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/graphics.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/graphics",
-"redirect_document_id": true
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection",
+"redirect_document_id": false
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml",
"redirect_document_id": true
},
{
@@ -837,28 +887,28 @@
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/prerelease.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/prerelease",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prerelease",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np",
"redirect_document_id": true
},
{
"source_path": "windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md",
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection",
-"redirect_document_id": true
+"redirect_document_id": false
},
{
"source_path": "windows/keep-secure/advanced-features-windows-defender-advanced-threat-protection.md",
@@ -3153,7 +3203,7 @@
},
{
"source_path": "windows/device-security/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection",
"redirect_document_id": true
},
{
@@ -5991,6 +6041,11 @@
"redirect_url": "https://docs.microsoft.com/dynamics365/#pivot=mixed-reality-apps",
"redirect_document_id": true
},
+{
+ "source_path": "devices/hololens/hololens-restart-recover.md",
+ "redirect_url": "/hololens/hololens-recovery",
+ "redirect_document_id": false
+},
{
"source_path": "devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md",
"redirect_url": "https://docs.microsoft.com/surface-hub/provisioning-packages-for-surface-hub",
@@ -12193,8 +12248,8 @@
},
{
"source_path": "windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md",
-"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity",
-"redirect_document_id": true
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection",
+"redirect_document_id": false
},
{
"source_path": "windows/keep-secure/requirements-for-deploying-applocker-policies.md",
@@ -15279,7 +15334,12 @@
{
"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md",
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection",
-"redirect_document_id": true
+"redirect_document_id": false
+},
+{
+"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md",
+"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection",
+"redirect_document_id": false
}
]
}
diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md
index 3f07da3690..03234dc869 100644
--- a/devices/hololens/TOC.md
+++ b/devices/hololens/TOC.md
@@ -47,12 +47,12 @@
# Hologram optics and placement in space
## [Tips for viewing clear Holograms](hololens-calibration.md)
-## [Mapping physical spaces with HoloLens](hololens-spaces.md)
+## [Environment considerations for HoloLens](hololens-environment-considerations.md)
+## [Spatial mapping on HoloLens](hololens-spaces.md)
-# Recovery and troubleshooting
-## [Restore HoloLens 2 using Advanced Recovery Companion](hololens-recovery.md)
-## [Restart, reset, or recover the HoloLens](hololens-restart-recover.md)
+# Update and recovery
+## [Join the Windows Insider program](hololens-insider.md)
+## [Restart, reset, or recover](hololens-recovery.md)
# [Give us feedback](hololens-feedback.md)
-# [Insider preview for Microsoft HoloLens](hololens-insider.md)
# [Change history for Microsoft HoloLens documentation](change-history-hololens.md)
diff --git a/devices/hololens/hololens-environment-considerations.md b/devices/hololens/hololens-environment-considerations.md
new file mode 100644
index 0000000000..fd573a27c0
--- /dev/null
+++ b/devices/hololens/hololens-environment-considerations.md
@@ -0,0 +1,121 @@
+---
+title: Environment considerations for HoloLens
+description: Get the best possible experience using HoloLens when you optimize the device for your eyes and environment. Many different environmental factors are fused together to enable tracking, but as a Mixed Reality developer, there are several factors you can keep in mind to tune a space for better holograms.
+keywords: holographic frame, field of view, fov, calibration, spaces, environment, how-to
+author: dorreneb
+ms.author: dobrown
+manager: jarrettr
+ms.date: 8/29/2019
+ms.prod: hololens
+ms.topic: article
+audience: ITPro
+ms.localizationpriority: medium
+appliesto:
+- HoloLens 1
+- HoloLens 2
+---
+
+# Environment considerations for HoloLens
+
+HoloLens blends the holographic with the "real" world, placing holograms in your surroundings. A holographic app window "hangs" on the wall, a holographic ballerina spins on the tabletop, bunny ears sit on top of your unwitting friend’s head. When you’re using an immersive game or app, the holographic world will spread to fill your surroundings but you’ll still be able to see and move around the space.
+
+The holograms you place will stay where you’ve put them, even if you turn off your device.
+
+## Setting up an environment
+
+HoloLens devices know how to place stable and accurate holograms by *tracking* users in a space. Without proper tracking, the device does not understand the environment or the user within it so holograms can appear in the wrong places, not appear in the same spot every time, or not appear at all. The data used to track users is represented in the *spatial map*.
+
+Tracking performance is heavily influenced by the environment the user is in, and tuning an environment to induce stable and consistent tracking is an art rather than a science. Many different environmental factors are fused together to enable tracking, but as a Mixed Reality developer, there are several factors you can keep in mind to tune a space for better tracking.
+
+### Lighting
+
+Windows Mixed Reality uses visual light to track the user's location. When an environment is too bright, the cameras can get saturated, and nothing is seen. If the environment is too dark, the cameras cannot pick up enough information, and nothing is seen. Lighting should be even and sufficiently bright that a human can see without effort, but not so bright that the light is painful to look at.
+
+Areas where there are points of bright light in an overall dim area are also problematic, as the camera has to adjust when moving in and out of bright spaces. This can cause the device to "get lost" and think that the change in light equates to a change in location. Stable light levels in an area will lead to better tracking.
+
+Any outdoor lighting can also cause instability in the tracker, as the sun may vary considerably over time. For example, tracking in the same space in the summer vs. winter can produce drastically different results, as the secondhand light outside may be higher at different times of year.
+
+If you have a luxmeter, a steady 500-1000 lux is a good place to start.
+
+#### Types of lighting
+
+Different types of light in a space can also influence tracking. Light bulbs pulse with the AC electricity running through it - if the AC frequency is 50Hz, then the light pulses at 50Hz. For a human, this pulsing is not noticed. However, HoloLens' 30fps camera sees these changes - some frames will be well-lit, some will be poorly lit, and some will be over-exposed as the camera tries to compensate for light pulses.
+
+In the USA, electricity frequency standard is 60Hz, so light bulb pulses are harmonized with HoloLens' framerate - 60Hz pulses align with HoloLens' 30 FPS framerate. However, many countries have an AC frequency standard of 50Hz, which means some HoloLens frames will be taken during pulses, and others will not. In particular, fluorescent lighting in Europe has been known to cause issues.
+
+There are a few things you can try to resolve flickering issues. Temperature, bulb age, and warm-up cycles are common causes of fluorescent flickering and replacing bulbs may help. Tightening bulbs and making sure current draws are constant can also help.
+
+### Items in a space
+
+HoloLens uses unique environmental landmarks, also known as *features*, to locate itself in a space.
+
+A device can almost never track in a feature-poor area, as the device has no way of knowing where in space it is. Adding features to the walls of a space is usually a good way to improve tracking. Posters, symbols taped to a wall, plants, unique objects, or other similar items all help. A messy desk is a good example of an environment that leads to good tracking - there are a lot of different features in a single area.
+
+Additionally, use unique features in the same space. The same poster repeated multiple times over a wall, for example, will cause device confusion as the HoloLens won't know which of the repetitive posters it is looking at. One common way of adding unique features is to use lines of masking tape to create unique, non-repetitive patterns along the walls and floor of a space.
+
+A good question to ask yourself is: if you saw just a small amount of the scene, could you uniquely locate yourself in the space? If not, it's likely the device will have problems tracking as well.
+
+#### Wormholes
+
+If you have two areas or regions that look the same, the tracker may think they are the same. This results in the device tricking itself into thinking it is somewhere else. We call these types of repetitive areas *wormholes*.
+
+To prevent wormholes, try to prevent identical areas in the same space. Identical areas can sometimes include factory stations, windows on a building, server racks, or work stations. Labelling areas or adding unique features to each similar-looking areas can help mitigate wormholes.
+
+### Movement in a space
+
+If your environment is constantly shifting and changing, the device has no stable features to locate against.
+
+The more moving objects that are in a space, including people, the easier it is to lose tracking. Moving conveyor belts, items in different states of construction, and lots of people in a space have all been known to cause tracking issues.
+
+The HoloLens can quickly adapt to these changes, but only when that area is clearly visible to the device. Areas that are not seen as frequently may lag behind reality, which can cause errors in the spatial map. For example, a user scans a friend and then turns around while the friend leaves the room. A 'ghost' representation of the friend will persist in the spatial mapping data until the user re-scans the now empty space.
+
+### Proximity of the user to items in the space
+
+Similarly to how humans cannot focus well on objects close to the eyes, HoloLens struggles when objects are close to it's cameras. If an object is too close to be seen with both cameras, or if an object is blocking one camera, the device will have far more issues with tracking against the object.
+
+The cameras can see no closer than 15cm from an object.
+
+### Surfaces in a space
+
+Strongly reflective surfaces will likely look different depending on the angle, which affects tracking. Think of a brand new car—when you move around it, light reflects and you see different objects in the surface as you move. To the tracker, the different objects reflected in the surface represent a changing environment, and the device loses tracking.
+
+Less shiny objects are easier to track against.
+
+### Wi-Fi fingerprint considerations
+
+As long as Wi-Fi is enabled, map data will be correlated with a Wi-Fi fingerprint, even when not connected to an actual WiFi network/router. Without Wi-Fi info, the space and holograms may be slightly slower to recognize. If the Wi-Fi signals change significantly, the device may think it is in a different space altogether.
+
+Network identification (such as SSID or MAC address) is not sent to Microsoft, and all Wi-Fi references are kept local on the HoloLens.
+
+## Mapping new spaces
+
+When you enter a new space (or load an existing one), you’ll see a mesh graphic spreading over the space. This means your device is mapping your surroundings. While a HoloLens will learn a space over time, there are tips and tricks to map spaces.
+
+## Environment management
+
+There are two settings which enable users to “clean up” holograms and cause HoloLens to “forget" a space. They exist in **Holograms and environments** in the settings app, with the second setting also appearing under **Privacy** in the settings app.
+
+1. **Delete nearby holograms**. When you select this setting, HoloLens will erase all anchored holograms and all stored map data for the “current space” where the device is located. A new map section would be created and stored in the database for that location once holograms are again placed in that same space.
+
+1. **Delete all holograms**.By selecting this setting, HoloLens will erase ALL map data and anchored holograms in the entire databases of spaces. No holograms will be rediscovered and any holograms need to be newly placed to again store map sections in the database.
+
+## Hologram quality
+
+Holograms can be placed throughout your environment—high, low, and all around you—but you’ll see them through a [holographic frame](https://docs.microsoft.com/windows/mixed-reality/holographic-frame) that sits in front of your eyes. To get the best view, make sure to adjust your device so you can see the entire frame. And don’t hesitate to walk around your environment and explore!
+
+For your [holograms](https://docs.microsoft.com/windows/mixed-reality/hologram) to look crisp, clear, and stable, your HoloLens needs to be calibrated just for you. When you first set up your HoloLens, you’ll be guided through this process. Later on, if holograms don’t look right or you’re seeing a lot of errors, you can make adjustments.
+
+If you are having trouble mapping spaces, try deleting nearby holograms and remapping the space.
+
+### Calibration
+
+If your holograms look jittery or shaky, or if you’re having trouble placing holograms, the first thing to try is the [Calibration app](hololens-calibration.md). This app can also help if you’re experiencing any discomfort while using your HoloLens.
+
+To get to the Calibration app, go to **Settings** > **System** > **Utilities**. Select **Open Calibration** and follow the instructions.
+
+If someone else is going to be using your HoloLens, they should run the Calibration app first so the device is set up properly for them.
+
+## See also
+
+- [Spatial mapping design](https://docs.microsoft.com/windows/mixed-reality/spatial-mapping-design)
+- [Holograms](https://docs.microsoft.com/windows/mixed-reality/hologram)
diff --git a/devices/hololens/hololens-offline.md b/devices/hololens/hololens-offline.md
index 908a2bbb45..daf928dd5e 100644
--- a/devices/hololens/hololens-offline.md
+++ b/devices/hololens/hololens-offline.md
@@ -1,16 +1,16 @@
---
title: Use HoloLens offline
description: To set up HoloLens, you'll need to connect to a Wi-Fi network
-ms.assetid: b86f603c-d25f-409b-b055-4bbc6edcd301
-ms.reviewer: jarrettrenshaw
+keywords: hololens, offline, OOBE
+audience: ITPro
ms.date: 07/01/2019
-manager: v-miegge
-keywords: hololens
-ms.prod: hololens
-ms.sitesec: library
+ms.assetid: b86f603c-d25f-409b-b055-4bbc6edcd301
author: v-miegge
ms.author: v-miegge
+manager: v-miegge
ms.topic: article
+ms.prod: hololens
+ms.sitesec: library
ms.localizationpriority: medium
appliesto:
- HoloLens (1st gen)
@@ -35,6 +35,10 @@ HoloLens need a network connection to go through initial device set up. If your
| MSA | https://login.live.com/ppsecure/inlineconnect.srf?id=80600 |
| MSA Pin | https://account.live.com/msangc?fl=enroll |
+Additional references:
+
+- [Technical reference for AAD related IP ranges and URLs](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges)
+
## HoloLens limitations
After your HoloLens is set up, you can use it without a Wi-Fi connection, but apps that use Internet connections will have limited capabilities when you use HoloLens offline.
diff --git a/devices/hololens/hololens-recovery.md b/devices/hololens/hololens-recovery.md
index b0f40d77cc..67541da523 100644
--- a/devices/hololens/hololens-recovery.md
+++ b/devices/hololens/hololens-recovery.md
@@ -1,55 +1,103 @@
---
-title: Restore HoloLens 2 using Advanced Recovery Companion
-ms.reviewer:
-manager: dansimp
+title: Reset or recover your HoloLens
+ms.reviewer: Both basic and advanced instructions for rebooting or resetting your HoloLens.
description: How to use Advanced Recovery Companion to flash an image to HoloLens 2.
+keywords: how-to, reboot, reset, recover, hard reset, soft reset, power cycle, HoloLens, shut down, arc, advanced recovery companion
ms.prod: hololens
ms.sitesec: library
-author: dansimp
-ms.author: dansimp
+author: mattzmsft
+ms.author: mazeller
+ms.date: 08/30/2019
ms.topic: article
-ms.localizationpriority: medium
+ms.localizationpriority:
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
---
-# Restore HoloLens 2 using Advanced Recovery Companion
+# Restart, reset, or recover HoloLens
->[!TIP]
->If you're having issues with HoloLens (the first device released), see [Restart, reset, or recover HoloLens](https://support.microsoft.com/help/13452/hololens-restart-reset-or-recover-hololens). Advanced Recovery Companion is only supported for HoloLens 2.
+If you’re experiencing problems with your HoloLens you may want to try a restart, reset, or even re-flash with device recovery.
->[!WARNING]
->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+Here are some things to try if your HoloLens isn’t running well. This article will guide you through the recommended recovery steps in succession.
-The Advanced Recovery Companion is a new app in Microsoft Store that you can use to restore the operating system image to your HoloLens device.
+This article focuses on the HoloLens device and software, if your holograms don't look right, [this article](hololens-environment-considerations.md) talks about environmental factors that improve hologram quality.
-When your HoloLens 2 is unresponsive, not running properly, or is experiencing software or update problems, try these things in order:
+## Restart your HoloLens
-1. [Restart](#restart-hololens-2) the HoloLens 2.
-2. [Reset](#reset-hololens-2) the HoloLens 2.
-3. [Recover](#recover-hololens-2) the HoloLens 2.
+First, try restarting the device.
->[!IMPORTANT]
->Resetting or recovering your HoloLens will erase all of your personal data, including apps, games, photos, and settings. You won’t be able to restore a backup once the reset is complete.
+### Perform a safe restart by using Cortana
-## Restart HoloLens 2
+The safest way to restart the HoloLens is by using Cortana. This is generally a great first-step when experiencing an issue with HoloLens:
-A device restart can often "fix" a computer issue. First, say "Hey Cortana, restart the device."
+1. Put on your device
+1. Make sure it’s powered on, a user is logged in, and the device is not waiting for a password to unlock it.
+1. Say “Hey Cortana, reboot” or "Hey Cortana, restart."
+1. When she acknowledges she will ask you for confirmation. Wait a second for a sound to play after she has finished her question, indicating she is listening to you and then say “Yes.”
+1. The device will now restart.
-If you’re still having problems, press the power button for 4 seconds, until all of the battery indicators fade out. Wait 1 minute, then press the power button again to turn on the device.
+### Perform a safe restart by using the power button
-If neither of those things works, force restart the device. Hold down the power button for 10 seconds. Release it and wait 30 seconds, then press the power button again to turn on the device.
+If you still can't restart your device, you can try to restart it by using the power button:
-## Reset HoloLens 2
+1. Press and hold the power button for five seconds.
+ 1. After one second, you will see all five LEDs illuminate, then slowly turn off from right to left.
+ 1. After five seconds, all LEDs will be off, indicating the shutdown command was issued successfully.
+ 1. Note that it’s important to stop pressing the button immediately after all the LEDs have turned off.
+1. Wait one minute for the shutdown to cleanly succeed. Note that the shutdown may still be in progress even if the displays are turned off.
+1. Power on the device again by pressing and holding the power button for one second.
-If the device is still having a problem after restart, use reset to return the HoloLens 2 to factory settings.
+### Perform a safe restart by using Windows Device Portal
-To reset your HoloLens 2, go to **Settings > Update > Reset** and select **Reset device**.
+> [!NOTE]
+> To do this, HoloLens has to be configured as a developer device.
+> Read more about [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal).
+
+If the previous procedure doesn't work, you can try to restart the device by using [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal). In the upper right corner, there is an option to restart or shut down the device.
+
+### Perform an unsafe forced restart
+
+If none of the previous methods are able to successfully restart your device, you can force a restart. This method is equivalent to pulling the battery from the HoloLens. It is a dangerous operation which may leave your device in a corrupt state. If that happens, you'll have to flash your HoloLens.
+
+> [!WARNING]
+> This is a potentially harmful method and should only be used in the event none of the above methods work.
+
+1. Press and hold the power button for at least 10 seconds.
+
+ - It’s okay to hold the button for longer than 10 seconds.
+ - It’s safe to ignore any LED activity.
+1. Release the button and wait for two or three seconds.
+1. Power on the device again by pressing and holding the power button for one second.
+If you’re still having problems, press the power button for 4 seconds, until all of the battery indicators fade out and the screen stops displaying holograms. Wait 1 minute, then press the power button again to turn on the device.
+
+## Reset to factory settings
>[!NOTE]
>The battery needs at least 40 percent charge to reset.
-## Recover HoloLens 2
+If your HoloLens is still experiencing issues after restarting, try resetting it to factory state. Resetting your HoloLens keeps the version of the Windows Holographic software that’s installed on it and returns everything else to factory settings.
-If the device is still having a problem after reset, you can use Advanced Recovery Companion to flash the device with a new image.
+If you reset your device, all your personal data, apps, and settings will be erased. Resetting will only install the latest installed version of Windows Holographic and you will have to redo all the initialization steps (calibrate, connect to Wi-Fi, create a user account, download apps, and so forth).
+
+1. Launch the Settings app, and then select **Update** > **Reset**.
+1. Select the **Reset device** option and read the confirmation message.
+1. If you agree to reset your device, the device will restart and display a set of spinning gears with a progress bar.
+1. Wait about 30 minutes for this process to complete.
+1. The reset will complete and the device will restart into the out-of-the-box experience.
+
+## Re-install the operating system
+
+If the device is still having a problem after rebooting and resetting, you can use a recovery tool on your computer to reinstall the HoloLens' operating system and firmware.
+
+HoloLens (1st gen) and HoloLens 2 use different tools but both tools will auto-detect your HoloLens and install new software.
+
+All of the data HoloLens needs to reset is packaged in a Full Flash Update (ffu). This is similar to an iso, wim, or vhd. [Learn about FFU image file formats.](https://docs.microsoft.com/windows-hardware/manufacture/desktop/wim-vs-ffu-image-file-formats)
+
+### HoloLens 2
+
+The Advanced Recovery Companion is a new app in Microsoft Store restore the operating system image to your HoloLens 2 device.
1. On your computer, get [Advanced Recovery Companion](https://www.microsoft.com/p/advanced-recovery-companion/9p74z35sfrs8?activetab=pivot:overviewtab) from Microsoft Store.
2. Connect HoloLens 2 to your computer.
@@ -58,5 +106,18 @@ If the device is still having a problem after reset, you can use Advanced Recove
5. On the **Device info** page, select **Install software** to install the default package. (If you have a Full Flash Update (FFU) image that you want to install instead, select **Manual package selection**.)
6. Software installation will begin. Do not use the device or disconnect the cable during installation. When you see the **Installation finished** page, you can disconnect and use your device.
->[!NOTE]
->[Learn about FFU image file formats.](https://docs.microsoft.com/windows-hardware/manufacture/desktop/wim-vs-ffu-image-file-formats)
+### HoloLens (1st gen)
+
+If necessary, you can install a completely new operating system on your HoloLens (1st gen) with the Windows Device Recovery Tool.
+
+Before you use this tool, determine if restarting or resetting your HoloLens fixes the problem. The recovery process may take some time. When you're done, the latest version of the Windows Holographic software approved for your HoloLens will be installed.
+
+To use the tool, you’ll need a computer running Windows 10 or later, with at least 4 GB of free storage space. Please note that you can’t run this tool on a virtual machine.
+
+To recover your HoloLens
+
+1. Download and install the [Windows Device Recovery Tool](https://dev.azure.com/ContentIdea/ContentIdea/_queries/query/8a004dbe-73f8-4a32-94bc-368fc2f2a895/) on your computer.
+1. Connect the HoloLens (1st gen) to your computer using the Micro USB cable that came with your HoloLens.
+1. Run the Windows Device Recovery Tool and follow the instructions.
+
+If the HoloLens (1st gen) isn’t automatically detected, select **My device was not detected** and follow the instructions to put your device into recovery mode.
diff --git a/devices/hololens/hololens-restart-recover.md b/devices/hololens/hololens-restart-recover.md
deleted file mode 100644
index 9bf0cddb37..0000000000
--- a/devices/hololens/hololens-restart-recover.md
+++ /dev/null
@@ -1,55 +0,0 @@
----
-title: Restart, reset, or recover HoloLens
-description: Restart, reset, or recover HoloLens
-ms.assetid: 9a546416-1648-403c-9e0c-742171b8812e
-ms.reviewer: jarrettrenshaw
-ms.date: 07/01/2019
-manager: v-miegge
-keywords: hololens
-ms.prod: hololens
-ms.sitesec: library
-author: v-miegge
-ms.author: v-miegge
-ms.topic: article
-ms.localizationpriority: medium
----
-
-# Restart, reset, or recover HoloLens
-
-Here are some things to try if your HoloLens is unresponsive, isn’t running well, or is experiencing software or update problems.
-
-## Restart your HoloLens
-
-If your HoloLens isn’t running well or is unresponsive, try the following things.
-
-First, try restarting the device: say, "Hey Cortana, restart the device."
-
-If you’re still having problems, press the power button for 4 seconds, until all of the battery indicators fade out. Wait 1 minute, then press the power button again to turn on the device.
-
-If neither of those things works, force restart the device. Hold down the power button for 10 seconds. Release it and wait 30 seconds, then press the power button again to turn on the device.
-
-## Reset or recover your HoloLens
-
-If restarting your HoloLens doesn’t help, another option is to reset it. If resetting it doesn’t fix the problem, the Windows Device Recovery Tool can help you recover your device.
-
->[!IMPORTANT]
->Resetting or recovering your HoloLens will erase all of your personal data, including apps, games, photos, and settings. You won’t be able to restore a backup once the reset is complete.
-
-## Reset
-
-Resetting your HoloLens keeps the version of the Windows Holographic software that’s installed on it and returns everything else to factory settings.
-
-To reset your HoloLens, go to **Settings** > **Update** > **Reset** and select **Reset device**. The battery will need to have at least a 40 percent charge remaining to reset.
-
-## Recover using the Windows Device Recovery Tool
-
-Before you use this tool, determine if restarting or resetting your HoloLens fixes the problem. The recovery process may take some time, and the latest version of the Windows Holographic software approved for your HoloLens will be installed.
-
-To use the tool, you’ll need a computer running Windows 10 or later, with at least 4 GB of free storage space. Please note that you can’t run this tool on a virtual machine.
-To recover your HoloLens
-
-1. Download and install the [Windows Device Recovery Tool](https://dev.azure.com/ContentIdea/ContentIdea/_queries/query/8a004dbe-73f8-4a32-94bc-368fc2f2a895/) on your computer.
-1. Connect the clicker to your computer using the Micro USB cable that came with your HoloLens.
-1. Run the Windows Device Recovery Tool and follow the instructions.
-
-If the clicker isn’t automatically detected, select **My device was not detected** and follow the instructions to put your device into recovery mode.
diff --git a/devices/hololens/hololens2-setup.md b/devices/hololens/hololens2-setup.md
index d007628794..7b662a76b4 100644
--- a/devices/hololens/hololens2-setup.md
+++ b/devices/hololens/hololens2-setup.md
@@ -62,9 +62,20 @@ To turn on your HoloLens 2, press the Power button. The LED lights below the Po
| To turn off | Press and for hold 5s. | All five lights turn on, then fade off one at a time. After the lights turn off, a sound plays and the screen displays "Goodbye." |
| To force the Hololens to restart if it is unresponsive | Press and hold for 10s. | All five lights turn on, then fade off one at a time. After the lights turn off. |
-## HoloLens indicator lights
+## HoloLens behavior reference
-Not sure what the indicator lights on your HoloLens mean? Here's some help!
+Not sure what the indicator lights on your HoloLens mean? Want to know how HoloLens should behave while charging? Here's some help!
+
+### Charging behavior
+
+| State of the Device | Action | HoloLens 2 will do this |
+| - | - | - |
+| OFF | Plug in USB Cable | Device transitions to ON with indicator lights showing battery level and device starts charging.
+| ON | Remove USB Cable | Device stops charging
+| ON | Plug in USB Cable | Device starts charging
+| SLEEP | Plug in USB Cable | Device starts charging
+| SLEEP | Remove USB Cable | Device stops charging
+| ON with USB cable pluged in | Turn off Device | Device transitions to ON with indicator lights showing battery level and device will start charging |
### Lights that indicate the battery level
@@ -76,6 +87,14 @@ Not sure what the indicator lights on your HoloLens mean? Here's some help!
| One solid light, one light fading in and out | Between 40% and 21% |
| One light fading in and out | Between 20% and 5% or lower (critical battery) |
+### Sleep Behavior
+
+| State of the Device | Action | HoloLens 2 will do this |
+| - | - | - |
+| ON | Single Power button press | Device transitions to SLEEP and turns off all indicator lights |
+| ON | No movement for 3 minutes | Device transition to SLEEP and turns off all indicator lights |
+| SLEEP | Single Power button Press | Device transitions to ON and turns on indicator lights |
+
### Lights to indicate problems
| When you do this | The lights do this | It means this |
diff --git a/devices/surface-hub/first-run-program-surface-hub.md b/devices/surface-hub/first-run-program-surface-hub.md
index 22cddbc67d..3d38a356f5 100644
--- a/devices/surface-hub/first-run-program-surface-hub.md
+++ b/devices/surface-hub/first-run-program-surface-hub.md
@@ -337,12 +337,12 @@ This is what happens when you choose an option.
- **Use Microsoft Azure Active Directory**
- Clicking this option allows you to join the device to Azure AD. Once you click **Next**, the device will restart to apply some settings, and then you’ll be taken to the [Use Microsoft Azure Active Directory](#use-microsoft-azure) page and asked to enter credentials that can allow you to join Azure AD. Members of the Azure Global Admins security group from the joined organization will be able to use the Settings app. The specific people that will be allowed depends on your Azure AD subscription and how you’ve configured the settings for your Azure AD organization.
+ Clicking this option allows you to join the device to Azure AD. Once you click **Next**, the device will restart to apply some settings, and then you’ll be taken to the [Use Microsoft Azure Active Directory](#use-microsoft-azure) page and asked to enter credentials that can allow you to join Azure AD. Members of the Azure Global Admins role from the joined organization will be able to use the Settings app. The specific people that will be allowed depends on your Azure AD subscription and how you’ve configured the settings for your Azure AD organization.
- >[!IMPORTANT]
- >Administrators added to the Azure Global Admins group after you join the device to Azure AD will be unable to use the Settings app.
+ > [!IMPORTANT]
+ > Administrators added to the Azure Device Administrators role after you join the device to Azure AD will be unable to use the Settings app.
>
- >If you join Surface Hub to Azure AD during first-run setup, single sign-on (SSO) for Office apps will not work properly. Users will have to sign in to each Office app individually.
+ > If you join Surface Hub to Azure AD during first-run setup, single sign-on (SSO) for Office apps will not work properly. Users will have to sign in to each Office app individually.
- **Use Active Directory Domain Services**
diff --git a/devices/surface-hub/index.md b/devices/surface-hub/index.md
index 110355baf4..61a9b33c78 100644
--- a/devices/surface-hub/index.md
+++ b/devices/surface-hub/index.md
@@ -1,7 +1,7 @@
---
title: Surface Hub
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
layout: LandingPage
ms.prod: surface-hub
diff --git a/devices/surface-hub/surface-hub-2s-account.md b/devices/surface-hub/surface-hub-2s-account.md
index 03b3f8d7ef..852ea6463d 100644
--- a/devices/surface-hub/surface-hub-2s-account.md
+++ b/devices/surface-hub/surface-hub-2s-account.md
@@ -4,8 +4,8 @@ description: "This page describes the procedure for creating the Surface Hub 2S
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-adoption-kit.md b/devices/surface-hub/surface-hub-2s-adoption-kit.md
index de75086db3..2058fcd918 100644
--- a/devices/surface-hub/surface-hub-2s-adoption-kit.md
+++ b/devices/surface-hub/surface-hub-2s-adoption-kit.md
@@ -4,8 +4,8 @@ description: "Microsoft has developed downloadable materials that you can make a
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-change-history.md b/devices/surface-hub/surface-hub-2s-change-history.md
index a24c8c12e4..f629bd6bd6 100644
--- a/devices/surface-hub/surface-hub-2s-change-history.md
+++ b/devices/surface-hub/surface-hub-2s-change-history.md
@@ -4,8 +4,8 @@ description: "This page shows change history for Surface Hub 2S."
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
audience: Admin
ms.manager: laurawi
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-connect.md b/devices/surface-hub/surface-hub-2s-connect.md
index 7cc48d747d..7a08a67098 100644
--- a/devices/surface-hub/surface-hub-2s-connect.md
+++ b/devices/surface-hub/surface-hub-2s-connect.md
@@ -4,8 +4,8 @@ description: "This page explains how to connect external devices to Surface Hub
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-custom-install.md b/devices/surface-hub/surface-hub-2s-custom-install.md
index 020256c627..c86ac8b4b3 100644
--- a/devices/surface-hub/surface-hub-2s-custom-install.md
+++ b/devices/surface-hub/surface-hub-2s-custom-install.md
@@ -4,8 +4,8 @@ description: "Learn how to perform a custom install of Surface Hub 2S."
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-deploy-apps-intune.md b/devices/surface-hub/surface-hub-2s-deploy-apps-intune.md
index b52bdc6532..77fe0fa1ca 100644
--- a/devices/surface-hub/surface-hub-2s-deploy-apps-intune.md
+++ b/devices/surface-hub/surface-hub-2s-deploy-apps-intune.md
@@ -4,8 +4,8 @@ description: "Learn how you can deploy apps to Surface Hub 2S using Intune."
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-deploy-checklist.md b/devices/surface-hub/surface-hub-2s-deploy-checklist.md
index 10fe718f75..08421ad2f6 100644
--- a/devices/surface-hub/surface-hub-2s-deploy-checklist.md
+++ b/devices/surface-hub/surface-hub-2s-deploy-checklist.md
@@ -4,8 +4,8 @@ description: "Verify your deployment of Surface Hub 2S using pre- and post-deplo
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-deploy.md b/devices/surface-hub/surface-hub-2s-deploy.md
index cd99172ad3..87908ed944 100644
--- a/devices/surface-hub/surface-hub-2s-deploy.md
+++ b/devices/surface-hub/surface-hub-2s-deploy.md
@@ -4,8 +4,8 @@ description: "This page describes how to deploy Surface Hub 2S using provisionin
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-install-mount.md b/devices/surface-hub/surface-hub-2s-install-mount.md
index 7b4e3e3e00..1ae4dcadb6 100644
--- a/devices/surface-hub/surface-hub-2s-install-mount.md
+++ b/devices/surface-hub/surface-hub-2s-install-mount.md
@@ -4,8 +4,8 @@ description: "Learn how to install and mount Surface Hub 2S."
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-manage-intune.md b/devices/surface-hub/surface-hub-2s-manage-intune.md
index 1749e6cafd..e71d37def0 100644
--- a/devices/surface-hub/surface-hub-2s-manage-intune.md
+++ b/devices/surface-hub/surface-hub-2s-manage-intune.md
@@ -4,8 +4,8 @@ description: "Learn how to update and manage Surface Hub 2S using Intune."
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
@@ -28,7 +28,7 @@ Surface Hub 2S allows IT administrators to manage settings and policies using a
### Auto registration — Azure Active Directory Affiliated
-When affiliating Surface Hub 2S with a tenant that has Intune auto enrollment enabled, the device will automatically enroll with Intune.
+When affiliating Surface Hub 2S with a tenant that has Intune auto enrollment enabled, the device will automatically enroll with Intune. For more information, refer to [Intune enrollment methods for Windows devices](https://docs.microsoft.com/intune/enrollment/windows-enrollment-methods).
## Windows 10 Team Edition settings
diff --git a/devices/surface-hub/surface-hub-2s-manage-passwords.md b/devices/surface-hub/surface-hub-2s-manage-passwords.md
index 3de1d293aa..accd5d7e84 100644
--- a/devices/surface-hub/surface-hub-2s-manage-passwords.md
+++ b/devices/surface-hub/surface-hub-2s-manage-passwords.md
@@ -4,8 +4,8 @@ description: "Learn how to configure Surface Hub 2S on-premises accounts with Po
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-onprem-powershell.md b/devices/surface-hub/surface-hub-2s-onprem-powershell.md
index 0d51997eda..fb2c98dcbd 100644
--- a/devices/surface-hub/surface-hub-2s-onprem-powershell.md
+++ b/devices/surface-hub/surface-hub-2s-onprem-powershell.md
@@ -4,8 +4,8 @@ description: "Learn how to configure Surface Hub 2S on-premises accounts with Po
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-onscreen-display.md b/devices/surface-hub/surface-hub-2s-onscreen-display.md
index 0f5679cd37..da4712505e 100644
--- a/devices/surface-hub/surface-hub-2s-onscreen-display.md
+++ b/devices/surface-hub/surface-hub-2s-onscreen-display.md
@@ -4,8 +4,8 @@ description: "Learn how to use the onscreen display to adjust brightness and oth
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-pack-components.md b/devices/surface-hub/surface-hub-2s-pack-components.md
index 692f4ee02d..287f43ec7b 100644
--- a/devices/surface-hub/surface-hub-2s-pack-components.md
+++ b/devices/surface-hub/surface-hub-2s-pack-components.md
@@ -4,8 +4,8 @@ description: "Instructions for packing Surface Hub 2S components, replacing the
keywords: pack, replace components, camera, compute cartridge
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-phone-authenticate.md b/devices/surface-hub/surface-hub-2s-phone-authenticate.md
index 53b8395f63..f79bbca0d4 100644
--- a/devices/surface-hub/surface-hub-2s-phone-authenticate.md
+++ b/devices/surface-hub/surface-hub-2s-phone-authenticate.md
@@ -4,8 +4,8 @@ description: "Learn how to simplify signing in to Surface Hub 2S using password-
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-port-keypad-overview.md b/devices/surface-hub/surface-hub-2s-port-keypad-overview.md
index 05c3c4b37a..8a667d95ac 100644
--- a/devices/surface-hub/surface-hub-2s-port-keypad-overview.md
+++ b/devices/surface-hub/surface-hub-2s-port-keypad-overview.md
@@ -4,8 +4,8 @@ description: "This page describes the ports, physical buttons, and configuration
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-prepare-environment.md b/devices/surface-hub/surface-hub-2s-prepare-environment.md
index 2b28cab313..a1bd059ab4 100644
--- a/devices/surface-hub/surface-hub-2s-prepare-environment.md
+++ b/devices/surface-hub/surface-hub-2s-prepare-environment.md
@@ -4,8 +4,8 @@ description: "Learn what you need to do to prepare your environment for Surface
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-quick-start.md b/devices/surface-hub/surface-hub-2s-quick-start.md
index d1d20bc7c8..3d7f08641a 100644
--- a/devices/surface-hub/surface-hub-2s-quick-start.md
+++ b/devices/surface-hub/surface-hub-2s-quick-start.md
@@ -4,8 +4,8 @@ description: "View the quick start steps to begin using Surface Hub 2S."
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-recover-reset.md b/devices/surface-hub/surface-hub-2s-recover-reset.md
index d055e724cd..414456c4f3 100644
--- a/devices/surface-hub/surface-hub-2s-recover-reset.md
+++ b/devices/surface-hub/surface-hub-2s-recover-reset.md
@@ -4,8 +4,8 @@ description: "Learn how to recover and reset Surface Hub 2S."
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-secure-with-uefi-semm.md b/devices/surface-hub/surface-hub-2s-secure-with-uefi-semm.md
index cf7b561dca..8d0768ba93 100644
--- a/devices/surface-hub/surface-hub-2s-secure-with-uefi-semm.md
+++ b/devices/surface-hub/surface-hub-2s-secure-with-uefi-semm.md
@@ -4,8 +4,8 @@ description: "Learn more about securing Surface Hub 2S with SEMM."
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-setup.md b/devices/surface-hub/surface-hub-2s-setup.md
index 76e5ac1055..08318020fb 100644
--- a/devices/surface-hub/surface-hub-2s-setup.md
+++ b/devices/surface-hub/surface-hub-2s-setup.md
@@ -4,8 +4,8 @@ description: "Learn how to complete first time Setup for Surface Hub 2S."
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
@@ -27,7 +27,7 @@ When you first start Surface Hub 2S, the device automatically enters first time
- This option is not shown if connected using an Ethernet cable.
- You cannot connect to a wireless network in hotspots (captive portals) that redirect sign-in requests to a provider’s website.
-3. **Enter device account info.** Use **domain\user** for on-premises and hybrid environments and **user@example.com** for online environments. Select **Next.**
+3. **Enter device account info.** Use **domain\user** for on-premises and hybrid environments and **user\@example.com** for online environments. Select **Next.**

1. **Enter additional info.** If requested, provide your Exchange server address and then select **Next.**
diff --git a/devices/surface-hub/surface-hub-2s-site-planning.md b/devices/surface-hub/surface-hub-2s-site-planning.md
index 683d732f9a..9b04ea0174 100644
--- a/devices/surface-hub/surface-hub-2s-site-planning.md
+++ b/devices/surface-hub/surface-hub-2s-site-planning.md
@@ -4,8 +4,8 @@ description: "Learn more about rooms for Surface Hub 2S."
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-site-readiness-guide.md b/devices/surface-hub/surface-hub-2s-site-readiness-guide.md
index e765207b4c..8db9d3818e 100644
--- a/devices/surface-hub/surface-hub-2s-site-readiness-guide.md
+++ b/devices/surface-hub/surface-hub-2s-site-readiness-guide.md
@@ -4,8 +4,8 @@ description: "Get familiar with site readiness requirements and recommendations
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-techspecs.md b/devices/surface-hub/surface-hub-2s-techspecs.md
index 12955c3afb..5f898a3fb6 100644
--- a/devices/surface-hub/surface-hub-2s-techspecs.md
+++ b/devices/surface-hub/surface-hub-2s-techspecs.md
@@ -4,9 +4,9 @@ description: "View tech specs for Surface Hub 2S including pen, camera, and opti
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
+author: greg-lindsay
manager: laurawi
-ms.author: robmazz
+ms.author: greglin
audience: Admin
ms.topic: article
ms.date: 06/20/2019
diff --git a/devices/surface-hub/surface-hub-2s-unpack.md b/devices/surface-hub/surface-hub-2s-unpack.md
index 474bec14da..950a5caa6f 100644
--- a/devices/surface-hub/surface-hub-2s-unpack.md
+++ b/devices/surface-hub/surface-hub-2s-unpack.md
@@ -4,8 +4,8 @@ description: "This page includes information about safely unpacking Surface Hub
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-2s-whats-new.md b/devices/surface-hub/surface-hub-2s-whats-new.md
index 2f0dad2a22..13d7eb06ce 100644
--- a/devices/surface-hub/surface-hub-2s-whats-new.md
+++ b/devices/surface-hub/surface-hub-2s-whats-new.md
@@ -4,8 +4,8 @@ description: "Learn more about new features in Surface Hub 2S."
keywords: separate values with commas
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
audience: Admin
ms.topic: article
diff --git a/devices/surface-hub/surface-hub-start-menu.md b/devices/surface-hub/surface-hub-start-menu.md
index 9c1f451f63..b46f7b2edd 100644
--- a/devices/surface-hub/surface-hub-start-menu.md
+++ b/devices/surface-hub/surface-hub-start-menu.md
@@ -3,8 +3,8 @@ title: Configure Surface Hub Start menu
description: Use MDM to customize the Start menu on Surface Hub.
ms.prod: surface-hub
ms.sitesec: library
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
ms.topic: article
ms.date: 08/15/2018
ms.reviewer:
diff --git a/devices/surface/TOC.md b/devices/surface/TOC.md
index 99c584e4ba..a10cc065ed 100644
--- a/devices/surface/TOC.md
+++ b/devices/surface/TOC.md
@@ -3,13 +3,17 @@
## [Get started](get-started.md)
## Overview
-### [Surface Pro Tech specs](https://www.microsoft.com/surface/devices/surface-pro/tech-specs)
-### [Surface Book Tech specs](https://www.microsoft.com/surface/devices/surface-book/tech-specs)
-### [Surface Studio Tech specs](https://www.microsoft.com/surface/devices/surface-studio/tech-specs)
-### [Surface Go Tech specs](https://www.microsoft.com/surface/devices/surface-go/tech-specs)
-### [Surface Laptop 2 Tech specs](https://www.microsoft.com/surface/devices/surface-laptop/tech-specs)
+
+### [Surface Pro 7 for Business](https://www.microsoft.com/surface/business/surface-pro-7)
+### [Surface Pro X for Business](https://www.microsoft.com/surface/business/surface-pro-x)
+### [Surface Laptop 3 for Business](https://www.microsoft.com/surface/business/surface-laptop-3)
+### [Surface Book 2 for Business](https://www.microsoft.com/surface/business/surface-book-2)
+### [Surface Studio 2 for Business](https://www.microsoft.com/surface/business/surface-studio-2)
+### [Surface Go](https://www.microsoft.com/surface/business/surface-go)
+### [Secure, work-anywhere mobility with LTE Advanced](https://www.microsoft.com/surface/business/lte-laptops-and-tablets)
## Plan
+
### [Surface device compatibility with Windows 10 Long-Term Servicing Branch](surface-device-compatibility-with-windows-10-ltsc.md)
### [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md)
### [Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md)
@@ -19,10 +23,11 @@
### [Ethernet adapters and Surface deployment](ethernet-adapters-and-surface-device-deployment.md)
## Deploy
+
### [Deploy Surface devices](deploy.md)
### [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md)
### [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md)
-### [Windows 10 ARM-based PC app compatibility](surface-pro-arm-app-performance.md)
+### [Surface Pro X app compatibility](surface-pro-arm-app-performance.md)
### [Deploy the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)
### [Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md)
### [Step by step: Surface Deployment Accelerator](step-by-step-surface-deployment-accelerator.md)
@@ -34,16 +39,17 @@
### [Surface System SKU reference](surface-system-sku-reference.md)
## Manage
+
### [Optimize Wi-Fi connectivity for Surface devices](surface-wireless-connect.md)
### [Best practice power settings for Surface devices](maintain-optimal-power-settings-on-Surface-devices.md)
### [Surface Dock Firmware Update](surface-dock-firmware-update.md)
### [Battery Limit setting](battery-limit.md)
### [Surface Brightness Control](microsoft-surface-brightness-control.md)
### [Surface Asset Tag](assettag.md)
-### [Surface firmware and driver updates](update.md)
-### [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md)
+### [Manage Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md)
## Secure
+### [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md)
### [Manage Surface UEFI settings](manage-surface-uefi-settings.md)
### [Advanced UEFI security features for Surface Pro 3](advanced-uefi-security-features-for-surface-pro-3.md)
### [Surface Enterprise Management Mode](surface-enterprise-management-mode.md)
diff --git a/devices/surface/assettag.md b/devices/surface/assettag.md
index 7ccc8ed708..db6a63ad69 100644
--- a/devices/surface/assettag.md
+++ b/devices/surface/assettag.md
@@ -3,12 +3,13 @@ title: Surface Asset Tag Tool
description: This topic explains how to use the Surface Asset Tag Tool.
ms.prod: w10
ms.mktglfcycl: manage
+ms.localizationpriority: medium
ms.sitesec: library
author: dansimp
ms.author: dansimp
ms.topic: article
-ms.date: 02/01/2019
-ms.reviewer:
+ms.date: 10/21/2019
+ms.reviewer: hachidan
manager: dansimp
---
@@ -33,6 +34,9 @@ To run Surface Asset Tag:
extract the zip file, and save AssetTag.exe in desired folder (in
this example, C:\\assets).
+ > [!NOTE]
+ > For Surface Pro X, use the application named **AssetTag_x86** in the ZIP file.
+
2. Open a command console as an Administrator and run AssetTag.exe,
entering the full path to the tool.
diff --git a/devices/surface/change-history-for-surface.md b/devices/surface/change-history-for-surface.md
index dcff7acd6d..ebbb3fc3b5 100644
--- a/devices/surface/change-history-for-surface.md
+++ b/devices/surface/change-history-for-surface.md
@@ -9,6 +9,9 @@ ms.sitesec: library
author: dansimp
ms.author: dansimp
ms.topic: article
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/21/2019
---
# Change history for Surface documentation
@@ -19,7 +22,9 @@ This topic lists new and updated topics in the Surface documentation library.
| **New or changed topic** | **Description** |
| ------------------------ | --------------- |
+| [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md)| New document explaining how to configure a DFCI environment in Microsoft Intune and manage firmware settings for targeted Surface devices.|
| [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md)| New document highlighting key considerations for deploying, managing, and servicing Surface Pro X.|
+|Multiple topics| Updated with information on Surface Pro 7, Surface Pro X, and Surface Laptop 3.|
## September 2019
diff --git a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md
index ec997db3be..cf84fec23c 100644
--- a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md
+++ b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md
@@ -9,14 +9,16 @@ ms.sitesec: library
author: dansimp
ms.author: dansimp
ms.topic: article
-ms.date: 10/16/2017
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/24/2019
ms.reviewer:
manager: dansimp
---
# Considerations for Surface and System Center Configuration Manager
-Fundamentally, management and deployment of Surface devices with System Center Configuration Manager is the same as the management and deployment of any other PC. Like any other PC, a deployment to Surface devices includes importing drivers, importing a Windows image, preparing a deployment task sequence, and then deploying the task sequence to a collection. After deployment, Surface devices are like any other Windows client – to publish apps, settings, and policies, you use the same process that you would use for any other device.
+Fundamentally, management and deployment of Surface devices with System Center Configuration Manager (SCCM) is the same as the management and deployment of any other PC. Like other PCs, a deployment to Surface devices includes importing drivers, importing a Windows image, preparing a deployment task sequence, and then deploying the task sequence to a collection. After deployment, Surface devices are like any other Windows client – to publish apps, settings, and policies, you use the same process that you would use for any other device.
You can find more information about how to use Configuration Manager to deploy and manage devices in the [Documentation for System Center Configuration Manager](https://docs.microsoft.com/sccm/index).
@@ -25,6 +27,11 @@ Although the deployment and management of Surface devices is fundamentally the s
>[!NOTE]
>For management of Surface devices it is recommended that you use the Current Branch of System Center Configuration Manager.
+## Support for Surface Pro X
+Beginning in version 1802, SCCM includes client management support for Surface Pro X. Note however that running the SCCM agent on Surface Pro X may accelerate battery consumption. In addition, SCCM operating system deployment is not supported on Surface Pro X. For more information, refer to:
+- [What's new in version 1802 of System Center Configuration Manager](https://docs.microsoft.com/sccm/core/plan-design/changes/whats-new-in-version-1802)
+- [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md)
+
## Updating Surface device drivers and firmware
For devices that receive updates through Windows Update, drivers for Surface components – and even firmware updates – are applied automatically as part of the Windows Update process. For devices with managed updates, such as those updated through Windows Server Update Services (WSUS), the option to install drivers and firmware through Windows Update is not available. For these managed devices, the recommended driver management process is the deployment of driver and firmware updates using the Windows Installer (.msi) files, which are provided through the Microsoft Download Center. You can find a list of these downloads at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices).
@@ -79,3 +86,4 @@ To apply an asset tag using the [Surface Asset Tag CLI Utility](https://www.micr
When you deploy Windows to a Surface device, the push-button reset functionality of Windows is configured by default to revert the system back to a state where the environment is not yet configured. When the reset function is used, the system discards any installed applications and settings. Although in some situations it can be beneficial to restore the system to a state without applications and settings, in a professional environment this effectively renders the system unusable to the end user.
Push-button reset can be configured, however, to restore the system configuration to a state where it is ready for use by the end user. Follow the process outlined in [Deploy push-button reset features](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/deploy-push-button-reset-features) to customize the push-button reset experience for your devices.
+
diff --git a/devices/surface/customize-the-oobe-for-surface-deployments.md b/devices/surface/customize-the-oobe-for-surface-deployments.md
index f160c5977b..efc6802f8f 100644
--- a/devices/surface/customize-the-oobe-for-surface-deployments.md
+++ b/devices/surface/customize-the-oobe-for-surface-deployments.md
@@ -13,13 +13,13 @@ ms.sitesec: library
author: dansimp
ms.author: dansimp
ms.topic: article
-ms.date: 07/27/2017
+ms.audience: itpro
+ms.date: 10/21/2019
---
# Customize the OOBE for Surface deployments
-
-This article walks you through the process of customizing the Surface out-of-box experience for end users in your organization.
+This article describes customizing the Surface out-of-box experience for end users in your organization.
It is common practice in a Windows deployment to customize the user experience for the first startup of deployed computers — the out-of-box experience, or OOBE.
@@ -28,6 +28,9 @@ It is common practice in a Windows deployment to customize the user experience f
In some scenarios, you may want to provide complete automation to ensure that at the end of a deployment, computers are ready for use without any interaction from the user. In other scenarios, you may want to leave key elements of the experience for users to perform necessary actions or select between important choices. For administrators deploying to Surface devices, each of these scenarios presents a unique challenge to overcome.
+> [!NOTE]
+> This article does not apply to Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md)
+
This article provides a summary of the scenarios where a deployment might require additional steps. It also provides the required information to ensure that the desired experience is achieved on any newly deployed Surface device. This article is intended for administrators who are familiar with the deployment process, as well as concepts such as answer files and [reference images](https://technet.microsoft.com/itpro/windows/deploy/create-a-windows-10-reference-image).
>[!NOTE]
@@ -57,7 +60,7 @@ To provide the factory Surface Pen pairing experience in OOBE, you must copy fou
- %windir%\\system32\\oobe\\info\\default\\1033\\PenSuccess\_en-US.png
>[!NOTE]
->You should copy the files from a factory image for the same model Surface device that you intend to deploy to. For example, you should use the files from a Surface Pro 3 to deploy to Surface Pro 3, and the files from Surface Book to deploy Surface Book, but you should not use the files from a Surface Pro 3 to deploy Surface Book or Surface Pro 4.
+>You should copy the files from a factory image for the same model Surface device that you intend to deploy to. For example, you should use the files from a Surface Pro 7 to deploy to Surface Pro 7, and the files from Surface Book 2 to deploy Surface Book 2, but you should not use the files from a Surface Pro 7 to deploy Surface Book or Surface Pro 6.
diff --git a/devices/surface/deploy-surface-app-with-windows-store-for-business.md b/devices/surface/deploy-surface-app-with-windows-store-for-business.md
index 5c4cc7c4a3..7c3f3bd079 100644
--- a/devices/surface/deploy-surface-app-with-windows-store-for-business.md
+++ b/devices/surface/deploy-surface-app-with-windows-store-for-business.md
@@ -9,7 +9,9 @@ ms.sitesec: library
author: dansimp
ms.author: dansimp
ms.topic: article
-ms.date: 09/21/2017
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/21/2019
ms.reviewer:
manager: dansimp
---
@@ -17,12 +19,25 @@ manager: dansimp
# Deploy Surface app with Microsoft Store for Business and Education
**Applies to**
-* Surface Pro 4
-* Surface Book
-* Surface 3
->[!NOTE]
->The Surface app ships in Surface Studio.
+- Surface Pro 7
+- Surface Laptop 3
+- Surface Pro 6
+- Surface Laptop 2
+- Surface Go
+- Surface Go with LTE
+- Surface Book 2
+- Surface Pro with LTE Advanced (Model 1807)
+- Surface Pro (Model 1796)
+- Surface Laptop
+- Surface Studio
+- Surface Studio 2
+- Surface Book
+- Surface Pro 4
+- Surface 3 LTE
+- Surface 3
+- Surface Pro 3
+
The Surface app is a lightweight Microsoft Store app that provides control of many Surface-specific settings and options, including:
@@ -34,9 +49,12 @@ The Surface app is a lightweight Microsoft Store app that provides control of ma
* Enable or disable Surface audio enhancements
-* Quick access to support documentation and information for your device
+* Quick access to support documentation and information for your device
-If your organization is preparing images that will be deployed to your Surface devices, you may want to include the Surface app (formerly called the Surface Hub) in your imaging and deployment process instead of requiring users of each individual device to download and install the app from the Microsoft Store or your Microsoft Store for Business.
+Customers using Windows Update will ordinarily receive Surface app as part of automatic updates. But if your organization is preparing images for deployment to your Surface devices, you may want to include the Surface app (formerly called the Surface Hub) in your imaging and deployment process instead of requiring users of each individual device to download and install the app from the Microsoft Store or your Microsoft Store for Business.
+
+> [!NOTE]
+> This article does not apply to Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md)
## Surface app overview
diff --git a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md
index 94094f2b60..f836e8254c 100644
--- a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md
+++ b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md
@@ -11,7 +11,8 @@ ms.mktglfcycl: deploy
ms.pagetype: surface, devices
ms.sitesec: library
author: dansimp
-ms.date: 08/13/2019
+ms.audience: itpro
+ms.date: 10/21/2019
ms.author: dansimp
ms.topic: article
---
@@ -68,7 +69,7 @@ Look to the **version** number to determine the latest files that contain the mo
The first file — SurfacePro6_Win10_16299_1900307_0.msi — is the newest because its VERSION field has the newest build in 2019; the other files are from 2018.
## Supported devices
-Downloadable MSI files are available for Surface devices from Surface Pro 2 and later.
+Downloadable MSI files are available for Surface devices from Surface Pro 2 and later. Information about MSI files for the newest Surface devices such as Surface Pro 7, Surface Pro X, and Surface Laptop 3 will be available from this page upon release.
>[!NOTE]
>There are no downloadable firmware or driver updates available for Surface devices with Windows RT, including Surface RT and Surface 2. Updates can only be applied using Windows Update.
diff --git a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md
index 258912cc3d..fe487f8337 100644
--- a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md
+++ b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md
@@ -9,7 +9,9 @@ ms.sitesec: library
author: dansimp
ms.author: dansimp
ms.topic: article
-ms.date: 10/16/2017
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/21/2019
ms.reviewer:
manager: dansimp
---
@@ -17,13 +19,21 @@ manager: dansimp
# Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit
**Applies to**
-- Surface Studio
-- Surface Pro 4
-- Surface Book
+
+- Surface Studio and later
+- Surface Pro 4 and later
+- Surface Book and later
+- Surface Laptop and later
+- Surface Go
- Surface 3
- Windows 10
-This article walks you through the recommended process to deploy Windows 10 to Surface devices with Microsoft deployment technologies. The process described in this article yields a complete Windows 10 environment including updated firmware and drivers for your Surface device along with applications like Microsoft Office 365 and the Surface app. When the process is complete, the Surface device will be ready for use by the end user. You can customize this process to include your own applications and configuration to meet the needs of your organization. You can also follow the guidance provided in this article to integrate deployment to Surface devices into existing deployment strategies.
+This article walks you through the recommended process to deploy Windows 10 to Surface devices with Microsoft deployment technologies. The process described in this article yields a complete Windows 10 environment including updated firmware and drivers for your Surface device along with applications like Microsoft Office 365 and the Surface app.
+
+> [!NOTE]
+> MDT is not currently supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md)
+
+When the process is complete, the Surface device will be ready for use by the end user. You can customize this process to include your own applications and configuration to meet the needs of your organization. You can also follow the guidance provided in this article to integrate deployment to Surface devices into existing deployment strategies.
By following the procedures in this article, you can create an up-to-date reference image and deploy this image to your Surface devices, a process known as *reimaging*. Reimaging will erase and overwrite the existing environment on your Surface devices. This process allows you to rapidly configure your Surface devices with identical environments that can be configured to precisely fit your organization’s requirements.
diff --git a/devices/surface/enroll-and-configure-surface-devices-with-semm.md b/devices/surface/enroll-and-configure-surface-devices-with-semm.md
index 7eb53c4ec9..e8a0143aab 100644
--- a/devices/surface/enroll-and-configure-surface-devices-with-semm.md
+++ b/devices/surface/enroll-and-configure-surface-devices-with-semm.md
@@ -9,7 +9,9 @@ ms.sitesec: library
author: dansimp
ms.author: dansimp
ms.topic: article
-ms.date: 01/06/2017
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/21/2019
ms.reviewer:
manager: dansimp
---
@@ -20,6 +22,11 @@ With Microsoft Surface Enterprise Management Mode (SEMM), you can securely confi
For a more high-level overview of SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode).
+A streamlined method of managing firmware from the cloud on Surface Pro 7,Surface Pro X and Surface Laptop 3 is now available via public preview. For more information,refer to [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md).
+
+> [!NOTE]
+> SEMM is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md).
+
#### Download and install Microsoft Surface UEFI Configurator
The tool used to create SEMM packages is Microsoft Surface UEFI Configurator. You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center.
Run the Microsoft Surface UEFI Configurator Windows Installer (.msi) file to start the installation of the tool. When the installer completes, find Microsoft Surface UEFI Configurator in the All Apps section of your Start menu.
diff --git a/devices/surface/ethernet-adapters-and-surface-device-deployment.md b/devices/surface/ethernet-adapters-and-surface-device-deployment.md
index 00aa0c1f1a..1b1216cd8d 100644
--- a/devices/surface/ethernet-adapters-and-surface-device-deployment.md
+++ b/devices/surface/ethernet-adapters-and-surface-device-deployment.md
@@ -13,13 +13,14 @@ ms.sitesec: library
author: dansimp
ms.author: dansimp
ms.topic: article
-ms.date: 07/27/2017
+ms.audience: itpro
+ms.date: 10/21/2019
---
# Ethernet adapters and Surface deployment
-This article provides guidance and answers to help you perform a network deployment to Surface devices.
+This article provides guidance and answers to help you perform a network deployment to Surface devices including Surface Pro 3 and later.
Network deployment to Surface devices can pose some unique challenges for system administrators. Due to the lack of a native wired Ethernet adapter, administrators must provide connectivity through a removable Ethernet adapter.
@@ -32,6 +33,9 @@ The primary concern when selecting an Ethernet adapter is how that adapter will
Booting from the network (PXE boot) is only supported when you use an Ethernet adapter or docking station from Microsoft. To boot from the network, the chipset in the Ethernet adapter or dock must be detected and configured as a boot device in the firmware of the Surface device. Microsoft Ethernet adapters, such as the Surface Ethernet Adapter and the [Surface Dock](https://www.microsoft.com/surface/accessories/surface-dock) use a chipset that is compatible with the Surface firmware.
+> [!NOTE]
+> PXE boot is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md)
+
The following Ethernet devices are supported for network boot with Surface devices:
- Surface USB-C to Ethernet and USB 3.0 Adapter
@@ -50,7 +54,6 @@ Third-party Ethernet adapters are also supported for network deployment, althoug
## Boot Surface devices from the network
-
To boot from the network or a connected USB stick, you must instruct the Surface device to boot from an alternate boot device. You can alter the boot order in the system firmware to prioritize USB boot devices, or you can instruct it to boot from an alternate boot device during the boot up process.
To boot a Surface device from an alternative boot device, follow these steps:
diff --git a/devices/surface/get-started.md b/devices/surface/get-started.md
index 407e12ba82..ff37d7a72e 100644
--- a/devices/surface/get-started.md
+++ b/devices/surface/get-started.md
@@ -1,7 +1,7 @@
---
title: Get started with Surface devices
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
layout: LandingPage
ms.assetid:
@@ -14,7 +14,7 @@ ms.localizationpriority: High
---
# Get started with Surface devices
-Harness the power of Surface, Windows, and Office connected together through the cloud. Find tools, step-by-step guides, and other resources to help you plan, deploy, and manage Surface devices in your organization.
+Harness the power of Surface, Windows, and Office connected together through the cloud. Find tools, step-by-step guides, and other resources to help you plan, deploy, and manage Surface for Business devices in your organization.
@@ -29,7 +29,7 @@ Harness the power of Surface, Windows, and Office connected together through the
@@ -86,8 +86,8 @@ Harness the power of Surface, Windows, and Office connected together through the
@@ -105,6 +105,8 @@ Harness the power of Surface, Windows, and Office connected together through the
@@ -121,12 +123,13 @@ Harness the power of Surface, Windows, and Office connected together through the
diff --git a/devices/surface/images/df1.png b/devices/surface/images/df1.png
new file mode 100644
index 0000000000..cd55014d27
Binary files /dev/null and b/devices/surface/images/df1.png differ
diff --git a/devices/surface/images/df2a.png b/devices/surface/images/df2a.png
new file mode 100644
index 0000000000..6a50ae6862
Binary files /dev/null and b/devices/surface/images/df2a.png differ
diff --git a/devices/surface/images/df3.png b/devices/surface/images/df3.png
new file mode 100644
index 0000000000..c5263ce83f
Binary files /dev/null and b/devices/surface/images/df3.png differ
diff --git a/devices/surface/index.md b/devices/surface/index.md
index 2677bffc49..3d8e45e45e 100644
--- a/devices/surface/index.md
+++ b/devices/surface/index.md
@@ -3,8 +3,8 @@ title: Microsoft Surface documentation and resources
layout: HubPage
hide_bc: true
description: Surface and Surface Hub documentation for admins & IT professionals
-author: robmazz
-ms.author: robmazz
+author: greg-lindsay
+ms.author: greglin
manager: laurawi
ms.topic: hub-page
keywords: Microsoft Surface, Microsoft Surface Hub, Surface documentation
diff --git a/devices/surface/manage-surface-driver-and-firmware-updates.md b/devices/surface/manage-surface-driver-and-firmware-updates.md
new file mode 100644
index 0000000000..efdf20be4d
--- /dev/null
+++ b/devices/surface/manage-surface-driver-and-firmware-updates.md
@@ -0,0 +1,65 @@
+---
+title: Manage Surface driver and firmware updates (Surface)
+description: This article describes the available options to manage firmware and driver updates for Surface devices.
+ms.assetid: CD1219BA-8EDE-4BC8-BEEF-99B50C211D73
+ms.reviewer:
+manager: dansimp
+keywords: Surface, Surface Pro 3, firmware, update, device, manage, deploy, driver, USB
+ms.localizationpriority: medium
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: surface, devices
+ms.sitesec: library
+author: dansimp
+ms.author: dansimp
+ms.topic: article
+ms.audience: itpro
+ms.date: 10/21/2019
+---
+
+# Manage Surface driver and firmware updates
+
+This article describes the available options that you can use to manage firmware and driver updates for Surface devices including Surface Pro 3 and later.
+
+To see a list of the available downloads for Surface devices and links to download the drivers and firmware for your device, see [Deploy the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md).
+
+On Surface devices, the firmware is exposed to the operating system as a driver and is visible in Device Manager. This design allows a Surface device firmware to be automatically updated along with all drivers through Windows Update. This mechanism provides a seamless, automatic experience for receiving the latest firmware and driver updates. Although automatic updating is easy for end users, updating firmware and drivers automatically may not always be appropriate for organizations and businesses. In cases where you strictly manage updates or when you deploy a new operating system to a Surface device, automatic updates from Windows Update may not be appropriate.
+
+## Methods for deploying firmware
+
+Windows Update automatically provides firmware for computers that receive updates directly from Microsoft. However, in environments where Windows Server Update Services (WSUS) manages updates, Windows Update cannot update the firmware. For managed environments, there are a number of options you can use to deploy firmware updates.
+
+### Windows Update
+
+The simplest solution to ensure that firmware on Surface devices in your organization is kept up to date is to allow Surface devices to receive updates directly from Microsoft. You can implement this solution easily by excluding Surface devices from Group Policy that directs computers to receive updates from WSUS.
+
+Although this solution ensures that firmware will be updated as new releases are made available to Windows Update, it does present potential drawbacks. Each Surface device that receives updates from Windows Update downloads each update independently from Microsoft instead of accessing a central location. These operations increase demand on Internet connectivity and bandwidth. Additionally, such updates are not subjected to testing or review by administrators.
+
+For details about Group Policy for client configuration of WSUS or Windows Update, see [Step 4: Configure Group Policy Settings for Automatic Updates](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/deploy/4-configure-group-policy-settings-for-automatic-updates).
+
+### Windows Installer Package
+
+Surface driver and firmware updates are packaged as Windows Installer (MSI) files. To deploy these Windows Installer packages, you can use application deployment utilities such as the Microsoft Deployment Toolkit (MDT) or System Center Configuration Manager. Such solutions provide the means for administrators to test and review updates before deploying them, and to centralize deployment. For each device, it is important to select the correct MSI file for the device and its operating system. For more information see [Deploy the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md).
+
+For instructions on how to deploy updates by using System Center Configuration Manager, refer to [Deploy applications with Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/deploy-applications). For instructions on how to deploy updates by using MDT, see [Deploy a Windows 10 image using MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt).
+
+> [!NOTE]
+> You can deploy applications separately from an operating system deployment through MDT by using a Post OS Installation task sequence.
+
+### Microsoft System Center Configuration Manager
+
+Starting in Microsoft System Center Configuration Manager version 1710, you can synchronize and deploy Microsoft Surface firmware and driver updates by using the Configuration Manager client. The process resembles that for deploying regular updates. For additional information, see KB 4098906, [How to manage Surface driver updates in Configuration Manager](https://support.microsoft.com/help/4098906/manage-surface-driver-updates-in-configuration-manager).
+
+## Considerations when deploying updates and operating systems together
+
+The process of deploying firmware updates during an operating system deployment is straightforward. You can import the firmware and driver pack into either System Center Configuration Manager or MDT, and use them to deploy a fully updated environment to a target Surface device, complete with firmware. For a complete step-by-step guide to using MDT to deploy Windows to a Surface device, see [Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit](deploy-windows-10-to-surface-devices-with-mdt.md).
+
+> [!IMPORTANT]
+> Select the correct MSI file for each specific device and its operating system. For more information, see [Deploy the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md).
+
+**WindowsPE and Surface firmware and drivers**
+
+System Center Configuration Manager and MDT both use the Windows Preinstallation Environment (WindowsPE) during the deployment process. WindowsPE only supports a limited set of basic drivers such as those for network adapters and storage controllers. Drivers for Windows components that are not part of WindowsPE might produce errors. As a best practice, you can prevent such errors by configuring the deployment process to use only the required drivers during the WindowsPE phase.
+
+## Supported devices
+Downloadable MSI files are available for Surface devices from Surface Pro 2 and later. Information about MSI files for the newest Surface devices such as Surface Pro 7, Surface Pro X, and Surface Laptop 3 will be available from this page upon release.
diff --git a/devices/surface/manage-surface-pro-3-firmware-updates.md b/devices/surface/manage-surface-pro-3-firmware-updates.md
deleted file mode 100644
index e37749103c..0000000000
--- a/devices/surface/manage-surface-pro-3-firmware-updates.md
+++ /dev/null
@@ -1,64 +0,0 @@
----
-title: Manage Surface driver and firmware updates (Surface)
-description: This article describes the available options to manage firmware and driver updates for Surface devices.
-ms.assetid: CD1219BA-8EDE-4BC8-BEEF-99B50C211D73
-ms.reviewer:
-manager: dansimp
-keywords: Surface, Surface Pro 3, firmware, update, device, manage, deploy, driver, USB
-ms.localizationpriority: medium
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.pagetype: surface, devices
-ms.sitesec: library
-author: dansimp
-ms.author: dansimp
-ms.topic: article
-ms.date: 07/27/2017
----
-
-# Manage Surface driver and firmware updates
-
-
-This article describes the available options to manage firmware and driver updates for Surface devices.
-
-For a list of the available downloads for Surface devices and links to download the drivers and firmware for your device, see [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md).
-
-On Surface devices, the firmware is exposed to the operating system as a driver and is visible in Device Manager. This allows a Surface device firmware to be automatically updated along with all drivers through Windows Update. This mechanism provides a seamless, automatic experience to receive the latest firmware and driver updates. Although automatic updating is easy for end users, updating firmware and drivers automatically may not always apply to organizations and businesses. Automatic updates with Windows Update may not be applicable where updates are carefully managed, or when you deploy a new operating system to a Surface device.
-
-## Methods for firmware deployment
-
-
-Although firmware is provided automatically by Windows Update for computers that receive updates directly from Microsoft, in environments where updates are carefully managed by using Windows Server Update Services (WSUS), updating the firmware through Windows Update is not supported. For managed environments, there are a number of options you can use to deploy firmware updates.
-
-**Windows Update**
-
-The simplest solution to ensure that firmware on Surface devices in your organization is kept up to date is to allow Surface devices to receive updates directly from Microsoft. You can implement this solution easily by excluding Surface devices from Group Policy that directs computers to receive updates from WSUS.
-
-Although this solution ensures that firmware will be updated as new releases are made available to Windows Update, it does present potential drawbacks. Each Surface device that receives Windows Updates directly will separately download each update rather than accessing a central location, which increases demand on Internet connectivity and bandwidth. Updates are also provided automatically to devices, without being subjected to testing or review by administrators.
-
-For details about Group Policy for client configuration of WSUS or Windows Update, see [Step 5: Configure Group Policy Settings for Automatic Updates](https://technet.microsoft.com/library/dn595129).
-
-**Windows Installer Package**
-
-The firmware and driver downloads for Surface devices now include Windows Installer files for firmware and driver updates. These Windows Installer packages can be deployed with utilities that support application deployment, including the Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. This solution allows for centralized deployment and for administrators to test and review firmware updates before they are deployed. For more information about the Windows Installer package delivery method for firmware and driver updates, including details on what drivers are updated by the package and why certain drivers and firmware are not updated by the Windows Installer package, see the [Surface Pro 3 MSI Now Available](https://blogs.technet.microsoft.com/surface/2015/03/04/surface-pro-3-msi-now-available/) blog post.
-
-For instructions on how to deploy with System Center Configuration Manager, refer to [How to Deploy Applications in Configuration Manager](https://technet.microsoft.com/library/gg682082). For deployment of applications with MDT, see [Step 4: Add an application in the Deploy a Windows 8.1 Image Using MDT 2013](https://technet.microsoft.com/library/dn744279#sec04). Note that you can deploy applications separately from an operating system deployment through MDT by using a Post OS Installation task sequence.
-
-**Provisioning packages**
-
-New in Windows 10, provisioning packages (PPKG files) provide a simple method to apply a configuration to a destination device. You can find out more about provisioning packages, including instructions for how to create your own, in [Provisioning packages](https://technet.microsoft.com/itpro/windows/deploy/provisioning-packages). For easy application of a complete set of drivers and firmware to devices running Windows 10, a provisioning package is supplied for Surface Pro 3 devices. This file contains all of the instructions and required assets to update a Surface Pro 3 device with Windows 10 to the latest drivers and firmware.
-
-**Windows PowerShell**
-
-Another method you can use to update the firmware when Windows Updates are managed in the organization is to install the firmware from the firmware and driver pack by using PowerShell. This method allows for a similar deployment experience to the Windows Installer package and can similarly be deployed as a package by using System Center Configuration Manager. You can find the PowerShell script and details on how to perform the firmware deployment in the [Deploying Drivers and Firmware to Surface Pro](https://blogs.technet.microsoft.com/deploymentguys/2013/05/16/deploying-drivers-and-firmware-to-surface-pro/) blog post.
-
-## Operating system deployment considerations
-
-
-The deployment of firmware updates during an operating system deployment is a straightforward process. The firmware and driver pack can be imported into either System Center Configuration Manager or MDT, and are used to deploy a fully updated environment, complete with firmware, to a target Surface device. For a complete step-by-step guide for deployment to Surface Pro 3 using either Configuration Manager or MDT, download the [Deployment and Administration Guide for Surface Pro 3](https://www.microsoft.com/download/details.aspx?id=45292) from the Microsoft Download Center.
-
-The individual driver files are also made available in the Microsoft Download Center if you are using deployment tools. The driver files are available in the ZIP archive file in the list of available downloads for your device.
-
-**Windows PE and Surface firmware and drivers**
-
-A best practice for deployment with any solution that uses the Windows Preinstallation Environment (WinPE), such as System Center Configuration Manager or MDT, is to configure WinPE with only the drivers that are required during the WinPE stage of deployment. These usually include drivers for network adapters and storage controllers. This best practice helps to prevent errors with more complex drivers that rely on components that are not present in WinPE. For Surface Pro 3 devices, this is especially true of the Touch Firmware. The Touch Firmware should never be loaded in a WinPE environment on Surface Pro 3.
diff --git a/devices/surface/manage-surface-uefi-settings.md b/devices/surface/manage-surface-uefi-settings.md
index 74e22a3d1b..4de1914275 100644
--- a/devices/surface/manage-surface-uefi-settings.md
+++ b/devices/surface/manage-surface-uefi-settings.md
@@ -17,13 +17,17 @@ manager: dansimp
# Manage Surface UEFI settings
-Current and future generations of Surface devices, including Surface Pro 4, Surface Book, and Surface Studio, use a unique UEFI firmware engineered by Microsoft specifically for these devices. This firmware allows for significantly greater control of the device’s operation over firmware versions in earlier generation Surface devices, including the support for touch, mouse, and keyboard operation. By using the Surface UEFI settings you can easily enable or disable internal devices or components, configure security to protect UEFI settings from being changed, and adjust the Surface device boot settings.
+Current and future generations of Surface devices, including Surface Pro 7, Surface Book 2, and Surface Studio 2,use a unique UEFI firmware engineered by Microsoft specifically for these devices. This firmware allows for significantly greater control of the device’s operation over firmware versions in earlier generation Surface devices, including the support for touch, mouse, and keyboard operation. By using the Surface UEFI settings you can easily enable or disable internal devices or components, configure security to protect UEFI settings from being changed, and adjust the Surface device boot settings.
>[!NOTE]
>Surface Pro 3, Surface 3, Surface Pro 2, Surface 2, Surface Pro, and Surface do not use the Surface UEFI and instead use firmware provided by third-party manufacturers, such as AMI.
You can enter the Surface UEFI settings on your Surface device by pressing the **Volume Up** button and the **Power** button simultaneously. Hold the **Volume Up** button until the Surface logo is displayed, which indicates that the device has begun to boot.
+## Support for cloud-based management
+With Device Firmware Configuration Interface (DFCI) profiles built into Microsoft Intune (now available in public preview), Surface UEFI management extends the modern management stack down to the UEFI hardware level. DFCI supports zero-touch provisioning, eliminates BIOS passwords, provides control of security settings including boot options and built-in peripherals, and lays the groundwork for advanced security scenarios in the future. DFCI is currently available for Surface Pro 7, Surface Pro X, and Surface Laptop 3. For more information, refer to [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md).
+
+
## PC information
On the **PC information** page, detailed information about your Surface device is provided:
diff --git a/devices/surface/microsoft-surface-brightness-control.md b/devices/surface/microsoft-surface-brightness-control.md
index 41b2e3d994..4a37b1fd9d 100644
--- a/devices/surface/microsoft-surface-brightness-control.md
+++ b/devices/surface/microsoft-surface-brightness-control.md
@@ -9,7 +9,7 @@ author: dansimp
ms.author: dansimp
ms.topic: article
ms.date: 1/15/2019
-ms.reviewer:
+ms.reviewer: hachidan
manager: dansimp
---
@@ -60,6 +60,11 @@ Full Brightness | Default: 100 Option: Range of 0-100 percent of screen b
## Changes and updates
+### Version 1.16.137
+*Release Date: 22 October 2019*
+This version of Surface Brightness Control adds support for the following:
+-Recompiled for x86, adding support for Surface Pro 7, Surface Pro X, and Surface Laptop 3.
+
### Version 1.12.239.0
*Release Date: 26 April 2019*
This version of Surface Brightness Control adds support for the following:
diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md
index 29b42615a0..64e380aab5 100644
--- a/devices/surface/microsoft-surface-data-eraser.md
+++ b/devices/surface/microsoft-surface-data-eraser.md
@@ -2,7 +2,7 @@
title: Microsoft Surface Data Eraser (Surface)
description: Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices.
ms.assetid: 8DD3F9FE-5458-4467-BE26-E9200341CF10
-ms.reviewer:
+ms.reviewer: hachidan
manager: dansimp
ms.localizationpriority: medium
keywords: tool, USB, data, erase
@@ -13,7 +13,8 @@ ms.sitesec: library
author: dansimp
ms.author: dansimp
ms.topic: article
-ms.date: 05/15/2018
+ms.audience: itpro
+ms.date: 10/21/2019
---
# Microsoft Surface Data Eraser
@@ -28,6 +29,9 @@ Find out how the Microsoft Surface Data Eraser tool can help you securely wipe d
Compatible Surface devices include:
+* Surface Pro 7
+* Surface Pro X
+* Surface Laptop 3
* Surface Pro 6
* Surface Laptop 2
* Surface Go
@@ -156,6 +160,12 @@ After you create a Microsoft Surface Data Eraser USB stick, you can boot a suppo
Microsoft Surface Data Eraser is periodically updated by Microsoft. For information about the changes provided in each new version, see the following:
+### Version 3.21.137
+*Release Date: 21 Oct 2019*
+This version of Surface Data Eraser is compiled for x86 and adds support for the following devices:
+
+Supports Surface Pro 7, Surface Pro X, and Surface Laptop 3.
+
### Version 3.2.78.0
*Release Date: 4 Dec 2018*
diff --git a/devices/surface/microsoft-surface-deployment-accelerator.md b/devices/surface/microsoft-surface-deployment-accelerator.md
index b6921a138f..1cfe727788 100644
--- a/devices/surface/microsoft-surface-deployment-accelerator.md
+++ b/devices/surface/microsoft-surface-deployment-accelerator.md
@@ -2,7 +2,7 @@
title: Microsoft Surface Deployment Accelerator (Surface)
description: Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices.
ms.assetid: E7991E90-4AAE-44B6-8822-58BFDE3EADE4
-ms.reviewer:
+ms.reviewer: hachidan
manager: dansimp
ms.date: 07/27/2017
ms.localizationpriority: medium
@@ -14,19 +14,19 @@ ms.sitesec: library
author: dansimp
ms.author: dansimp
ms.topic: article
+ms.audience: itpro
---
# Microsoft Surface Deployment Accelerator
-Microsoft Surface Deployment Accelerator (SDA) provides a quick and simple deployment mechanism for organizations to reimage Surface devices.
+Microsoft Surface Deployment Accelerator (SDA) automates the creation and configuration of a Microsoft recommended deployment experience by using free Microsoft deployment tools.
-SDA includes a wizard that automates the creation and configuration of a Microsoft recommended deployment experience by using free Microsoft deployment tools. The resulting deployment solution is complete with everything you need to immediately begin the deployment of Windows to a Surface device. You can also use SDA to create and capture a Windows reference image and then deploy it with the latest Windows updates.
+> [!NOTE]
+> SDA is not supported on Surface Pro 7, Surface Pro X, and Surface Laptop 3. For more information refer to [Deploy Surface devices](deploy.md).
SDA is built on the powerful suite of deployment tools available from Microsoft including the Windows Assessment and Deployment Kit (ADK), the Microsoft Deployment Toolkit (MDT), and Windows Deployment Services (WDS). The resulting deployment share encompasses the recommended best practices for managing drivers during deployment and automating image creation and can serve as a starting point upon which you build your own customized deployment solution.
-You can find more information about how to deploy to Surface devices, including step-by-step walkthroughs of customized deployment solution implementation, on the Deploy page of the [Surface TechCenter](https://technet.microsoft.com/windows/dn913725).
-
**Download Microsoft Surface Deployment Accelerator**
You can download the installation files for SDA from the Microsoft Download Center. To download the installation files:
diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md
index 956924345f..0fac7db7a9 100644
--- a/devices/surface/step-by-step-surface-deployment-accelerator.md
+++ b/devices/surface/step-by-step-surface-deployment-accelerator.md
@@ -20,6 +20,9 @@ ms.date: 07/27/2017
This article shows you how to install Microsoft Surface Deployment Accelerator (SDA), configure a deployment share for the deployment of Windows to Surface devices, and perform a deployment to Surface devices. This article also contains instructions on how to perform these tasks without an Internet connection or without support for Windows Deployment Services network boot (PXE).
+> [!NOTE]
+> SDA is not supported on Surface Pro 7, Surface Pro X, and Surface Laptop 3. For more information refer to [Deploy Surface devices](deploy.md).
+
## How to install Surface Deployment Accelerator
For information about prerequisites and instructions for how to download and install SDA, see [Microsoft Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md).
diff --git a/devices/surface/support-solutions-surface.md b/devices/surface/support-solutions-surface.md
index 51db33fb4e..39f66879fb 100644
--- a/devices/surface/support-solutions-surface.md
+++ b/devices/surface/support-solutions-surface.md
@@ -47,7 +47,7 @@ These are the top Microsoft Support solutions for common issues experienced when
- [Troubleshoot connecting Surface to a second screen](https://support.microsoft.com/help/4023496)
-- [Microsoft Surface Dock Updater](https://docs.microsoft.com/surface/surface-dock-updater)
+- [Microsoft Surface Dock Firmware Update](https://docs.microsoft.com/surface/surface-dock-updater)
## Surface Drivers and Firmware
diff --git a/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md b/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md
index f095bc3269..51e39c27a3 100644
--- a/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md
+++ b/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md
@@ -9,8 +9,10 @@ ms.sitesec: library
author: dansimp
ms.author: dansimp
ms.topic: article
-ms.date: 01/03/2018
-ms.reviewer:
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/21/2019
+ms.reviewer: scottmca
manager: dansimp
---
@@ -55,7 +57,7 @@ Before you choose to use Windows 10 Enterprise LTSC edition on Surface devices,
* Surface device replacements (for example, devices replaced under warranty) may contain subtle variations in hardware components that require updated device drivers and firmware. Compatibility with these updates may require the installation of a more recent version of Windows 10 Enterprise LTSC or Windows 10 Pro or Enterprise with the SAC servicing option.
>[!NOTE]
->Organizations that standardize on a specific version of Windows 10 Enterprise LTSC may be unable to adopt new generations of Surface hardware without also updating to a later version of Windows 10 Enterprise LTSC or Windows 10 Pro or Enterprise. For more information, see the **How will Windows 10 LTSBs be supported?** topic in the **Supporting the latest processor and chipsets on Windows** section of [Lifecycle Policy FAQ—Windows products](https://support.microsoft.com/help/18581/lifecycle-policy-faq-windows-products#b4).
+>Organizations that standardize on a specific version of Windows 10 Enterprise LTSC may be unable to adopt new generations of Surface hardware such as Surface Pro 7, Surface Pro X, or Surface Laptop 3 without also updating to a later version of Windows 10 Enterprise LTSC or Windows 10 Pro or Enterprise. For more information, see the **How will Windows 10 LTSBs be supported?** topic in the **Supporting the latest processor and chipsets on Windows** section of [Lifecycle Policy FAQ—Windows products](https://support.microsoft.com/help/18581/lifecycle-policy-faq-windows-products#b4).
Surface devices running Windows 10 Enterprise LTSC edition will not receive new features. In many cases these features are requested by customers to improve the usability and capabilities of Surface hardware. For example, new improvements for High DPI applications in Windows 10, version 1703. Customers that use Surface devices in the LTSC configuration will not see the improvements until they either update to a new Windows 10 Enterprise LTSC release or upgrade to a version of Windows 10 with support for the SAC servicing option.
diff --git a/devices/surface/surface-diagnostic-toolkit-business.md b/devices/surface/surface-diagnostic-toolkit-business.md
index 41b2939439..28726e9c2d 100644
--- a/devices/surface/surface-diagnostic-toolkit-business.md
+++ b/devices/surface/surface-diagnostic-toolkit-business.md
@@ -41,6 +41,8 @@ Command line | Directly troubleshoot Surface devices remotely without user inter
SDT for Business is supported on Surface 3 and later devices, including:
+- Surface Pro 7
+- Surface Laptop 3
- Surface Pro 6
- Surface Laptop 2
- Surface Go
@@ -168,6 +170,12 @@ You can select to run a wide range of logs across applications, drivers, hardwar
- [Use Surface Diagnostic Toolkit for Business using commands](surface-diagnostic-toolkit-command-line.md)
## Changes and updates
+### Version 2.43.139.0
+*Release date: October 21, 2019*
+This version of Surface Diagnostic Toolkit for Business adds support for the following:
+-Surface Pro 7
+-Surface Laptop 3
+
### Version 2.42.139.0
*Release date: September 24, 2019*
This version of Surface Diagnostic Toolkit for Business adds support for the following:
diff --git a/devices/surface/surface-diagnostic-toolkit-command-line.md b/devices/surface/surface-diagnostic-toolkit-command-line.md
index c02d79e984..7359067813 100644
--- a/devices/surface/surface-diagnostic-toolkit-command-line.md
+++ b/devices/surface/surface-diagnostic-toolkit-command-line.md
@@ -10,7 +10,7 @@ ms.topic: article
ms.date: 11/15/2018
ms.reviewer: hachidan
manager: dansimp
-ms.localizationpriority: normal
+ms.localizationpriority: medium
ms.audience: itpro
---
@@ -19,7 +19,7 @@ ms.audience: itpro
Running the Surface Diagnostic Toolkit (SDT) at a command prompt requires downloading the STD app console. After it's installed, you can run SDT at a command prompt via the Windows command console (cmd.exe) or using Windows PowerShell, including PowerShell Integrated Scripting Environment (ISE), which provides support for autocompletion of commands, copy/paste, and other features.
>[!NOTE]
->To run SDT using commands, you must be signed in to the Administrator account or signed in to an account that is a member of the Administrator group on your Surface device.
+>To run SDT using commands, you must be signed in to the Administrator account or signed in to an account that is a member of the Administrator group on your Surface device.
## Running SDT app console
diff --git a/devices/surface/surface-dock-firmware-update.md b/devices/surface/surface-dock-firmware-update.md
index 1bb2ddeb4b..ffd159f4a1 100644
--- a/devices/surface/surface-dock-firmware-update.md
+++ b/devices/surface/surface-dock-firmware-update.md
@@ -38,7 +38,8 @@ If preferred, you can manually complete the update as follows:
> [!NOTE]
>
> - Manually installing the MSI file may prompt you to restart Surface; however, restarting is optional and not required.
->- You will need to disconnect and reconnect the dock twice before the update fully completes.
+> - You will need to disconnect and reconnect the dock twice before the update fully completes.
+> - To create a log file, specify the path in the Msiexec command. For example, append /l*v %windir%\logs\ SurfaceDockFWI.log".
## Network deployment
@@ -48,6 +49,12 @@ You can use Windows Installer commands (Msiexec.exe) to deploy Surface Dock Firm
For more information, refer to [Command line options](https://docs.microsoft.com/windows/win32/msi/command-line-options) documentation.
+## Intune deployment
+You can use Intune to distribute Surface Dock Firmware Update to your devices. First you will need to convert the MSI file to the .intunewin format, as described in the following documentation: [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps/apps-win32-app-management).
+
+Use the following command:
+ - **msiexec /i /quiet /q**
+
## How to verify completion of firmware update
Surface dock firmware consists of two components:
@@ -77,7 +84,7 @@ Successful completion of Surface Dock Firmware Update results in new registry ke
| Log | Location | Notes |
| -------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Surface Dock Firmware Update log | /l*v %windir%\logs\ SurfaceDockFWI.log | Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater. |
+| Surface Dock Firmware Update log | /l*v %windir%\logs\Applications\SurfaceDockFWI.log | Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater. |
| Windows Device Install log | %windir%\inf\ setupapi.dev.log | For more information about using Device Install Log, refer [to SetupAPI Logging](https://docs.microsoft.com/windows-hardware/drivers/install/setupapi-logging--windows-vista-and-later-) documentation. |
@@ -101,7 +108,7 @@ Successful completion of Surface Dock Firmware Update results in new registry ke
## Changes and updates
-Microsoft periodically releases new versions of Surface Dock Firmware Update. To update a Surface Dock to the latest firmware, you must use the latest version of Surface Dock Firmware Update.
+Microsoft periodically releases new versions of Surface Dock Firmware Update.Note that the MSI file is not self-updating. If you have deployed the MSI to Surface devices and a new version of the firmware is released, you will need to deploy the new version of the MSI.
## Versions reference
### Version 1.42.139
@@ -113,6 +120,8 @@ This version, contained in Surface_Dock_FwUpdate_1.42.139_Win10_17134_19.084.316
- Component10CurrentFwVersion updated to **4ac3970**.
- Component20CurrentFwVersion updated to **4a1d570**.
+It adds support for Surface Pro 7 and Surface Laptop 3.
+
## Legacy versions
### Version 2.23.139.0
diff --git a/devices/surface/surface-enterprise-management-mode.md b/devices/surface/surface-enterprise-management-mode.md
index 5944375042..32c1f38406 100644
--- a/devices/surface/surface-enterprise-management-mode.md
+++ b/devices/surface/surface-enterprise-management-mode.md
@@ -226,6 +226,10 @@ create a reset package using PowerShell to reset SEMM.
## Version History
+### Version 2.59.139
+* Support to Surface Pro 7 and Surface Laptop 3
+- Support to Wake on Power feature
+
### Version 2.54.139.0
* Support to Surface Hub 2S
* Bug fixes
diff --git a/devices/surface/surface-manage-dfci-guide.md b/devices/surface/surface-manage-dfci-guide.md
new file mode 100644
index 0000000000..b2988422c1
--- /dev/null
+++ b/devices/surface/surface-manage-dfci-guide.md
@@ -0,0 +1,172 @@
+---
+title: Intune management of Surface UEFI settings
+description: This article explains how to configure a DFCI environment in Microsoft Intune and manage firmware settings for targeted Surface devices.
+ms.localizationpriority: medium
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: dansimp
+ms.author: dansimp
+ms.topic: article
+ms.date: 10/20/2019
+ms.reviewer: jesko
+manager: dansimp
+ms.audience: itpro
+---
+# Intune management of Surface UEFI settings
+
+## Introduction
+
+The ability to manage devices from the cloud has dramatically simplified IT deployment and provisioning across the lifecycle. With Device Firmware Configuration Interface (DFCI) profiles built into Microsoft Intune (now available in public preview), Surface UEFI management extends the modern management stack down to the UEFI hardware level. DFCI supports zero-touch provisioning, eliminates BIOS passwords, provides control of security settings including boot options and built-in peripherals, and lays the groundwork for advanced security scenarios in the future.
+
+### Background
+
+Like any computer running Windows 10, Surface devices rely on code stored in the SoC that enables the CPU to interface with hard drives, display devices, USB ports, and other devices. The programs stored in this read-only memory (ROM) are known as firmware (while programs stored in dynamic media are known as software).
+
+In contrast to other Windows 10 devices available in the market today, Surface provides IT admins with the ability to configure and manage firmware through a rich set of UEFI configuration settings. This provides a layer of hardware control on top of software-based policy management as implemented via mobile device management (MDM) policies, Configuration Manager or Group Policy. For example, organizations deploying devices in highly secure areas with sensitive information can prevent camera use by removing functionality at the hardware level. From a device standpoint, turning the camera off via a firmware setting is equivalent to physically removing the camera. Compare the added security of managing at the firmware level to relying only on operating system software settings. For example, if you disable the Windows audio service via a policy setting in a domain environment, a local admin could still re-enable the service.
+
+### DFCI versus SEMM
+
+Until now, managing firmware required enrolling devices into Surface Enterprise Management Mode (SEMM) with the overhead of ongoing manual IT-intensive tasks. As an example, SEMM requires IT staff to physically access each PC to enter a two-digit pin as part of the certificate management process. Although SEMM remains a good solution for organizations in a strictly on-premises environment, its complexity and IT-intensive requirements make it costly to use.
+
+Now with newly integrated UEFI firmware management capabilities in Microsoft Intune, the ability to lock down hardware is simplified and easier to use with new features for provisioning, security, and streamlined updating all in a single console.
+
+DFCI leverages the device profiles capability in Intune and is deployed using Windows Autopilot, eliminating the need for manual interaction by IT admins or end users. A device profile allows you to add and configure settings which can then be deployed to devices enrolled in management within your organization. Once the device receives the device profile, the features and settings are applied automatically. Examples of common device profiles include Email, Device restrictions, VPN, Wi-Fi, and Administrative templates. DFCI is simply an additional device profile that enables you to manage UEFI configuration settings from the cloud without having to maintain a costly on-premises infrastructure.
+
+## Supported devices
+
+At this time, DFCI is supported in the following devices:
+
+- Surface Pro 7
+- Surface Pro X
+- Surface Laptop 3
+
+## Prerequisites
+
+- Devices must be registered with Windows Autopilot by a [Microsoft Cloud Solution Provider (CSP) partner](https://partner.microsoft.com/membership/cloud-solution-provider) or OEM distributor.
+
+- Before configuring DFCI for Surface, you should be familiar with Autopilot configuration requirements in [Microsoft Intune](https://docs.microsoft.com/intune/) and [Azure Active Directory](https://docs.microsoft.com/azure/active-directory/) (Azure AD).
+
+## Before you begin
+
+Add your target Surface devices to an Azure AD security group. For more information about creating and managing security groups, refer to [Intune documentation](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows#create-your-azure-ad-security-groups).
+
+## Configure DFCI management for Surface devices
+
+A DFCI environment requires setting up a DFCI profile that contains the settings and an Autopilot profile to apply the settings to registered devices. An enrollment status profile is also recommended to ensure settings are pushed down during OOBE setup when users first start the device. This guide explains how to configure the DFCI environment and manage UEFI configuration settings for targeted Surface devices.
+
+## Create DFCI profile
+
+Before configuring DFCI policy settings, first create a DFCI profile and assign it to the Azure AD security group that contains your target devices.
+
+1. Open Intune select **Device configuration > Profiles > Create profile** and enter a name; for example **My DFCI profile.**
+2. Select Windows 10 and later for platform type.
+3. In the Profile type drop down list, select **Device Firmware Configuration Interface** to open the DFCI blade containing all available policy settings. For information on DFCI settings, refer to Table 2 on this page below or the [Intune documentation](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows). You can configure DFCI settings during the initial setup process or later by editing the DFCI profile.
+
+> 
+
+4. Click **OK** and then select **Create**.
+5. Select **Assignments** and under **Select groups to include** select the Azure AD security group that contains your target devices, as shown in the following figure. Click **Save**.
+
+
+
+## Create Autopilot profile
+
+1. Go to **Intune > Device enrollment > Windows enrollment** and scroll down to select **Deployment Profiles**.
+2. Select **Create profile**, enter a name; for example, My Autopilot profile, and select **Next**.
+3. Select the following settings:
+
+- Deployment mode: **User-Driven**.
+- Join type: Azure **AD joined**.
+
+4. Leave the remaining default settings unchanged and select **Next**
+5. On the Scope tags page, select **Next**.
+6. On the Assignments page, choose **Select groups to include** and click your Azure AD security group. Select **Next**.
+7. Accept the summary and then select **Create**. The Autopilot profile is now created and assigned to the group.
+
+## Configure Enrollment Status Page
+
+To ensure that devices apply the DFCI configuration during OOBE before users sign in, you need to configure enrollment status.
+
+For more information, refer to [Set up an enrollment status page](https://docs.microsoft.com/intune/enrollment/windows-enrollment-status).
+
+
+## Configure DFCI settings on Surface devices
+
+DFCI includes a streamlined set of UEFI configuration policies that provide an extra level of security by locking down devices at the hardware level. DFCI is designed to be used in conjunction with mobile device management settings at the software level. Note that DFCI settings only affect hardware components built into Surface devices and do not extend to attached peripherals such as USB webcams. (However, you can use Device restriction policies in Intune to turn off access to attached peripherals at the software level).
+
+You configure DFCI policy settings by editing the DFCI profile:
+
+- **Intune > Device configuration > Profiles > “DFCI profile name” > Properties > Settings**
+
+### Block user access to UEFI settings
+
+For many customers, the ability to block users from changing UEFI settings is critically important and a primary reason to use DFCI. As listed in the followng table, this is managed via the setting **Allow local user to change UEFI settings**. If you do not edit or configure this setting, local users will be able to change any UEFI setting not managed by Intune. Therefore, it’s highly recommended to disable **Allow local user to change UEFI settings.**
+The rest of the DFCI settings enable you to turn off functionality that would otherwise be available to users. For example, if you need to protect sensitive information in highly secure areas, you can disable the camera, and if you don’t want users booting from USB drives, you can disable that also.
+
+### Table 1. DFCI scenarios
+
+| Device management goal | Configuration steps |
+| --------------------------------------------- | --------------------------------------------------------------------------------------------- |
+| Block local users from changing UEFI settings | Under **Security Features > Allow local user to change UEFI settings**, select **None**. |
+| Disable cameras | Under **Built in Hardware > Cameras**, select **Disabled**. |
+| Disable Microphones and speakers | Under **Built in Hardware > Microphones and speakers**, select **Disabled**. |
+| Disable radios (Bluetooth, Wi-Fi) | Under **Built in Hardware > Radios (Bluetooth, Wi-Fi, etc…)**, select **Disabled**. |
+| Disable Boot from external media (USB, SD) | Under **Built in Hardware > Boot Options > Boot from external media (USB, SD)**, select **Disabled**. |
+
+
+> [!NOTE]
+> DFCI in Intune includes two settings that do not currently apply to Surface devices:
+- CPU and IO virtualization
+- Disable Boot from network adapters
+
+Intune provides Scope tags to delegate administrative rights and Applicability Rules to manage device types. For more information about policy management support and full details on all DFCI settings, refer to [Microsoft Intune documentation](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows).
+
+## Register devices in Autopilot
+
+As stated above, DFCI can only be applied on devices registered in Windows Autopilot by your reseller or distributor and is only supported, at this time, on Surface Pro 7, Surface Pro X, and Surface Laptop 3. For security reasons, it’s not possible to “self-provision” your devices into Autopilot.
+
+## Manually Sync Autopilot devices
+
+Although Intune policy settings typically get applied almost immediately, there may be a delay of 10 minutes before the settings take effect on targeted devices. In rare circumstances, delays of up to 8 hours are possible. To ensure settings apply as soon as possible, (such as in test scenarios), you can manually sync the target devices.
+
+- In Intune, go to **Device enrollment > Windows enrollment > Windows Autopilot Devices** and select **Sync**.
+
+ For more information, refer to [Sync your Windows device manually](https://docs.microsoft.com/intune-user-help/sync-your-device-manually-windows).
+
+> [!NOTE]
+> When adjusting settings directly in UEFI, you need to ensure the device fully restarts to the standard Windows login.
+
+## Verifying UEFI settings on DFCI-managed devices
+
+In a test environment, you can verify settings in the Surface UEFI interface.
+
+1. Open Surface UEFI, which involves pressing the **Volume +** and **Power** buttons at the same time.
+2. Select **Devices**. The UEFI menu will reflect configured settings, as shown in the following figure.
+
+
+
+Note how:
+
+- The settings are greyed out because **Allow local user to change UEFI setting** is set to None.
+- Audio is set to off because **Microphones and speakers** are set to **Disabled**.
+
+## Removing DFCI policy settings
+
+When you create a DFCI profile, all configured settings will remain in effect across all devices within the profile’s scope of management. You can only remove DFCI policy settings by editing the DFCI profile directly.
+
+If the original DFCI profile has been deleted, you can remove policy settings by creating a new profile and then editing the settings, as appropriate.
+
+## Unregistering devices from DFCI to prepare for resale or recycle
+
+1. Contact your partner, OEM, or reseller to unregister the device from Autopilot.
+2. Remove the device from Intune.
+3. Connect a Surface-branded network adapter.
+4. Open Surface UEFI, which involves pressing the **Volume +** and **Power** buttons at the same time.
+5. Select **Management > Configure > Refresh from Network**.
+6. Validate DFCI is removed from the device in the UEFI.
+
+## Learn more
+- [Windows Autopilot](https://www.microsoft.com/microsoft-365/windows/windows-autopilot)
+- [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md)
+- [Use DFCI profiles on Windows devices in Microsoft Intune](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows)
diff --git a/devices/surface/surface-pro-arm-app-management.md b/devices/surface/surface-pro-arm-app-management.md
index 0457612090..2f8061c0b4 100644
--- a/devices/surface/surface-pro-arm-app-management.md
+++ b/devices/surface/surface-pro-arm-app-management.md
@@ -28,6 +28,7 @@ Surface Pro X is designed almost exclusively for a modern, cloud-based environme
For the best experience, deploy Surface Pro X using Windows Autopilot either with the assistance of a Microsoft Cloud Solution Provider or self-provisioned using Autopilot deployment profiles and related features. For more information, refer to:
- [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md)
+- [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot)
Autopilot deployment has several advantages: It allows you to use the factory provisioned operating system, streamlined for zero-touch deployment, to include pre-installation of Office Pro Plus.
@@ -35,7 +36,7 @@ Organizations already using modern management, security, and productivity soluti
## Image-based deployment considerations
-Surface Pro X will be released without a standard Windows .ISO deployment image, which means it’s not supported on the Microsoft Deployment Toolkit (MDT) or operating system deployment methods using System Center Configuration Manager (SCCM) aka ConfiMgr. Customers relying on image-based deployment should consider Surface Pro 7 while they continue to evaluate the right time to transition to the cloud.
+Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager (SCCM) operating system deployment currently do not support Surface Pro X. Customers relying on image-based deployment should consider Surface Pro 7 while they continue to evaluate the right time to transition to the cloud.
## Managing Surface Pro X devices
@@ -146,13 +147,12 @@ The following tables show the availability of selected key features on Surface P
| Conditional Access | Yes | Yes | |
| Secure Boot | Yes | Yes | |
| Windows Information Protection | Yes | Yes | |
-| Surface Data Eraser (SDE) | Yes | Yes | |
-
+| Surface Data Eraser (SDE) | Yes | Yes |
## FAQ
-### Will an OS image be available at launch?
+### Can I deploy Surface Pro X with MDT or SCCM?
-No. Surface Pro X will be released without a standard Windows .ISO deployment image, which means it’s not supported on the Microsoft Deployment Toolkit (MDT) or operating system deployment methods using System Center Configuration Manager (SCCM) aka ConfiMgr. Customers relying on image-based deployment should consider Surface Pro 7 while they continue to evaluate the right time to transition to the cloud.
+The Microsoft Deployment Toolkit and System Center Configuration Manager operating system deployment currently do not support Surface Pro X. Customers relying on image-based deployment should consider Surface Pro 7 while they continue to evaluate the right time to transition to the cloud.
### How can I deploy Surface Pro X?
diff --git a/devices/surface/surface-pro-arm-app-performance.md b/devices/surface/surface-pro-arm-app-performance.md
index 8418efebd7..baa547d04b 100644
--- a/devices/surface/surface-pro-arm-app-performance.md
+++ b/devices/surface/surface-pro-arm-app-performance.md
@@ -1,5 +1,5 @@
---
-title: Windows 10 ARM-based PC app compatibility
+title: Surface Pro X app compatibility
description: This article provides introductory app compatibility information for Surface Pro X ARM-based PCs.
ms.prod: w10
ms.localizationpriority: medium
@@ -13,7 +13,7 @@ ms.reviewer: jessko
manager: dansimp
ms.audience: itpro
---
-# Windows 10 ARM-based PC app compatibility
+# Surface Pro X app compatibility
Applications run differently on ARM-based Windows 10 PCs such as Surface Pro X. Limitations include the following:
diff --git a/devices/surface/update.md b/devices/surface/update.md
deleted file mode 100644
index 121bf7a6e7..0000000000
--- a/devices/surface/update.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-title: Surface firmware and driver updates (Surface)
-description: Find out how to download and manage the latest firmware and driver updates for your Surface device.
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.pagetype: surface, devices
-ms.sitesec: library
-author: dansimp
-ms.author: dansimp
-ms.topic: article
-ms.date: 11/13/2018
-ms.reviewer:
-manager: dansimp
----
-
-# Surface firmware and driver updates
-
-Find out how to download and manage the latest firmware and driver updates for your Surface device.
-
-## In this section
-
-| Topic | Description |
-| --- | --- |
-| [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md)| Explore the available options to manage firmware and driver updates for Surface devices.|
-| [Deploy the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)| Find links to manually deploy firmware and drivers, outside of Windows Update. |
-| [Surface Dock Firmware Update](surface-dock-firmware-update.md)| See how you can update Surface Dock firmware automatically.|
-|[Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) | See how you can use Wake On LAN to remotely wake up devices to perform management or maintenance tasks, or to enable management solutions automatically. |
diff --git a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md
index fc560e5345..ac6102c2ef 100644
--- a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md
+++ b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md
@@ -9,7 +9,9 @@ ms.sitesec: library
author: dansimp
ms.author: dansimp
ms.topic: article
-ms.date: 10/16/2017
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/21/2019
ms.reviewer:
manager: dansimp
---
@@ -17,11 +19,24 @@ manager: dansimp
# Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit
#### Applies to
-* Surface Pro 3
-* Surface 3
-* Surface Pro 2
-* Surface Pro
-* Windows 10
+- Surface Pro 6
+- Surface Laptop 2
+- Surface Go
+- Surface Go with LTE
+- Surface Book 2
+- Surface Pro with LTE Advanced (Model 1807)
+- Surface Pro (Model 1796)
+- Surface Laptop
+- Surface Studio
+- Surface Studio 2
+- Surface Book
+- Surface Pro 4
+- Surface 3 LTE
+- Surface 3
+- Surface Pro 3
+- Surface Pro 2
+- Surface Pro
+- Windows 10
In addition to the traditional deployment method of reimaging devices, administrators that want to upgrade Surface devices that are running Windows 8.1 or Windows 10 have the option of deploying upgrades. By performing an upgrade deployment, Windows 10 can be applied to devices without removing users, apps, or configuration. The users of the deployed devices can simply continue using the devices with the same apps and settings that they used prior to the upgrade. The process described in this article shows how to perform a Windows 10 upgrade deployment to Surface devices.
@@ -37,6 +52,9 @@ For versions of Windows prior to Windows 10, if you wanted to install a new vers
Introduced with Windows 10 and MDT 2013 Update 1, you can use the upgrade installation path directly with Microsoft deployment technologies such as the Microsoft Deployment Toolkit (MDT). With an upgrade deployment you can use the same deployment technologies and process, but you can preserve users settings, and applications of the existing environment on the device.
+> [!NOTE]
+> MDT is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md)
+
## Deployment tools and resources
Performing an upgrade deployment of Windows 10 requires the same tools and resources that are required for a traditional reimaging deployment. You can read about the tools required, including detailed explanations and installation instructions, in [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md). To proceed with the upgrade deployment described in this article, you will need the following tools installed and configured:
diff --git a/devices/surface/using-the-sda-deployment-share.md b/devices/surface/using-the-sda-deployment-share.md
index 52e96859b3..20ad4f6903 100644
--- a/devices/surface/using-the-sda-deployment-share.md
+++ b/devices/surface/using-the-sda-deployment-share.md
@@ -9,7 +9,9 @@ ms.sitesec: library
author: dansimp
ms.author: dansimp
ms.topic: article
-ms.date: 10/16/2017
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/21/2019
ms.reviewer:
manager: dansimp
---
@@ -20,6 +22,9 @@ With Microsoft Surface Deployment Accelerator (SDA), you can quickly and easily
For more information about SDA and information on how to download SDA, see [Microsoft Surface Deployment Accelerator (SDA)](https://technet.microsoft.com/itpro/surface/microsoft-surface-deployment-accelerator).
+> [!NOTE]
+> SDA is not supported on Surface Pro 7, Surface Pro X, and Surface Laptop 3. For more information refer to [Deploy Surface devices](deploy.md).
+
Using SDA provides these primary benefits:
* With SDA, you can create a ready-to-deploy environment that can deploy to target devices as fast as your download speeds allow. The wizard experience enables you to check a few boxes and then the automated process builds your deployment environment for you.
diff --git a/devices/surface/wake-on-lan-for-surface-devices.md b/devices/surface/wake-on-lan-for-surface-devices.md
index 0c63bbe4b5..0ee065cb59 100644
--- a/devices/surface/wake-on-lan-for-surface-devices.md
+++ b/devices/surface/wake-on-lan-for-surface-devices.md
@@ -43,7 +43,7 @@ The following devices are supported for WOL:
* Surface Laptop 2
* Surface Go
* Surface Go with LTE Advanced
-* Surface Studio (see Surface Studio instructions below)
+* Surface Studio 2 (see Surface Studio 2 instructions below)
## WOL driver
@@ -60,9 +60,9 @@ To extract the contents of SurfaceWOL.msi, use the MSIExec administrative instal
`msiexec /a surfacewol.msi targetdir=C:\WOL /qn`
-## Surface Studio instructions
+## Surface Studio 2 instructions
-To enable WOL on Surface Studio, you must use the following procedure
+To enable WOL on Surface Studio 2, you must use the following procedure
1. Create the following registry keys:
diff --git a/devices/surface/windows-autopilot-and-surface-devices.md b/devices/surface/windows-autopilot-and-surface-devices.md
index 9c6fafb2d6..00b08cc73a 100644
--- a/devices/surface/windows-autopilot-and-surface-devices.md
+++ b/devices/surface/windows-autopilot-and-surface-devices.md
@@ -1,5 +1,5 @@
---
-title: Windows Autopilot and Surface Devices (Surface)
+title: Windows Autopilot and Surface Devices
ms.reviewer:
manager: dansimp
description: Find out about Windows Autopilot deployment options for Surface devices.
@@ -11,18 +11,24 @@ ms.sitesec: library
author: dansimp
ms.author: dansimp
ms.topic: article
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/21/2019
---
# Windows Autopilot and Surface devices
-Windows Autopilot is a cloud-based deployment technology available in Windows 10. Using Windows Autopilot, you can remotely deploy and configure devices in a truly zero-touch process right out of the box. Windows Autopilot registered devices are identified over the internet at first boot using a unique device signature, known as the hardware hash, and automatically enrolled and configured using modern management solutions such as Azure Active Directory (AAD) and Mobile Device Management (MDM).
+Windows Autopilot is a cloud-based deployment technology available in Windows 10. Using Windows Autopilot, you can remotely deploy and configure devices in a zero-touch process right out of the box. Windows Autopilot registered devices are identified over the internet at first boot using a unique device signature, known as a hardware hash, and automatically enrolled and configured using modern management solutions such as Azure Active Directory (AAD) and Mobile Device Management (MDM).
-With Surface devices, you can choose to register your devices at the time of purchase when purchasing from a Surface partner enabled for Windows Autopilot. New devices can be shipped directly to your end-users and will be automatically enrolled and configured when the units are unboxed and turned on for the first time. This process can eliminate need to reimage your devices as part of your deployment process, reducing the work required of your deployment staff and opening up new, agile methods for device management and distribution.
+With Surface devices, you can choose to register your devices at the time of purchase when purchasing from a Surface partner enabled for Windows Autopilot. New devices can be shipped directly to your end-users and will be automatically enrolled and configured when the units are unboxed and turned on for the first time. This process eliminates need to reimage your devices as part of your deployment process, reducing the work required of your deployment staff and opening up new, agile methods for device management and distribution.
-In this article learn how to enroll your Surface devices in Windows Autopilot with a Surface partner and the options and considerations you will need to know along the way. This article focuses specifically on Surface devices, for more information about using Windows Autopilot with other devices, or to read more about Windows Autopilot and its capabilities, see [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot) in the Windows Docs Library. For information about licensing and other prerequisites, see [Windows Autopilot requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements).
+## Modern management
+Autopilot is the recommended deployment option for Surface devices including Surface Pro 7, Surface Laptop 3, and Surface Pro X, which is specifically designed to be deployed with Autopilot.
-### Windows version considerations
-Support for broad deployments of Surface devices using Windows Autopilot, including enrollment performed by Surface partners at the time of purchase, requires devices manufactured with or otherwise installed with Windows 10 Version 1709 (Fall Creators Update) or later. These versions support a 4000-byte (4k) hash value to uniquely identify devices for Windows Autopilot that is necessary for deployments at scale. All new Surface devices ship with Windows 10 Version 1709 or above.
+ For the best experience, enroll your Surface devices with the assistance of a Microsoft Cloud Solution Provider. Doing so enables you to manage UEFI firmware settings on Surface devices directly from Intune, eliminating the need to physically touch devices for certificate management. For more information, see [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md).
+
+## Windows version considerations
+Support for broad deployments of Surface devices using Windows Autopilot, including enrollment performed by Surface partners at the time of purchase, requires devices manufactured with or otherwise installed with Windows 10 Version 1709 (Fall Creators Update) or later. These versions support a 4000-byte (4k) hash value to uniquely identify devices for Windows Autopilot that is necessary for deployments at scale. All new Surface devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3 ship with Windows 10 Version 1903 or above.
## Surface partners enabled for Windows Autopilot
Enrolling Surface devices in Windows Autopilot at the time of purchase is a capability provided by select Surface partners that are enabled with the capability to identify individual Surface devices during the purchase process and perform enrollment on an organization’s behalf. Devices enrolled by a Surface partner at time of purchase can be shipped directly to users and configured entirely through the zero-touch process of Windows Autopilot, Azure Active Directory, and Mobile Device Management.
@@ -34,3 +40,7 @@ When you purchase Surface devices from a Surface partner enabled for Windows Aut
- [Insight](https://www.insight.com/en_US/buy/partner/microsoft/surface/windows-autopilot.html)
- [SHI](https://www.shi.com/Surface)
+## Learn more
+For more information about Windows Autopilot, refer to:
+- [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot)
+- [Windows Autopilot requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements)
\ No newline at end of file
diff --git a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md
index 4dbf7f3b64..f66484192f 100644
--- a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md
+++ b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md
@@ -224,7 +224,7 @@ The XML file that is included in the Office Deployment Tool specifies the produc
```xml
-
+
diff --git a/store-for-business/billing-understand-your-invoice-msfb.md b/store-for-business/billing-understand-your-invoice-msfb.md
index ecc4e1f38e..b9df263894 100644
--- a/store-for-business/billing-understand-your-invoice-msfb.md
+++ b/store-for-business/billing-understand-your-invoice-msfb.md
@@ -26,7 +26,6 @@ Invoices are your bill from Microsoft. A few things to note:
- **Billing profile** - Billing profiles are created during your purchase. Invoices are created for each billing profile. Billing profiles let you customize what products are purchased, how you pay for them, and who can make purchases. For more information, see [Understand billing profiles](billing-profile.md)
- **Items included** - Your invoice includes total charges for all first and third-party software and hardware products purchased under a Microsoft Customer Agreement. That includes items purchased from Microsoft Store for Business and Azure Marketplace.
- **Charges** - Your invoice provides information about products purchased and their related charges and taxes. Purchases are aggregated to provide a concise view of your bill.
-- **International customers** - Charges on invoices for international customers are converted to their local currencies. Exchange rate information is listed at the bottom of the invoice.
## Online invoice
For Store for Business customers, invoices are also available online. A few things to note:
@@ -107,9 +106,6 @@ At the bottom of the invoice, there are instructions for paying your bill. You c
### Publisher information
If you have third-party services in your bill, the name and address of each publisher is listed at the bottom of your invoice.
-### Exchange rate
-If prices were converted to your local currency, the exchange rates are listed in this section at the bottom of the invoice. All Azure charges are priced in USD and third-party services are priced in the seller's currency.
-
## Next steps
If there are Azure charges on your invoice that you would like more details on, see [Understand the Azure charges on your Microsoft Customer Agreement invoice](https://docs.microsoft.com/azure/billing/billing-understand-your-invoice-mca).
diff --git a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md
index bb14436095..704d0954f7 100644
--- a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md
+++ b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md
@@ -145,6 +145,8 @@ App-V doesn't support Visual Studio 2012.
**Workaround**: Use a newer version of Microsoft Visual Studio.
+Currently, Visual Studio 2012 doesn't support app virtualization, whether using Microsoft App-V or third party solutions such as VMWare ThinApp. While it is possible you might find that Visual Studio works well enough for your purposes when running within one of these environments, we are unable to address any bugs or issues found when running in a virtualized environment at this time.
+
## Application filename restrictions for App-V Sequencer
The App-V Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated.
diff --git a/windows/application-management/change-history-for-application-management.md b/windows/application-management/change-history-for-application-management.md
index b7fda33af3..2ae0e03c13 100644
--- a/windows/application-management/change-history-for-application-management.md
+++ b/windows/application-management/change-history-for-application-management.md
@@ -7,7 +7,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: msfttracyp
+author: dansimp
ms.author: dansimp
ms.topic: article
ms.date: 10/24/2017
diff --git a/windows/application-management/enterprise-background-activity-controls.md b/windows/application-management/enterprise-background-activity-controls.md
index a9bdc7b123..dc56d686c7 100644
--- a/windows/application-management/enterprise-background-activity-controls.md
+++ b/windows/application-management/enterprise-background-activity-controls.md
@@ -1,5 +1,5 @@
---
-author: msfttracyp
+author: dansimp
title: Remove background task resource restrictions
description: Allow enterprise background tasks unrestricted access to computer resources.
ms.author: dansimp
@@ -8,7 +8,6 @@ ms.reviewer:
manager: dansimp
ms.topic: article
ms.prod: w10
-ms.technology: uwp
keywords: windows 10, uwp, enterprise, background task, resources
---
diff --git a/windows/application-management/manage-windows-mixed-reality.md b/windows/application-management/manage-windows-mixed-reality.md
index 74edf682a0..205e2c3711 100644
--- a/windows/application-management/manage-windows-mixed-reality.md
+++ b/windows/application-management/manage-windows-mixed-reality.md
@@ -8,7 +8,7 @@ ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
ms.localizationpriority: medium
-author: msfttracyp
+author: dansimp
ms.author: dansimp
ms.topic: article
---
@@ -33,7 +33,7 @@ Organizations that use Windows Server Update Services (WSUS) must take action to
2. Windows Mixed Reality Feature on Demand (FOD) is downloaded from Windows Update. If access to Windows Update is blocked, you must manually install the Windows Mixed Reality FOD.
- a. Download the FOD .cab file for [Windows 10, version 1903](https://software-download.microsoft.com/download/pr/Microsoft-Windows-Holographic-Desktop-FOD-Package-31bf3856ad364e35-amd64.cab), [Windows 10, version 1809](https://software-download.microsoft.com/download/pr/microsoft-windows-holographic-desktop-fod-package31bf3856ad364e35amd64_1.cab), [Windows 10, version 1803](https://download.microsoft.com/download/9/9/3/9934B163-FA01-4108-A38A-851B4ACD1244/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab), or [Windows 10, version 1709](http://download.microsoft.com/download/6/F/8/6F816172-AC7D-4F45-B967-D573FB450CB7/Microsoft-Windows-Holographic-Desktop-FOD-Package.cab).
+ a. Download the FOD .cab file for [Windows 10, version 1903](https://software-download.microsoft.com/download/pr/Microsoft-Windows-Holographic-Desktop-FOD-Package-31bf3856ad364e35-amd64.cab), [Windows 10, version 1809](https://software-download.microsoft.com/download/pr/microsoft-windows-holographic-desktop-fod-package31bf3856ad364e35amd64_1.cab), [Windows 10, version 1803](https://download.microsoft.com/download/9/9/3/9934B163-FA01-4108-A38A-851B4ACD1244/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab), or [Windows 10, version 1709](https://download.microsoft.com/download/6/F/8/6F816172-AC7D-4F45-B967-D573FB450CB7/Microsoft-Windows-Holographic-Desktop-FOD-Package.cab).
>[!NOTE]
>You must download the FOD .cab file that matches your operating system version.
diff --git a/windows/client-management/administrative-tools-in-windows-10.md b/windows/client-management/administrative-tools-in-windows-10.md
index 84c3b8c3d2..35c0f225b0 100644
--- a/windows/client-management/administrative-tools-in-windows-10.md
+++ b/windows/client-management/administrative-tools-in-windows-10.md
@@ -4,11 +4,11 @@ description: Administrative Tools is a folder in Control Panel that contains too
ms.assetid: FDC63933-C94C-43CB-8373-629795926DC8
ms.reviewer:
manager: dansimp
-ms.author: tracyp
+ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
-author: msfttracyp
+author: dansimp
ms.localizationpriority: medium
ms.date: 07/27/2017
ms.topic: article
diff --git a/windows/client-management/advanced-troubleshooting-802-authentication.md b/windows/client-management/advanced-troubleshooting-802-authentication.md
index 878b065aa7..267386adc6 100644
--- a/windows/client-management/advanced-troubleshooting-802-authentication.md
+++ b/windows/client-management/advanced-troubleshooting-802-authentication.md
@@ -5,9 +5,9 @@ manager: dansimp
description: Learn how 802.1X Authentication works
keywords: advanced troubleshooting, 802.1X authentication, troubleshooting, authentication, Wi-Fi
ms.prod: w10
-ms.mktglfcycl:
+ms.mktglfcycl:
ms.sitesec: library
-author: msfttracyp
+author: dansimp
ms.localizationpriority: medium
ms.author: tracyp
ms.topic: troubleshooting
diff --git a/windows/client-management/advanced-troubleshooting-boot-problems.md b/windows/client-management/advanced-troubleshooting-boot-problems.md
index 5f1c4ea9c9..a9442e6fe9 100644
--- a/windows/client-management/advanced-troubleshooting-boot-problems.md
+++ b/windows/client-management/advanced-troubleshooting-boot-problems.md
@@ -1,11 +1,11 @@
---
title: Advanced troubleshooting for Windows boot problems
-description: Learn how to troubleshoot when Windows is unable to boot
+description: Learn how to troubleshoot when Windows is unable to boot
ms.prod: w10
ms.sitesec: library
-author: msfttracyp
+author: dansimp
ms.localizationpriority: medium
-ms.author: tracyp
+ms.author: dansimp
ms.date: 11/16/2018
ms.reviewer:
manager: dansimp
@@ -229,7 +229,7 @@ If the system gets stuck during the kernel phase, you experience multiple sympto
- Specific error code is displayed.
For example, "0x00000C2" , "0x0000007B" , "inaccessible boot device" and so on.
- (To troubleshoot the 0x0000007B error, see [Error code INACCESSIBLE_BOOT_DEVICE (STOP 0x7B)](https://internal.support.services.microsoft.com/help/4343769/troubleshooting-guide-for-windows-boot-problems#0x7bstoperror))
+ [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](https://docs.microsoft.com/windows/client-management/troubleshoot-inaccessible-boot-device)
- The screen is stuck at the "spinning wheel" (rolling dots) "system busy" icon.
@@ -307,9 +307,7 @@ To troubleshoot this Stop error, follow these steps to filter the drivers:
For additional troubleshooting steps, see the following articles:
-- [Troubleshooting a Stop 0x7B in Windows](https://blogs.technet.microsoft.com/askcore/2013/08/05/troubleshooting-a-stop-0x7b-in-windows/)
-
-- [Advanced troubleshooting for "Stop error code 0x0000007B (INACCESSIBLE_BOOT_DEVICE)" errors in Windows XP](https://internal.support.services.microsoft.com/help/324103).
+- [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](https://docs.microsoft.com/windows/client-management/troubleshoot-inaccessible-boot-device)
To fix problems that occur after you install Windows updates, check for pending updates by using these steps:
@@ -358,17 +356,15 @@ If the computer does not start, follow these steps:
12. Try to start the computer.
-If the Stop error occurs late in the startup process, or if the Stop error is still being generated, you can capture a memory dump. A good memory dump can help determine the root cause of the Stop error. For details, see the following Knowledge Base article:
+If the Stop error occurs late in the startup process, or if the Stop error is still being generated, you can capture a memory dump. A good memory dump can help determine the root cause of the Stop error. For details, see the following articles:
-- [969028](https://support.microsoft.com/help/969028) How to generate a kernel or a complete memory dump file in Windows Server 2008 and Windows Server 2008 R2
+- [Generate a kernel or complete crash dump](https://docs.microsoft.com/windows/client-management/generate-kernel-or-complete-crash-dump)
-For more information about page file problems in Windows 10 or Windows Server 2016, see the following Knowledge Base article:
-
-- [4133658](https://support.microsoft.com/help/4133658) Introduction of page file in Long-Term Servicing Channel and Semi-Annual Channel of Windows
+For more information about page file problems in Windows 10 or Windows Server 2016, see the following:
+- [Introduction to page files](https://docs.microsoft.com/windows/client-management/introduction-page-file)
For more information about Stop errors, see the following Knowledge Base article:
-
-- [3106831](https://support.microsoft.com/help/3106831) Troubleshooting Stop error problems for IT Pros
+- [Advanced troubleshooting for Stop error or blue screen error issue](https://docs.microsoft.com/windows/client-management/troubleshoot-stop-errors)
If the dump file shows an error that is related to a driver (for example, windows\system32\drivers\stcvsm.sys is missing or corrupted), follow these guidelines:
diff --git a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md
index dbd429f2e5..c04dae805a 100644
--- a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md
+++ b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md
@@ -5,11 +5,11 @@ manager: dansimp
description: Learn how troubleshooting of establishing Wi-Fi connections
keywords: troubleshooting, wireless network connectivity, wireless, Wi-Fi
ms.prod: w10
-ms.mktglfcycl:
+ms.mktglfcycl:
ms.sitesec: library
-author: msfttracyp
+author: dansimp
ms.localizationpriority: medium
-ms.author: tracyp
+ms.author: dansimp
ms.topic: troubleshooting
---
@@ -92,7 +92,7 @@ The following is a high-level view of the main wifi components in Windows.
- Scanning for wireless networks in range
- Managing connectivity of wireless networks
The Media Specific Module (MSM) handles security aspects of connection being established.
-The Native Wifi stack consists of drivers and wireless APIs to interact with wireless miniports and the supporting user-mode Wlansvc.
+The Native WiFi stack consists of drivers and wireless APIs to interact with wireless miniports and the supporting user-mode Wlansvc.
Third-party wireless miniport drivers interface with the upper wireless stack to provide notifications to and receive commands from Windows.
diff --git a/windows/client-management/change-history-for-client-management.md b/windows/client-management/change-history-for-client-management.md
index 771366616a..4f2cab1d56 100644
--- a/windows/client-management/change-history-for-client-management.md
+++ b/windows/client-management/change-history-for-client-management.md
@@ -7,8 +7,8 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: msfttracyp
-ms.author: tracyp
+author: dansimp
+ms.author: dansimp
ms.date: 12/06/2018
ms.reviewer:
manager: dansimp
diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md
index 464c8d9b6c..9241a7fdf7 100644
--- a/windows/client-management/mdm/TOC.md
+++ b/windows/client-management/mdm/TOC.md
@@ -168,7 +168,6 @@
#### [Policies supported by Windows 10 IoT Core](policies-supported-by-iot-core.md)
#### [Policies supported by Microsoft Surface Hub](policies-supported-by-surface-hub.md)
#### [Policies that can be set using Exchange Active Sync (EAS)](policies-that-can-be-set-using-eas.md)
-#### [ApplicationRestrictions XSD](applicationrestrictions-xsd.md)
#### [AboveLock](policy-csp-abovelock.md)
#### [Accounts](policy-csp-accounts.md)
#### [ActiveXControls](policy-csp-activexcontrols.md)
diff --git a/windows/client-management/mdm/accountmanagement-csp.md b/windows/client-management/mdm/accountmanagement-csp.md
index 294043dca3..f14ec54b3b 100644
--- a/windows/client-management/mdm/accountmanagement-csp.md
+++ b/windows/client-management/mdm/accountmanagement-csp.md
@@ -31,7 +31,7 @@ Root node for the AccountManagement configuration service provider.
Interior node.
**UserProfileManagement/EnableProfileManager**
-Enable profile lifetime mangement for shared or communal device scenarios. Default value is false.
+Enable profile lifetime management for shared or communal device scenarios. Default value is false.
Supported operations are Add, Get,Replace, and Delete. Value type is bool.
diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md
index 052d05d6a0..cb636ce3ef 100644
--- a/windows/client-management/mdm/applicationcontrol-csp.md
+++ b/windows/client-management/mdm/applicationcontrol-csp.md
@@ -117,16 +117,7 @@ Value type is char.
To use ApplicationControl CSP, you must:
- Know a generated policy’s GUID, which can be found in the policy xml as ``.
- Convert the policies to binary format using the ConvertFrom-CIPolicy cmdlet in order to be deployed. The binary policy may be signed or unsigned.
-- Create a policy node (a Base64-encoded blob of the binary policy representation) using the [certutil -encode](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#BKMK_encode) command line tool.
-Here is a sample certutil invocation:
-```
-certutil -encode WinSiPolicy.p7b WinSiPolicy.cer
-```
-An alternative to using certutil would be to use the following PowerShell invocation:
-```
-[Convert]::ToBase64String($(Get-Content -Encoding Byte -ReadCount 0 -Path ))
-```
If you are using hybrid MDM management with System Center Configuration Manager or using Intune, ensure that you are using Base64 as the Data type when using Custom OMA-URI
functionality to apply the Code Integrity policy.
diff --git a/windows/client-management/mdm/applicationrestrictions-xsd.md b/windows/client-management/mdm/applicationrestrictions-xsd.md
deleted file mode 100644
index a088806e23..0000000000
--- a/windows/client-management/mdm/applicationrestrictions-xsd.md
+++ /dev/null
@@ -1,129 +0,0 @@
----
-title: ApplicationRestrictions XSD
-description: Here's the XSD for the ApplicationManagement/ApplicationRestrictions policy.
-ms.assetid: A5AA2B59-3736-473E-8F70-A90FD61EE426
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-author: lomayor
-ms.date: 06/26/2017
----
-
-# ApplicationRestrictions XSD
-
-
-Here's the XSD for the ApplicationManagement/ApplicationRestrictions policy.
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- GUID must use lowercase letters
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-```
-
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md
index 5d09981ed6..82139a98a6 100644
--- a/windows/client-management/mdm/bitlocker-csp.md
+++ b/windows/client-management/mdm/bitlocker-csp.md
@@ -6,12 +6,16 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: lomayor
-ms.date: 08/05/2019
+ms.localizationpriority: medium
+ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
---
# BitLocker CSP
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
The BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. This CSP was added in Windows 10, version 1703. Starting in Windows 10, version 1809, it is also supported in Windows 10 Pro.
> [!NOTE]
@@ -25,7 +29,7 @@ For RequireDeviceEncryption and RequireStorageCardEncryption, the Get operation
The following diagram shows the BitLocker configuration service provider in tree format.
-
+
**./Device/Vendor/MSFT/BitLocker**
Defines the root node for the BitLocker configuration service provider.
@@ -57,7 +61,7 @@ Allows the administrator to require storage card encryption on the device. This
Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the storage card, but the user will no longer be prompted to turn it on.
- 0 (default) – Storage cards do not need to be encrypted.
-- 1 – Require Storage cards to be encrypted.
+- 1 – Require storage cards to be encrypted.
Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on.
@@ -125,10 +129,10 @@ Encryptable fixed data volumes are treated similarly to OS volumes. However, fix
The following list shows the supported values:
-- 0 (default) – Disable. If the policy setting is not set or is set to 0, the device's enforcement status will not be checked. The policy will not enforce encryption and it will not decrypt encrypted volumes.
-- 1 – Enable. The device's enforcement status will be checked. Setting this policy to 1 will trigger encryption of all drives (silently or non-silently based on [AllowWarningForOtherDiskEncryption](#allowwarningforotherdiskencryption) policy).
+- 0 (default) — Disable. If the policy setting is not set or is set to 0, the device's enforcement status is not checked. The policy does not enforce encryption and it does not decrypt encrypted volumes.
+- 1 – Enable. The device's enforcement status is checked. Setting this policy to 1 triggers encryption of all drives (silently or non-silently based on [AllowWarningForOtherDiskEncryption](#allowwarningforotherdiskencryption) policy).
-If you want to disable this policy use the following SyncML:
+If you want to disable this policy, use the following SyncML:
```xml
@@ -151,7 +155,7 @@ If you want to disable this policy use the following SyncML:
**EncryptionMethodByDriveType**
-Allows you to set the default encrytion method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)".
+Allows you to set the default encryption method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system, and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)".
Home
@@ -520,7 +524,8 @@ Set "OSActiveDirectoryBackup_Name" (Save BitLocker recovery informatio
Set the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.
-> [!Note] > If the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field is set, a recovery password is automatically generated.
+> [!Note]
+> If the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field is set, a recovery password is automatically generated.
If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected operating system drives.
@@ -532,26 +537,18 @@ Sample value for this node to enable this policy is:
```
-The possible values for 'xx' are:
-
-true = Explicitly allow
-false = Policy not set
-
-
+The possible values for 'xx' are:
+- true = Explicitly allow
+- false = Policy not set
-The possible values for 'yy' are:
-
-2 = Allowed
-1 = Required
-0 = Disallowed
-
+The possible values for 'yy' are:
+- 2 = Allowed
+- 1 = Required
+- 0 = Disallowed
-The possible values for 'zz' are:
-
-2 = Store recovery passwords only
-1 = Store recovery passwords and key packages
-
-
+The possible values for 'zz' are:
+- 2 = Store recovery passwords only
+- 1 = Store recovery passwords and key packages
Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:
@@ -896,6 +893,161 @@ If you want to disable this policy use the following SyncML:
```
+
+ **ConfigureRecoveryPasswordRotation**
+This setting initiates a client-driven recovery password refresh after an OS drive recovery (either by using bootmgr or WinRE) and recovery password unlock on a Fixed data drive. This setting will refresh the specific recovery password that was used, and other unused passwords on the volume will remain unchanged. If the initialization of the refresh fails, the device will retry the refresh during the next reboot. When password refresh is initiated, the client will generate a new recovery password. The client will use the existing API in Azure AD to upload the new recovery key and retry on failure. After the recovery password has been successfully backed up to Azure AD, the recovery key that was used locally will be removed. This setting refreshes only the used key and retains other unused keys.
+
+
+ Home
+ Pro
+ Business
+ Enterprise
+ Education
+ Mobile
+ Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+Value type is int. Supported operations are Add, Delete, Get, and Replace.
+
+Supported values are:
+- 0 – Refresh off (default)
+- 1 – Refresh on for Azure AD-joined devices
+- 2 – Refresh on for both Azure AD-joined and hybrid-joined devices
+
+ **RotateRecoveryPasswords**
+This setting refreshes all recovery passwords for OS and fixed drives (removable drives are not included so they can be shared between users). All recovery passwords for all drives will be refreshed and only one password per volume is retained. In case of errors, an error code will be returned so that server can take appropriate action to remediate.
+
+The client will generate a new recovery password. The client will use the existing API in Azure AD to upload the new recovery key and retry on failure.
+
+Policy type is Execute. When “Execute Policy” is pushed, the client sets the status as Pending and initiates an asynchronous rotation operation. After refresh is complete, pass or fail status is updated. The client will not retry, but if needed, the server can re-issue the execute request.
+
+Server can call Get on the RotateRecoveryPasswordsRotationStatus node to query the status of the refresh.
+
+Recovery password refresh will only occur for devices that are joined to Azure AD or joined to both Azure AD and on-premises (hybrid Azure AD-joined) that run a Windows 10 edition with the BitLocker CSP (Pro/Enterprise). Devices cannot refresh recovery passwords if they are only registered in Azure AD (also known as workplace-joined) or signed in with a Microsoft account.
+
+Each server-side recovery key rotation is represented by a request ID. The server can query the following nodes to make sure it reads status/result for same rotation request.
+- RotateRecoveryPasswordsRequestID: Returns request ID of last request processed.
+- RotateRecoveryPasswordsRotationStatus: Returns status of last request processed.
+
+
+ Home
+ Pro
+ Business
+ Enterprise
+ Education
+ Mobile
+ Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+Value type is string. Supported operation is Execute. Request ID is expected as a parameter.
+
+ **Status**
+Interior node. Supported operation is Get.
+
+ **Status/DeviceEncryptionStatus**
+This node reports compliance state of device encryption on the system.
+
+
+
+ Home
+ Pro
+ Business
+ Enterprise
+ Education
+ Mobile
+ Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+
+Supported values:
+- 0 - Indicates that the device is compliant.
+- Any other value represents a non-compliant device.
+
+Value type is int. Supported operation is Get.
+
+ **Status/RotateRecoveryPasswordsStatus**
+This node reports the status of RotateRecoveryPasswords request.
+
+Status code can be one of the following:
+
+- 2 – Not started
+- 1 - Pending
+- 0 - Pass
+- Any other code - Failure HRESULT
+
+
+ Home
+ Pro
+ Business
+ Enterprise
+ Education
+ Mobile
+ Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+Value type is int. Supported operation is Get.
+
+ **Status/RotateRecoveryPasswordsRequestID**
+This node reports the RequestID corresponding to RotateRecoveryPasswordsStatus.
+This node needs to be queried in synchronization with RotateRecoveryPasswordsStatus to ensure the status is correctly matched to the request ID.
+
+
+ Home
+ Pro
+ Business
+ Enterprise
+ Education
+ Mobile
+ Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+Value type is string. Supported operation is Get.
+
### SyncML example
The following example is provided to show proper format and should not be taken as a recommendation.
@@ -1058,4 +1210,4 @@ The following example is provided to show proper format and should not be taken
-```
+```
\ No newline at end of file
diff --git a/windows/client-management/mdm/bitlocker-ddf-file.md b/windows/client-management/mdm/bitlocker-ddf-file.md
index 1fed0144fa..19421997ba 100644
--- a/windows/client-management/mdm/bitlocker-ddf-file.md
+++ b/windows/client-management/mdm/bitlocker-ddf-file.md
@@ -6,7 +6,8 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: lomayor
-ms.date: 06/29/2018
+ms.localizationpriority: medium
+ms.date: 09/30/2019
ms.reviewer:
manager: dansimp
---
@@ -20,7 +21,7 @@ This topic shows the OMA DM device description framework (DDF) for the **BitLock
Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
-The XML below is the current version Windows 10, version 1809.
+The XML below is the current version for this CSP.
```xml
@@ -46,7 +47,7 @@ The XML below is the current version Windows 10, version 1809.
- com.microsoft/3.0/MDM/BitLocker
+ com.microsoft/5.0/MDM/BitLocker
@@ -736,6 +737,206 @@ The XML below is the current version Windows 10, version 1809.
+
+
+ ConfigureRecoveryPasswordRotation
+
+
+
+
+
+
+
+ Allows Admin to configure Numeric Recovery Password Rotation upon use for OS and fixed drives on AAD and Hybrid domain joined devices.
+ When not configured, Rotation is turned on by default for AAD only and off on Hybrid. The Policy will be effective only when
+ Active Directory back up for recovery password is configured to required.
+ For OS drive: Turn on "Do not enable Bitlocker until recovery information is stored to AD DS for operating system drives"
+ For Fixed drives: Turn on "Do not enable Bitlocker until recovery information is stored to AD DS for fixed data drives"
+
+ Supported Values: 0 - Numeric Recovery Passwords rotation OFF.
+ 1 - Numeric Recovery Passwords Rotation upon use ON for AAD joined devices. Default value
+ 2 - Numeric Recovery Passwords Rotation upon use ON for both AAD and Hybrid devices
+
+ If you want to disable this policy use the following SyncML:
+
+
+ 112
+ -
+
+ ./Device/Vendor/MSFT/BitLocker/ConfigureRecoveryPasswordRotation
+
+
+ int
+
+ 0
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+
+
+
+
+
+
+ RotateRecoveryPasswords
+
+
+
+
+ Allows admin to push one-time rotation of all numeric recovery passwords for OS and Fixed Data drives on an Azure Active Directory or hybrid-joined device.
+ This policy is Execute type and rotates all numeric passwords when issued from MDM tools.
+
+The policy only comes into effect when Active Directory backup for a recovery password is configured to "required."
+ * For OS drives, enable "Do not enable BitLocker until recovery information is stored to Active Directory Domain Services for operating system drives."
+ *For fixed drives, enable "Do not enable BitLocker until recovery information is stored to Active Directory Domain Services for fixed data drives."
+
+ Client returns status DM_S_ACCEPTED_FOR_PROCESSING to indicate the rotation has started. Server can query status with the following status nodes:
+
+* status\RotateRecoveryPasswordsStatus
+ * status\RotateRecoveryPasswordsRequestID
+
+
+
+Supported Values: String form of request ID. Example format of request ID is GUID. Server can choose the format as needed according to the management tools.\
+
+
+ 113
+ -
+
+ ./Device/Vendor/MSFT/BitLocker/RotateRecoveryPasswords
+
+
+ chr
+
+ <RequestID/>
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+
+ Status
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ DeviceEncryptionStatus
+
+
+
+
+ This node reports compliance state of device encryption on the system.
+ Value '0' means the device is compliant. Any other value represents a non-compliant device.
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+
+ RotateRecoveryPasswordsStatus
+
+
+
+
+ This Node reports the status of RotateRecoveryPasswords request.
+ Status code can be one of the following:
+ NotStarted(2), Pending (1), Pass (0), Other error codes in case of failure
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+
+ RotateRecoveryPasswordsRequestID
+
+
+
+
+ This Node reports the RequestID corresponding to RotateRecoveryPasswordsStatus.
+ This node needs to be queried in synchronization with RotateRecoveryPasswordsStatus
+ To ensure the status is correctly matched to the request ID.
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
```
diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md
index 744a4be799..746d5b282e 100644
--- a/windows/client-management/mdm/defender-csp.md
+++ b/windows/client-management/mdm/defender-csp.md
@@ -9,7 +9,8 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
-ms.date: 07/19/2018
+ms.localizationpriority: medium
+ms.date: 10/21/2019
---
# Defender CSP
@@ -138,7 +139,7 @@ The following list shows the supported values:
- 2 = Manual steps required
- 3 = Full scan required
- 4 = Reboot required
-- 5 = Remediated with non critical failures
+- 5 = Remediated with noncritical failures
- 6 = Quarantined
- 7 = Removed
- 8 = Cleaned
@@ -243,7 +244,7 @@ The following list shows the supported values:
- 2 = Pending reboot
- 4 = Pending manual steps (Windows Defender is waiting for the user to take some action, such as restarting the computer or running a full scan)
- 8 = Pending offline scan
-- 16 = Pending critical failure (Windows Defender has failed critically and an Adminsitrator needs to investigate and take some action, such as restarting the computer or reinstalling Windows Defender)
+- 16 = Pending critical failure (Windows Defender has failed critically and an Administrator needs to investigate and take some action, such as restarting the computer or reinstalling Windows Defender)
Supported operation is Get.
@@ -352,6 +353,53 @@ The data type is a string.
Supported operation is Get.
+ **Health/TamperProtectionEnabled**
+Indicates whether the Windows Defender tamper protection feature is enabled.
+
+The data type is a boolean.
+
+Supported operation is Get.
+
+ **Health/IsVirtualMachine**
+Indicates whether the device is a virtual machine.
+
+The data type is a string.
+
+Supported operation is Get.
+
+ **Configuration**
+An interior node to group Windows Defender configuration information.
+
+Supported operation is Get.
+
+ **Configuration/TamperProtection**
+Tamper protection helps protect important security features from unwanted changes and interference. This includes real-time protection, behavior monitoring, and more. Accepts signed string to turn the feature on or off. Settings are configured with an MDM solution, such as Intune and is available in Windows 10 Enterprise E5 or equivalent subscriptions.
+
+Send off blob to device to reset tamper protection state before setting this configuration to "not configured" or "unassigned" in Intune.
+
+The data type is a Signed blob.
+
+Supported operations are Add, Delete, Get, Replace.
+
+Intune tamper protection setting UX supports three states:
+- Not configured (default): Does not have any impact on the default state of the device.
+- Enabled: Enables the tamper protection feature.
+- Disabled: Turns off the tamper protection feature.
+
+When enabled or disabled exists on the client and admin moves the setting to not configured, it will not have any impact on the device state. To change the state to either enabled or disabled would require to be set explicitly.
+
+ **Configuration/EnableFileHashComputation**
+Enables or disables file hash computation feature.
+When this feature is enabled Windows defender will compute hashes for files it scans.
+
+The data type is a integer.
+
+Supported operations are Add, Delete, Get, Replace.
+
+Valid values are:
+- 1 – Enable.
+- 0 (default) – Disable.
+
**Scan**
Node that can be used to start a Windows Defender scan on a device.
@@ -374,5 +422,4 @@ Supported operations are Get and Execute.
## Related topics
-[Configuration service provider reference](configuration-service-provider-reference.md)
-
+[Configuration service provider reference](configuration-service-provider-reference.md)
\ No newline at end of file
diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md
index fb7628c241..e5c1dcd59e 100644
--- a/windows/client-management/mdm/defender-ddf.md
+++ b/windows/client-management/mdm/defender-ddf.md
@@ -9,7 +9,8 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
-ms.date: 07/12/2018
+ms.localizationpriority: medium
+ms.date: 10/21/2019
---
# Defender DDF file
@@ -19,7 +20,7 @@ This topic shows the OMA DM device description framework (DDF) for the **Defende
Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
-The XML below is for Windows 10, version 1809.
+The XML below is the current version for this CSP.
```xml
@@ -628,6 +629,112 @@ The XML below is for Windows 10, version 1809.
+
+ TamperProtectionEnabled
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ IsVirtualMachine
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+
+ Configuration
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ TamperProtection
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
+
+ EnableFileHashComputation
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/plain
+
+
+
Scan
diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md
index 849b1c551d..ac08247a1f 100644
--- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md
+++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md
@@ -116,6 +116,9 @@ Requirements:
> In Windows 10, version 1903, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have the Windows 10, version 1903 feature update installed.
The default behavior for older releases is to revert to **User Credential**.
+> [!NOTE]
+> Device credential group policy setting is not supported for enrolling into Microsoft Intune.
+
When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called " Schedule created by enrollment client for automatically enrolling in MDM from AAD."
To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app).
diff --git a/windows/client-management/mdm/get-product-details.md b/windows/client-management/mdm/get-product-details.md
index 9ab64f1f8b..18a0174509 100644
--- a/windows/client-management/mdm/get-product-details.md
+++ b/windows/client-management/mdm/get-product-details.md
@@ -1,6 +1,6 @@
---
title: Get product details
-description: The Get product details operation retrieves the product information from the Micosoft Store for Business for a specific application.
+description: The Get product details operation retrieves the product information from the Microsoft Store for Business for a specific application.
ms.assetid: BC432EBA-CE5E-43BD-BD54-942774767286
ms.reviewer:
manager: dansimp
@@ -14,7 +14,7 @@ ms.date: 09/18/2017
# Get product details
-The **Get product details** operation retrieves the product information from the Micosoft Store for Business for a specific application.
+The **Get product details** operation retrieves the product information from the Microsoft Store for Business for a specific application.
## Request
diff --git a/windows/client-management/mdm/images/provisioning-csp-bitlocker.png b/windows/client-management/mdm/images/provisioning-csp-bitlocker.png
index d3d33ff9f6..63ccb6fc89 100644
Binary files a/windows/client-management/mdm/images/provisioning-csp-bitlocker.png and b/windows/client-management/mdm/images/provisioning-csp-bitlocker.png differ
diff --git a/windows/client-management/mdm/images/provisioning-csp-defender.png b/windows/client-management/mdm/images/provisioning-csp-defender.png
index c4a743deeb..793b1568ff 100644
Binary files a/windows/client-management/mdm/images/provisioning-csp-defender.png and b/windows/client-management/mdm/images/provisioning-csp-defender.png differ
diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
index fd199bb187..0a50619021 100644
--- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
+++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
@@ -24,6 +24,7 @@ This topic provides information about what's new and breaking changes in Windows
For details about Microsoft mobile device management protocols for Windows 10 see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347).
- **What’s new in MDM for Windows 10 versions**
+ - [What’s new in MDM for Windows 10, version 1909](#whats-new-in-mdm-for-windows-10-version-1909)
- [What’s new in MDM for Windows 10, version 1903](#whats-new-in-mdm-for-windows-10-version-1903)
- [What’s new in MDM for Windows 10, version 1809](#whats-new-in-mdm-for-windows-10-version-1809)
- [What’s new in MDM for Windows 10, version 1803](#whats-new-in-mdm-for-windows-10-version-1803)
@@ -83,6 +84,27 @@ For details about Microsoft mobile device management protocols for Windows 10 s
- [September 2017](#september-2017)
- [August 2017](#august-2017)
+## What’s new in MDM for Windows 10, version 1909
+
+
+
+
+
+
+
+
+
+
+BitLocker CSP
+ Added the following new nodes in Windows 10, version 1909:
+ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID.
+
+
+
+
## What’s new in MDM for Windows 10, version 1903
@@ -143,7 +165,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
WindowsLogon/ConfigAutomaticRestartSignOn
WindowsLogon/EnableFirstLogonAnimation
-Policy CSP - Audit
+Policy CSP - Audit
Added new Audit policies in Windows 10, version 1903.
@@ -153,6 +175,10 @@ For details about Microsoft mobile device management protocols for Windows 10 s
Added new CSP in Windows 10, version 1903.
+Defender CSP
+Added the following new nodes: Health/TamperProtectionEnabled, Health/IsVirtualMachine, Configuration, Configuration/TamperProtection, Configuration/EnableFileHashComputation.
+
+
DiagnosticLog CSP
DiagnosticLog DDF
Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
@@ -1912,13 +1938,14 @@ How do I turn if off? | The service can be stopped from the "Services" console o
|New or updated topic | Description|
|--- | ---|
-|[Policy CSP - Update](policy-csp-update.md)|Added the following new policy: Update/TargetReleaseVersion|
+|[BitLocker CSP](bitlocker-csp.md)|Added the following new nodes: ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID.|
+|[Defender CSP](defender-csp.md)|Added the following new nodes: Health/TamperProtectionEnabled, Health/IsVirtualMachine, Configuration, Configuration/TamperProtection, Configuration/EnableFileHashComputation.|
### September 2019
|New or updated topic | Description|
|--- | ---|
-|[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)|Added the following new node: IsStub|
+|[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)|Added the following new node: IsStub.|
|[Policy CSP - Defender](policy-csp-defender.md)|Updated the supported value list for Defender/ScheduleScanDay policy.|
|[Policy CSP - DeviceInstallation](policy-csp-deviceinstallation.md)|Added the following new policies: DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs, DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs.|
@@ -1937,7 +1964,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o
|[ApplicationControl CSP](applicationcontrol-csp.md)|Added new CSP in Windows 10, version 1903.|
|[PassportForWork CSP](passportforwork-csp.md)|Added the following new nodes in Windows 10, version 1903: SecurityKey, SecurityKey/UseSecurityKeyForSignin|
|[Policy CSP - Privacy](policy-csp-privacy.md)|Added the following new policies: LetAppsActivateWithVoice, LetAppsActivateWithVoiceAboveLock|
-|Create a custom configuration service provider|Deleted the following documents from the CSP reference because extensibility via CSPs is not currently supported: Create a custom configuration service provider Design a custom configuration service provider IConfigServiceProvider2 IConfigServiceProvider2::ConfigManagerNotification IConfigServiceProvider2::GetNode ICSPNode ICSPNode::Add ICSPNode::Clear ICSPNode::Copy ICSPNode::DeleteChild ICSPNode::DeleteProperty ICSPNode::Execute ICSPNode::GetChildNodeNames ICSPNode::GetProperty ICSPNode::GetPropertyIdentifiers ICSPNode::GetValue ICSPNode::Move ICSPNode::SetProperty ICSPNode::SetValue ICSPNodeTransactioning ICSPValidate Samples for writing a custom configuration service provider|
+|Create a custom configuration service provider|Deleted the following documents from the CSP reference because extensibility via CSPs is not currently supported: Create a custom configuration service provider Design a custom configuration service provider IConfigServiceProvider2 IConfigServiceProvider2::ConfigManagerNotification IConfigServiceProvider2::GetNode ICSPNode ICSPNode::Add ICSPNode::Clear ICSPNode::Copy ICSPNode::DeleteChild ICSPNode::DeleteProperty ICSPNode::Execute ICSPNode::GetChildNodeNames ICSPNode::GetProperty ICSPNode::GetPropertyIdentifiers ICSPNode::GetValue ICSPNode::Move ICSPNode::SetProperty ICSPNode::SetValue ICSPNodeTransactioning ICSPValidate Samples for writing a custom configuration service provider.|
### June 2019
diff --git a/windows/client-management/mdm/policies-that-can-be-set-using-eas.md b/windows/client-management/mdm/policies-that-can-be-set-using-eas.md
index f7f50cd529..3c0303c2c0 100644
--- a/windows/client-management/mdm/policies-that-can-be-set-using-eas.md
+++ b/windows/client-management/mdm/policies-that-can-be-set-using-eas.md
@@ -14,12 +14,10 @@ ms.date: 07/18/2019
# Policies that can be set using Exchange Active Sync (EAS)
-- [Browser/AllowBrowser](policy-csp-browser.md#browser-allowbrowser)
- [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera)
- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui)
- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth)
- [Connectivity/AllowCellularDataRoaming](policy-csp-connectivity.md#connectivity-allowcellulardataroaming)
-- [Connectivity/AllowUSBConnection](policy-csp-connectivity.md#connectivity-allowusbconnection)
- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword)
- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired)
- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled)
diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md
index 1924bb3b2a..9d72af8a49 100644
--- a/windows/client-management/mdm/policy-configuration-service-provider.md
+++ b/windows/client-management/mdm/policy-configuration-service-provider.md
@@ -138,9 +138,6 @@ The following diagram shows the Policy configuration service provider in tree fo
### AboveLock policies
-
- AboveLock/AllowActionCenterNotifications
-
AboveLock/AllowCortanaAboveLock
@@ -201,12 +198,6 @@ The following diagram shows the Policy configuration service provider in tree fo
ApplicationManagement/AllowSharedUserAppData
-
- ApplicationManagement/AllowStore
-
-
- ApplicationManagement/ApplicationRestrictions
-
ApplicationManagement/DisableStoreOriginatedApps
@@ -632,9 +623,6 @@ The following diagram shows the Policy configuration service provider in tree fo
Browser/AllowAutofill
-
- Browser/AllowBrowser
-
Browser/AllowConfigurationUpdateForBooksLibrary
@@ -737,9 +725,6 @@ The following diagram shows the Policy configuration service provider in tree fo
Browser/EnterpriseSiteListServiceUrl
-
- Browser/FirstRunURL
-
Browser/HomePages
@@ -839,9 +824,6 @@ The following diagram shows the Policy configuration service provider in tree fo
Connectivity/AllowConnectedDevices
-
- Connectivity/AllowNFC
-
Connectivity/AllowPhonePCLinking
@@ -1236,9 +1218,6 @@ The following diagram shows the Policy configuration service provider in tree fo
DeviceLock/AllowIdleReturnWithoutPassword
-
- DeviceLock/AllowScreenTimeoutWhileLockedUserConfig
-
DeviceLock/AllowSimpleDevicePassword
@@ -1257,18 +1236,12 @@ The following diagram shows the Policy configuration service provider in tree fo
DeviceLock/EnforceLockScreenAndLogonImage
-
- DeviceLock/EnforceLockScreenProvider
-
DeviceLock/MaxDevicePasswordFailedAttempts
DeviceLock/MaxInactivityTimeDeviceLock
-
- DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay
-
DeviceLock/MinDevicePasswordComplexCharacters
@@ -1284,9 +1257,6 @@ The following diagram shows the Policy configuration service provider in tree fo
DeviceLock/PreventLockScreenSlideShow
-
- DeviceLock/ScreenTimeoutWhileLocked
-
### Display policies
@@ -1400,9 +1370,6 @@ The following diagram shows the Policy configuration service provider in tree fo
Experience/AllowClipboardHistory
-
- Experience/AllowCopyPaste
-
Experience/AllowCortana
@@ -1415,15 +1382,9 @@ The following diagram shows the Policy configuration service provider in tree fo
Experience/AllowManualMDMUnenrollment
-
- Experience/AllowSIMErrorDialogPromptWhenNoSIM
-
Experience/AllowSaveAsOfOfficeFiles
-
- Experience/AllowScreenCapture
-
Experience/AllowSharingOfOfficeFiles
@@ -1433,15 +1394,9 @@ The following diagram shows the Policy configuration service provider in tree fo
Experience/AllowTailoredExperiencesWithDiagnosticData
-
- Experience/AllowTaskSwitcher
-
Experience/AllowThirdPartySuggestionsInWindowsSpotlight
-
- Experience/AllowVoiceRecording
-
Experience/AllowWindowsConsumerFeatures
@@ -2519,15 +2474,9 @@ The following diagram shows the Policy configuration service provider in tree fo
### Messaging policies
-
- Messaging/AllowMMS
-
Messaging/AllowMessageSync
-
- Messaging/AllowRCS
-
### MSSecurityGuide policies
@@ -3165,9 +3114,6 @@ The following diagram shows the Policy configuration service provider in tree fo
Search/PreventRemoteQueries
-
- Search/SafeSearchPermissions
-
### Security policies
@@ -3179,15 +3125,9 @@ The following diagram shows the Policy configuration service provider in tree fo
Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices
-
- Security/AllowManualRootCertificateInstallation
-
Security/AllowRemoveProvisioningPackage
-
- Security/AntiTheftMode
-
Security/ClearTPMIfNotReady
@@ -3230,9 +3170,6 @@ The following diagram shows the Policy configuration service provider in tree fo
Settings/AllowDateTime
-
- Settings/AllowEditDeviceName
-
Settings/AllowLanguage
@@ -3598,9 +3535,6 @@ The following diagram shows the Policy configuration service provider in tree fo
### TimeLanguageSettings policies
-
- TimeLanguageSettings/AllowSet24HourClock
-
TimeLanguageSettings/ConfigureTimeZone
@@ -3788,9 +3722,6 @@ The following diagram shows the Policy configuration service provider in tree fo
Update/SetEDURestart
-
- Update/TargetReleaseVersion
-
Update/UpdateNotificationLevel
diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md
index 914fbfa1ee..493575d365 100644
--- a/windows/client-management/mdm/policy-csp-abovelock.md
+++ b/windows/client-management/mdm/policy-csp-abovelock.md
@@ -2,6 +2,7 @@
title: Policy CSP - AboveLock
description: Policy CSP - AboveLock
ms.author: dansimp
+ms.localizationpriority: medium
ms.topic: article
ms.prod: w10
ms.technology: windows
@@ -21,9 +22,6 @@ manager: dansimp
## AboveLock policies
-
- AboveLock/AllowActionCenterNotifications
-
AboveLock/AllowCortanaAboveLock
@@ -35,76 +33,6 @@ manager: dansimp
-
- **AboveLock/AllowActionCenterNotifications**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
-Specifies whether to allow Action Center notifications above the device lock screen.
-
-Most restricted value is 0.
-
-
-
-The following list shows the supported values:
-
-- 0 - Not allowed.
-- 1 (default) - Allowed.
-
-
-
-
-
**AboveLock/AllowCortanaAboveLock**
@@ -135,14 +63,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -209,14 +129,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md
index 1e1ee819ca..e978cc82da 100644
--- a/windows/client-management/mdm/policy-csp-accounts.md
+++ b/windows/client-management/mdm/policy-csp-accounts.md
@@ -2,6 +2,7 @@
title: Policy CSP - Accounts
description: Policy CSP - Accounts
ms.author: dansimp
+ms.localizationpriority: medium
ms.topic: article
ms.prod: w10
ms.technology: windows
diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md
index ea16cb9e87..98588acfa2 100644
--- a/windows/client-management/mdm/policy-csp-activexcontrols.md
+++ b/windows/client-management/mdm/policy-csp-activexcontrols.md
@@ -2,6 +2,7 @@
title: Policy CSP - ActiveXControls
description: Policy CSP - ActiveXControls
ms.author: dansimp
+ms.localizationpriority: medium
ms.topic: article
ms.prod: w10
ms.technology: windows
@@ -58,14 +59,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md
index 54411312e9..76ac87c616 100644
--- a/windows/client-management/mdm/policy-csp-applicationdefaults.md
+++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -61,14 +62,6 @@ manager: dansimp
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -185,14 +178,6 @@ Here is the SyncMl example:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md
index 40b7cdd894..a7680a8600 100644
--- a/windows/client-management/mdm/policy-csp-applicationmanagement.md
+++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -38,12 +39,6 @@ manager: dansimp
ApplicationManagement/AllowSharedUserAppData
-
- ApplicationManagement/AllowStore
-
-
- ApplicationManagement/ApplicationRestrictions
-
ApplicationManagement/DisableStoreOriginatedApps
@@ -102,14 +97,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -179,14 +166,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -256,14 +235,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -333,14 +304,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -412,14 +375,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -459,155 +414,6 @@ Most restricted value: 0
-
- **ApplicationManagement/AllowStore**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Specifies whether app store is allowed at the device.
-
-Most restricted value is 0.
-
-
-
-The following list shows the supported values:
-
-- 0 – Not allowed.
-- 1 (default) – Allowed.
-
-
-
-
-
-
-
- **ApplicationManagement/ApplicationRestrictions**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. For desktop devices, use the [AppLocker CSP](applocker-csp.md) instead.
-
-
-An XML blob that specifies the application restrictions company want to put to the device. It could be an app allow list, app disallow list, allowed publisher IDs, and so on. For a list of Windows apps and product IDs, see [inbox apps](applocker-csp.md#inboxappsandcomponents). For more information about the XML, see the [ApplicationRestrictions XSD](applicationrestrictions-xsd.md).
-
-> [!NOTE]
-> When you upgrade Windows Phone 8.1 devices to Windows 10 Mobile with a list of allowed apps, some Windows inbox apps get blocked causing unexpected behavior. To work around this issue, you must include the [inbox apps](applocker-csp.md#inboxappsandcomponents) that you need to your list of allowed apps.
->
-> Here's additional guidance for the upgrade process:
->
-> - Use Windows 10 product IDs for the apps listed in [inbox apps](applocker-csp.md#inboxappsandcomponents).
-> - Use the new Microsoft publisher name (PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US") and Publisher="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" if you are using the publisher policy. Do not remove the Windows Phone 8.1 publisher if you are using it.
-> - In the SyncML, you must use lowercase product ID.
-> - Do not duplicate a product ID. Messaging and Skype Video use the same product ID. Duplicates cause an error.
-> - You cannot disable or enable **Contact Support** and **Windows Feedback** apps using ApplicationManagement/ApplicationRestrictions policy, although these are listed in the [inbox apps](applocker-csp.md#inboxappsandcomponents).
-
-
-An application that is running may not be immediately terminated.
-
-Value type is chr.
-
-Value evaluation rule - The information for PolicyManager is opaque. There is no most restricted value evaluation. Whenever there is a change to the value, the device parses the node value and enforces specified policies.
-
-
-
-
-
-
**ApplicationManagement/DisableStoreOriginatedApps**
@@ -637,14 +443,6 @@ Value evaluation rule - The information for PolicyManager is opaque. There is no
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -711,14 +509,6 @@ The following list shows the supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -790,14 +580,6 @@ For this policy to work, the Windows apps need to declare in their manifest that
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -869,14 +651,6 @@ This setting supports a range of values between 0 and 1.
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -949,14 +723,6 @@ This setting supports a range of values between 0 and 1.
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1027,14 +793,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1103,14 +861,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1179,14 +929,6 @@ The following list shows the supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-appruntime.md b/windows/client-management/mdm/policy-csp-appruntime.md
index a7844912b0..fce0c40f17 100644
--- a/windows/client-management/mdm/policy-csp-appruntime.md
+++ b/windows/client-management/mdm/policy-csp-appruntime.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -58,14 +59,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md
index c7c9ba66ef..adce29e627 100644
--- a/windows/client-management/mdm/policy-csp-appvirtualization.md
+++ b/windows/client-management/mdm/policy-csp-appvirtualization.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -139,14 +140,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -213,14 +206,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -287,14 +272,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -361,14 +338,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -435,14 +404,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -509,14 +470,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -593,14 +546,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -667,14 +612,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -741,14 +678,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -815,14 +744,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -889,14 +810,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -963,14 +876,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1037,14 +942,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1129,14 +1026,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1221,14 +1110,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1313,14 +1194,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1405,14 +1278,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1497,14 +1362,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1571,14 +1428,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1645,14 +1494,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1719,14 +1560,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1793,14 +1626,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1867,14 +1692,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1941,14 +1758,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2015,14 +1824,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2089,14 +1890,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2163,14 +1956,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2237,14 +2022,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md
index 0c0a985993..b09a07d3b2 100644
--- a/windows/client-management/mdm/policy-csp-attachmentmanager.md
+++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -64,14 +65,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -144,14 +137,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -224,14 +209,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md
index ee6f36a0cb..96103d4ca7 100644
--- a/windows/client-management/mdm/policy-csp-audit.md
+++ b/windows/client-management/mdm/policy-csp-audit.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
---
@@ -232,14 +233,6 @@ ms.date: 09/27/2019
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -317,14 +310,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -399,14 +384,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -483,14 +460,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -566,14 +535,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -648,14 +609,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -731,14 +684,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -817,14 +762,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -899,14 +836,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -987,14 +916,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1069,14 +990,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1153,14 +1066,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1235,14 +1140,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1318,14 +1215,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1401,14 +1290,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1482,14 +1363,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1567,14 +1440,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1650,14 +1515,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1739,14 +1596,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1827,14 +1676,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1913,14 +1754,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2003,14 +1836,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2084,14 +1909,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2168,14 +1985,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2258,14 +2067,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2344,14 +2145,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2426,14 +2219,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2508,14 +2293,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2590,14 +2367,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2672,14 +2441,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2754,14 +2515,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2834,14 +2587,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2918,14 +2663,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3005,14 +2742,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3102,14 +2831,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3186,14 +2907,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3270,14 +2983,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3355,14 +3060,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3448,14 +3145,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3528,14 +3217,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3613,14 +3294,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3696,14 +3369,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3786,14 +3451,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3871,14 +3528,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3953,14 +3602,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4045,14 +3686,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4142,14 +3775,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4230,14 +3855,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4317,14 +3934,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4407,14 +4016,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4493,14 +4094,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4584,14 +4177,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4697,14 +4282,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4775,14 +4352,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4872,14 +4441,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4961,14 +4522,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5044,14 +4597,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5127,14 +4672,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5212,14 +4749,6 @@ The following are the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md
index 7121831325..26a3e3120b 100644
--- a/windows/client-management/mdm/policy-csp-authentication.md
+++ b/windows/client-management/mdm/policy-csp-authentication.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -79,14 +80,6 @@ manager: dansimp
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -145,14 +138,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -211,14 +196,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -279,14 +256,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -349,14 +318,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -427,14 +388,6 @@ The following list shows the supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -507,14 +460,6 @@ Value type is integer. Supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -587,14 +532,6 @@ Value type is integer. Supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md
index 96b8bf6c71..38a9ace228 100644
--- a/windows/client-management/mdm/policy-csp-autoplay.md
+++ b/windows/client-management/mdm/policy-csp-autoplay.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -64,14 +65,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -143,14 +136,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -231,14 +216,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-bitlocker.md b/windows/client-management/mdm/policy-csp-bitlocker.md
index e236364c2d..3ab3d8246b 100644
--- a/windows/client-management/mdm/policy-csp-bitlocker.md
+++ b/windows/client-management/mdm/policy-csp-bitlocker.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -61,14 +62,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-bits.md b/windows/client-management/mdm/policy-csp-bits.md
index 099ae1bf62..07a7f51c0f 100644
--- a/windows/client-management/mdm/policy-csp-bits.md
+++ b/windows/client-management/mdm/policy-csp-bits.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -83,14 +84,6 @@ If BITS/BandwidthThrottlingStartTime or BITS/BandwidthThrottlingEndTime are NOT
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -174,14 +167,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -265,14 +250,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -356,14 +333,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -442,14 +411,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -528,14 +489,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md
index f2168493d4..225de9c9ca 100644
--- a/windows/client-management/mdm/policy-csp-bluetooth.md
+++ b/windows/client-management/mdm/policy-csp-bluetooth.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -73,14 +74,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -143,14 +136,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -213,14 +198,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -279,14 +256,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -345,14 +314,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -408,14 +369,6 @@ If this policy is not set or it is deleted, the default local radio name is used
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md
index 8ac9f5aa11..fc3c9baff8 100644
--- a/windows/client-management/mdm/policy-csp-browser.md
+++ b/windows/client-management/mdm/policy-csp-browser.md
@@ -9,6 +9,7 @@ ms.author: dansimp
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
+ms.localizationpriority: medium
---
# Policy CSP - Browser
@@ -27,9 +28,6 @@ manager: dansimp
Browser/AllowAutofill
-
- Browser/AllowBrowser
-
Browser/AllowConfigurationUpdateForBooksLibrary
@@ -132,9 +130,6 @@ manager: dansimp
Browser/EnterpriseSiteListServiceUrl
-
- Browser/FirstRunURL
-
Browser/HomePages
@@ -226,14 +221,6 @@ manager: dansimp
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -305,14 +292,6 @@ Most restricted value: 0
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -363,79 +342,6 @@ To verify AllowAutofill is set to 0 (not allowed):
-
- **Browser/AllowBrowser**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * User
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. For desktop devices, use the [AppLocker CSP](applocker-csp.md) instead.
-
-The device allows Microsoft Edge on Windows 10 Mobile by default. With this policy, you can disable the Microsoft Edge tile, and when clicking the tile, a message opens indicating that the administrator disabled Internet browsing.
-
-
-
-
-
-Supported values:
-
-- 0 – Prevented/not allowed.
-- 1 (default) – Allowed.
-
-Most restricted value: 0
-
-
-
-
-
**Browser/AllowConfigurationUpdateForBooksLibrary**
@@ -465,14 +371,6 @@ Most restricted value: 0
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -542,14 +440,6 @@ Supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -629,14 +519,6 @@ To verify AllowCookies is set to 0 (not allowed):
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -708,14 +590,6 @@ Most restricted value: 0
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -794,14 +668,6 @@ To verify AllowDoNotTrack is set to 0 (not allowed):
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -871,14 +737,6 @@ Supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -948,14 +806,6 @@ Supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1028,14 +878,6 @@ Most restricted value: 1
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1113,14 +955,6 @@ Most restricted value: 0
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1190,14 +1024,6 @@ Most restricted value: 0
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -1271,14 +1097,6 @@ Most restricted value: 0
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1357,14 +1175,6 @@ To verify AllowPasswordManager is set to 0 (not allowed):
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1443,14 +1253,6 @@ To verify AllowPopups is set to 0 (not allowed):
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1529,14 +1331,6 @@ Most restricted value: 0
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1614,14 +1408,6 @@ Most restricted value: 0
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1699,14 +1485,6 @@ Most restricted value: 0
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -1782,14 +1560,6 @@ Most restricted value: 0
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1860,14 +1630,6 @@ Most restricted value: 0
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1945,14 +1707,6 @@ Most restricted value: 0
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2030,14 +1784,6 @@ To verify AllowSmartScreen is set to 0 (not allowed):
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2114,14 +1860,6 @@ Most restricted value: 1
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2198,14 +1936,6 @@ Supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2278,14 +2008,6 @@ Most restricted value: 0
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -2366,14 +2088,6 @@ To verify that browsing data is cleared on exit (ClearBrowsingDataOnExit is set
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -2449,14 +2163,6 @@ Most restricted value: 0
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2534,14 +2240,6 @@ Supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2623,14 +2321,6 @@ Supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2715,14 +2405,6 @@ Supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2802,14 +2484,6 @@ Supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2899,14 +2573,6 @@ Supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2985,14 +2651,6 @@ Most restricted value: 0
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3069,14 +2727,6 @@ Most restricted value: 0
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3146,14 +2796,6 @@ Most restricted value: 0
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3229,14 +2871,6 @@ Supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3261,69 +2895,6 @@ Supported values:
-
- **Browser/FirstRunURL**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * User
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
-Enter a URL in string format for the site you want to load when Microsoft Edge for Windows 10 Mobile opens for the first time, for example, contoso.com.
-
-
-
-
-
-
**Browser/HomePages**
@@ -3353,14 +2924,6 @@ Enter a URL in string format for the site you want to load when Microsoft Edge f
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3446,14 +3009,6 @@ Supported values:
Education
3
-
- Mobile
- 3
-
-
- Mobile Enterprise
- 3
-
@@ -3525,14 +3080,6 @@ Most restricted value: 1
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3602,14 +3149,6 @@ Most restricted value: 1
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3685,14 +3224,6 @@ Most restricted value: 1
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -3763,14 +3294,6 @@ Most restricted value: 1
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -3841,14 +3364,6 @@ Most restricted value: 1
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3917,14 +3432,6 @@ Most restricted value: 1
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3994,14 +3501,6 @@ Most restricted value: 1
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4077,14 +3576,6 @@ Supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4156,14 +3647,6 @@ Most restricted value: 1
Education
3
-
- Mobile
- 3
-
-
- Mobile Enterprise
- 3
-
@@ -4242,14 +3725,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4324,14 +3799,6 @@ Most restricted value: 0
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -4410,14 +3877,6 @@ Most restricted value: 1
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4493,14 +3952,6 @@ Supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4575,14 +4026,6 @@ Supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4656,14 +4099,6 @@ Most restricted value: 0
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4747,14 +4182,6 @@ To verify that favorites are in synchronized between Internet Explorer and Micro
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4830,14 +4257,6 @@ Supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md
index b653678c88..c3b2407f95 100644
--- a/windows/client-management/mdm/policy-csp-camera.md
+++ b/windows/client-management/mdm/policy-csp-camera.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -58,14 +59,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md
index 20ce1d0a5e..8eea1718e2 100644
--- a/windows/client-management/mdm/policy-csp-cellular.md
+++ b/windows/client-management/mdm/policy-csp-cellular.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -70,14 +71,6 @@ manager: dansimp
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -158,14 +151,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -226,14 +211,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -294,14 +271,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -362,14 +331,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md
index df441e8d28..9f039348ee 100644
--- a/windows/client-management/mdm/policy-csp-connectivity.md
+++ b/windows/client-management/mdm/policy-csp-connectivity.md
@@ -34,9 +34,6 @@ manager: dansimp
Connectivity/AllowConnectedDevices
-
- Connectivity/AllowNFC
-
Connectivity/AllowPhonePCLinking
@@ -101,14 +98,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -175,14 +164,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -242,14 +223,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -329,14 +302,6 @@ To validate on mobile devices, do the following:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -369,103 +334,6 @@ The following list shows the supported values:
-
- **Connectivity/AllowNFC**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
-
-Allows or disallows near field communication (NFC) on the device.
-
-Most restricted value is 0.
-
-
-
-The following list shows the supported values:
-
-- 0 – Do not allow NFC capabilities.
-- 1 (default) – Allow NFC capabilities.
-
-
-
-
-The following example shows how to disallow NFC capabilities.
-
-```xml
-
-
-
- $CmdID$
- -
-
- ./Vendor/MSFT/Policy/Config/Connectivity/AllowNFC
-
-
- int
-
- 0
-
-
-
-
-
-```
-
-
-
-
-
-
**Connectivity/AllowPhonePCLinking**
@@ -495,14 +363,6 @@ The following example shows how to disallow NFC capabilities.
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -578,14 +438,6 @@ Device that has previously opt-in to MMX will also stop showing on the device li
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -602,8 +454,7 @@ Device that has previously opt-in to MMX will also stop showing on the device li
> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
+> Currently, this policy is supported only in HoloLens 2, Hololens (1st gen) Commercial Suite, and HoloLens (1st gen) Development Edition.
Enables USB connection between the device and a computer to sync files with the device or to use developer tools to deploy or debug applications. Changing this policy does not affect USB charging.
@@ -652,14 +503,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -720,14 +563,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -788,14 +623,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -872,14 +699,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -954,14 +773,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1036,14 +847,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1105,14 +908,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1181,14 +976,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md
index 5d76f3ae08..1cb56dfe89 100644
--- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md
+++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md
@@ -59,14 +59,6 @@ manager: dansimp
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md
index 6f9bacca01..a246711f54 100644
--- a/windows/client-management/mdm/policy-csp-credentialproviders.md
+++ b/windows/client-management/mdm/policy-csp-credentialproviders.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -64,14 +65,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -146,14 +139,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -226,14 +211,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-credentialsdelegation.md b/windows/client-management/mdm/policy-csp-credentialsdelegation.md
index 7b98255481..8ff0e68902 100644
--- a/windows/client-management/mdm/policy-csp-credentialsdelegation.md
+++ b/windows/client-management/mdm/policy-csp-credentialsdelegation.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -58,14 +59,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md
index fc06e65117..ddbe0fbb42 100644
--- a/windows/client-management/mdm/policy-csp-credentialsui.md
+++ b/windows/client-management/mdm/policy-csp-credentialsui.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -61,14 +62,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -144,14 +137,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md
index 8090aed7bd..e65d65744a 100644
--- a/windows/client-management/mdm/policy-csp-cryptography.md
+++ b/windows/client-management/mdm/policy-csp-cryptography.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -61,14 +62,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -138,14 +131,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md
index f61e4211ed..a59ff61127 100644
--- a/windows/client-management/mdm/policy-csp-dataprotection.md
+++ b/windows/client-management/mdm/policy-csp-dataprotection.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -61,14 +62,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -129,14 +122,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md
index 667a2f4316..13ed5363fb 100644
--- a/windows/client-management/mdm/policy-csp-datausage.md
+++ b/windows/client-management/mdm/policy-csp-datausage.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -74,14 +75,6 @@ This policy is deprecated in Windows 10, version 1809.
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md
index 039f7bf21b..09ea8790ad 100644
--- a/windows/client-management/mdm/policy-csp-defender.md
+++ b/windows/client-management/mdm/policy-csp-defender.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -178,14 +179,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -256,14 +249,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -334,14 +319,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -413,14 +390,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -491,14 +460,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -569,14 +530,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -647,14 +600,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -725,14 +670,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -795,14 +732,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -873,14 +802,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -951,14 +872,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1029,14 +942,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1099,14 +1004,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1177,14 +1074,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1251,14 +1140,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1327,14 +1208,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1406,14 +1279,6 @@ Valid values: 0–100
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1496,14 +1361,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1584,14 +1441,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1662,14 +1511,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1733,14 +1574,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1804,14 +1637,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1883,14 +1708,6 @@ Valid values: 0–90
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1971,14 +1788,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2059,14 +1868,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2138,14 +1939,6 @@ The following list shows the supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2224,14 +2017,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2309,14 +2094,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2381,14 +2158,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2453,14 +2222,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2531,14 +2292,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2602,14 +2355,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2685,14 +2430,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2764,14 +2501,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2849,14 +2578,6 @@ Valid values: 0–1380
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2938,14 +2659,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3023,14 +2736,6 @@ Valid values: 0–1380.
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3115,14 +2820,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3202,14 +2899,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3285,14 +2974,6 @@ Valid values: 0–24.
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3366,14 +3047,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md
index f1cad52c4e..79c0298921 100644
--- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md
+++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -136,14 +137,6 @@ manager: dansimp
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -210,14 +203,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -289,14 +274,6 @@ The following list shows the supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -366,14 +343,6 @@ ADMX Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -436,14 +405,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -517,14 +478,6 @@ Supported values: 0 - one month (in seconds)
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -596,14 +549,6 @@ Supported values: 0 - one month (in seconds)
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -678,14 +623,6 @@ The following list shows the supported values as number of seconds:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -761,14 +698,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -836,14 +765,6 @@ ADMX Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -921,14 +842,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -995,14 +908,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1069,14 +974,6 @@ ADMX Info:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1143,14 +1040,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1217,14 +1106,6 @@ ADMX Info:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1291,14 +1172,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1364,14 +1237,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1441,14 +1306,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1515,14 +1372,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1589,14 +1438,6 @@ ADMX Info:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1663,14 +1504,6 @@ ADMX Info:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1739,14 +1572,6 @@ ADMX Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1822,14 +1647,6 @@ This policy is deprecated. Use [DOPercentageMaxForegroundBandwidth](#deliveryopt
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1892,14 +1709,6 @@ ADMX Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1969,14 +1778,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2051,14 +1852,6 @@ This policy allows an IT Admin to define the following:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md
index 4ceba6053b..d1562413d5 100644
--- a/windows/client-management/mdm/policy-csp-desktop.md
+++ b/windows/client-management/mdm/policy-csp-desktop.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -58,14 +59,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md
index e9e4a9ca92..f34ee27dd5 100644
--- a/windows/client-management/mdm/policy-csp-deviceguard.md
+++ b/windows/client-management/mdm/policy-csp-deviceguard.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -69,14 +70,6 @@ manager: dansimp
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -154,14 +147,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -228,14 +213,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -304,14 +281,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md
index ebcbe2fab4..7d8aeb48ed 100644
--- a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md
+++ b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -64,14 +65,6 @@ manager: dansimp
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -136,14 +129,6 @@ The following list shows the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -207,14 +192,6 @@ IT Pros do not need to set this policy. Instead, Microsoft Intune is expected to
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md
index 69b0640af8..5a33e8eda5 100644
--- a/windows/client-management/mdm/policy-csp-deviceinstallation.md
+++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md
@@ -9,6 +9,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
---
# Policy CSP - DeviceInstallation
@@ -81,14 +82,6 @@ author: manikadhiman
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -203,14 +196,6 @@ To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -318,14 +303,6 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -449,14 +426,6 @@ To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -536,14 +505,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -656,14 +617,6 @@ You can also block installation by using a custom profile in Intune.
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -781,14 +734,6 @@ For example, this custom profile blocks installation and usage of USB devices wi
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -897,14 +842,6 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md
index 62f1a08352..8d3fe92592 100644
--- a/windows/client-management/mdm/policy-csp-devicelock.md
+++ b/windows/client-management/mdm/policy-csp-devicelock.md
@@ -25,9 +25,6 @@ manager: dansimp
DeviceLock/AllowIdleReturnWithoutPassword
-
- DeviceLock/AllowScreenTimeoutWhileLockedUserConfig
-
DeviceLock/AllowSimpleDevicePassword
@@ -46,18 +43,12 @@ manager: dansimp
DeviceLock/EnforceLockScreenAndLogonImage
-
- DeviceLock/EnforceLockScreenProvider
-
DeviceLock/MaxDevicePasswordFailedAttempts
DeviceLock/MaxInactivityTimeDeviceLock
-
- DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay
-
DeviceLock/MinDevicePasswordComplexCharacters
@@ -73,10 +64,7 @@ manager: dansimp
DeviceLock/PreventLockScreenSlideShow
-
- DeviceLock/ScreenTimeoutWhileLocked
-
-
+
@@ -110,14 +98,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -134,13 +114,12 @@ manager: dansimp
> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
+> Currently, this policy is supported only in HoloLens 2, Hololens (1st gen) Commercial Suite, and HoloLens (1st gen) Development Edition.
-
Specifies whether the user must input a PIN or password when the device resumes from an idle state.
> [!NOTE]
-> This policy must be wrapped in an Atomic command.
+> This policy must be wrapped in an Atomic command.
@@ -154,82 +133,6 @@ The following list shows the supported values:
-
- **DeviceLock/AllowScreenTimeoutWhileLockedUserConfig**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
-
-Specifies whether to show a user-configurable setting to control the screen timeout while on the lock screen of Windows 10 Mobile devices.
-
-> [!NOTE]
-> This policy must be wrapped in an Atomic command.
-
-> [!IMPORTANT]
-> If this policy is set to 1 (Allowed), the value set by **DeviceLock/ScreenTimeOutWhileLocked** is ignored. To ensure enterprise control over the screen timeout, set this policy to 0 (Not allowed) and use **DeviceLock/ScreenTimeOutWhileLocked** to set the screen timeout period.
-
-
-
-The following list shows the supported values:
-
-- 0 (default) – Not allowed.
-- 1 – Allowed.
-
-
-
-
-
-
**DeviceLock/AllowSimpleDevicePassword**
@@ -259,14 +162,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -332,14 +227,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -411,14 +298,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -518,14 +397,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -593,14 +464,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -668,14 +531,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -704,71 +559,6 @@ Value type is a string, which is the full image filepath and filename.
-
- **DeviceLock/EnforceLockScreenProvider**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Added in Windows 10, version 1607. Restricts lock screen image to a specific lock screen provider. Users will not be able change this provider.
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 for mobile devices.
-
-
-Value type is a string, which is the AppID.
-
-
-
-
-
-
**DeviceLock/MaxDevicePasswordFailedAttempts**
@@ -798,14 +588,6 @@ Value type is a string, which is the AppID.
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -880,14 +662,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -927,75 +701,6 @@ The following list shows the supported values:
-
- **DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked while connected to an external display.
-
-> [!NOTE]
-> This policy must be wrapped in an Atomic command.
-
-
-
-The following list shows the supported values:
-
-- An integer X where 0 <= X <= 999.
-- 0 (default) - No timeout is defined. The default of "0" is Windows Phone 7.5 parity and is interpreted by as "No timeout is defined."
-
-
-
-
-
-
**DeviceLock/MinDevicePasswordComplexCharacters**
@@ -1025,14 +730,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1155,14 +852,6 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1256,14 +945,6 @@ The following example shows how to set the minimum password length to 4 characte
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1325,14 +1006,6 @@ GP Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1403,14 +1076,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1452,75 +1117,6 @@ ADMX Info:
-
- **DeviceLock/ScreenTimeoutWhileLocked**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
-Allows an enterprise to set the duration in seconds for the screen timeout while on the lock screen of Windows 10 Mobile devices.
-
-Minimum supported value is 10.
-
-Maximum supported value is 1800.
-
-The default value is 10.
-
-Most restricted value is 0.
-
-
-
-
-
Footnotes:
- 1 - Added in Windows 10, version 1607.
diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md
index ac06feca25..5379d5fbac 100644
--- a/windows/client-management/mdm/policy-csp-display.md
+++ b/windows/client-management/mdm/policy-csp-display.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -70,14 +71,6 @@ manager: dansimp
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -138,14 +131,6 @@ ADMX Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -226,14 +211,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -294,14 +271,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -377,14 +346,6 @@ To validate on Desktop, do the following:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-dmaguard.md b/windows/client-management/mdm/policy-csp-dmaguard.md
index 02d35fa1fe..08eaddf872 100644
--- a/windows/client-management/mdm/policy-csp-dmaguard.md
+++ b/windows/client-management/mdm/policy-csp-dmaguard.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -60,14 +61,6 @@ manager: dansimp
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md
index 365bc82b69..825ac41a15 100644
--- a/windows/client-management/mdm/policy-csp-education.md
+++ b/windows/client-management/mdm/policy-csp-education.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -69,14 +70,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -140,14 +133,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -201,14 +186,6 @@ The policy value is expected to be the name (network host name) of an installed
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -275,14 +252,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md
index d920678f17..4cecf73ce0 100644
--- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md
+++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -73,14 +74,6 @@ manager: dansimp
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -136,14 +129,6 @@ The default value is an empty string. Otherwise, the value should contain the UR
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -199,14 +184,6 @@ The default value is an empty string. Otherwise, the value should contain a GUID
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -262,14 +239,6 @@ The default value is an empty string. Otherwise, the value should contain a URL.
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -325,14 +294,6 @@ The default value is an empty string. Otherwise, the value should contain the UR
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -388,14 +349,6 @@ For Windows Mobile, the default value is 20.
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
diff --git a/windows/client-management/mdm/policy-csp-errorreporting.md b/windows/client-management/mdm/policy-csp-errorreporting.md
index 927affaab1..9cdc8a23f1 100644
--- a/windows/client-management/mdm/policy-csp-errorreporting.md
+++ b/windows/client-management/mdm/policy-csp-errorreporting.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -70,14 +71,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -158,14 +151,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -236,14 +221,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -318,14 +295,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -396,14 +365,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md
index e45a30e9c1..85d7cfd540 100644
--- a/windows/client-management/mdm/policy-csp-eventlogservice.md
+++ b/windows/client-management/mdm/policy-csp-eventlogservice.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -67,14 +68,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -147,14 +140,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -225,14 +210,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -303,14 +280,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md
index 6e75b35fdf..644621a01e 100644
--- a/windows/client-management/mdm/policy-csp-experience.md
+++ b/windows/client-management/mdm/policy-csp-experience.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -24,9 +25,6 @@ manager: dansimp
Experience/AllowClipboardHistory
-
- Experience/AllowCopyPaste
-
Experience/AllowCortana
@@ -39,15 +37,9 @@ manager: dansimp
Experience/AllowManualMDMUnenrollment
-
- Experience/AllowSIMErrorDialogPromptWhenNoSIM
-
Experience/AllowSaveAsOfOfficeFiles
-
- Experience/AllowScreenCapture
-
Experience/AllowSharingOfOfficeFiles
@@ -57,15 +49,9 @@ manager: dansimp
Experience/AllowTailoredExperiencesWithDiagnosticData
-
- Experience/AllowTaskSwitcher
-
Experience/AllowThirdPartySuggestionsInWindowsSpotlight
-
- Experience/AllowVoiceRecording
-
Experience/AllowWindowsConsumerFeatures
@@ -133,14 +119,6 @@ manager: dansimp
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -191,77 +169,6 @@ ADMX Info:
-
- **Experience/AllowCopyPaste**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
-Specifies whether copy and paste is allowed.
-
-Most restricted value is 0.
-
-
-
-The following list shows the supported values:
-
-- 0 – Not allowed.
-- 1 (default) – Allowed.
-
-
-
-
-
-
**Experience/AllowCortana**
@@ -291,14 +198,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -367,14 +266,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -437,14 +328,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -515,14 +398,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -558,76 +433,6 @@ The following list shows the supported values:
-
- **Experience/AllowSIMErrorDialogPromptWhenNoSIM**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
-
-Specifies whether to display dialog prompt when no SIM card is detected.
-
-
-
-The following list shows the supported values:
-
-- 0 – SIM card dialog prompt is not displayed.
-- 1 (default) – SIM card dialog prompt is displayed.
-
-
-
-
-
-
**Experience/AllowSaveAsOfOfficeFiles**
@@ -641,78 +446,6 @@ This policy is deprecated.
-
- **Experience/AllowScreenCapture**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
-
-Specifies whether screen capture is allowed.
-
-Most restricted value is 0.
-
-
-
-The following list shows the supported values:
-
-- 0 – Not allowed.
-- 1 (default) – Allowed.
-
-
-
-
-
-
**Experience/AllowSharingOfOfficeFiles**
@@ -753,14 +486,6 @@ This policy is deprecated.
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -819,14 +544,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -873,76 +590,6 @@ The following list shows the supported values:
-
- **Experience/AllowTaskSwitcher**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
-
-Allows or disallows task switching on the device.
-
-
-
-The following list shows the supported values:
-
-- 0 – Task switching not allowed.
-- 1 (default) – Task switching allowed.
-
-
-
-
-
-
**Experience/AllowThirdPartySuggestionsInWindowsSpotlight**
@@ -972,14 +619,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1021,78 +660,6 @@ The following list shows the supported values:
-
- **Experience/AllowVoiceRecording**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
-
-Specifies whether voice recording is allowed for apps.
-
-Most restricted value is 0.
-
-
-
-The following list shows the supported values:
-
-- 0 – Not allowed.
-- 1 (default) – Allowed.
-
-
-
-
-
-
**Experience/AllowWindowsConsumerFeatures**
@@ -1122,14 +689,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1203,14 +762,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1283,14 +834,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1362,14 +905,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1440,14 +975,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1520,14 +1047,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1594,14 +1113,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1673,14 +1184,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -1751,14 +1254,6 @@ The following list shows the supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1853,14 +1348,6 @@ _**Turn syncing off by default but don’t disable**_
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1956,14 +1443,6 @@ Validation procedure:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md
index 4c9ac2d8da..f32917cdbc 100644
--- a/windows/client-management/mdm/policy-csp-exploitguard.md
+++ b/windows/client-management/mdm/policy-csp-exploitguard.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -58,14 +59,6 @@ manager: dansimp
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md
index 76e6dd9e7b..ddc419671c 100644
--- a/windows/client-management/mdm/policy-csp-fileexplorer.md
+++ b/windows/client-management/mdm/policy-csp-fileexplorer.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -61,14 +62,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -135,14 +128,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-games.md b/windows/client-management/mdm/policy-csp-games.md
index fe3421951b..b114cb8f6a 100644
--- a/windows/client-management/mdm/policy-csp-games.md
+++ b/windows/client-management/mdm/policy-csp-games.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -58,14 +59,6 @@ manager: dansimp
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md
index 4538f7e095..16d5bde9bd 100644
--- a/windows/client-management/mdm/policy-csp-handwriting.md
+++ b/windows/client-management/mdm/policy-csp-handwriting.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -58,14 +59,6 @@ manager: dansimp
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md
index f8b3bbe74a..bdb5336def 100644
--- a/windows/client-management/mdm/policy-csp-internetexplorer.md
+++ b/windows/client-management/mdm/policy-csp-internetexplorer.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -814,14 +815,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -893,14 +886,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -972,14 +957,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1057,14 +1034,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1137,14 +1106,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1216,14 +1177,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1299,14 +1252,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1380,14 +1325,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1472,14 +1409,6 @@ Supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1551,14 +1480,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1630,14 +1551,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1710,14 +1623,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1789,14 +1694,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1870,14 +1767,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1955,14 +1844,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2040,14 +1921,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2125,14 +1998,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2210,14 +2075,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2295,14 +2152,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2380,14 +2229,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2465,14 +2306,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2544,14 +2377,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2659,14 +2484,6 @@ Value and index pairs in the SyncML example:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2740,14 +2557,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2821,14 +2630,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2906,14 +2707,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2991,14 +2784,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3076,14 +2861,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3157,14 +2934,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3238,14 +3007,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3321,14 +3082,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3411,14 +3164,6 @@ Supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3492,14 +3237,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3571,14 +3308,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3650,14 +3379,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3740,14 +3461,6 @@ Supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3819,14 +3532,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3898,14 +3603,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3979,14 +3676,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4062,14 +3751,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4141,14 +3822,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4222,14 +3895,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4312,14 +3977,6 @@ Supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4395,14 +4052,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4478,14 +4127,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4570,14 +4211,6 @@ Supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4648,14 +4281,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4727,14 +4352,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4810,14 +4427,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4893,14 +4502,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4972,14 +4573,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5051,14 +4644,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5132,14 +4717,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5211,14 +4788,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5291,14 +4860,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5383,14 +4944,6 @@ Supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5466,14 +5019,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5550,14 +5095,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5634,14 +5171,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5715,14 +5244,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5800,14 +5321,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5881,14 +5394,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5962,14 +5467,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -6043,14 +5540,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -6124,14 +5613,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -6203,14 +5684,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -6286,14 +5759,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -6367,14 +5832,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -6448,14 +5905,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -6529,14 +5978,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -6610,14 +6051,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -6691,14 +6124,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -6770,14 +6195,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -6849,14 +6266,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -6930,14 +6339,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -7011,14 +6412,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -7092,14 +6485,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -7175,14 +6560,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -7254,14 +6631,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -7335,14 +6704,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -7418,14 +6779,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -7499,14 +6852,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -7580,14 +6925,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -7661,14 +6998,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -7740,14 +7069,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -7823,14 +7144,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -7906,14 +7219,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -7987,14 +7292,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -8068,14 +7365,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -8149,14 +7438,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -8232,14 +7513,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -8281,14 +7554,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -8368,14 +7633,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -8449,14 +7706,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -8538,14 +7787,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -8619,14 +7860,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -8700,14 +7933,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -8781,14 +8006,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -8862,14 +8079,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -8943,14 +8152,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -9024,14 +8225,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -9103,14 +8296,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -9184,14 +8369,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -9265,14 +8442,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -9346,14 +8515,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -9427,14 +8588,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -9510,14 +8663,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -9591,14 +8736,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -9672,14 +8809,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -9755,14 +8884,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -9842,14 +8963,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -9923,14 +9036,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -10004,14 +9109,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -10085,14 +9182,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -10164,14 +9253,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -10245,14 +9326,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -10326,14 +9399,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -10407,14 +9472,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -10488,14 +9545,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -10571,14 +9620,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -10652,14 +9693,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -10733,14 +9766,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -10816,14 +9841,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -10903,14 +9920,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -10984,14 +9993,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -11065,14 +10066,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -11146,14 +10139,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -11225,14 +10210,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -11306,14 +10283,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -11387,14 +10356,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -11468,14 +10429,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -11549,14 +10502,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -11632,14 +10577,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -11713,14 +10650,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -11796,14 +10725,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -11883,14 +10804,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -11964,14 +10877,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -12051,14 +10956,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -12132,14 +11029,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -12213,14 +11102,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -12292,14 +11173,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -12373,14 +11246,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -12454,14 +11319,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -12535,14 +11392,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -12616,14 +11465,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -12699,14 +11540,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -12780,14 +11613,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -12863,14 +11688,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -12944,14 +11761,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -13025,14 +11834,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -13106,14 +11907,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -13185,14 +11978,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -13266,14 +12051,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -13347,14 +12124,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -13428,14 +12197,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -13509,14 +12270,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -13592,14 +12345,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -13673,14 +12418,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -13756,14 +12493,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -13843,14 +12572,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -13924,14 +12645,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -14005,14 +12718,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -14086,14 +12791,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -14165,14 +12862,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -14246,14 +12935,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -14327,14 +13008,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -14408,14 +13081,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -14489,14 +13154,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -14572,14 +13229,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -14653,14 +13302,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -14736,14 +13377,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -14823,14 +13456,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -14904,14 +13529,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -14985,14 +13602,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -15066,14 +13675,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -15145,14 +13746,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -15226,14 +13819,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -15307,14 +13892,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -15388,14 +13965,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -15469,14 +14038,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -15552,14 +14113,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -15633,14 +14186,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -15716,14 +14261,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -15803,14 +14340,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -15884,14 +14413,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -15965,14 +14486,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -16046,14 +14559,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -16139,14 +14644,6 @@ Supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -16220,14 +14717,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -16299,14 +14788,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -16378,14 +14859,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -16459,14 +14932,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -16540,14 +15005,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -16621,14 +15078,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -16702,14 +15151,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -16783,14 +15224,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -16864,14 +15297,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -16945,14 +15370,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -17024,14 +15441,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -17105,14 +15514,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -17188,14 +15589,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -17269,14 +15662,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -17350,14 +15735,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -17431,14 +15808,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -17512,14 +15881,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -17593,14 +15954,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -17674,14 +16027,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -17755,14 +16100,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -17834,14 +16171,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -17913,14 +16242,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -17994,14 +16315,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -18075,14 +16388,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -18156,14 +16461,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -18239,14 +16536,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -18318,14 +16607,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -18399,14 +16680,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -18482,14 +16755,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -18563,14 +16828,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -18644,14 +16901,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -18725,14 +16974,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -18804,14 +17045,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -18887,14 +17120,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -18970,14 +17195,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -19051,14 +17268,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -19132,14 +17341,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -19215,14 +17416,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -19302,14 +17495,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -19383,14 +17568,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -19472,14 +17649,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -19553,14 +17722,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -19636,14 +17797,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -19717,14 +17870,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -19800,14 +17945,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -19883,14 +18020,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -19964,14 +18093,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -20045,14 +18166,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -20126,14 +18239,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -20207,14 +18312,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -20286,14 +18383,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -20368,14 +18457,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -20447,14 +18528,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -20528,14 +18601,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -20609,14 +18674,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -20688,14 +18745,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -20769,14 +18818,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -20850,14 +18891,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -20931,14 +18964,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -21012,14 +19037,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -21095,14 +19112,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -21176,14 +19185,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -21257,14 +19258,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -21340,14 +19333,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -21427,14 +19412,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md
index e3e557427b..200fde9087 100644
--- a/windows/client-management/mdm/policy-csp-kerberos.md
+++ b/windows/client-management/mdm/policy-csp-kerberos.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -75,14 +76,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -153,14 +146,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -230,14 +215,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -312,14 +289,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -390,14 +359,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -472,14 +433,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md
index 3536f9af1f..83b8e5e9a2 100644
--- a/windows/client-management/mdm/policy-csp-kioskbrowser.md
+++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -79,14 +80,6 @@ These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Mic
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -141,14 +134,6 @@ Added in Windows 10, version 1803. List of exceptions to the blocked website URL
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -203,14 +188,6 @@ Added in Windows 10, version 1803. List of blocked website URLs (with wildcard s
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -265,14 +242,6 @@ Added in Windows 10, version 1803. Configures the default URL kiosk browsers to
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -324,14 +293,6 @@ Shows the Kiosk Browser's end session button. When the policy is enabled, the Ki
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -386,14 +347,6 @@ Added in Windows 10, version 1803. Enable/disable kiosk browser's home button.
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -448,14 +401,6 @@ Added in Windows 10, version 1803. Enable/disable kiosk browser's navigation but
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-lanmanworkstation.md
index c6e30c3741..86575f2093 100644
--- a/windows/client-management/mdm/policy-csp-lanmanworkstation.md
+++ b/windows/client-management/mdm/policy-csp-lanmanworkstation.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -58,14 +59,6 @@ manager: dansimp
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md
index 1fa6c62b22..e6cfff8888 100644
--- a/windows/client-management/mdm/policy-csp-licensing.md
+++ b/windows/client-management/mdm/policy-csp-licensing.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -61,14 +62,6 @@ manager: dansimp
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -135,14 +128,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
index c41fae0999..b99fa3f5fc 100644
--- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
+++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -201,14 +202,6 @@ manager: dansimp
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -281,14 +274,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -366,14 +351,6 @@ Valid values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -437,14 +414,6 @@ GP Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -508,14 +477,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -580,14 +541,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -652,14 +605,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -726,14 +671,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -797,14 +734,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -892,14 +821,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -984,14 +905,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1071,14 +984,6 @@ GP Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1146,14 +1051,6 @@ Valid values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1226,14 +1123,6 @@ Valid values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1307,14 +1196,6 @@ Valid values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1389,14 +1270,6 @@ Valid values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1466,14 +1339,6 @@ Valid values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1539,14 +1404,6 @@ GP Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1610,14 +1467,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1696,14 +1545,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1780,14 +1621,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1851,14 +1684,6 @@ GP Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1937,14 +1762,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2033,14 +1850,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2121,14 +1930,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2202,14 +2003,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2273,14 +2066,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2344,14 +2129,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2415,14 +2192,6 @@ GP Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2491,14 +2260,6 @@ Valid values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2567,14 +2328,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2658,14 +2411,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2734,14 +2479,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2816,14 +2553,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2902,14 +2631,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2988,14 +2709,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3074,14 +2787,6 @@ GP Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3136,14 +2841,6 @@ Valid values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3218,14 +2915,6 @@ Valid values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3291,14 +2980,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3356,14 +3037,6 @@ Default: Enabled.
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3437,14 +3110,6 @@ Valid values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3520,14 +3185,6 @@ GP Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3596,14 +3253,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3669,14 +3318,6 @@ GP Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3742,14 +3383,6 @@ GP Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3821,14 +3454,6 @@ GP Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3895,14 +3520,6 @@ GP Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3968,14 +3585,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4041,14 +3650,6 @@ GP Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md
index 09c431d7cb..18d00b257a 100644
--- a/windows/client-management/mdm/policy-csp-lockdown.md
+++ b/windows/client-management/mdm/policy-csp-lockdown.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -58,14 +59,6 @@ manager: dansimp
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-maps.md b/windows/client-management/mdm/policy-csp-maps.md
index 16c27d47df..8635166d18 100644
--- a/windows/client-management/mdm/policy-csp-maps.md
+++ b/windows/client-management/mdm/policy-csp-maps.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -61,14 +62,6 @@ manager: dansimp
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -130,14 +123,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md
index f10d8a8d53..aefb521407 100644
--- a/windows/client-management/mdm/policy-csp-messaging.md
+++ b/windows/client-management/mdm/policy-csp-messaging.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -21,87 +22,12 @@ manager: dansimp
## Messaging policies
-
- Messaging/AllowMMS
-
Messaging/AllowMessageSync
-
- Messaging/AllowRCS
-
-
-
-
- **Messaging/AllowMMS**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
-Added in Windows 10, version 1703. Enables or disables the MMS send/receive functionality on the device. For enterprises, this policy can be used to disable MMS on devices as part of the auditing or management requirement.
-
-
-
-The following list shows the supported values:
-
-- 0 - Disabled.
-- 1 (default) - Enabled.
-
-
-
-
@@ -133,14 +59,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -178,74 +96,6 @@ The following list shows the supported values:
-
- **Messaging/AllowRCS**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
-Added in Windows 10, version 1703. Enables or disables the RCS send/receive functionality on the device. For enterprises, this policy can be used to disable RCS on devices as part of the auditing or management requirement.
-
-
-
-The following list shows the supported values:
-
-- 0 - Disabled.
-- 1 (default) - Enabled.
-
-
-
-
-
Footnotes:
- 1 - Added in Windows 10, version 1607.
diff --git a/windows/client-management/mdm/policy-csp-mssecurityguide.md b/windows/client-management/mdm/policy-csp-mssecurityguide.md
index 191d19d39c..598cad17d2 100644
--- a/windows/client-management/mdm/policy-csp-mssecurityguide.md
+++ b/windows/client-management/mdm/policy-csp-mssecurityguide.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -73,14 +74,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -144,14 +137,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -215,14 +200,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -286,14 +263,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -357,14 +326,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -428,14 +389,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md
index 1d3889bac0..80b3024ffa 100644
--- a/windows/client-management/mdm/policy-csp-msslegacy.md
+++ b/windows/client-management/mdm/policy-csp-msslegacy.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -67,14 +68,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -138,14 +131,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -209,14 +194,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -280,14 +257,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md
index e6e784b313..3d7afccb49 100644
--- a/windows/client-management/mdm/policy-csp-networkisolation.md
+++ b/windows/client-management/mdm/policy-csp-networkisolation.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -79,14 +80,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -147,14 +140,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -228,14 +213,6 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -295,14 +272,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -363,14 +332,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -432,14 +393,6 @@ Here are the steps to create canonical domain names:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -500,14 +453,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -567,14 +512,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md
index 00bea64a62..8433af94b3 100644
--- a/windows/client-management/mdm/policy-csp-notifications.md
+++ b/windows/client-management/mdm/policy-csp-notifications.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -64,14 +65,6 @@ manager: dansimp
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -153,14 +146,6 @@ Validation:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -231,14 +216,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md
index 795bba52f2..e5adaec521 100644
--- a/windows/client-management/mdm/policy-csp-power.md
+++ b/windows/client-management/mdm/policy-csp-power.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -121,14 +122,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -199,14 +192,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -277,14 +262,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -357,14 +334,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -437,14 +406,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -519,14 +480,6 @@ Supported values: 0-100. The default is 70.
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -600,14 +553,6 @@ Supported values: 0-100. The default is 70.
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -680,14 +625,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -760,14 +697,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -838,14 +767,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -916,14 +837,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1003,14 +916,6 @@ The following are the supported lid close switch actions (on battery):
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1090,14 +995,6 @@ The following are the supported lid close switch actions (plugged in):
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1177,14 +1074,6 @@ The following are the supported Power button actions (on battery):
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1264,14 +1153,6 @@ The following are the supported Power button actions (plugged in):
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1351,14 +1232,6 @@ The following are the supported Sleep button actions (on battery):
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1438,14 +1311,6 @@ The following are the supported Sleep button actions (plugged in):
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1518,14 +1383,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1598,14 +1455,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1682,14 +1531,6 @@ The following are the supported values for Hybrid sleep (on battery):
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1766,14 +1607,6 @@ The following are the supported values for Hybrid sleep (plugged in):
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1850,14 +1683,6 @@ Default value for unattended sleep timeout (on battery):
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md
index 59b5e7c09a..16ec44e238 100644
--- a/windows/client-management/mdm/policy-csp-printers.md
+++ b/windows/client-management/mdm/policy-csp-printers.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -64,14 +65,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -167,14 +160,6 @@ Data type: String Value:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -258,14 +243,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md
index 47ff4b48d0..0079133981 100644
--- a/windows/client-management/mdm/policy-csp-privacy.md
+++ b/windows/client-management/mdm/policy-csp-privacy.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -325,14 +326,6 @@ manager: dansimp
Education
3
-
- Mobile
- 3
-
-
- Mobile Enterprise
- 3
-
@@ -397,14 +390,6 @@ The following list shows the supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -473,14 +458,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -549,14 +526,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -626,14 +595,6 @@ The following list shows the supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -709,14 +670,6 @@ ADMX Info:
Education
3
-
- Mobile
- 3
-
-
- Mobile Enterprise
- 3
-
@@ -783,14 +736,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -862,14 +807,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -930,14 +867,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -998,14 +927,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -1066,14 +987,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1148,14 +1061,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1225,14 +1130,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1302,14 +1199,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1380,14 +1269,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -1459,14 +1340,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -1527,14 +1400,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -1595,14 +1460,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -1663,14 +1520,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -1742,14 +1591,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -1810,14 +1651,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -1878,14 +1711,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -1946,14 +1771,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -2025,14 +1842,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -2093,14 +1902,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -2161,14 +1962,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -2229,14 +2022,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -2308,14 +2093,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -2376,14 +2153,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -2444,14 +2213,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -2512,14 +2273,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -2591,14 +2344,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -2659,14 +2404,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -2727,14 +2464,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -2795,14 +2524,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2854,14 +2575,6 @@ This policy setting specifies whether Windows apps can access the eye tracker.
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2913,14 +2626,6 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. Listed
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2972,14 +2677,6 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. Listed
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3031,14 +2728,6 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. The use
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -3110,14 +2799,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -3178,14 +2859,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -3246,14 +2919,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -3314,14 +2979,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -3393,14 +3050,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -3461,14 +3110,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -3529,14 +3170,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -3597,14 +3230,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -3676,14 +3301,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -3744,14 +3361,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -3812,14 +3421,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -3880,14 +3481,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -3959,14 +3552,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -4027,14 +3612,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -4095,14 +3672,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -4163,14 +3732,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -4242,14 +3803,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -4310,14 +3863,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -4378,14 +3923,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -4446,14 +3983,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -4525,14 +4054,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -4593,14 +4114,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -4661,14 +4174,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -4729,14 +4234,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -4808,14 +4305,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -4876,14 +4365,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -4944,14 +4425,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -5012,14 +4485,6 @@ ADMX Info:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -5080,14 +4545,6 @@ ADMX Info:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -5148,14 +4605,6 @@ ADMX Info:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -5216,14 +4665,6 @@ ADMX Info:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -5284,14 +4725,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -5363,14 +4796,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -5431,14 +4856,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -5499,14 +4916,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -5567,14 +4976,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5643,14 +5044,6 @@ The following list shows the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -5719,14 +5112,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -5798,14 +5183,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -5866,14 +5243,6 @@ ADMX Info:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -5934,14 +5303,6 @@ ADMX Info:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -6002,14 +5363,6 @@ ADMX Info:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -6083,14 +5436,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -6151,14 +5496,6 @@ ADMX Info:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -6219,14 +5556,6 @@ ADMX Info:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -6287,14 +5616,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -6366,14 +5687,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -6434,14 +5747,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -6502,14 +5807,6 @@ ADMX Info:
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
@@ -6570,14 +5867,6 @@ ADMX Info:
Education
3
-
- Mobile
- 3
-
-
- Mobile Enterprise
- 3
-
@@ -6644,14 +5933,6 @@ The following list shows the supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md
index 899fe3e34f..599dc2d1f3 100644
--- a/windows/client-management/mdm/policy-csp-remoteassistance.md
+++ b/windows/client-management/mdm/policy-csp-remoteassistance.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -67,14 +68,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -151,14 +144,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -231,14 +216,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -319,14 +296,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md
index fb7061e182..e5588c0da4 100644
--- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md
+++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -73,14 +74,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -157,14 +150,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -245,14 +230,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -327,14 +304,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -405,14 +374,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -489,14 +450,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md
index da1fe45088..0eecb5bda9 100644
--- a/windows/client-management/mdm/policy-csp-remotemanagement.md
+++ b/windows/client-management/mdm/policy-csp-remotemanagement.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -100,14 +101,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -178,14 +171,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -256,14 +241,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -334,14 +311,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -412,14 +381,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -503,14 +464,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -581,14 +534,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -659,14 +604,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -737,14 +674,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -815,14 +744,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -893,14 +814,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -973,14 +886,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1057,14 +962,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1135,14 +1032,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1217,14 +1106,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md
index 8fb6a016bf..1870b26735 100644
--- a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md
+++ b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -61,14 +62,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -143,14 +136,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md
index 7884c583a1..8062074499 100644
--- a/windows/client-management/mdm/policy-csp-remoteshell.md
+++ b/windows/client-management/mdm/policy-csp-remoteshell.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -76,14 +77,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -154,14 +147,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -234,14 +219,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -314,14 +291,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -394,14 +363,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -472,14 +433,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -552,14 +505,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md
index 330b5e5bf5..adff5f8a8b 100644
--- a/windows/client-management/mdm/policy-csp-restrictedgroups.md
+++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -58,14 +59,6 @@ manager: dansimp
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md
index ed140ad774..273291c10b 100644
--- a/windows/client-management/mdm/policy-csp-search.md
+++ b/windows/client-management/mdm/policy-csp-search.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -63,9 +64,6 @@ manager: dansimp
Search/PreventRemoteQueries
-
- Search/SafeSearchPermissions
-
@@ -100,14 +98,6 @@ manager: dansimp
Education
3
-
- Mobile
- 3
-
-
- Mobile Enterprise
- 3
-
@@ -175,14 +165,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -249,14 +231,6 @@ The following list shows the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -329,14 +303,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -409,14 +375,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -496,14 +454,6 @@ This policy has been deprecated.
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -573,14 +523,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -632,14 +574,6 @@ Allow Windows indexer. Value type is integer.
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -709,14 +643,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -783,14 +709,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -861,14 +779,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -940,14 +850,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1018,14 +920,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1063,78 +957,6 @@ The following list shows the supported values:
-
- **Search/SafeSearchPermissions**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. Desktop users should use Search/DoNotUseWebResults.
-
-
-Specifies what level of safe search (filtering adult content) is required.
-
-
-Most restricted value is 0.
-
-
-
-The following list shows the supported values:
-
-- 0 – Strict, highest filtering against adult content.
-- 1 (default) – Moderate filtering against adult content (valid search results will not be filtered).
-
-
-
-
-
Footnotes:
- 1 - Added in Windows 10, version 1607.
diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md
index 2719df8815..0a4dcd146d 100644
--- a/windows/client-management/mdm/policy-csp-security.md
+++ b/windows/client-management/mdm/policy-csp-security.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -29,15 +30,9 @@ manager: dansimp
Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices
-
- Security/AllowManualRootCertificateInstallation
-
Security/AllowRemoveProvisioningPackage
-
- Security/AntiTheftMode
-
Security/ClearTPMIfNotReady
@@ -93,14 +88,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -159,14 +146,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -196,78 +175,6 @@ The following list shows the supported values:
-
- **Security/AllowManualRootCertificateInstallation**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
-
-Specifies whether the user is allowed to manually install root and intermediate CA certificates.
-
-Most restricted value is 0.
-
-
-
-The following list shows the supported values:
-
-- 0 – Not allowed.
-- 1 (default) – Allowed.
-
-
-
-
-
-
**Security/AllowRemoveProvisioningPackage**
@@ -297,14 +204,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -334,76 +233,6 @@ The following list shows the supported values:
-
- **Security/AntiTheftMode**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop.
-
-
-Allows or disallow Anti Theft Mode on the device.
-
-
-
-The following list shows the supported values:
-
-- 0 – Don't allow Anti Theft Mode.
-- 1 (default) – Anti Theft Mode will follow the default device configuration (region-dependent).
-
-
-
-
-
-
**Security/ClearTPMIfNotReady**
@@ -433,14 +262,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -510,14 +331,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -580,14 +393,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -652,14 +457,6 @@ The following list shows the supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -749,14 +546,6 @@ If the MDM policy is set to "NoRequireAuthentication" (2)
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -821,14 +610,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -887,14 +668,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md
index 649cdfc3d4..fff74ab134 100644
--- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md
+++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: Heidilohr
+ms.localizationpriority: medium
ms.date: 09/27/2019
---
@@ -56,14 +57,6 @@ ms.date: 09/27/2019
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md
index 726ca4ead7..5b737586b2 100644
--- a/windows/client-management/mdm/policy-csp-settings.md
+++ b/windows/client-management/mdm/policy-csp-settings.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -30,9 +31,6 @@ manager: dansimp
Settings/AllowDateTime
-
- Settings/AllowEditDeviceName
-
Settings/AllowLanguage
@@ -97,14 +95,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -170,14 +160,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -236,14 +218,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -273,72 +247,6 @@ The following list shows the supported values:
-
- **Settings/AllowEditDeviceName**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Allows editing of the device name.
-
-
-
-The following list shows the supported values:
-
-- 0 – Not allowed.
-- 1 (default) – Allowed.
-
-
-
-
-
-
**Settings/AllowLanguage**
@@ -368,14 +276,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -438,14 +338,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -508,14 +400,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -578,14 +462,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -648,14 +524,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -718,14 +586,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -784,14 +644,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -854,14 +706,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -920,14 +764,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -996,14 +832,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md
index edaeed0de9..205d51bff6 100644
--- a/windows/client-management/mdm/policy-csp-smartscreen.md
+++ b/windows/client-management/mdm/policy-csp-smartscreen.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -64,14 +65,6 @@ manager: dansimp
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -141,14 +134,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -215,14 +200,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md
index d1ee46dc3c..8ecc09d034 100644
--- a/windows/client-management/mdm/policy-csp-speech.md
+++ b/windows/client-management/mdm/policy-csp-speech.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -58,14 +59,6 @@ manager: dansimp
Education
1
-
- Mobile
- 1
-
-
- Mobile Enterprise
- 1
-
diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md
index 29f7f51a2c..a55e6716ff 100644
--- a/windows/client-management/mdm/policy-csp-start.md
+++ b/windows/client-management/mdm/policy-csp-start.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -147,14 +148,6 @@ manager: dansimp
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -214,14 +207,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -281,14 +266,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -348,14 +325,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -415,14 +384,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -482,14 +443,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -549,14 +502,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -616,14 +561,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -683,14 +620,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -750,14 +679,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -817,14 +738,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -898,14 +811,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -972,14 +877,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1054,14 +951,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1127,14 +1016,6 @@ To validate on Desktop, do the following:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1207,14 +1088,6 @@ To validate on Desktop, do the following:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1284,14 +1157,6 @@ To validate on Laptop, do the following:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1357,14 +1222,6 @@ To validate on Desktop, do the following:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1433,14 +1290,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1509,14 +1358,6 @@ To validate on Desktop, do the following:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1592,14 +1433,6 @@ To validate on Desktop, do the following:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1680,14 +1513,6 @@ To validate on Desktop, do the following:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1753,14 +1578,6 @@ To validate on Desktop, do the following:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1826,14 +1643,6 @@ To validate on Desktop, do the following:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1899,14 +1708,6 @@ To validate on Desktop, do the following:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1972,14 +1773,6 @@ To validate on Desktop, do the following:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2045,14 +1838,6 @@ To validate on Desktop, do the following:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2122,14 +1907,6 @@ To validate on Desktop, do the following:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2206,14 +1983,6 @@ To validate on Desktop, do the following:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2282,14 +2051,6 @@ To validate on Desktop, do the following:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md
index 142595b6bd..bc6f3d7253 100644
--- a/windows/client-management/mdm/policy-csp-storage.md
+++ b/windows/client-management/mdm/policy-csp-storage.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -82,14 +83,6 @@ manager: dansimp
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -158,14 +151,6 @@ The following list shows the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -239,14 +224,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -323,14 +300,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -407,14 +376,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -491,14 +452,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -581,14 +534,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -665,14 +610,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -743,14 +680,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md
index 4c10f0caf0..ff54e474bf 100644
--- a/windows/client-management/mdm/policy-csp-system.md
+++ b/windows/client-management/mdm/policy-csp-system.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -124,14 +125,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -204,14 +197,6 @@ The following list shows the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -294,14 +279,6 @@ The following list shows the supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -371,14 +348,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -439,14 +408,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -512,14 +473,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -599,14 +552,6 @@ To verify if System/AllowFontProviders is set to true:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -683,14 +628,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -751,14 +688,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -897,14 +826,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -965,14 +886,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1049,14 +962,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1131,14 +1036,6 @@ ADMX Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1201,14 +1098,6 @@ ADMX Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1276,14 +1165,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1355,14 +1236,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1434,14 +1307,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1502,14 +1367,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1592,14 +1449,6 @@ To validate on Desktop, do the following:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1676,14 +1525,6 @@ ADMX Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1742,14 +1583,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
- 3
-
-
- Mobile Enterprise
- 3
-
@@ -1823,14 +1656,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1893,14 +1718,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md
index 61992a11d2..85d08130a7 100644
--- a/windows/client-management/mdm/policy-csp-systemservices.md
+++ b/windows/client-management/mdm/policy-csp-systemservices.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -73,14 +74,6 @@ manager: dansimp
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -138,14 +131,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -203,14 +188,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -268,14 +245,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -333,14 +302,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -398,14 +359,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-taskmanager.md b/windows/client-management/mdm/policy-csp-taskmanager.md
index 7f50f472aa..8a69418c47 100644
--- a/windows/client-management/mdm/policy-csp-taskmanager.md
+++ b/windows/client-management/mdm/policy-csp-taskmanager.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -60,14 +61,6 @@ manager: dansimp
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md
index 8b9872caf9..4bc5ef3a22 100644
--- a/windows/client-management/mdm/policy-csp-taskscheduler.md
+++ b/windows/client-management/mdm/policy-csp-taskscheduler.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -58,14 +59,6 @@ manager: dansimp
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md
index e999e67da7..7786a5eb5c 100644
--- a/windows/client-management/mdm/policy-csp-textinput.md
+++ b/windows/client-management/mdm/policy-csp-textinput.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -162,14 +163,6 @@ Added in Windows 10, version 1803. Placeholder only. Do not use in production e
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -234,14 +227,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -304,14 +289,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -376,14 +353,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -449,14 +418,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -521,14 +482,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -593,14 +546,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -665,14 +610,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -757,14 +694,6 @@ This policy has been deprecated.
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -837,14 +766,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -908,14 +829,6 @@ This setting supports a range of values between 0 and 1.
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -979,14 +892,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1050,14 +955,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1121,14 +1018,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1193,14 +1082,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1263,14 +1144,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1333,14 +1206,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1403,14 +1268,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1470,14 +1327,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1537,14 +1386,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1604,14 +1445,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1671,14 +1504,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1738,14 +1563,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1805,14 +1622,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1872,14 +1681,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md
index 611cb5cf8e..2f1d95383c 100644
--- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md
+++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -21,81 +22,12 @@ manager: dansimp
## TimeLanguageSettings policies
-
- TimeLanguageSettings/AllowSet24HourClock
-
TimeLanguageSettings/ConfigureTimeZone
-
-
-
- **TimeLanguageSettings/AllowSet24HourClock**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
-
-
-
- Business
-
-
-
- Enterprise
-
-
-
- Education
-
-
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Allows for the configuration of the default clock setting to be the 24 hour format. If set to 0 (zero), the device uses the default clock as prescribed by the current locale setting.
-
-
-
-The following list shows the supported values:
-
-- 0 (default) – Current locale setting.
-- 1 – Set 24 hour clock.
-
-
-
-
@@ -127,14 +59,6 @@ The following list shows the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md
index e3d594d02e..191bcd30d7 100644
--- a/windows/client-management/mdm/policy-csp-troubleshooting.md
+++ b/windows/client-management/mdm/policy-csp-troubleshooting.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
+ms.localizationpriority: medium
ms.date: 09/27/2019
---
@@ -56,14 +57,6 @@ ms.date: 09/27/2019
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md
index 3eada3bc25..d096ead06d 100644
--- a/windows/client-management/mdm/policy-csp-update.md
+++ b/windows/client-management/mdm/policy-csp-update.md
@@ -14,9 +14,6 @@ manager: dansimp
# Policy CSP - Update
-> [!WARNING]
-> Some information relates to prereleased products, which may be substantially modified before they are commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
-
> [!NOTE]
> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are).
@@ -197,9 +194,6 @@ manager: dansimp
Update/SetEDURestart
-
- Update/TargetReleaseVersion
-
Update/UpdateNotificationLevel
@@ -243,14 +237,6 @@ manager: dansimp
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
- 1
-
@@ -318,14 +304,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -390,14 +368,6 @@ ADMX Info:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
- 1
-
@@ -465,14 +435,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -553,14 +515,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -631,14 +585,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -706,14 +652,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -776,14 +714,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -857,14 +787,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -941,14 +863,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1025,14 +939,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -1099,14 +1005,6 @@ Supported values are 15, 30, 60, 120, and 240 (minutes).
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -1174,14 +1072,6 @@ The following list shows the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1258,14 +1148,6 @@ Supported values:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
- 1
-
@@ -1336,14 +1218,6 @@ The following list shows the supported values:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1415,14 +1289,6 @@ Default value is 7.
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1493,14 +1359,6 @@ Default value is 7.
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1571,14 +1429,6 @@ Default value is 2.
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1651,14 +1501,6 @@ Supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1710,14 +1552,6 @@ Added in Windows 10, version 1803. Enable IT admin to configure feature update u
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1785,14 +1619,6 @@ ADMX Info:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
- 1
-
@@ -1855,14 +1681,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2014,14 +1832,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2092,14 +1902,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -2160,14 +1962,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2240,14 +2034,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -2326,14 +2112,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2407,14 +2185,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -2486,14 +2256,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2565,14 +2327,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -2644,14 +2398,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2723,14 +2469,6 @@ ADMX Info:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2800,14 +2538,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2878,14 +2608,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -2957,14 +2679,6 @@ To validate this policy:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -3036,14 +2750,6 @@ To validate this policy:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -3112,14 +2818,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3194,14 +2892,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3272,14 +2962,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -3342,14 +3024,6 @@ ADMX Info:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
- 1
-
@@ -3417,14 +3091,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -3498,14 +3164,6 @@ This policy is deprecated. Use [Update/RequireUpdateApproval](#update-requireupd
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3575,14 +3233,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3647,14 +3297,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -3721,14 +3363,6 @@ Supported values are 15, 30, or 60 (minutes).
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -3799,14 +3433,6 @@ Supported values are 2, 4, 8, 12, or 24 (hours).
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -3884,14 +3510,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
- 3
-
-
- Mobile Enterprise
-
-
@@ -3956,14 +3574,6 @@ ADMX Info:
Education
3
-
- Mobile
- 3
-
-
- Mobile Enterprise
-
-
@@ -4028,14 +3638,6 @@ ADMX Info:
Education
3
-
- Mobile
- 3
-
-
- Mobile Enterprise
-
-
@@ -4100,14 +3702,6 @@ ADMX Info:
Education
3
-
- Mobile
- 3
-
-
- Mobile Enterprise
-
-
@@ -4172,14 +3766,6 @@ ADMX Info:
Education
3
-
- Mobile
- 3
-
-
- Mobile Enterprise
-
-
@@ -4244,14 +3830,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4324,14 +3902,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -4399,14 +3969,6 @@ The following list shows the supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4466,14 +4028,6 @@ ADMX Info:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4533,14 +4087,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
- 2
-
@@ -4580,82 +4126,6 @@ The following list shows the supported values:
-
- **Update/TargetReleaseVersion**
-
-
-
-
- Windows Edition
- Supported?
-
-
- Home
-
-
-
- Pro
- 7
-
-
- Business
- 7
-
-
- Enterprise
- 7
-
-
- Education
- 7
-
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Enables IT administrators to specify which version they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy. For details about different Windows 10 versions, see [Windows 10 release information](https://docs.microsoft.com/windows/release-information/).
-
-
-ADMX Info:
-- GP English name: *Select the target Feature Update version*
-- GP name: *TargetReleaseVersion*
-- GP element: *TargetReleaseVersionId*
-- GP path: *Windows Components/Windows Update/Windows Update for Business*
-- GP ADMX file name: *WindowsUpdate.admx*
-
-
-
-Value type is a string containing Windows 10 version number. For example, 1809, 1903.
-
-
-
-
-
-
-
-
-
-
-
**Update/UpdateNotificationLevel**
@@ -4685,14 +4155,6 @@ Value type is a string containing Windows 10 version number. For example, 1809,
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4770,14 +4232,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4870,14 +4324,6 @@ Example
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -4927,6 +4373,5 @@ Footnotes:
- 4 - Added in Windows 10, version 1803.
- 5 - Added in Windows 10, version 1809.
- 6 - Added in Windows 10, version 1903.
-- 7 - Added in the next major release of Windows 10.
diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md
index ac7ded0237..c485382b9e 100644
--- a/windows/client-management/mdm/policy-csp-userrights.md
+++ b/windows/client-management/mdm/policy-csp-userrights.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -206,14 +207,6 @@ For example, the following syntax grants user rights to Authenticated Users and
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -271,14 +264,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -336,14 +321,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -401,14 +378,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -466,14 +435,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -531,14 +492,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -596,14 +549,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -661,14 +606,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -726,14 +663,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -791,14 +720,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -856,14 +777,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -921,14 +834,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -986,14 +891,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1051,14 +948,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1116,14 +1005,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1181,14 +1062,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1246,14 +1119,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1311,14 +1176,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1380,14 +1237,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1445,14 +1294,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1510,14 +1351,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1575,14 +1408,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1640,14 +1465,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1705,14 +1522,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1770,14 +1579,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1835,14 +1636,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1900,14 +1693,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1965,14 +1750,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -2030,14 +1807,6 @@ GP Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md
index cec40575e4..dbae4b5780 100644
--- a/windows/client-management/mdm/policy-csp-wifi.md
+++ b/windows/client-management/mdm/policy-csp-wifi.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -89,14 +90,6 @@ This policy has been deprecated.
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -165,14 +158,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -241,14 +226,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -312,14 +289,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -380,14 +349,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -446,14 +407,6 @@ The following list shows the supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md
index 76fd03726a..12c192e3e0 100644
--- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md
+++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -58,14 +59,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
index e1bd6aa6ae..4db39b31f2 100644
--- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
+++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -123,14 +124,6 @@ manager: dansimp
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -193,14 +186,6 @@ ADMX Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -267,14 +252,6 @@ Valid values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -343,14 +320,6 @@ The following list shows the supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -433,14 +402,6 @@ ADMX Info:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -507,14 +468,6 @@ Valid values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -586,14 +539,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -662,14 +607,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -738,14 +675,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -814,14 +743,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -890,14 +811,6 @@ The following list shows the supported values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -980,14 +893,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1056,14 +961,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1132,14 +1029,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1202,14 +1091,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1278,14 +1159,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1354,14 +1227,6 @@ The following list shows the supported values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1428,14 +1293,6 @@ Valid values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1502,14 +1359,6 @@ Valid values:
Education
4
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1576,14 +1425,6 @@ Valid values:
Education
5
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1668,14 +1509,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -1738,14 +1571,6 @@ ADMX Info:
Education
3
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md
index ea3dbe4db1..5b88961f3e 100644
--- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md
+++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -61,14 +62,6 @@ manager: dansimp
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -135,14 +128,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md
index 7e623ffee0..f5558370d6 100644
--- a/windows/client-management/mdm/policy-csp-windowslogon.md
+++ b/windows/client-management/mdm/policy-csp-windowslogon.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -76,14 +77,6 @@ manager: dansimp
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -169,14 +162,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -262,14 +247,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -340,14 +317,6 @@ ADMX Info:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -443,14 +412,6 @@ ADMX Info:
Education
6
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -530,14 +491,6 @@ Supported values:
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -608,14 +561,6 @@ ADMX Info:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md
index 5d1a4c94b1..6ea895cd9a 100644
--- a/windows/client-management/mdm/policy-csp-windowspowershell.md
+++ b/windows/client-management/mdm/policy-csp-windowspowershell.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -58,14 +59,6 @@ manager: dansimp
Education
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md
index ed48795fa1..056759ea10 100644
--- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md
+++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md
@@ -6,6 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
manager: dansimp
@@ -79,14 +80,6 @@ manager: dansimp
Education
3
-
- Mobile
- 3
-
-
- Mobile Enterprise
- 3
-
@@ -145,14 +138,6 @@ The following list shows the supported values:
Education
3
-
- Mobile
- 3
-
-
- Mobile Enterprise
- 3
-
@@ -211,14 +196,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -277,14 +254,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -343,14 +312,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -421,14 +382,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
- 2
-
-
- Mobile Enterprise
- 2
-
@@ -487,14 +440,6 @@ The following list shows the supported values:
Education
2
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
@@ -553,14 +498,6 @@ The following list shows the supported values:
Education
1
-
- Mobile
-
-
-
- Mobile Enterprise
-
-
diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md
index 86b57361ab..beb25c4bea 100644
--- a/windows/client-management/mdm/policy-ddf-file.md
+++ b/windows/client-management/mdm/policy-ddf-file.md
@@ -9,6 +9,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
+ms.localizationpriority: medium
ms.date: 05/21/2019
---
diff --git a/windows/client-management/troubleshoot-tcpip-connectivity.md b/windows/client-management/troubleshoot-tcpip-connectivity.md
index cff5317a5f..fe6e32ce59 100644
--- a/windows/client-management/troubleshoot-tcpip-connectivity.md
+++ b/windows/client-management/troubleshoot-tcpip-connectivity.md
@@ -89,7 +89,7 @@ The application which is causing the reset (identified by port numbers) should b
>The above information is about resets from a TCP standpoint and not UDP. UDP is a connectionless protocol and the packets are sent unreliably. You would not see retransmission or resets when using UDP as a transport protocol. However, UDP makes use of ICMP as a error reporting protocol. When you have the UDP packet sent out on a port and the destination does not have port listed, you will see the destination sending out **ICMP Destination host unreachable: Port unreachable** message immediately after the UDP packet
-```typescript
+```
10.10.10.1 10.10.10.2 UDP UDP:SrcPort=49875,DstPort=3343
10.10.10.2 10.10.10.1 ICMP ICMP:Destination Unreachable Message, Port Unreachable,10.10.10.2:3343
@@ -98,7 +98,7 @@ The application which is causing the reset (identified by port numbers) should b
During the course of troubleshooting connectivity issue, you might also see in the network trace that a machine receives packets but does not respond to. In such cases, there could be a drop at the server level. You should enable firewall auditing on the machine to understand if the local firewall is dropping the packet.
-```typescript
+```
auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:enable /failure:enable
```
diff --git a/windows/client-management/windows-10-support-solutions.md b/windows/client-management/windows-10-support-solutions.md
index 7d787f544d..c319034f39 100644
--- a/windows/client-management/windows-10-support-solutions.md
+++ b/windows/client-management/windows-10-support-solutions.md
@@ -1,99 +1,134 @@
---
-title: Top support solutions for Windows 10
-ms.reviewer:
+title: Troubleshooting Windows 10
+description: Get links to troubleshooting articles for Windows 10 issues
+ms.reviewer: kaushika
manager: dansimp
-description: Get links to solutions for Windows 10 issues
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
-ms.author: dansimp
-author: dansimp
+ms.author: kaushika
+author: kaushika-msft
ms.localizationpriority: medium
ms.topic: troubleshooting
---
-# Troubleshoot Windows 10 clients
+# Troubleshoot Windows 10 client
-This section contains advanced troubleshooting topics and links to help you resolve issues with Windows 10 clients. Additional topics will be added as they become available.
+Microsoft regularly releases both updates for Windows Server. To ensure your servers can receive future updates, including security updates, it's important to keep your servers updated. Check out - [Windows 10 and Windows Server 2016 update history](https://support.microsoft.com/en-us/help/4000825/windows-10-windows-server-2016-update-history) for a complete list of released updates.
-## Troubleshooting support topics
+This section contains advanced troubleshooting topics and links to help you resolve issues with Windows 10 in an enterprise or IT pro environment. Additional topics will be added as they become available.
-- [Advanced troubleshooting for Windows networking](troubleshoot-networking.md)
- - [Advanced troubleshooting wireless network connectivity](advanced-troubleshooting-wireless-network-connectivity.md)
- - [Advanced troubleshooting 802.1X authentication](advanced-troubleshooting-802-authentication.md)
- - [Data collection for troubleshooting 802.1X authentication](data-collection-for-802-authentication.md)
- - [Advanced troubleshooting for TCP/IP](troubleshoot-tcpip.md)
- - [Collect data using Network Monitor](troubleshoot-tcpip-netmon.md)
- - [Troubleshoot TCP/IP connectivity](troubleshoot-tcpip-connectivity.md)
- - [Troubleshoot port exhaustion](troubleshoot-tcpip-port-exhaust.md)
- - [Troubleshoot Remote Procedure Call (RPC) errors](troubleshoot-tcpip-rpc-errors.md)
-- [Advanced troubleshooting for Windows startup](troubleshoot-windows-startup.md)
- - [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md)
- - [Advanced troubleshooting for Windows-based computer issues](troubleshoot-windows-freeze.md)
- - [Advanced troubleshooting for stop errors or blue screen errors](troubleshoot-stop-errors.md)
- - [Advanced troubleshooting for stop error 7B or Inaccessible_Boot_Device](troubleshoot-inaccessible-boot-device.md)
+### Troubleshoot 802.1x Authentication
+- [Advanced Troubleshooting 802.1X Authentication](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-802-authentication)
+- [Data collection for troubleshooting 802.1X authentication](https://docs.microsoft.com/windows/client-management/data-collection-for-802-authentication)
-## Windows 10 update history
+### Troubleshoot BitLocker
+- [BitLocker overview and requirements FAQ (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq)
+- [BitLocker Upgrading FAQ (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq)
+- [BitLocker frequently asked questions (FAQ) (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq)
+- [BitLocker Key Management FAQ (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-key-management-faq)
+- [BitLocker To Go FAQ (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-to-go-faq)
+- [BitLocker and Active Directory Domain Services (AD DS) FAQ (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq)
+- [BitLocker Security FAQ (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-security-faq)
+- [BitLocker frequently asked questions (FAQ) (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq)
+- [Using BitLocker with other programs FAQ (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq)
+- [BitLocker recovery guide (Windows 10)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan)
-Microsoft regularly releases both updates and solutions for Windows 10. To ensure your computers can receive future updates, including security updates, it's important to keep them updated. Check out the following links for a complete list of released updates:
+### Troubleshoot Bugcheck and Stop errors
+- [Introduction to the page file](https://docs.microsoft.com/windows/client-management/introduction-page-file)
+- [How to determine the appropriate page file size for 64-bit versions of Windows](https://docs.microsoft.com/windows/client-management/determine-appropriate-page-file-size)
+- [Configure system failure and recovery options in Windows](https://docs.microsoft.com/windows/client-management/system-failure-recovery-options)
+- [Generate a kernel or complete crash dump](https://docs.microsoft.com/windows/client-management/generate-kernel-or-complete-crash-dump)
+- [Advanced troubleshooting for Stop error or blue screen error issue](https://docs.microsoft.com/windows/client-management/troubleshoot-stop-errors)
+- [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](https://docs.microsoft.com/windows/client-management/troubleshoot-inaccessible-boot-device)
+- [Blue Screen Data - Windows drivers](https://docs.microsoft.com/windows-hardware/drivers/debugger/blue-screen-data)
+- [Bug Check Code Reference - Windows drivers](https://docs.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2)
-- [Windows 10 version 1809 update history](https://support.microsoft.com/help/4464619)
-- [Windows 10 version 1803 update history](https://support.microsoft.com/help/4099479)
-- [Windows 10 version 1709 update history](https://support.microsoft.com/help/4043454)
-- [Windows 10 Version 1703 update history](https://support.microsoft.com/help/4018124)
-- [Windows 10 Version 1607 update history](https://support.microsoft.com/help/4000825)
-- [Windows 10 Version 1511 update history](https://support.microsoft.com/help/4000824)
+### Troubleshoot Credential Guard
+- [Windows Defender Credential Guard - Known issues (Windows 10)](https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-known-issues)
+
+### Troubleshoot Disks
+- [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt)
+- [Windows and GPT FAQ](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-and-gpt-faq)
+
+### Troubleshoot Kiosk mode
+- [Troubleshoot kiosk mode issues](https://docs.microsoft.com/windows/configuration/kiosk-troubleshoot)
+
+### Troubleshoot No Boot
+- [Advanced troubleshooting for Windows boot problems](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-boot-problems)
+
+### Troubleshoot Push Button Reset
+- [Push-button reset frequently-asked questions (FAQ)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/pbr-faq)
+- [Push-button reset frequently-asked questions (FAQ)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/pbr-validation)
+- [Recovery components](https://docs.microsoft.com/windows-hardware/manufacture/desktop/recovery-strategy-for-common-customizations)
+
+### Troubleshoot Power Management
+- [Modern Standby FAQs](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby-faqs)
-These are the top Microsoft Support solutions for the most common issues experienced when using Windows 10 in an enterprise or IT pro environment. The links below include links to KB articles, updates, and library articles.
+### Troubleshoot Secure Boot
+- [Secure Boot isn't configured correctly: troubleshooting](https://docs.microsoft.com/windows-hardware/manufacture/desktop/secure-boot-isnt-configured-correctly-troubleshooting)
-## Solutions related to installing Windows Updates
-- [How does Windows Update work](https://docs.microsoft.com/windows/deployment/update/how-windows-update-works)
+### Troubleshoot Setup and Install
+- [Deployment Troubleshooting and Log Files](https://docs.microsoft.com/windows-hardware/manufacture/desktop/deployment-troubleshooting-and-log-files)
+
+
+### Troubleshoot Start Menu
+- [Troubleshoot Start menu errors](https://docs.microsoft.com/windows/configuration/start-layout-troubleshoot)
+
+
+### Troubleshoot Subscription Activation
+- [Deploy Windows 10 Enterprise licenses](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses)
+
+### Troubleshoot System Hang
+- [Advanced troubleshooting for Windows-based computer freeze issues](https://docs.microsoft.com/windows/client-management/troubleshoot-windows-freeze)
+
+### Troubleshoot TCP/IP Communication
+- [Collect data using Network Monitor](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-netmon)
+- [Troubleshoot TCP/IP connectivity](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-connectivity)
+- [Troubleshoot port exhaustion issues](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-port-exhaust)
+- [Troubleshoot Remote Procedure Call (RPC) errors](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-rpc-errors)
+
+### Troubleshoot User State Migration Toolkit (USMT)
+- [Common Issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues)
+- [Frequently Asked Questions](https://docs.microsoft.com/windows/deployment/usmt/usmt-faq)
+- [Log Files](https://docs.microsoft.com/windows/deployment/usmt/usmt-log-files)
+- [Return Codes](https://docs.microsoft.com/windows/deployment/usmt/usmt-return-codes)
+
+### Troubleshoot Windows Hello for Business (WHFB)
+- [Windows Hello for Business Frequently Asked Questions](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-faq)
+- [Windows Hello errors during PIN creation (Windows 10)](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation)
+- [Event ID 300 - Windows Hello successfully created (Windows 10)](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-event-300)
+
+
+### Troubleshoot Windows Analytics
+- [Frequently asked questions and troubleshooting Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-faq-troubleshooting)
+
+### Troubleshoot Windows Update
+- [How Windows Update works](https://docs.microsoft.com/windows/deployment/update/how-windows-update-works)
- [Windows Update log files](https://docs.microsoft.com/windows/deployment/update/windows-update-logs)
- [Windows Update troubleshooting](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting)
- [Windows Update common errors and mitigation](https://docs.microsoft.com/windows/deployment/update/windows-update-errors)
-- [Windows Update - additional resources](https://docs.microsoft.com/windows/deployment/update/windows-update-resources)
+- [Windows Update - Additional resources](https://docs.microsoft.com/windows/deployment/update/windows-update-resources)
+- [Get started with Windows Update](https://docs.microsoft.com/windows/deployment/update/windows-update-overview)
+- [Servicing stack updates](https://docs.microsoft.com/windows/deployment/update/servicing-stack-updates)
-## Solutions related to installing or upgrading Windows
+### Troubleshoot Windows Upgrade
+- [Quick fixes - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/quick-fixes)
+- [SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag)
+- [Troubleshoot Windows 10 upgrade errors - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/troubleshoot-upgrade-errors)
+- [Windows error reporting - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/windows-error-reporting)
+- [Upgrade error codes - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/upgrade-error-codes)
+- [Log files - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/log-files)
+- [Resolution procedures - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/resolution-procedures)
-- [Quick Fixes](https://docs.microsoft.com/windows/deployment/upgrade/quick-fixes)
-- [Troubleshooting upgrade errors](https://docs.microsoft.com/windows/deployment/upgrade/troubleshoot-upgrade-errors)
-- [Resolution procedures](https://docs.microsoft.com/windows/deployment/upgrade/resolution-procedures)
-- [0xc1800118 error when you push Windows 10 Version 1607 by using WSUS](https://support.microsoft.com/en-in/help/3194588/0xc1800118-error-when-you-push-windows-10-version-1607-by-using-wsus)
-- [0xC1900101 error when Windows 10 upgrade fails after the second system restart](https://support.microsoft.com/en-in/help/3208485/0xc1900101-error-when-windows-10-upgrade-fails-after-the-second-system)
+### Troubleshoot Windows Recovery (WinRE)
+- [Windows RE troubleshooting features](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-re-troubleshooting-features)
-## Solutions related to BitLocker
+### Troubleshoot Wireless Connection
+- [Advanced Troubleshooting Wireless Network Connectivity](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-wireless-network-connectivity)
-- [BitLocker recovery guide](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan)
-- [BitLocker: How to enable Network Unlock](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock)
-- [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker)
-- [BitLocker Group Policy settings](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings)
+## Other Resources
-## Solutions related to Bugchecks or Stop Errors
-- [Troubleshooting Stop error problems for IT Pros](https://support.microsoft.com/help/3106831/troubleshooting-stop-error-problems-for-it-pros)
-- [How to use Windows Recovery Environment (WinRE) to troubleshoot common startup issues](https://support.microsoft.com/help/4026030/how-to-use-windows-recovery-environment-winre-to-troubleshoot-common-s)
-- [How to troubleshoot Windows-based computer freeze issues](https://support.microsoft.com/help/3118553/how-to-troubleshoot-windows-based-computer-freeze-issues)
-- [Introduction of page file in Long-Term Servicing Channel and Semi-Annual Channel of Windows](https://support.microsoft.com/help/4133658)
-
-
-## Solutions related to Windows Boot issues
-- [Troubleshooting Windows boot problems for IT Pros](https://support.microsoft.com/help/4343769)
-- [How to use Windows Recovery Environment (WinRE) to troubleshoot common startup issues](https://support.microsoft.com/help/4026030/how-to-use-windows-recovery-environment-winre-to-troubleshoot-common-s)
-
-
-## Solutions related to configuring or managing the Start menu
-- [Manage Windows 10 Start and taskbar layout](/windows/configuration/windows-10-start-layout-options-and-policies)
-- [Customize and export Start layout](/windows/configuration/customize-and-export-start-layout)
-- [Changes to Group Policy settings for Windows 10 Start](/windows/configuration/changes-to-start-policies-in-windows-10)
-- [Preinstalled system applications and Start menu may not work when you upgrade to Windows 10, Version 1511](https://support.microsoft.com/help/3152599)
-- [Start menu shortcuts aren't immediately accessible in Windows Server 2016](https://support.microsoft.com/help/3198613)
-- [Troubleshoot problems opening the Start menu or Cortana](https://support.microsoft.com/help/12385/windows-10-troubleshoot-problems-opening-start-menu-cortana)
-- [Modern apps are blocked by security software when you start the applications on Windows 10 Version 1607](https://support.microsoft.com/help/4016973/modern-apps-are-blocked-by-security-software-when-you-start-the-applic)
-
-## Solutions related to wireless networking and 802.1X authentication
-- [Advanced Troubleshooting Wireless Network](Connectivity]https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-wireless-network-connectivity)
-- [Advanced Troubleshooting 802.1x Authentication](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-802-authentication)
-- [Troubleshooting Windows 802.11 Wireless Connections](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-vista/cc766215(v=ws.10))
-- [Troubleshooting Windows Secure 802.3 Wired Connections](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-vista/cc749352(v%3dws.10))
-- [Windows 10 devices can't connect to an 802.1X environment](https://support.microsoft.com/kb/3121002)
+### [Troubleshooting Windows Server components](https://docs.microsoft.com/windows-server/troubleshoot/windows-server-support-solutions)
diff --git a/windows/configuration/customize-and-export-start-layout.md b/windows/configuration/customize-and-export-start-layout.md
index 7ac4b1ff90..f13d6f81c8 100644
--- a/windows/configuration/customize-and-export-start-layout.md
+++ b/windows/configuration/customize-and-export-start-layout.md
@@ -93,7 +93,7 @@ When you have the Start layout that you want your users to see, use the [Export-
`Export-StartLayout –path .xml`
- On a device running Windows 10, version 1809, run the **Export-StartLayout** with the switch **-UseDesktopApplicationID**. For example:
+ On a device running Windows 10, version 1809 or higher, run the **Export-StartLayout** with the switch **-UseDesktopApplicationID**. For example:
```PowerShell
Export-StartLayout -UseDesktopApplicationID -Path layout.xml
@@ -191,7 +191,7 @@ If the Start layout is applied by Group Policy or MDM, and the policy is removed
- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md)
- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md)
- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md)
-- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
+- [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)
diff --git a/windows/configuration/kiosk-xml.md b/windows/configuration/kiosk-xml.md
index cf28c53e4a..c9d6d3b2c0 100644
--- a/windows/configuration/kiosk-xml.md
+++ b/windows/configuration/kiosk-xml.md
@@ -255,7 +255,7 @@ This sample demonstrates that both UWP and Win32 apps can be configured to autom
```
## [Preview] Global Profile Sample XML
-Global Profile is currently supported in Windows 10 Insider Preview (19H2, 20H1 builds). Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lock down mode, or used as mitigation when a profile cannot be determined for an user.
+Global Profile is currently supported in Windows 10 Insider Preview (20H1 builds). Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lock down mode, or used as mitigation when a profile cannot be determined for an user.
This sample demonstrates that only a global profile is used, no active user configured. Global profile will be applied when every non-admin account logs in
```xml
diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md
index f42631e973..57629adbe8 100644
--- a/windows/configuration/lock-down-windows-10-to-specific-apps.md
+++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md
@@ -29,7 +29,7 @@ The following table lists changes to multi-app kiosk in recent updates.
| New features and improvements | In update |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| - Configure [a single-app kiosk profile](#profile) in your XML file - Assign [group accounts to a config profile](#config-for-group-accounts) - Configure [an account to sign in automatically](#config-for-autologon-account) | Windows 10, version 1803 |
-| - Explicitly allow [some known folders when user opens file dialog box](#fileexplorernamespacerestrictions) - [Automatically launch an app](#allowedapps) when the user signs in - Configure a [display name for the autologon account](#config-for-autologon-account) | Windows 10, version 1809 **Important:** To use features released in Windows 10, version 1809, make sure that [your XML file](#create-xml-file) references `http://schemas.microsoft.com/AssignedAccess/201810/config`. |
+| - Explicitly allow [some known folders when user opens file dialog box](#fileexplorernamespacerestrictions) - [Automatically launch an app](#allowedapps) when the user signs in - Configure a [display name for the autologon account](#config-for-autologon-account) | Windows 10, version 1809 **Important:** To use features released in Windows 10, version 1809, make sure that [your XML file](#create-xml-file) references `https://schemas.microsoft.com/AssignedAccess/201810/config`. |
>[!WARNING]
>The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, [certain policies](kiosk-policies.md) are enforced system-wide, and will impact other users on the device. Deleting the kiosk configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access.
@@ -88,8 +88,8 @@ You can start your file by pasting the following XML (or any other examples in t
```xml
@@ -199,8 +199,8 @@ The following example shows how to allow user access to the Downloads folder in
```xml
@@ -219,7 +219,7 @@ The following example shows how to allow user access to the Downloads folder in
```
-FileExplorerNamespaceRestriction has been extended in current Windows 10 Prerelease for finer granularity and easier use, see in the [Assigned access XML reference.](kiosk-xml.md) for full samples. The changes will allow IT Admin to configure if user can access Downloads folder, Removable drives, or no restriction at all by using certain new elements. Note that FileExplorerNamesapceRestrictions and AllowedNamespace:Downloads are available in namespace http://schemas.microsoft.com/AssignedAccess/201810/config, AllowRemovableDrives and NoRestriction are defined in a new namespace http://schemas.microsoft.com/AssignedAccess/2020/config.
+FileExplorerNamespaceRestriction has been extended in current Windows 10 Prerelease for finer granularity and easier use, see in the [Assigned access XML reference.](kiosk-xml.md) for full samples. The changes will allow IT Admin to configure if user can access Downloads folder, Removable drives, or no restriction at all by using certain new elements. Note that FileExplorerNamesapceRestrictions and AllowedNamespace:Downloads are available in namespace https://schemas.microsoft.com/AssignedAccess/201810/config, AllowRemovableDrives and NoRestriction are defined in a new namespace https://schemas.microsoft.com/AssignedAccess/2020/config.
* When FileExplorerNamespaceRestrictions node is not used, or used but left empty, user will not be able to access any folder in common dialog (e.g. Save As in Microsoft Edge browser).
* When Downloads is mentioned in allowed namespace, user will be able to access Downloads folder.
@@ -244,7 +244,7 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint,
```xml
-
+
@@ -423,9 +423,9 @@ Note:
```xml
@@ -438,7 +438,7 @@ Note:
-
+
@@ -466,9 +466,7 @@ Note:
-
-
-
+
```
diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md
index 2ac2f8253f..2e88d65395 100644
--- a/windows/deployment/TOC.md
+++ b/windows/deployment/TOC.md
@@ -1,4 +1,5 @@
# [Deploy and update Windows 10](https://docs.microsoft.com/windows/deployment)
+## [Deployment process posters](windows-10-deployment-posters.md)
## [Deploy Windows 10 with Microsoft 365](deploy-m365.md)
## [What's new in Windows 10 deployment](deploy-whats-new.md)
## [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md)
@@ -240,6 +241,16 @@
#### [Delivery Optimization reference](update/waas-delivery-optimization-reference.md)
#### [Configure BranchCache for Windows 10 updates](update/waas-branchcache.md)
#### [Whitepaper: Windows Updates using forward and reverse differentials](update/PSFxWhitepaper.md)
+### Monitor Windows Updates
+#### [Monitor Windows Updates with Update Compliance](update/update-compliance-monitor.md)
+#### [Get started with Update Compliance](update/update-compliance-get-started.md)
+#### [Use Update Compliance](update/update-compliance-using.md)
+##### [Need Attention! report](update/update-compliance-need-attention.md)
+##### [Security Update Status report](update/update-compliance-security-update-status.md)
+##### [Feature Update Status report](update/update-compliance-feature-update-status.md)
+##### [Windows Defender AV Status report](update/update-compliance-wd-av-status.md)
+##### [Delivery Optimization in Update Compliance](update/update-compliance-delivery-optimization.md)
+##### [Update Compliance Perspectives](update/update-compliance-perspectives.md)
### Best practices
#### [Best practices for feature updates on mission-critical devices](update/feature-update-mission-critical.md)
#### [Deploy feature updates during maintenance windows](update/feature-update-maintenance-window.md)
@@ -260,7 +271,6 @@
### [Manage device restarts after updates](update/waas-restart.md)
### [Manage additional Windows Update settings](update/waas-wu-settings.md)
### [Determine the source of Windows updates](update/windows-update-sources.md)
-
## Windows Analytics
### [Windows Analytics overview](update/windows-analytics-overview.md)
### [Windows Analytics in the Azure Portal](update/windows-analytics-azure-portal.md)
@@ -281,16 +291,6 @@
##### [Step 4: Monitor deployment](upgrade/upgrade-readiness-monitor-deployment.md)
##### [Additional insights](upgrade/upgrade-readiness-additional-insights.md)
##### [Targeting a new operating system version](upgrade/upgrade-readiness-target-new-OS.md)
-### Monitor Windows Updates
-#### [Monitor Windows Updates with Update Compliance](update/update-compliance-monitor.md)
-#### [Get started with Update Compliance](update/update-compliance-get-started.md)
-#### [Use Update Compliance](update/update-compliance-using.md)
-##### [Need Attention! report](update/update-compliance-need-attention.md)
-##### [Security Update Status report](update/update-compliance-security-update-status.md)
-##### [Feature Update Status report](update/update-compliance-feature-update-status.md)
-##### [Windows Defender AV Status report](update/update-compliance-wd-av-status.md)
-##### [Delivery Optimization in Update Compliance](update/update-compliance-delivery-optimization.md)
-##### [Update Compliance Perspectives](update/update-compliance-perspectives.md)
### Device Health
#### [Device Health overview](update/device-health-monitor.md)
#### [Get started with Device Health](update/device-health-get-started.md)
diff --git a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md
index 784c5a13fd..f9405d730e 100644
--- a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md
+++ b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md
@@ -7,10 +7,12 @@ ms.mktglfcycl: deploy
ms.localizationpriority: medium
ms.sitesec: library
ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
+audience: itpro
+author: greg-lindsay
ms.reviewer:
manager: laurawi
-audience: itpro
author: greg-lindsay
+audience: itpro
+author: greg-lindsay
ms.author: greglin
ms.topic: article
---
@@ -72,27 +74,27 @@ All four of the roles specified above can be hosted on the same computer or each
```
net use y: \\PXE-1\TFTPRoot
y:
- md boot
+ md Boot
```
6. Copy the PXE boot files from the mounted directory to the \boot folder. For example:
```
- copy c:\winpe_amd64\mount\windows\boot\pxe\*.* y:\boot
+ copy c:\winpe_amd64\mount\windows\boot\pxe\*.* y:\Boot
```
7. Copy the boot.sdi file to the PXE/TFTP server.
```
- copy C:\winpe_amd64\media\boot\boot.sdi y:\boot
+ copy C:\winpe_amd64\media\boot\boot.sdi y:\Boot
```
8. Copy the bootable Windows PE image (boot.wim) to the \boot folder.
```
- copy C:\winpe_amd64\media\sources\boot.wim y:\boot
+ copy C:\winpe_amd64\media\sources\boot.wim y:\Boot
```
9. (Optional) Copy true type fonts to the \boot folder
```
- copy C:\winpe_amd64\media\Boot\Fonts y:\boot\Fonts
+ copy C:\winpe_amd64\media\Boot\Fonts y:\Boot\Fonts
```
## Step 2: Configure boot settings and copy the BCD file
@@ -107,7 +109,7 @@ All four of the roles specified above can be hosted on the same computer or each
```
bcdedit /store c:\BCD /create {ramdiskoptions} /d "Ramdisk options"
bcdedit /store c:\BCD /set {ramdiskoptions} ramdisksdidevice boot
- bcdedit /store c:\BCD /set {ramdiskoptions} ramdisksdipath \boot\boot.sdi
+ bcdedit /store c:\BCD /set {ramdiskoptions} ramdisksdipath \Boot\boot.sdi
bcdedit /store c:\BCD /create /d "winpe boot image" /application osloader
```
The last command will return a GUID, for example:
@@ -119,9 +121,9 @@ All four of the roles specified above can be hosted on the same computer or each
3. Create a new boot application entry for the Windows PE image:
```
- bcdedit /store c:\BCD /set {GUID1} device ramdisk=[boot]\boot\boot.wim,{ramdiskoptions}
+ bcdedit /store c:\BCD /set {GUID1} device ramdisk=[boot]\Boot\boot.wim,{ramdiskoptions}
bcdedit /store c:\BCD /set {GUID1} path \windows\system32\winload.exe
- bcdedit /store c:\BCD /set {GUID1} osdevice ramdisk=[boot]\boot\boot.wim,{ramdiskoptions}
+ bcdedit /store c:\BCD /set {GUID1} osdevice ramdisk=[boot]\Boot\boot.wim,{ramdiskoptions}
bcdedit /store c:\BCD /set {GUID1} systemroot \windows
bcdedit /store c:\BCD /set {GUID1} detecthal Yes
bcdedit /store c:\BCD /set {GUID1} winpe Yes
@@ -136,7 +138,7 @@ All four of the roles specified above can be hosted on the same computer or each
5. Copy the BCD file to your TFTP server:
```
- copy c:\BCD \\PXE-1\TFTPRoot\boot\BCD
+ copy c:\BCD \\PXE-1\TFTPRoot\Boot\BCD
```
Your PXE/TFTP server is now configured. You can view the BCD settings that have been configured using the command bcdedit /store <BCD file location> /enum all. See the following example. Note: Your GUID will be different than the one shown below.
@@ -153,9 +155,9 @@ timeout 30
Windows Boot Loader
-------------------
identifier {a4f89c62-2142-11e6-80b6-00155da04110}
-device ramdisk=[boot]\boot\boot.wim,{ramdiskoptions}
+device ramdisk=[boot]\Boot\boot.wim,{ramdiskoptions}
description winpe boot image
-osdevice ramdisk=[boot]\boot\boot.wim,{ramdiskoptions}
+osdevice ramdisk=[boot]\Boot\boot.wim,{ramdiskoptions}
systemroot \Windows
detecthal Yes
winpe Yes
@@ -165,7 +167,7 @@ Setup Ramdisk Options
identifier {ramdiskoptions}
description ramdisk options
ramdisksdidevice boot
-ramdisksdipath \boot\boot.sdi
+ramdisksdipath \Boot\boot.sdi
```
>[!TIP]
diff --git a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md
index 70a3a46434..b1a4515898 100644
--- a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md
+++ b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md
@@ -19,29 +19,34 @@ ms.topic: article
# Set up MDT for BitLocker
This topic will show you how to configure your environment for BitLocker, the disk volume encryption built into Windows 10 Enterprise and Windows 10 Pro, using MDT. BitLocker in Windows 10 has two requirements in regard to an operating system deployment:
-- A protector, which can either be stored in the Trusted Platform Module (TPM) chip, or stored as a password. Technically, you also can use a USB stick to store the protector, but it's not a practical approach as the USB stick can be lost or stolen. We, therefore, recommend that you instead use a TPM chip and/or a password.
-- Multiple partitions on the hard drive.
+
+- A protector, which can either be stored in the Trusted Platform Module (TPM) chip, or stored as a password. Technically, you can also use a USB stick to store the protector, but it's not a practical approach as the USB stick can be lost or stolen. We, therefore, recommend that you instead use a TPM chip and/or a password.
+- Multiple partitions on the hard drive.
To configure your environment for BitLocker, you will need to do the following:
-1. Configure Active Directory for BitLocker.
-2. Download the various BitLocker scripts and tools.
-3. Configure the operating system deployment task sequence for BitLocker.
-4. Configure the rules (CustomSettings.ini) for BitLocker.
+1. Configure Active Directory for BitLocker.
+2. Download the various BitLocker scripts and tools.
+3. Configure the operating system deployment task sequence for BitLocker.
+4. Configure the rules (CustomSettings.ini) for BitLocker.
+
+> [!NOTE]
+> Even though it is not a BitLocker requirement, we recommend configuring BitLocker to store the recovery password in Active Directory. For additional information about this feature, see [Backing Up BitLocker and TPM Recovery Information to AD DS](https://docs.microsoft.com/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds).
+If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), which is part of Microsoft Desktop Optimization Pack (MDOP), you have additional management features for BitLocker.
+
+> [!NOTE]
+> Backing up TMP to Active Directory was supported only on Windows 10 version 1507 and 1511.
->[!NOTE]
->Even though it is not a BitLocker requirement, we recommend configuring BitLocker to store the recovery key and TPM owner information in Active Directory. For additional information about these features, see [Backing Up BitLocker and TPM Recovery Information to AD DS](https://go.microsoft.com/fwlink/p/?LinkId=619548). If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), which is part of Microsoft Desktop Optimization Pack (MDOP), you have additional management features for BitLocker.
-
For the purposes of this topic, we will use DC01, a domain controller that is a member of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof).
-## Configure Active Directory for BitLocker
+## Configure Active Directory for BitLocker
To enable BitLocker to store the recovery key and TPM information in Active Directory, you need to create a Group Policy for it in Active Directory. For this section, we are running Windows Server 2012 R2, so you do not need to extend the Schema. You do, however, need to set the appropriate permissions in Active Directory.
->[!NOTE]
->Depending on the Active Directory Schema version, you might need to update the Schema before you can store BitLocker information in Active Directory.
-
-In Windows Server 2012 R2 (as well as in Windows Server 2008 R2 and Windows Server 2012), you have access to the BitLocker Drive Encryption Administration Utilities features, which will help you manage BitLocker. When you install the features, the BitLocker Active Directory Recovery Password Viewer is included, and it extends Active Directory Users and Computers with BitLocker Recovery information.
+> [!NOTE]
+> Depending on the Active Directory Schema version, you might need to update the Schema before you can store BitLocker information in Active Directory.
+
+In Windows Server version from 2008 R2 and later, you have access to the BitLocker Drive Encryption Administration Utilities features, which will help you manage BitLocker. When you install the features, the BitLocker Active Directory Recovery Password Viewer is included, and it extends Active Directory Users and Computers with BitLocker Recovery information.

@@ -51,16 +56,16 @@ Figure 2. The BitLocker Recovery information on a computer object in the contoso
The BitLocker Drive Encryption Administration Utilities are added as features via Server Manager (or Windows PowerShell):
-1. On DC01, log on as **CONTOSO\\Administrator**, and, using Server Manager, click **Add roles and features**.
-2. On the **Before you begin** page, click **Next**.
-3. On the **Select installation type** page, select **Role-based or feature-based installation**, and click **Next**.
-4. On the **Select destination server** page, select **DC01.contoso.com** and click **Next**.
-5. On the **Select server roles** page, click **Next**.
-6. On the **Select features** page, expand **Remote Server Administration Tools**, expand **Feature Administration Tools**, select the following features, and then click **Next**:
- 1. BitLocker Drive Encryption Administration Utilities
- 2. BitLocker Drive Encryption Tools
- 3. BitLocker Recovery Password Viewer
-7. On the **Confirm installation selections** page, click **Install** and then click **Close**.
+1. On DC01, log on as **CONTOSO\\Administrator**, and, using Server Manager, click **Add roles and features**.
+2. On the **Before you begin** page, click **Next**.
+3. On the **Select installation type** page, select **Role-based or feature-based installation**, and click **Next**.
+4. On the **Select destination server** page, select **DC01.contoso.com** and click **Next**.
+5. On the **Select server roles** page, click **Next**.
+6. On the **Select features** page, expand **Remote Server Administration Tools**, expand **Feature Administration Tools**, select the following features, and then click **Next**:
+ 1. BitLocker Drive Encryption Administration Utilities
+ 2. BitLocker Drive Encryption Tools
+ 3. BitLocker Recovery Password Viewer
+7. On the **Confirm installation selections** page, click **Install** and then click **Close**.

@@ -69,29 +74,30 @@ Figure 3. Selecting the BitLocker Drive Encryption Administration Utilities.
### Create the BitLocker Group Policy
Following these steps, you enable the backup of BitLocker and TPM recovery information to Active Directory. You also enable the policy for the TPM validation profile.
-1. On DC01, using Group Policy Management, right-click the **Contoso** organizational unit (OU), and select **Create a GPO in this domain, and Link it here**.
-2. Assign the name **BitLocker Policy** to the new Group Policy.
-3. Expand the **Contoso** OU, right-click the **BitLocker Policy**, and select **Edit**. Configure the following policy settings:
- Computer Configuration / Policies / Administrative Templates / Windows Components / BitLocker Drive Encryption / Operating System Drives
- 1. Enable the **Choose how BitLocker-protected operating system drives can be recovered** policy, and configure the following settings:
- 1. Allow data recovery agent (default)
- 2. Save BitLocker recovery information to Active Directory Domain Services (default)
- 3. Do not enable BitLocker until recovery information is stored in AD DS for operating system drives
- 2. Enable the **Configure TPM platform validation profile for BIOS-based firmware configurations** policy.
- 3. Enable the **Configure TPM platform validation profile for native UEFI firmware configurations** policy.
- Computer Configuration / Policies / Administrative Templates / System / Trusted Platform Module Services
- 4. Enable the **Turn on TPM backup to Active Directory Domain Services** policy.
->[!NOTE]
->If you consistently get the error "Windows BitLocker Drive Encryption Information. The system boot information has changed since BitLocker was enabled. You must supply a BitLocker recovery password to start this system." after encrypting a computer with BitLocker, you might have to change the various "Configure TPM platform validation profile" Group Policies, as well. Whether or not you need to do this will depend on the hardware you are using.
-
+1. On DC01, using Group Policy Management, right-click the **Contoso** organizational unit (OU), and select **Create a GPO in this domain, and Link it here**.
+2. Assign the name **BitLocker Policy** to the new Group Policy.
+3. Expand the **Contoso** OU, right-click the **BitLocker Policy**, and select **Edit**. Configure the following policy settings:
+ Computer Configuration / Policies / Administrative Templates / Windows Components / BitLocker Drive Encryption / Operating System Drives
+ 1. Enable the **Choose how BitLocker-protected operating system drives can be recovered** policy, and configure the following settings:
+ 1. Allow data recovery agent (default)
+ 2. Save BitLocker recovery information to Active Directory Domain Services (default)
+ 3. Do not enable BitLocker until recovery information is stored in AD DS for operating system drives
+ 2. Enable the **Configure TPM platform validation profile for BIOS-based firmware configurations** policy.
+ 3. Enable the **Configure TPM platform validation profile for native UEFI firmware configurations** policy.
+ Computer Configuration / Policies / Administrative Templates / System / Trusted Platform Module Services
+
+> [!NOTE]
+> If you consistently get the error "Windows BitLocker Drive Encryption Information. The system boot information has changed since BitLocker was enabled. You must supply a BitLocker recovery password to start this system." after encrypting a computer with BitLocker, you might have to change the various "Configure TPM platform validation profile" Group Policies, as well. Whether or not you need to do this will depend on the hardware you are using.
+
### Set permissions in Active Directory for BitLocker
In addition to the Group Policy created previously, you need to configure permissions in Active Directory to be able to store the TPM recovery information. In these steps, we assume you have downloaded the [Add-TPMSelfWriteACE.vbs script](https://go.microsoft.com/fwlink/p/?LinkId=167133) from Microsoft to C:\\Setup\\Scripts on DC01.
-1. On DC01, start an elevated PowerShell prompt (run as Administrator).
-2. Configure the permissions by running the following command:
- ``` syntax
+1. On DC01, start an elevated PowerShell prompt (run as Administrator).
+2. Configure the permissions by running the following command:
+
+ ```dos
cscript C:\Setup\Scripts\Add-TPMSelfWriteACE.vbs
```
@@ -99,26 +105,29 @@ In addition to the Group Policy created previously, you need to configure permis
Figure 4. Running the Add-TPMSelfWriteACE.vbs script on DC01.
-## Add BIOS configuration tools from Dell, HP, and Lenovo
+## Add BIOS configuration tools from Dell, HP, and Lenovo
If you want to automate enabling the TPM chip as part of the deployment process, you need to download the vendor tools and add them to your task sequences, either directly or in a script wrapper.
### Add tools from Dell
-The Dell tools are available via the Dell Client Configuration Toolkit (CCTK). The executable file from Dell is named cctk.exe. Here is a sample command to enable TPM and set a BIOS password using the cctk.exe tool:
-``` syntax
+The Dell tools are available via the Dell Client Configuration Toolkit (CCTK). The executable file from Dell is named *cctk.exe*. Here is a sample command to enable TPM and set a BIOS password using the cctk.exe tool:
+
+```dos
cctk.exe --tpm=on --valsetuppwd=Password1234
```
+
### Add tools from HP
The HP tools are part of HP System Software Manager. The executable file from HP is named BiosConfigUtility.exe. This utility uses a configuration file for the BIOS settings. Here is a sample command to enable TPM and set a BIOS password using the BiosConfigUtility.exe tool:
-``` syntax
+```dos
BIOSConfigUtility.EXE /SetConfig:TPMEnable.REPSET /NewAdminPassword:Password1234
```
+
And the sample content of the TPMEnable.REPSET file:
-``` syntax
+```txt
English
Activate Embedded Security On Next Boot
*Enable
@@ -129,25 +138,30 @@ Allow user to reject
Embedded Security Device Availability
*Available
```
+
### Add tools from Lenovo
The Lenovo tools are a set of VBScripts available as part of the Lenovo BIOS Setup using Windows Management Instrumentation Deployment Guide. Lenovo also provides a separate download of the scripts. Here is a sample command to enable TPM using the Lenovo tools:
-``` syntax
+
+```dos
cscript.exe SetConfig.vbs SecurityChip Active
```
-## Configure the Windows 10 task sequence to enable BitLocker
-When configuring a task sequence to run any BitLocker tool, either directly or using a custom script, it is helpful if you also add some logic to detect whether the BIOS is already configured on the machine. In the following task sequence, we are using a sample script (ZTICheckforTPM.wsf) from the Deployment Guys web page to check the status on the TPM chip. You can download this script from the Deployment Guys Blog post, [Check to see if the TPM is enabled](https://go.microsoft.com/fwlink/p/?LinkId=619549).
+## Configure the Windows 10 task sequence to enable BitLocker
+
+When configuring a task sequence to run any BitLocker tool, either directly or using a custom script, it is helpful if you also add some logic to detect whether the BIOS is already configured on the machine. In the following task sequence, we are using a sample script (ZTICheckforTPM.wsf) from the Deployment Guys web page to check the status on the TPM chip. You can download this script from the Deployment Guys Blog post, [Check to see if the TPM is enabled](https://go.microsoft.com/fwlink/p/?LinkId=619549).
In the following task sequence, we added five actions:
-- **Check TPM Status.** Runs the ZTICheckforTPM.wsf script to determine if TPM is enabled. Depending on the status, the script will set the TPMEnabled and TPMActivated properties to either true or false.
-- **Configure BIOS for TPM.** Runs the vendor tools (in this case, HP, Dell, and Lenovo). To ensure this action is run only when necessary, add a condition so the action is run only when the TPM chip is not already activated. Use the properties from the ZTICheckforTPM.wsf.
- **Note**
- It is common for organizations to wrap these tools in scripts to get additional logging and error handling.
-
-- **Restart computer.** Self-explanatory, reboots the computer.
-- **Check TPM Status.** Runs the ZTICheckforTPM.wsf script one more time.
-- **Enable BitLocker.** Runs the built-in action to activate BitLocker.
+
+- **Check TPM Status.** Runs the ZTICheckforTPM.wsf script to determine if TPM is enabled. Depending on the status, the script will set the TPMEnabled and TPMActivated properties to either true or false.
+- **Configure BIOS for TPM.** Runs the vendor tools (in this case, HP, Dell, and Lenovo). To ensure this action is run only when necessary, add a condition so the action is run only when the TPM chip is not already activated. Use the properties from the ZTICheckforTPM.wsf.
+
+ > [!NOTE]
+ > It is common for organizations to wrap these tools in scripts to get additional logging and error handling.
+
+- **Restart computer.** Self-explanatory, reboots the computer.
+- **Check TPM Status.** Runs the ZTICheckforTPM.wsf script one more time.
+- **Enable BitLocker.** Runs the built-in action to activate BitLocker.
## Related topics
diff --git a/windows/deployment/docfx.json b/windows/deployment/docfx.json
index cf43dc83df..b5e2f332bb 100644
--- a/windows/deployment/docfx.json
+++ b/windows/deployment/docfx.json
@@ -21,7 +21,9 @@
"files": [
"**/*.png",
"**/*.jpg",
- "**/*.gif"
+ "**/*.gif",
+ "**/*.pdf",
+ "**/*.vsdx"
],
"exclude": [
"**/obj/**",
diff --git a/windows/deployment/media/Windows10AutopilotFlowchart.pdf b/windows/deployment/media/Windows10AutopilotFlowchart.pdf
new file mode 100644
index 0000000000..5ab6f1c52e
Binary files /dev/null and b/windows/deployment/media/Windows10AutopilotFlowchart.pdf differ
diff --git a/windows/deployment/media/Windows10Autopilotflowchart.vsdx b/windows/deployment/media/Windows10Autopilotflowchart.vsdx
new file mode 100644
index 0000000000..ef702ab66b
Binary files /dev/null and b/windows/deployment/media/Windows10Autopilotflowchart.vsdx differ
diff --git a/windows/deployment/media/Windows10DeploymentConfigManager.pdf b/windows/deployment/media/Windows10DeploymentConfigManager.pdf
new file mode 100644
index 0000000000..ac27941579
Binary files /dev/null and b/windows/deployment/media/Windows10DeploymentConfigManager.pdf differ
diff --git a/windows/deployment/media/Windows10DeploymentConfigManager.vsdx b/windows/deployment/media/Windows10DeploymentConfigManager.vsdx
new file mode 100644
index 0000000000..5c5328cb5f
Binary files /dev/null and b/windows/deployment/media/Windows10DeploymentConfigManager.vsdx differ
diff --git a/windows/deployment/media/windows10-autopilot-flowchart.png b/windows/deployment/media/windows10-autopilot-flowchart.png
new file mode 100644
index 0000000000..878c9d483d
Binary files /dev/null and b/windows/deployment/media/windows10-autopilot-flowchart.png differ
diff --git a/windows/deployment/media/windows10-deployment-config-manager.png b/windows/deployment/media/windows10-deployment-config-manager.png
new file mode 100644
index 0000000000..af6c8313e0
Binary files /dev/null and b/windows/deployment/media/windows10-deployment-config-manager.png differ
diff --git a/windows/deployment/update/PSFxWhitepaper.md b/windows/deployment/update/PSFxWhitepaper.md
index dc4e379e29..c46b4cc2da 100644
--- a/windows/deployment/update/PSFxWhitepaper.md
+++ b/windows/deployment/update/PSFxWhitepaper.md
@@ -1,206 +1,114 @@
----
-title: Windows Updates using forward and reverse differentials
-description: A technique to produce compact software updates optimized for any origin and destination revision pair
-keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.author: greglin
-ms.date: 10/18/2018
-ms.reviewer:
-manager: laurawi
-ms.topic: article
----
-
-# Windows Updates using forward and reverse differentials
-
-
-Windows 10 monthly quality updates are cumulative, containing all previously
-released fixes to ensure consistency and simplicity. For an operating system
-platform like Windows 10, which stays in support for multiple years, the size of
-monthly quality updates can quickly grow large, thus directly impacting network
-bandwidth consumption.
-
-Today, this problem is addressed by using express downloads, where differential
-downloads for every changed file in the update are generated based on selected
-historical revisions plus the base version. In this paper, we introduce a new
-technique to build compact software update packages that are applicable to any
-revision of the base version, and then describe how Windows 10 quality updates
-uses this technique.
-
-## General Terms
-
-The following general terms apply throughout this document:
-
-- *Base version*: A major software release with significant changes, such as
- Windows 10, version 1809 (Windows 10 Build 17763.1)
-
-- *Revision*: Minor releases in between the major version releases, such as
- KB4464330 (Windows 10 Build 17763.55)
-
-- *Baseless Patch Storage Files (Baseless PSF)*: Patch storage files that
- contain full binaries or files
-
-## Introduction
-
-In this paper, we introduce a new technique that can produce compact software
-updates optimized for any origin/destination revision pair. It does this by
-calculating forward the differential of a changed file from the base version and
-its reverse differential back to the base version. Both forward and reverse
-differentials are then packaged as an update and distributed to the endpoints
-running the software to be updated. The update package contents can be symbolized as follows:
-
-
-
-The endpoints that have the base version of the file (V0 ) hydrate the target
-revision (VN ) by applying a simple transformation:
-
-
-
-The endpoints that have revision N of the file (VN ), hydrate the target revision
-(VR ) by applying the following set of transformations:
-
-
-
-The endpoints retain the reverse differentials for the software revision they
-are on, so that it can be used for hydrating and applying next revision update.
-
-By using a common baseline, this technique produces a single update package with
-numerous advantages:
-
-- Compact in size
-
-- Applicable to all baselines
-
-- Simple to build
-
-- Efficient to install
-
-- Redistributable
-
-Historically, download sizes of Windows 10 quality updates (Windows 10, version
-1803 and older supported versions of Windows 10) are optimized by using express
-download. Express download is optimized such that updating Windows 10 systems
-will download the minimum number of bytes. This is achieved by generating
-differentials for every updated file based on selected historical base revisions
-of the same file + its base or RTM version.
-
-For example, if the October monthly quality update has updated Notepad.exe,
-differentials for Notepad.exe file changes from September to October, August to
-October, July to October, June to October, and from the original feature release
-to October are generated. All these differentials are stored in a Patch Storage
-File (PSF, also referred to as “express download files”) and hosted or cached on
-Windows Update or other update management or distribution servers (for example,
-Windows Server Update Services (WSUS), System Center Configuration Manager, or a
-non-Microsoft update management or distribution server that supports express
-updates). A device leveraging express updates uses network protocol to determine
-optimal differentials, then downloads only what is needed from the update
-distribution endpoints.
-
-The flipside of express download is that the size of PSF files can be very large
-depending on the number of historical baselines against which differentials were
-calculated. Downloading and caching large PSF files to on-premises or remote
-update distribution servers is problematic for most organizations, hence they
-are unable to leverage express updates to keep their fleet of devices running
-Windows 10 up to date. Secondly, due to the complexity of generating
-differentials and size of the express files that need to be cached on update
-distribution servers, it is only feasible to generate express download files for
-the most common baselines, thus express updates are only applicable to selected
-baselines. Finally, calculation of optimal differentials is expensive in terms
-of system memory utilization, especially for low-cost systems, impacting their
-ability to download and apply an update seamlessly.
-
-In the following sections, we describe how Windows 10 quality updates will
-leverage this technique based on forward and reverse differentials for newer
-releases of Windows 10 and Windows Server to overcome the challenges with
-express downloads.
-
-## High-level Design
-
-### Update packaging
-
-Windows 10 quality update packages will contain forward differentials from
-quality update RTM baselines (∆RTM→N) and reverse differentials back to RTM
-(∆N→RTM) for each file that has changed since RTM. By using the RTM version as
-the baseline, we ensure that all devices will have an identical payload. Update
-package metadata, content manifests, and forward and reverse differentials will
-be packaged into a cabinet file (.cab). This .cab file, and the applicability
-logic, will also be wrapped in Microsoft Standalone Update (.msu) format.
-
-There can be cases where new files are added to the system during servicing.
-These files will not have RTM baselines, thus forward and reverse differentials
-cannot be used. In these scenarios, null differentials will be used to handle
-servicing. Null differentials are the slightly compressed and optimized version
-of the full binaries. Update packages can have either
-forward or reverse differentials, or null differential of any given binary in
-them. The following image symbolizes the content of a Windows 10 quality update installer:
-
-
-
-### Hydration and installation
-
-Once the usual applicability checks are performed on the update package and are
-determined to be applicable, the Windows component servicing infrastructure will
-hydrate the full files during pre-installation and then proceed with the usual
-installation process.
-
-Below is a high-level sequence of activities that the component servicing
-infrastructure will run in a transaction to complete installation of the update:
-
-- Identify all files that are required to install the update.
-
-- Hydrate each of necessary files using current version (VN ) of the file,
- reverse differential (VN --->RTM) of the file back to quality update RTM/base
- version and forward differential (VRTM --->R) from feature update RTM/base
- version to the target version. Also, use null differential hydration to
- hydrate null compressed files.
-
-- Stage the hydrated files (full file), forward differentials (under ‘f’
- folder) and reverse differentials (under ‘r’ folder) or null compressed
- files (under ‘n’ folder) in the component store (%windir%\\WinSxS folder).
-
-- Resolve any dependencies and install components.
-
-- Clean up older state (VN-1 ); the previous state VN is retained for
- uninstallation and restoration or repair.
-
-### **Resilient Hydration**
-
-To ensure resiliency against component store corruption or missing files that
-could occur due to susceptibility of certain types of hardware to file system
-corruption, a corruption repair service has been traditionally used to recover
-the component store automatically (“automatic corruption repair”) or on demand
-(“manual corruption repair”) using an online or local repair source. This
-service will continue to offer the ability to repair and recover content for
-hydration and successfully install an update, if needed.
-
-When corruption is detected during update operations, automatic corruption
-repair will start as usual and use the Baseless Patch Storage File published to
-Windows Update for each update to fix corrupted manifests, binary differentials,
-or hydrated or full files. Baseless patch storage files will contain reverse and
-forward differentials and full files for each updated component. Integrity of
-the repair files will be hash verified.
-
-Corruption repair will use the component manifest to detect missing files and
-get hashes for corruption detection. During update installation, new registry
-flags for each differential staged on the machine will be set. When automatic
-corruption repair runs, it will scan hydrated files using the manifest and
-differential files using the flags. If the differential cannot be found or
-verified, it will be added to the list of corruptions to repair.
-
-### Lazy automatic corruption repair
-
-“Lazy automatic corruption repair” runs during update operations to detect
-corrupted binaries and differentials. While applying an update, if hydration of
-any file fails, "lazy" automatic corruption repair automatically starts,
-identifies the corrupted binary or differential file, and then adds it to the
-corruption list. Later, the update operation continues as far as it can go, so
-that "lazy" automatic corruption repair can collect as many corrupted files to fix
-as possible. At the end of the hydration section, the update fails, and
-automatic corruption repair starts. Automatic corruption repair runs as usual
-and at the end of its operation, adds the corruption list generated by "lazy"
-automatic corruption repair on top of the new list to repair. Automatic
-corruption repair then repairs the files on the corruption list and installation
-of the update will succeed on the next attempt.
+---
+title: Windows Updates using forward and reverse differentials
+description: A technique to produce compact software updates optimized for any origin and destination revision pair
+keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools
+ms.prod: w10
+ms.mktglfcycl: manage
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationpriority: medium
+ms.author: jaimeo
+ms.reviewer:
+manager: laurawi
+ms.topic: article
+---
+
+# Windows Updates using forward and reverse differentials
+
+Windows 10 monthly quality updates are cumulative, containing all previously
+released fixes to ensure consistency and simplicity. For an operating system
+platform like Windows 10, which stays in support for multiple years, the size of
+monthly quality updates can quickly grow large, thus directly impacting network
+bandwidth consumption.
+
+Today, this problem is addressed by using express downloads, where differential
+downloads for every changed file in the update are generated based on selected
+historical revisions plus the base version. In this paper, we introduce a new
+technique to build compact software update packages that are applicable to any
+revision of the base version, and then describe how Windows 10 quality updates
+uses this technique.
+
+## General Terms
+
+The following general terms apply throughout this document:
+
+- *Base version*: A major software release with significant changes, such as Windows 10, version 1809 (Windows 10 Build 17763.1)
+- *Revision*: Minor releases in between the major version releases, such as KB4464330 (Windows 10 Build 17763.55)
+- *Baseless Patch Storage Files (Baseless PSF)*: Patch storage files that contain full binaries or files
+
+## Introduction
+
+In this paper, we introduce a new technique that can produce compact software
+updates optimized for any origin/destination revision pair. It does this by
+calculating forward the differential of a changed file from the base version and
+its reverse differential back to the base version. Both forward and reverse
+differentials are then packaged as an update and distributed to the endpoints
+running the software to be updated. The update package contents can be symbolized as follows:
+
+
+
+The endpoints that have the base version of the file (V0 ) hydrate the target
+revision (VN ) by applying a simple transformation:
+
+
+
+The endpoints that have revision N of the file (VN ), hydrate the target revision
+(VR ) by applying the following set of transformations:
+
+
+
+The endpoints retain the reverse differentials for the software revision they
+are on, so that it can be used for hydrating and applying next revision update.
+
+By using a common baseline, this technique produces a single update package with
+numerous advantages:
+
+- Compact in size
+- Applicable to all baselines
+- Simple to build
+- Efficient to install
+- Redistributable
+
+Historically, download sizes of Windows 10 quality updates (Windows 10, version 1803 and older supported versions of Windows 10) are optimized by using express download. Express download is optimized such that updating Windows 10 systems will download the minimum number of bytes. This is achieved by generating differentials for every updated file based on selected historical base revisions of the same file + its base or RTM version.
+
+For example, if the October monthly quality update has updated Notepad.exe, differentials for Notepad.exe file changes from September to October, August to October, July to October, June to October, and from the original feature release to October are generated. All these differentials are stored in a Patch Storage File (PSF, also referred to as “express download files”) and hosted or cached on Windows Update or other update management or distribution servers (for example, Windows Server Update Services (WSUS), System Center Configuration Manager, or a non-Microsoft update management or distribution server that supports express updates). A device leveraging express updates uses network protocol to determine optimal differentials, then downloads only what is needed from the update distribution endpoints.
+
+The flip side of express download is that the size of PSF files can be very large depending on the number of historical baselines against which differentials were calculated. Downloading and caching large PSF files to on-premises or remote update distribution servers is problematic for most organizations, hence they are unable to leverage express updates to keep their fleet of devices running Windows 10 up to date. Secondly, due to the complexity of generating differentials and size of the express files that need to be cached on update distribution servers, it is only feasible to generate express download files for the most common baselines, thus express updates are only applicable to selected baselines. Finally, calculation of optimal differentials is expensive in terms of system memory utilization, especially for low-cost systems, impacting their ability to download and apply an update seamlessly.
+
+In the following sections, we describe how Windows 10 quality updates will leverage this technique based on forward and reverse differentials for newer releases of Windows 10 and Windows Server to overcome the challenges with express downloads.
+
+## High-level Design
+
+### Update packaging
+
+Windows 10 quality update packages will contain forward differentials from quality update RTM baselines (∆RTM→N) and reverse differentials back to RTM (∆N→RTM) for each file that has changed since RTM. By using the RTM version as the baseline, we ensure that all devices will have an identical payload. Update package metadata, content manifests, and forward and reverse differentials will be packaged into a cabinet file (.cab). This .cab file, and the applicability logic, will also be wrapped in Microsoft Standalone Update (.msu) format.
+
+There can be cases where new files are added to the system during servicing. These files will not have RTM baselines, thus forward and reverse differentials cannot be used. In these scenarios, null differentials will be used to handle servicing. Null differentials are the slightly compressed and optimized version of the full binaries. Update packages can have either forward or reverse differentials, or null differential of any given binary in them. The following image symbolizes the content of a Windows 10 quality update installer:
+
+
+
+### Hydration and installation
+
+Once the usual applicability checks are performed on the update package and are determined to be applicable, the Windows component servicing infrastructure will hydrate the full files during pre-installation and then proceed with the usual installation process.
+
+Below is a high-level sequence of activities that the component servicing infrastructure will run in a transaction to complete installation of the update:
+
+- Identify all files that are required to install the update.
+- Hydrate each of necessary files using current version (VN ) of the file, reverse differential (VN --->RTM) of the file back to quality update RTM/base version and forward differential (VRTM --->R) from feature update RTM/base version to the target version. Also, use null differential hydration to hydrate null compressed files.
+- Stage the hydrated files (full file), forward differentials (under ‘f’ folder) and reverse differentials (under ‘r’ folder) or null compressed files (under ‘n’ folder) in the component store (%windir%\\WinSxS folder).
+- Resolve any dependencies and install components.
+- Clean up older state (VN-1 ); the previous state VN is retained for uninstallation and restoration or repair.
+
+### **Resilient Hydration**
+
+To ensure resiliency against component store corruption or missing files that could occur due to susceptibility of certain types of hardware to file system corruption, a corruption repair service has been traditionally used to recover the component store automatically (“automatic corruption repair”) or on demand (“manual corruption repair”) using an online or local repair source. This service will continue to offer the ability to repair and recover content for
+hydration and successfully install an update, if needed.
+
+When corruption is detected during update operations, automatic corruption repair will start as usual and use the Baseless Patch Storage File published to Windows Update for each update to fix corrupted manifests, binary differentials, or hydrated or full files. Baseless patch storage files will contain reverse and forward differentials and full files for each updated component. Integrity of the repair files will be hash verified.
+
+Corruption repair will use the component manifest to detect missing files and get hashes for corruption detection. During update installation, new registry flags for each differential staged on the machine will be set. When automatic corruption repair runs, it will scan hydrated files using the manifest and differential files using the flags. If the differential cannot be found or verified, it will be added to the list of corruptions to repair.
+
+### Lazy automatic corruption repair
+
+“Lazy automatic corruption repair” runs during update operations to detect corrupted binaries and differentials. While applying an update, if hydration of any file fails, "lazy" automatic corruption repair automatically starts, identifies the corrupted binary or differential file, and then adds it to the corruption list. Later, the update operation continues as far as it can go, so that "lazy" automatic corruption repair can collect as many corrupted files to fix as possible. At the end of the hydration section, the update fails, and automatic corruption repair starts. Automatic corruption repair runs as usual and at the end of its operation, adds the corruption list generated by "lazy" automatic corruption repair on top of the new list to repair. Automatic corruption repair then repairs the files on the corruption list and installation of the update will succeed on the next attempt.
diff --git a/windows/deployment/update/WIP4Biz-intro.md b/windows/deployment/update/WIP4Biz-intro.md
index 20ecac8ae7..9022265138 100644
--- a/windows/deployment/update/WIP4Biz-intro.md
+++ b/windows/deployment/update/WIP4Biz-intro.md
@@ -1,74 +1,69 @@
----
-title: Introduction to the Windows Insider Program for Business
-description: Introduction to the Windows Insider Program for Business and why IT Pros should join it
-keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, WiP4Biz, enterprise, rings, flight
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.audience: itpro
author: greg-lindsay
-ms.date: 03/01/2018
-ms.reviewer:
-manager: laurawi
-ms.topic: article
----
-
-# Introduction to the Windows Insider Program for Business
-
-
-**Applies to**
-
-- Windows 10
-
-> **Looking for information about Windows 10 for personal or home use?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
-
-For many IT Pros, it's valuable to have visibility into feature updates early--before they’re available in the Semi-Annual Channel. With Windows 10, feature flighting enables participants in the Windows Insider Preview program can consume and deploy preproduction code to test devices, gaining early visibility into the next build. This is better for your organization because you can test the early builds of Windows 10 to discover possible issues with the code or with device and app compatibility in your organization before the update is ever publicly available. We at Microsoft also appreciate it because Insiders can report issues back to us in time for us to make improvements in a release before it is more generally available.
-
-The Windows Insider Program for Business gives you the opportunity to:
-
-* Get early access to Windows Insider Preview Builds.
-* Provide feedback to Microsoft in real time by using the Feedback Hub app.
-* Sign in with corporate credentials (Azure Active Directory) and increase the visibility of your organization's feedback with Microsoft – especially on features that support your productivity and business needs.
-* Register your Azure Active Directory domain in the program, allowing you to cover all users within your organization with just one registration.
-* Starting with Windows 10, version 1709, enable, disable, defer, and pause the installation of preview builds through policies.
-* Track feedback provided through the Feedback Hub App across your organization.
-
-Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans, and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub App.
-
-The Windows Insider Program doesn't replace Semi-Annual Channel deployments in an organization. Rather, it provides IT Pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft.
-
-
-[](images/WIP4Biz_deployment.png)
-Windows 10 Insider Preview builds enable organizations to prepare sooner for Windows Semi-Annual releases and reduce the overall validation effort required with traditional deployments.
-
-
-## Explore new Windows 10 features in Insider Previews
-Windows 10 Insider Preview builds offer organizations a valuable and exciting opportunity to evaluate new Windows features well before general release. What’s more, by providing feedback to Microsoft on these features, you and other Insiders in your organization can help shape Windows for your specific business needs. Here’s how to get the most out of your feature exploration:
-
-|Objective |Feature exploration|
-|---------|---------|
-|Release channel |**Fast Ring:** Insider Preview builds in the Fast Ring are released approximately once a week and contain the very latest features. This makes them ideal for feature exploration.|
-|Users | Because Fast Ring builds are released so early in the development cycle, we recommend limiting feature exploration in your organization to IT administrators and developers running Insider Preview builds on secondary devices. |
-|Tasks | - Install and manage Insider Preview builds on devices (per device or centrally across multiple devices) - Explore new features in Windows designed for organizations, including new features related to current and planned line of business applications - Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) for a summary of current features. |
-|Feedback | - Provide feedback via [Feedback Hub app](insiderhub://home/). This helps us make adjustments to features as quickly as possible. - Encourage users to sign into the Feedback Hub using their AAD work accounts. This enables both you and Microsoft to track feedback submitted by users within your specific organization. (Note: This tracking is only visible to Microsoft and registered Insiders within your organization’s domain.) - [Learn how to provide effective feedback in the Feedback Hub](https://insider.windows.com/en-us/how-to-feedback/) |
-
-## Validate Insider Preview builds
-Along with exploring new features, you also have the option to validate your apps and infrastructure on Insider Preview builds. This activity can play an important role in your [Windows 10 deployment strategy](https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business). Early validation has several benefits:
-
-- Get a head start on your Windows validation process
-- Identify issues sooner to accelerate your Windows deployment
-- Engage Microsoft earlier for help with potential compatibility issues
-- Deploy Windows 10 Semi-Annual releases faster and more confidently
-- Maximize the 18-month support Window that comes with each Semi-Annual release.
-
-
-
-|Objective |Feature exploration|
-|---------|---------|
-|Release channel |**Slow Ring:** Insider Preview builds in the Slow Ring are released approximately once a month. They are more stable than Fast Ring releases, making them better suited for validation purposes. Slow Ring releases can be run on either secondary or primary production devices by skilled users.|
-|Users | Application and infrastructure validation: In addition to Insiders who might have participated in feature exploration, we also recommend including a small group of application users from each business department to ensure a representative sample.|
-|Tasks | Application and infrastructure validation: Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) and [Windows Insider Tech Community](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/bd-p/WindowsInsiderProgram) pages for updates on current issues and fixes. |
-|Feedback | Application and infrastructure validation:Provide feedback in the Feedback Hub app and also inform app vendors of any significant issues. |
-|Guidance | Application and infrastructure validation: - [Use Upgrade Readiness to create an app inventory and identify mission-critical apps](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-identify-apps) - [Use Device Health to identify problem devices and device drivers](https://docs.microsoft.com/windows/deployment/update/device-health-monitor) - [Windows 10 application compatibility](https://technet.microsoft.com/windows/mt703793)|
-
+---
+title: Introduction to the Windows Insider Program for Business
+description: Introduction to the Windows Insider Program for Business and why IT Pros should join
+keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, WiP4Biz, enterprise, rings, flight
+ms.prod: w10
+ms.mktglfcycl: manage
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationprioauthor: jaimeo
+ms.audience: itpro
+author: jaimeo
+ms.reviewer:
+manager: laurawi
+ms.topic: article
+---
+
+# Introduction to the Windows Insider Program for Business
+
+**Applies to**
+
+- Windows 10
+
+> **Looking for information about Windows 10 for personal or home use?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
+
+For many IT Pros, it's valuable to have visibility into feature updates early--before they’re available in the Semi-Annual Channel. With Windows 10, feature flighting enables participants in the Windows Insider Preview program can consume and deploy preproduction code to test devices, gaining early visibility into the next build. This is better for your organization because you can test the early builds of Windows 10 to discover possible issues with the code or with device and app compatibility in your organization before the update is ever publicly available. We at Microsoft also appreciate it because Insiders can report issues back to us in time for us to make improvements in a release before it is more generally available.
+
+The Windows Insider Program for Business gives you the opportunity to:
+
+* Get early access to Windows Insider Preview Builds.
+* Provide feedback to Microsoft in real time by using the Feedback Hub app.
+* Sign in with corporate credentials (Azure Active Directory) and increase the visibility of your organization's feedback with Microsoft – especially on features that support your productivity and business needs.
+* Register your Azure Active Directory domain in the program, allowing you to cover all users within your organization with just one registration.
+* Starting with Windows 10, version 1709, enable, disable, defer, and pause the installation of preview builds through policies.
+* Track feedback provided through the Feedback Hub App across your organization.
+
+Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans, and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub App.
+
+The Windows Insider Program doesn't replace Semi-Annual Channel deployments in an organization. Rather, it provides IT Pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft.
+
+[](images/WIP4Biz_deployment.png)
+Windows 10 Insider Preview builds enable organizations to prepare sooner for Windows Semi-Annual releases and reduce the overall validation effort required with traditional deployments.
+
+## Explore new Windows 10 features in Insider Previews
+Windows 10 Insider Preview builds offer organizations a valuable and exciting opportunity to evaluate new Windows features well before general release. What’s more, by providing feedback to Microsoft on these features, you and other Insiders in your organization can help shape Windows for your specific business needs. Here’s how to get the most out of your feature exploration:
+
+|Objective |Feature exploration|
+|---------|---------|
+|Release channel |**Fast Ring:** Insider Preview builds in the Fast Ring are released approximately once a week and contain the very latest features. This makes them ideal for feature exploration.|
+|Users | Because Fast Ring builds are released so early in the development cycle, we recommend limiting feature exploration in your organization to IT administrators and developers running Insider Preview builds on secondary devices. |
+|Tasks | - Install and manage Insider Preview builds on devices (per device or centrally across multiple devices) - Explore new features in Windows designed for organizations, including new features related to current and planned line of business applications - Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) for a summary of current features. |
+|Feedback | - Provide feedback via [Feedback Hub app](insiderhub://home/). This helps us make adjustments to features as quickly as possible. - Encourage users to sign into the Feedback Hub using their AAD work accounts. This enables both you and Microsoft to track feedback submitted by users within your specific organization. (Note: This tracking is only visible to Microsoft and registered Insiders within your organization’s domain.) - [Learn how to provide effective feedback in the Feedback Hub](https://insider.windows.com/en-us/how-to-feedback/) |
+
+## Validate Insider Preview builds
+Along with exploring new features, you also have the option to validate your apps and infrastructure on Insider Preview builds. This activity can play an important role in your [Windows 10 deployment strategy](https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business). Early validation has several benefits:
+
+- Get a head start on your Windows validation process
+- Identify issues sooner to accelerate your Windows deployment
+- Engage Microsoft earlier for help with potential compatibility issues
+- Deploy Windows 10 Semi-Annual releases faster and more confidently
+- Maximize the 18-month support Window that comes with each Semi-Annual release.
+
+|Objective |Feature exploration|
+|---------|---------|
+|Release channel |**Slow Ring:** Insider Preview builds in the Slow Ring are released approximately once a month. They are more stable than Fast Ring releases, making them better suited for validation purposes. Slow Ring releases can be run on either secondary or primary production devices by skilled users.|
+|Users | Application and infrastructure validation: In addition to Insiders who might have participated in feature exploration, we also recommend including a small group of application users from each business department to ensure a representative sample.|
+|Tasks | Application and infrastructure validation: Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) and [Windows Insider Tech Community](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/bd-p/WindowsInsiderProgram) pages for updates on current issues and fixes. |
+|Feedback | Application and infrastructure validation:Provide feedback in the Feedback Hub app and also inform app vendors of any significant issues. |
+|Guidance | Application and infrastructure validation: - [Use Upgrade Readiness to create an app inventory and identify mission-critical apps](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-identify-apps) - [Use Device Health to identify problem devices and device drivers](https://docs.microsoft.com/windows/deployment/update/device-health-monitor) - [Windows 10 application compatibility](https://technet.microsoft.com/windows/mt703793)|
\ No newline at end of file
diff --git a/windows/deployment/update/change-history-for-update-windows-10.md b/windows/deployment/update/change-history-for-update-windows-10.md
index 135d1670a5..99bb88d5a4 100644
--- a/windows/deployment/update/change-history-for-update-windows-10.md
+++ b/windows/deployment/update/change-history-for-update-windows-10.md
@@ -1,52 +1,52 @@
----
-title: Change history for Update Windows 10 (Windows 10)
-description: This topic lists new and updated topics in the Update Windows 10 documentation for Windows 10 and Windows 10 Mobile.
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.date: 09/18/2018
-ms.reviewer:
-manager: laurawi
-ms.topic: article
----
-
-# Change history for Update Windows 10
-
-This topic lists new and updated topics in the [Update Windows 10](index.md) documentation for [Deploy and Update Windows 10](https://docs.microsoft.com/windows/deployment).
-
->If you're looking for **update history** for Windows 10, see [Windows 10 and Windows Server 2016 update history](https://support.microsoft.com/help/12387/windows-10-update-history).
-
-## September 2018
-
-| New or changed topic | Description |
-| --- | --- |
-| [Get started with Windows Update](windows-update-overview.md) | New |
-
-
-## RELEASE: Windows 10, version 1709
-
-The topics in this library have been updated for Windows 10, version 1709 (also known as the Fall Creators Update).
-
-## September 2017
-
-| New or changed topic | Description |
-| --- | --- |
-| [Olympia Corp](olympia/olympia-enrollment-guidelines.md) | New |
-
-## July 2017
-
-All topics were updated to reflect the new [naming changes](waas-overview.md#naming-changes).
-
-## May 2017
-
-| New or changed topic | Description |
-| --- | --- |
-| [Manage additional Windows Update settings](waas-wu-settings.md) | New |
-
-## RELEASE: Windows 10, version 1703
-
-The topics in this library have been updated for Windows 10, version 1703 (also known as the Creators Update). The following new topics have been added:
-* [Windows Insider Program for Business](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-get-started)
-* [Windows Insider Program for Business](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-register)
+---
+title: Change history for Update Windows 10 (Windows 10)
+description: This topic lists new and updated topics in the Update Windows 10 documentation for Windows 10 and Windows 10 Mobile.
+ms.prod: w10
+ms.mktglfcycl: manage
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.author: jaimeo
+ms.reviewer:
+manager: laurawi
+ms.topic: article
+---
+
+# Change history for Update Windows 10
+
+This topic lists new and updated topics in the [Update Windows 10](index.md) documentation for [Deploy and Update Windows 10](https://docs.microsoft.com/windows/deployment).
+
+>If you're looking for **update history** for Windows 10, see [Windows 10 and Windows Server 2016 update history](https://support.microsoft.com/help/12387/windows-10-update-history).
+
+## September 2018
+
+| New or changed topic | Description |
+| --- | --- |
+| [Get started with Windows Update](windows-update-overview.md) | New |
+
+
+## RELEASE: Windows 10, version 1709
+
+The topics in this library have been updated for Windows 10, version 1709 (also known as the Fall Creators Update).
+
+## September 2017
+
+| New or changed topic | Description |
+| --- | --- |
+| [Olympia Corp](olympia/olympia-enrollment-guidelines.md) | New |
+
+## July 2017
+
+All topics were updated to reflect the new [naming changes](waas-overview.md#naming-changes).
+
+## May 2017
+
+| New or changed topic | Description |
+| --- | --- |
+| [Manage additional Windows Update settings](waas-wu-settings.md) | New |
+
+## RELEASE: Windows 10, version 1703
+
+The topics in this library have been updated for Windows 10, version 1703 (also known as the Creators Update). The following new topics have been added:
+* [Windows Insider Program for Business](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-get-started)
+* [Windows Insider Program for Business](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-register)
diff --git a/windows/deployment/update/device-health-get-started.md b/windows/deployment/update/device-health-get-started.md
index eb1b10ab08..a7386012df 100644
--- a/windows/deployment/update/device-health-get-started.md
+++ b/windows/deployment/update/device-health-get-started.md
@@ -1,78 +1,81 @@
----
-title: Get started with Device Health
-description: Configure Device Health in Azure Monitor to monitor health (such as crashes and sign-in failures) for your Windows 10 devices.
-keywords: Device Health, oms, operations management suite, prerequisites, requirements, monitoring, crash, drivers, azure
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.date: 10/29/2018
-ms.reviewer:
-manager: laurawi
-ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.localizationpriority: medium
-ms.collection: M365-analytics
-ms.topic: article
----
-
-# Get started with Device Health
-
-This topic explains the steps necessary to configure your environment for Windows Analytics Device Health.
-
-- [Get started with Device Health](#get-started-with-device-health)
- - [Add the Device Health solution to your Azure subscription](#add-the-device-health-solution-to-your-azure-subscription)
- - [Enroll devices in Windows Analytics](#enroll-devices-in-windows-analytics)
- - [Use Device Health to monitor device crashes, app crashes, sign-in failures, and more](#use-device-health-to-monitor-device-crashes-app-crashes-sign-in-failures-and-more)
- - [Related topics](#related-topics)
-
-
-
-## Add the Device Health solution to your Azure subscription
-
-Device Health is offered as a *solution* which you link to a new or existing [Azure Monitor](https://azure.microsoft.com/services/monitor/) *workspace* within your Azure *subscription*. To configure this, follows these steps:
-
-1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal.
-
- >[!NOTE]
- > Device Health is included at no additional cost with Windows 10 [education and enterprise licensing](https://docs.microsoft.com/windows/deployment/update/device-health-monitor#device-health-licensing). An Azure subscription is required for managing and using Device Health, but no Azure charges are expected to accrue to the subscription as a result of using Device Health.
-
-2. In the Azure portal select **Create a resource**, search for "Device Health", and then select **Create** on the **Device Health** solution.
- 
-
- 
-3. Choose an existing workspace or create a new workspace to host the Device Health solution.
- 
- - If you are using other Windows Analytics solutions (Upgrade Readiness or Update Compliance) you should add Device Health to the same workspace.
- - If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started:
- - Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*.
- - For the resource group setting select **Create new** and use the same name you chose for your new workspace.
- - For the location setting, choose the Azure region where you would prefer the data to be stored.
- - For the pricing tier select **per GB**.
-4. Now that you have selected a workspace, you can go back to the Device Health blade and select **Create**.
- 
-5. Watch for a Notification (in the Azure portal) that "Deployment 'Microsoft.DeviceHealth' to resource group 'YourResourceGroupName' was successful." and then select **Go to resource** This might take several minutes to appear.
- 
- - Suggestion: Choose the **Pin to Dashboard** option to make it easy to navigate to your newly added Device Health solution.
- - Suggestion: If a "resource unavailable" error occurs when navigating to the solution, try again after one hour.
-
-## Enroll devices in Windows Analytics
-
-Once you've added Device Health to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For Device Health there are two key steps for enrollment:
-1. Deploy your CommercialID (from Device Health Settings page) to your Windows 10 devices (typically using Group Policy or similar)
-2. Ensure the Windows Diagnostic Data setting on devices is set to Enhanced or Full (typically using Group Policy or similar). Note that the [Limit Enhanced](https://docs.microsoft.com/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields) policy can substantially reduce the amount of diagnostic data shared with Microsoft while still allowing Device Health to function.
-For full enrollment instructions and troubleshooting, see [Enrolling devices in Windows Analytics](windows-analytics-get-started.md).
-
-After enrolling your devices (by deploying your CommercialID and Windows Diagnostic Data settings), it may take 48-72 hours for the first data to appear in the solution. Until then, the Device Health tile will show "Performing Assessment."
-
-## Use Device Health to monitor device crashes, app crashes, sign-in failures, and more
-
-Once your devices are enrolled and data is flowing, you can move on to [Using Device Health](device-health-using.md).
-
->[!NOTE]
->You can remove the Device Health solution from your workspace if you no longer want to monitor your organization’s devices. Windows diagnostic data will continue to be shared with Microsoft as normal as per the diagnostic data sharing settings on the devices.
-
-## Related topics
-
-[Use Device Health to monitor frequency and causes of device crashes](device-health-using.md)
-For the latest information on Windows Analytics, including new features and usage tips, see the [Windows Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics)
+---
+title: Get started with Device Health
+description: Configure Device Health in Azure Monitor to monitor health (such as crashes and sign-in failures) for your Windows 10 devices.
+keywords: Device Health, oms, operations management suite, prerequisites, requirements, monitoring, crash, drivers, azure
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.reviewer:
+manager: laurawi
+ms.pagetype: deploy
+audience: itpro
+author: jaimeo
+ms.author: jaimeo
+ms.localizationpriority: medium
+ms.collection: M365-analytics
+ms.topic: article
+---
+
+# Get started with Device Health
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+This topic explains the steps necessary to configure your environment for Windows Analytics Device Health.
+
+- [Get started with Device Health](#get-started-with-device-health)
+ - [Add the Device Health solution to your Azure subscription](#add-the-device-health-solution-to-your-azure-subscription)
+ - [Enroll devices in Windows Analytics](#enroll-devices-in-windows-analytics)
+ - [Use Device Health to monitor device crashes, app crashes, sign-in failures, and more](#use-device-health-to-monitor-device-crashes-app-crashes-sign-in-failures-and-more)
+ - [Related topics](#related-topics)
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+## Add the Device Health solution to your Azure subscription
+
+Device Health is offered as a *solution* which you link to a new or existing [Azure Monitor](https://azure.microsoft.com/services/monitor/) *workspace* within your Azure *subscription*. To configure this, follows these steps:
+
+1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal.
+
+ >[!NOTE]
+ > Device Health is included at no additional cost with Windows 10 [education and enterprise licensing](https://docs.microsoft.com/windows/deployment/update/device-health-monitor#device-health-licensing). An Azure subscription is required for managing and using Device Health, but no Azure charges are expected to accrue to the subscription as a result of using Device Health.
+
+2. In the Azure portal select **Create a resource**, search for "Device Health", and then select **Create** on the **Device Health** solution.
+ 
+
+ 
+3. Choose an existing workspace or create a new workspace to host the Device Health solution.
+ 
+ - If you are using other Windows Analytics solutions (Upgrade Readiness or Update Compliance) you should add Device Health to the same workspace.
+ - If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started:
+ - Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*.
+ - For the resource group setting select **Create new** and use the same name you chose for your new workspace.
+ - For the location setting, choose the Azure region where you would prefer the data to be stored.
+ - For the pricing tier select **per GB**.
+4. Now that you have selected a workspace, you can go back to the Device Health blade and select **Create**.
+ 
+5. Watch for a Notification (in the Azure portal) that "Deployment 'Microsoft.DeviceHealth' to resource group 'YourResourceGroupName' was successful." and then select **Go to resource** This might take several minutes to appear.
+ 
+ - Suggestion: Choose the **Pin to Dashboard** option to make it easy to navigate to your newly added Device Health solution.
+ - Suggestion: If a "resource unavailable" error occurs when navigating to the solution, try again after one hour.
+
+## Enroll devices in Windows Analytics
+
+Once you've added Device Health to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For Device Health there are two key steps for enrollment:
+1. Deploy your CommercialID (from Device Health Settings page) to your Windows 10 devices (typically using Group Policy or similar)
+2. Ensure the Windows Diagnostic Data setting on devices is set to Enhanced or Full (typically using Group Policy or similar). Note that the [Limit Enhanced](https://docs.microsoft.com/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields) policy can substantially reduce the amount of diagnostic data shared with Microsoft while still allowing Device Health to function.
+For full enrollment instructions and troubleshooting, see [Enrolling devices in Windows Analytics](windows-analytics-get-started.md).
+
+After enrolling your devices (by deploying your CommercialID and Windows Diagnostic Data settings), it may take 48-72 hours for the first data to appear in the solution. Until then, the Device Health tile will show "Performing Assessment."
+
+## Use Device Health to monitor device crashes, app crashes, sign-in failures, and more
+
+Once your devices are enrolled and data is flowing, you can move on to [Using Device Health](device-health-using.md).
+
+>[!NOTE]
+>You can remove the Device Health solution from your workspace if you no longer want to monitor your organization’s devices. Windows diagnostic data will continue to be shared with Microsoft as normal as per the diagnostic data sharing settings on the devices.
+
+## Related topics
+
+[Use Device Health to monitor frequency and causes of device crashes](device-health-using.md)
+For the latest information on Windows Analytics, including new features and usage tips, see the [Windows Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics)
diff --git a/windows/deployment/update/device-health-monitor.md b/windows/deployment/update/device-health-monitor.md
index 027f6cd65b..49b2c735d9 100644
--- a/windows/deployment/update/device-health-monitor.md
+++ b/windows/deployment/update/device-health-monitor.md
@@ -1,84 +1,88 @@
----
-title: Monitor the health of devices with Device Health
-ms.reviewer:
-manager: laurawi
-description: You can use Device Health in Azure Portal to monitor the frequency and causes of crashes and misbehaving apps on devices in your network.
-keywords: oms, operations management suite, wdav, health, log analytics
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.localizationpriority: medium
-ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.collection: M365-analytics
-ms.topic: article
----
-
-# Monitor the health of devices with Device Health
-
-## Introduction
-
-Device Health is the newest Windows Analytics solution that complements the existing Upgrade Readiness and Update Compliance solutions by providing IT with reports on some common problems the end users might experience so they can be proactively remediated, thus saving support calls and improving end-user productivity.
-
-Like Upgrade Readiness and Update Compliance, Device Health is a solution built in Azure Portal, a cloud-based monitoring and automation service that has a flexible servicing subscription based on data usage and retention. This release is free for customers to try and will not incur charges on your Azure Portal workspace for its use. For more information about Azure Portal, see [Windows Analytics in the Azure Portal](windows-analytics-azure-portal.md) .
-
-Device Health uses Windows diagnostic data that is part of all Windows 10 devices. If you have already employed Upgrade Readiness or Update Compliance solutions, all you need to do is select Device Health from the Azure Portal solution gallery and add it to your Azure Portal workspace. Device Health requires enhanced diagnostic data, so you might need to implement this policy if you've not already done so.
-
-
-Device Health provides the following:
-
-- Identification of devices that crash frequently, and therefore might need to be rebuilt or replaced
-- Identification of device drivers that are causing device crashes, with suggestions of alternative versions of those drivers that might reduce the number of crashes
-- Notification of Windows Information Protection misconfigurations that send prompts to end users
-- No need for new complex customized infrastructure, thanks to cloud-connected access using Windows 10 diagnostic data
-
-See the following topics in this guide for detailed information about configuring and using the Device Health solution:
-
-- [Get started with Device Health](device-health-get-started.md): How to add Device Health to your environment.
-- [Using Device Health](device-health-using.md): How to begin using Device Health.
-
-An overview of the processes used by the Device Health solution is provided below.
-
-## Device Health licensing
-
-Use of Windows Analytics Device Health requires one of the following licenses:
-
-- Windows 10 Enterprise or Windows 10 Education per-device with active Software Assurance
-- Windows 10 Enterprise E3 or E5 per-device or per-user subscription (including Microsoft 365 F1, E3, or E5)
-- Windows 10 Education A3 or A5 (including Microsoft 365 Education A3 or A5)
-- Windows VDA E3 or E5 per-device or per-user subscription
-
-
-You don't have to install Windows 10 Enterprise on a per-device basis--you just need enough of the above licenses for the number of devices using Device Health.
-
-
-## Device Health architecture
-
-The Device Health architecture and data flow is summarized by the following five-step process:
-
-
-
-**(1)** User computers send diagnostic data to a secure Microsoft data center using the Microsoft Data Management Service.
-**(2)** Diagnostic data is analyzed by the Microsoft Telemetry Service.
-**(3)** Diagnostic data is pushed from the Microsoft Telemetry Service to your Azure Portal workspace.
-**(4)** Diagnostic data is available in the Device Health solution.
-**(5)** You are now able to proactively monitor Device Health issues in your environment.
-
-These steps are illustrated in following diagram:
-
- [](images/analytics-architecture.png)
-
->[!NOTE]
->This process assumes that Windows diagnostic data is enabled and data sharing is enabled as described in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md).
-
-
-
-
-## Related topics
-
-[Get started with Device Health](device-health-get-started.md)
-
-[Use Device Health to monitor frequency and causes of device crashes](device-health-using.md)
-
-For the latest information on Windows Analytics, including new features and usage tips, see the [Windows Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics)
+---
+title: Monitor the health of devices with Device Health
+ms.reviewer:
+manager: laurawi
+description: You can use Device Health in Azure Portal to monitor the frequency and causes of crashes and misbehaving apps on devices in your network.
+keywords: oms, operations management suite, wdav, health, log analytics
+ms.prod: w10
+ms.mktglfcycl: deploy
+
+ms.localizationpriority: medium
+ms.pagetype: deploy
+audience: itpro
+author: jaimeo
+ms.author: jaimeo
+ms.collection: M365-analytics
+ms.topic: article
+---
+
+# Monitor the health of devices with Device Health
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+## Introduction
+
+Device Health is the newest Windows Analytics solution that complements the existing Upgrade Readiness and Update Compliance solutions by providing IT with reports on some common problems the end users might experience so they can be proactively remediated, thus saving support calls and improving end-user productivity.
+
+Like Upgrade Readiness and Update Compliance, Device Health is a solution built in Azure Portal, a cloud-based monitoring and automation service that has a flexible servicing subscription based on data usage and retention. This release is free for customers to try and will not incur charges on your Azure Portal workspace for its use. For more information about Azure Portal, see [Windows Analytics in the Azure Portal](windows-analytics-azure-portal.md) .
+
+Device Health uses Windows diagnostic data that is part of all Windows 10 devices. If you have already employed Upgrade Readiness or Update Compliance solutions, all you need to do is select Device Health from the Azure Portal solution gallery and add it to your Azure Portal workspace. Device Health requires enhanced diagnostic data, so you might need to implement this policy if you've not already done so.
+
+
+Device Health provides the following:
+
+- Identification of devices that crash frequently, and therefore might need to be rebuilt or replaced
+- Identification of device drivers that are causing device crashes, with suggestions of alternative versions of those drivers that might reduce the number of crashes
+- Notification of Windows Information Protection misconfigurations that send prompts to end users
+- No need for new complex customized infrastructure, thanks to cloud-connected access using Windows 10 diagnostic data
+
+See the following topics in this guide for detailed information about configuring and using the Device Health solution:
+
+- [Get started with Device Health](device-health-get-started.md): How to add Device Health to your environment.
+- [Using Device Health](device-health-using.md): How to begin using Device Health.
+
+An overview of the processes used by the Device Health solution is provided below.
+
+## Device Health licensing
+
+Use of Windows Analytics Device Health requires one of the following licenses:
+
+- Windows 10 Enterprise or Windows 10 Education per-device with active Software Assurance
+- Windows 10 Enterprise E3 or E5 per-device or per-user subscription (including Microsoft 365 F1, E3, or E5)
+- Windows 10 Education A3 or A5 (including Microsoft 365 Education A3 or A5)
+- Windows VDA E3 or E5 per-device or per-user subscription
+
+
+You don't have to install Windows 10 Enterprise on a per-device basis--you just need enough of the above licenses for the number of devices using Device Health.
+
+
+## Device Health architecture
+
+The Device Health architecture and data flow is summarized by the following five-step process:
+
+
+
+**(1)** User computers send diagnostic data to a secure Microsoft data center using the Microsoft Data Management Service.
+**(2)** Diagnostic data is analyzed by the Microsoft Telemetry Service.
+**(3)** Diagnostic data is pushed from the Microsoft Telemetry Service to your Azure Portal workspace.
+**(4)** Diagnostic data is available in the Device Health solution.
+**(5)** You are now able to proactively monitor Device Health issues in your environment.
+
+These steps are illustrated in following diagram:
+
+ [](images/analytics-architecture.png)
+
+>[!NOTE]
+>This process assumes that Windows diagnostic data is enabled and data sharing is enabled as described in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md).
+
+
+
+
+## Related topics
+
+[Get started with Device Health](device-health-get-started.md)
+
+[Use Device Health to monitor frequency and causes of device crashes](device-health-using.md)
+
+For the latest information on Windows Analytics, including new features and usage tips, see the [Windows Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics)
diff --git a/windows/deployment/update/device-health-using.md b/windows/deployment/update/device-health-using.md
index d2d9086345..8ca94aa1a8 100644
--- a/windows/deployment/update/device-health-using.md
+++ b/windows/deployment/update/device-health-using.md
@@ -6,7 +6,7 @@ description: Explains how to begin using Device Health.
ms.prod: w10
ms.mktglfcycl: deploy
keywords: oms, operations management suite, wdav, health, log analytics
-ms.sitesec: library
+
ms.pagetype: deploy
author: jaimeo
ms.author: jaimeo
@@ -17,6 +17,9 @@ ms.topic: article
# Using Device Health
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
This section describes how to use Device Health to monitor devices deployed on your network and troubleshoot the causes if they crash.
diff --git a/windows/deployment/update/feature-update-conclusion.md b/windows/deployment/update/feature-update-conclusion.md
index 7cd119e52b..5c72afc8c0 100644
--- a/windows/deployment/update/feature-update-conclusion.md
+++ b/windows/deployment/update/feature-update-conclusion.md
@@ -1,24 +1,24 @@
----
-title: Best practices for feature updates - conclusion
-description: Final thoughts about how to deploy feature updates
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.author: greglin
-ms.date: 07/09/2018
-ms.reviewer:
-manager: laurawi
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-# Conclusion
-
-**Applies to**: Windows 10
-
-Mission critical devices that need to be online 24x7 pose unique challenges for the IT Pro looking to stay current with the latest Windows 10 feature update. Because these devices are online continually, providing mission critical services, with only a small window of time available to apply feature updates, specific procedures are required to effectively keep these devices current, with as little downtime as possible.
-
-Whether you have defined servicing windows at your disposal where feature updates can be installed automatically, or you require user initiated installs by a technician, this whitepaper provides guidelines for either approach. Improvements are continually being made to Windows 10 setup to reduce device offline time for feature updates. This whitepaper will be updated as enhancements become available to improve the overall servicing approach and experience.
-
+---
+title: Best practices for feature updates - conclusion
+description: Final thoughts about how to deploy feature updates
+ms.prod: w10
+ms.mktglfcycl: manage
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationpriority: medium
+ms.author: jaimeo
+ms.reviewer:
+manager: laurawi
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+# Conclusion
+
+**Applies to**: Windows 10
+
+Mission critical devices that need to be online 24x7 pose unique challenges for the IT Pro looking to stay current with the latest Windows 10 feature update. Because these devices are online continually, providing mission critical services, with only a small window of time available to apply feature updates, specific procedures are required to effectively keep these devices current, with as little downtime as possible.
+
+Whether you have defined servicing windows at your disposal where feature updates can be installed automatically, or you require user initiated installs by a technician, this whitepaper provides guidelines for either approach. Improvements are continually being made to Windows 10 setup to reduce device offline time for feature updates. This whitepaper will be updated as enhancements become available to improve the overall servicing approach and experience.
+
diff --git a/windows/deployment/update/feature-update-maintenance-window.md b/windows/deployment/update/feature-update-maintenance-window.md
index 0fbe54bae5..da74aafced 100644
--- a/windows/deployment/update/feature-update-maintenance-window.md
+++ b/windows/deployment/update/feature-update-maintenance-window.md
@@ -1,261 +1,261 @@
----
-title: Best practices - deploy feature updates during maintenance windows
-description: Learn how to deploy feature updates during a maintenance window
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.author: greglin
-ms.date: 07/09/2018
-ms.reviewer:
-manager: laurawi
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-# Deploy feature updates during maintenance windows
-
-**Applies to**: Windows 10
-
-Use the following information to deploy feature updates during a maintenance window.
-
-## Get ready to deploy feature updates
-
-### Step 1: Configure maintenance windows
-
-1. In the Configuration Manager console, choose **Assets and Compliance> Device Collections**.
-2. In the **Device Collections** list, select the collection for which you intended to deploy the feature update(s).
-3. On the **Home** tab, in the **Properties** group, choose **Properties**.
-4. In the **Maintenance Windows** tab of the `` Properties dialog box, choose the New icon.
-5. Complete the `` Schedule dialog.
-6. Select from the Apply this schedule to drop-down list.
-7. Choose **OK** and then close the **\ Properties** dialog box.
-
-### Step 2: Review computer restart device settings
-
-If you’re not suppressing computer restarts and the feature update will be installed when no users are present, consider deploying a custom client settings policy to your feature update target collection to shorten the settings below or consider the total duration of these settings when defining your maintenance window duration.
-
-For example, by default, 90 minutes will be honored before the system is rebooted after the feature update install. If users will not be impacted by the user logoff or restart, there is no need to wait a full 90 minutes before rebooting the computer. If a delay and notification is needed, ensure that the maintenance window takes this into account along with the total time needed to install the feature update.
-
->[!NOTE]
-> The following settings must be shorter in duration than the shortest maintenance window applied to the computer.
->- **Display a temporary notification to the user that indicates the interval before the user is logged off or the computer restarts (minutes).**
->- **Display a dialog box that the user cannot close, which displays the countdown interval before the user is logged off or the computer restarts (minutes).**
-
-### Step 3: Enable Peer Cache
-
-Use **Peer Cache** to help manage deployment of content to clients in remote locations. Peer Cache is a built-in Configuration Manager solution that enables clients to share content with other clients directly from their local cache.
-
-[Enable Configuration Manager client in full OS to share content](https://docs.microsoft.com/sccm/core/clients/deploy/about-client-settings#enable-configuration-manager-client-in-full-os-to-share-content) if you have clients in remote locations that would benefit from downloading feature update content from a peer instead of downloading it from a distribution point (or Microsoft Update).
-
-### Step 4: Override the default Windows setup priority (Windows 10, version 1709 and later)
-
-If you’re deploying **Feature update to Windows 10, version 1709** or later, by default, portions of setup are configured to run at a lower priority. This can result in a longer total install time for the feature update. When deploying within a maintenance window, we recommend that you override this default behavior to benefit from faster total install times. To override the default priority, create a file called SetupConfig.ini on each machine to be upgraded in the below location containing the single section noted.
-
-%systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini
-
-```
-[SetupConfig]
-Priority=Normal
-```
-
-You can use the new [Run Scripts](https://docs.microsoft.com/sccm/apps/deploy-use/create-deploy-scripts) feature to run a PowerShell script like the sample below to create the SetupConfig.ini on target devices.
-
-```
-#Parameters
-Param(
- [string] $PriorityValue = "Normal"
- )
-
-#Variable for ini file path
-$iniFilePath = "$env:SystemDrive\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini"
-
-#Variables for SetupConfig
-$iniSetupConfigSlogan = "[SetupConfig]"
-$iniSetupConfigKeyValuePair =@{"Priority"=$PriorityValue;}
-
-#Init SetupConfig content
-$iniSetupConfigContent = @"
-$iniSetupConfigSlogan
-"@
-
-#Build SetupConfig content with settings
-foreach ($k in $iniSetupConfigKeyValuePair.Keys)
-{
- $val = $iniSetupConfigKeyValuePair[$k]
-
- $iniSetupConfigContent = $iniSetupConfigContent.Insert($iniSetupConfigContent.Length, "`r`n$k=$val")
-}
-
-#Write content to file
-New-Item $iniFilePath -ItemType File -Value $iniSetupConfigContent -Force
-
-Disclaimer
-Sample scripts are not supported under any Microsoft standard support program or service. The sample scripts is
-provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without
-limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk
-arising out of the use or performance of the sample script and documentation remains with you. In no event shall
-Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable
-for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption,
-loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample script
-or documentation, even if Microsoft has been advised of the possibility of such damages.
-```
-
->[!NOTE]
->If you elect not to override the default setup priority, you will need to increase the [maximum run time](https://docs.microsoft.com/sccm/sum/get-started/manage-settings-for-software-updates#BKMK_SetMaxRunTime) value for Feature Update to Windows 10, version 1709 or higher from the default of 60 minutes. A value of 240 minutes may be required. Remember to ensure that your maintenance window duration is larger than your defined maximum run time value.
-
-## Manually deploy feature updates
-
-The following sections provide the steps to manually deploy a feature update.
-
-### Step 1: Specify search criteria for feature updates
-There are potentially a thousand or more feature updates displayed in the Configuration Manager console. The first step in the workflow for manually deploying feature updates is to identify the feature updates that you want to deploy.
-
-1. In the Configuration Manager console, click **Software Library**.
-2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. The synchronized feature updates are displayed.
-3. In the search pane, filter to identify the feature updates that you need by using one or both of the following steps:
- - In the search text box, type a search string that will filter the feature updates. For example, type the version number for a specific feature update, or enter a string that would appear in the title of the feature update.
- - Click **Add Criteria**, select the criteria that you want to use to filter software updates, click **Add**, and then provide the values for the criteria. For example, Title contains 1803, Required is greater than or equal to 1, and Language equals English.
-
-4. Save the search for future use.
-
-### Step 2: Download the content for the feature update(s)
-Before you deploy the feature updates, you can download the content as a separate step. Do this so you can verify that the content is available on the distribution points before you deploy the feature updates. This will help you to avoid any unexpected issues with the content delivery. Use the following procedure to download the content for feature updates before creating the deployment.
-
-1. In the Configuration Manager console, navigate to **Software Library > Windows 10 Servicing**.
-2. Choose the feature update(s) to download by using your saved search criteria. Select one or more of the feature updates returned, right click, and select Download.
-
- The **Download Software Updates Wizard** opens.
-3. On the **Deployment Package** page, configure the following settings:
- **Create a new deployment package**: Select this setting to create a new deployment package for the software updates that are in the deployment. Configure the following settings:
- - **Name**: Specifies the name of the deployment package. The package must have a unique name that briefly describes the package content. It is limited to 50 characters.
- - **Description**: Specifies the description of the deployment package. The package description provides information about the package contents and is limited to 127 characters.
- - **Package source**: Specifies the location of the feature update source files. Type a network path for the source location, for example, \\server\sharename\path, or click **Browse** to find the network location. You must create the shared folder for the deployment package source files before you proceed to the next page.
-
- >[!NOTE]
- >The deployment package source location that you specify cannot be used by another software deployment package.
-
- >[!IMPORTANT]
- >The SMS Provider computer account and the user that is running the wizard to download the feature updates must both have Write NTFS permissions on the download location. You should carefully restrict access to the download location to reduce the risk of attackers tampering with the feature update source files.
-
- >[!IMPORTANT]
- >You can change the package source location in the deployment package properties after Configuration Manager creates the deployment package. But if you do so, you must first copy the content from the original package source to the new package source location.
-
- Click **Next**.
-4. On the **Distribution Points** page, specify the distribution points or distribution point groups that will host the feature update files, and then click **Next**. For more information about distribution points, see [Distribution point configurations](https://docs.microsoft.com/sccm/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_configs).
-
- >[!NOTE]
- >The Distribution Points page is available only when you create a new software update deployment package.
-5. On the **Distribution Settings** page, specify the following settings:
-
- - **Distribution priority**: Use this setting to specify the distribution priority for the deployment package. The distribution priority applies when the deployment package is sent to distribution points at child sites. Deployment packages are sent in priority order: High, Medium, or Low. Packages with identical priorities are sent in the order in which they were created. If there is no backlog, the package will process immediately regardless of its priority. By default, packages are sent using Medium priority.
- - **Enable for on-demand distribution**: Use this setting to enable on-demand content distribution to preferred distribution points. When this setting is enabled, the management point creates a trigger for the distribution manager to distribute the content to all preferred distribution points when a client requests the content for the package and the content is not available on any preferred distribution points. For more information about preferred distribution points and on-demand content, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios).
- - **Prestaged distribution point settings**: Use this setting to specify how you want to distribute content to prestaged distribution points. Choose one of the following options:
- - **Automatically download content when packages are assigned to distribution points**: Use this setting to ignore the prestage settings and distribute content to the distribution point.
- - **Download only content changes to the distribution point**: Use this setting to prestage the initial content to the distribution point, and then distribute content changes to the distribution point.
- - **Manually copy the content in this package to the distribution point**: Use this setting to always prestage content on the distribution point. This is the default setting.
-
- For more information about prestaging content to distribution points, see [Use Prestaged content](https://docs.microsoft.com/sccm/core/servers/deploy/configure/deploy-and-manage-content#bkmk_prestage).
- Click **Next**.
-6. On the **Download Location** page, specify location that Configuration Manager will use to download the software update source files. As needed, use the following options:
-
- - **Download software updates from the Internet**: Select this setting to download the software updates from the location on the Internet. This is the default setting.
- - **Download software updates from a location on the local network**: Select this setting to download software updates from a local folder or shared network folder. Use this setting when the computer running the wizard does not have Internet access.
-
- >[!NOTE]
- >When you use this setting, download the software updates from any computer with Internet access, and then copy the software updates to a location on the local network that is accessible from the computer running the wizard.
-
- Click **Next**.
-7. On the **Language Selection** page, specify the languages for which the selected feature updates are to be downloaded, and then click **Next**. Ensure that your language selection matches the language(s) of the feature updates selected for download. For example, if you selected English and German based feature updates for download, select those same languages on the language selection page.
-8. On the **Summary** page, verify the settings that you selected in the wizard, and then click Next to download the software updates.
-9. On the **Completion** page, verify that the software updates were successfully downloaded, and then click Close.
-
-#### To monitor content status
-1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console.
-2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**.
-3. Select the feature update package that you previously identified to download the feature updates.
-4. On the **Home** tab, in the Content group, click **View Status**.
-
-### Step 3: Deploy the feature update(s)
-After you determine which feature updates you intend to deploy, you can manually deploy the feature update(s). Use the following procedure to manually deploy the feature update(s).
-
-1. In the Configuration Manager console, click **Software Library**.
-2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**.
-3. Choose the feature update(s) to deploy by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Deploy**.
-
- The **Deploy Software Updates Wizard** opens.
-4. On the General page, configure the following settings:
- - **Name**: Specify the name for the deployment. The deployment must have a unique name that describes the purpose of the deployment and differentiates it from other deployments in the Configuration Manager site. By default, Configuration Manager automatically provides a name for the deployment in the following format: **Microsoft Software Updates - \\**
- - **Description**: Specify a description for the deployment. The description provides an overview of the deployment and any other relevant information that helps to identify and differentiate the deployment among others in Configuration Manager site. The description field is optional, has a limit of 256 characters, and has a blank value by default.
- - **Software Update/Software Update Group**: Verify that the displayed software update group, or software update, is correct.
- - **Select Deployment Template**: Specify whether to apply a previously saved deployment template. You can configure a deployment template to contain multiple common software update deployment properties and then apply the template when you deploy subsequent software updates to ensure consistency across similar deployments and to save time.
- - **Collection**: Specify the collection for the deployment, as applicable. Members of the collection receive the feature updates that are defined in the deployment.
-5. On the Deployment Settings page, configure the following settings:
-
- - **Type of deployment**: Specify the deployment type for the software update deployment. Select **Required** to create a mandatory software update deployment in which the feature updates are automatically installed on clients before a configured installation deadline.
-
- >[!IMPORTANT]
- > After you create the software update deployment, you cannot later change the type of deployment.
-
- >[!NOTE]
- >A software update group deployed as Required will be downloaded in background and honor BITS settings, if configured.
-
- - **Use Wake-on-LAN to wake up clients for required deployments**: Specify whether to enable Wake On LAN at the deadline to send wake-up packets to computers that require one or more software updates in the deployment. Any computers that are in sleep mode at the installation deadline time will be awakened so the software update installation can initiate. Clients that are in sleep mode that do not require any software updates in the deployment are not started. By default, this setting is not enabled and is available only when Type of deployment is set to Required.
-
- >[!WARNING]
- >Before you can use this option, computers and networks must be configured for Wake On LAN.
-
- - **Detail level**: Specify the level of detail for the state messages that are reported by client computers.
-6. On the Scheduling page, configure the following settings:
-
- - **Schedule evaluation**: Specify whether the available time and installation deadline times are evaluated according to UTC or the local time of the computer running the Configuration Manager console.
-
- >[!NOTE]
- >When you select local time, and then select **As soon as possible** for the **Software available time** or **Installation deadline**, the current time on the computer running the Configuration Manager console is used to evaluate when updates are available or when they are installed on a client. If the client is in a different time zone, these actions will occur when the client's time reaches the evaluation time.
-
- - **Software available time**: Select **As soon as possible** to specify when the software updates will be available to clients:
- - **As soon as possible**: Select this setting to make the software updates in the deployment available to clients as soon as possible. When the deployment is created, the client policy is updated, the clients are made aware of the deployment at their next client policy polling cycle, and then the software updates are available for installation.
- - **Installation deadline**: Select **Specific time** to specify the installation deadline for the software updates in the deployment.
-
- >[!NOTE]
- >You can configure the installation deadline setting only when **Type of deployment** is set to **Required** on the Deployment Settings page.
-
- - **Specific time**: Select this setting to automatically install the software updates in the deployment at a specific date and time. Set the date and time value to correspond with your defined maintenance window for the target collection. Allow sufficient time for clients to download the content in advance of the deadline. Adjust accordingly if clients in your environment will need additional download time. E.g., slow or unreliable network links.
-
- >[!NOTE]
- >The actual installation deadline time is the specific time that you configure plus a random amount of time up to 2 hours. This reduces the potential impact of all client computers in the destination collection installing the software updates in the deployment at the same time. Configure the Computer Agent client setting, Disable deadline randomization to disable the installation randomization delay for the required software updates to allow a greater chance for the installation to start and complete within your defined maintenance window. For more information, see [Computer Agent](https://docs.microsoft.com/sccm/core/clients/deploy/about-client-settings#computer-agent).
-7. On the User Experience page, configure the following settings:
- - **User notifications**: Specify whether to display notification of the software updates in Software Center on the client computer at the configured **Software available time** and whether to display user notifications on the client computers. When **Type of deployment** is set to **Available** on the Deployment Settings page, you cannot select **Hide in Software Center and all notifications**.
- - **Deadline behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify the behavior that is to occur when the deadline is reached for the software update deployment. Specify whether to install the software updates in the deployment. Also specify whether to perform a system restart after software update installation regardless of a configured maintenance window. For more information about maintenance windows, see [How to use maintenance windows](https://docs.microsoft.com/sccm/core/clients/manage/collections/use-maintenance-windows).
- - **Device restart behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify whether to suppress a system restart on servers and workstations after software updates are installed and a system restart is required to complete the installation.
-
- >[!IMPORTANT]
- >Suppressing system restarts can be useful in server environments or for cases in which you do not want the computers that are installing the software updates to restart by default. However, doing so can leave computers in an insecure state, whereas allowing a forced restart helps to ensure immediate completion of the software update installation.
- - **Write filter handling for Windows Embedded devices**: When you deploy software updates to Windows Embedded devices that are write filter enabled, you can specify to install the software update on the temporary overlay and either commit changes later or commit the changes at the installation deadline or during a maintenance window. When you commit changes at the installation deadline or during a maintenance window, a restart is required and the changes persist on the device.
-
- >[!NOTE]
- >When you deploy a software update to a Windows Embedded device, make sure that the device is a member of a collection that has a configured maintenance window.
- - **Software updates deployment re-evaluation behavior upon restart**: Starting in Configuration Manager version 1606, select this setting to configure software updates deployments to have clients run a software updates compliance scan immediately after a client installs software updates and restarts. This enables the client to check for additional software updates that become applicable after the client restarts, and to then install them (and become compliant) during the same maintenance window.
-8. On the Alerts page, configure how Configuration Manager and System Center Operations Manager will generate alerts for this deployment. You can configure alerts only when **Type of deployment** is set to **Required** on the Deployment Settings page.
-
- >[!NOTE]
- >You can review recent software updates alerts from the Software Updates node in the Software Library workspace.
-9. On the Download Settings page, configure the following settings:
- - Specify whether the client will download and install the software updates when a client is connected to a slow network or is using a fallback content location.
- - Specify whether to have the client download and install the software updates from a fallback distribution point when the content for the software updates is not available on a preferred distribution point.
- - **Allow clients to share content with other clients on the same subnet**: Specify whether to enable the use of BranchCache for content downloads. For more information about BranchCache, see [Fundamental concepts for content management](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/fundamental-concepts-for-content-management#branchcache).
- - **If software updates are not available on distribution point in current, neighbor or site groups, download content from Microsoft Updates**: Select this setting to have clients that are connected to the intranet download software updates from Microsoft Update if software updates are not available on distribution points. Internet-based clients can always go to Microsoft Update for software updates content.
- - Specify whether to allow clients to download after an installation deadline when they use metered Internet connections. Internet providers sometimes charge by the amount of data that you send and receive when you are on a metered Internet connection.
-
- >[!NOTE]
- >Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios).
-10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting.
-11. Click **Next** to deploy the feature update(s).
-
-### Step 4: Monitor the deployment status
-After you deploy the feature update(s), you can monitor the deployment status. Use the following procedure to monitor the deployment status:
-
-1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**.
-2. Click the software update group or software update for which you want to monitor the deployment status.
-3. On the **Home** tab, in the **Deployment** group, click **View Status**.
+---
+title: Best practices - deploy feature updates during maintenance windows
+description: Learn how to deploy feature updates during a maintenance window
+ms.prod: w10
+ms.mktglfcycl: manage
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationpriority: medium
+ms.author: jaimeo
+ms.reviewer:
+manager: laurawi
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+# Deploy feature updates during maintenance windows
+
+**Applies to**: Windows 10
+
+Use the following information to deploy feature updates during a maintenance window.
+
+## Get ready to deploy feature updates
+
+### Step 1: Configure maintenance windows
+
+1. In the Configuration Manager console, choose **Assets and Compliance> Device Collections**.
+2. In the **Device Collections** list, select the collection for which you intended to deploy the feature update(s).
+3. On the **Home** tab, in the **Properties** group, choose **Properties**.
+4. In the **Maintenance Windows** tab of the `` Properties dialog box, choose the New icon.
+5. Complete the `` Schedule dialog.
+6. Select from the Apply this schedule to drop-down list.
+7. Choose **OK** and then close the **\ Properties** dialog box.
+
+### Step 2: Review computer restart device settings
+
+If you’re not suppressing computer restarts and the feature update will be installed when no users are present, consider deploying a custom client settings policy to your feature update target collection to shorten the settings below or consider the total duration of these settings when defining your maintenance window duration.
+
+For example, by default, 90 minutes will be honored before the system is rebooted after the feature update install. If users will not be impacted by the user logoff or restart, there is no need to wait a full 90 minutes before rebooting the computer. If a delay and notification is needed, ensure that the maintenance window takes this into account along with the total time needed to install the feature update.
+
+>[!NOTE]
+> The following settings must be shorter in duration than the shortest maintenance window applied to the computer.
+>- **Display a temporary notification to the user that indicates the interval before the user is logged off or the computer restarts (minutes).**
+>- **Display a dialog box that the user cannot close, which displays the countdown interval before the user is logged off or the computer restarts (minutes).**
+
+### Step 3: Enable Peer Cache
+
+Use **Peer Cache** to help manage deployment of content to clients in remote locations. Peer Cache is a built-in Configuration Manager solution that enables clients to share content with other clients directly from their local cache.
+
+[Enable Configuration Manager client in full OS to share content](https://docs.microsoft.com/sccm/core/clients/deploy/about-client-settings#enable-configuration-manager-client-in-full-os-to-share-content) if you have clients in remote locations that would benefit from downloading feature update content from a peer instead of downloading it from a distribution point (or Microsoft Update).
+
+### Step 4: Override the default Windows setup priority (Windows 10, version 1709 and later)
+
+If you’re deploying **Feature update to Windows 10, version 1709** or later, by default, portions of setup are configured to run at a lower priority. This can result in a longer total install time for the feature update. When deploying within a maintenance window, we recommend that you override this default behavior to benefit from faster total install times. To override the default priority, create a file called SetupConfig.ini on each machine to be upgraded in the below location containing the single section noted.
+
+%systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini
+
+```
+[SetupConfig]
+Priority=Normal
+```
+
+You can use the new [Run Scripts](https://docs.microsoft.com/sccm/apps/deploy-use/create-deploy-scripts) feature to run a PowerShell script like the sample below to create the SetupConfig.ini on target devices.
+
+```
+#Parameters
+Param(
+ [string] $PriorityValue = "Normal"
+ )
+
+#Variable for ini file path
+$iniFilePath = "$env:SystemDrive\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini"
+
+#Variables for SetupConfig
+$iniSetupConfigSlogan = "[SetupConfig]"
+$iniSetupConfigKeyValuePair =@{"Priority"=$PriorityValue;}
+
+#Init SetupConfig content
+$iniSetupConfigContent = @"
+$iniSetupConfigSlogan
+"@
+
+#Build SetupConfig content with settings
+foreach ($k in $iniSetupConfigKeyValuePair.Keys)
+{
+ $val = $iniSetupConfigKeyValuePair[$k]
+
+ $iniSetupConfigContent = $iniSetupConfigContent.Insert($iniSetupConfigContent.Length, "`r`n$k=$val")
+}
+
+#Write content to file
+New-Item $iniFilePath -ItemType File -Value $iniSetupConfigContent -Force
+
+Disclaimer
+Sample scripts are not supported under any Microsoft standard support program or service. The sample scripts is
+provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without
+limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk
+arising out of the use or performance of the sample script and documentation remains with you. In no event shall
+Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable
+for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption,
+loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample script
+or documentation, even if Microsoft has been advised of the possibility of such damages.
+```
+
+>[!NOTE]
+>If you elect not to override the default setup priority, you will need to increase the [maximum run time](https://docs.microsoft.com/sccm/sum/get-started/manage-settings-for-software-updates#BKMK_SetMaxRunTime) value for Feature Update to Windows 10, version 1709 or higher from the default of 60 minutes. A value of 240 minutes may be required. Remember to ensure that your maintenance window duration is larger than your defined maximum run time value.
+
+## Manually deploy feature updates
+
+The following sections provide the steps to manually deploy a feature update.
+
+### Step 1: Specify search criteria for feature updates
+There are potentially a thousand or more feature updates displayed in the Configuration Manager console. The first step in the workflow for manually deploying feature updates is to identify the feature updates that you want to deploy.
+
+1. In the Configuration Manager console, click **Software Library**.
+2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. The synchronized feature updates are displayed.
+3. In the search pane, filter to identify the feature updates that you need by using one or both of the following steps:
+ - In the search text box, type a search string that will filter the feature updates. For example, type the version number for a specific feature update, or enter a string that would appear in the title of the feature update.
+ - Click **Add Criteria**, select the criteria that you want to use to filter software updates, click **Add**, and then provide the values for the criteria. For example, Title contains 1803, Required is greater than or equal to 1, and Language equals English.
+
+4. Save the search for future use.
+
+### Step 2: Download the content for the feature update(s)
+Before you deploy the feature updates, you can download the content as a separate step. Do this so you can verify that the content is available on the distribution points before you deploy the feature updates. This will help you to avoid any unexpected issues with the content delivery. Use the following procedure to download the content for feature updates before creating the deployment.
+
+1. In the Configuration Manager console, navigate to **Software Library > Windows 10 Servicing**.
+2. Choose the feature update(s) to download by using your saved search criteria. Select one or more of the feature updates returned, right click, and select Download.
+
+ The **Download Software Updates Wizard** opens.
+3. On the **Deployment Package** page, configure the following settings:
+ **Create a new deployment package**: Select this setting to create a new deployment package for the software updates that are in the deployment. Configure the following settings:
+ - **Name**: Specifies the name of the deployment package. The package must have a unique name that briefly describes the package content. It is limited to 50 characters.
+ - **Description**: Specifies the description of the deployment package. The package description provides information about the package contents and is limited to 127 characters.
+ - **Package source**: Specifies the location of the feature update source files. Type a network path for the source location, for example, \\server\sharename\path, or click **Browse** to find the network location. You must create the shared folder for the deployment package source files before you proceed to the next page.
+
+ >[!NOTE]
+ >The deployment package source location that you specify cannot be used by another software deployment package.
+
+ >[!IMPORTANT]
+ >The SMS Provider computer account and the user that is running the wizard to download the feature updates must both have Write NTFS permissions on the download location. You should carefully restrict access to the download location to reduce the risk of attackers tampering with the feature update source files.
+
+ >[!IMPORTANT]
+ >You can change the package source location in the deployment package properties after Configuration Manager creates the deployment package. But if you do so, you must first copy the content from the original package source to the new package source location.
+
+ Click **Next**.
+4. On the **Distribution Points** page, specify the distribution points or distribution point groups that will host the feature update files, and then click **Next**. For more information about distribution points, see [Distribution point configurations](https://docs.microsoft.com/sccm/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_configs).
+
+ >[!NOTE]
+ >The Distribution Points page is available only when you create a new software update deployment package.
+5. On the **Distribution Settings** page, specify the following settings:
+
+ - **Distribution priority**: Use this setting to specify the distribution priority for the deployment package. The distribution priority applies when the deployment package is sent to distribution points at child sites. Deployment packages are sent in priority order: High, Medium, or Low. Packages with identical priorities are sent in the order in which they were created. If there is no backlog, the package will process immediately regardless of its priority. By default, packages are sent using Medium priority.
+ - **Enable for on-demand distribution**: Use this setting to enable on-demand content distribution to preferred distribution points. When this setting is enabled, the management point creates a trigger for the distribution manager to distribute the content to all preferred distribution points when a client requests the content for the package and the content is not available on any preferred distribution points. For more information about preferred distribution points and on-demand content, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios).
+ - **Prestaged distribution point settings**: Use this setting to specify how you want to distribute content to prestaged distribution points. Choose one of the following options:
+ - **Automatically download content when packages are assigned to distribution points**: Use this setting to ignore the prestage settings and distribute content to the distribution point.
+ - **Download only content changes to the distribution point**: Use this setting to prestage the initial content to the distribution point, and then distribute content changes to the distribution point.
+ - **Manually copy the content in this package to the distribution point**: Use this setting to always prestage content on the distribution point. This is the default setting.
+
+ For more information about prestaging content to distribution points, see [Use Prestaged content](https://docs.microsoft.com/sccm/core/servers/deploy/configure/deploy-and-manage-content#bkmk_prestage).
+ Click **Next**.
+6. On the **Download Location** page, specify location that Configuration Manager will use to download the software update source files. As needed, use the following options:
+
+ - **Download software updates from the Internet**: Select this setting to download the software updates from the location on the Internet. This is the default setting.
+ - **Download software updates from a location on the local network**: Select this setting to download software updates from a local folder or shared network folder. Use this setting when the computer running the wizard does not have Internet access.
+
+ >[!NOTE]
+ >When you use this setting, download the software updates from any computer with Internet access, and then copy the software updates to a location on the local network that is accessible from the computer running the wizard.
+
+ Click **Next**.
+7. On the **Language Selection** page, specify the languages for which the selected feature updates are to be downloaded, and then click **Next**. Ensure that your language selection matches the language(s) of the feature updates selected for download. For example, if you selected English and German based feature updates for download, select those same languages on the language selection page.
+8. On the **Summary** page, verify the settings that you selected in the wizard, and then click Next to download the software updates.
+9. On the **Completion** page, verify that the software updates were successfully downloaded, and then click Close.
+
+#### To monitor content status
+1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console.
+2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**.
+3. Select the feature update package that you previously identified to download the feature updates.
+4. On the **Home** tab, in the Content group, click **View Status**.
+
+### Step 3: Deploy the feature update(s)
+After you determine which feature updates you intend to deploy, you can manually deploy the feature update(s). Use the following procedure to manually deploy the feature update(s).
+
+1. In the Configuration Manager console, click **Software Library**.
+2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**.
+3. Choose the feature update(s) to deploy by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Deploy**.
+
+ The **Deploy Software Updates Wizard** opens.
+4. On the General page, configure the following settings:
+ - **Name**: Specify the name for the deployment. The deployment must have a unique name that describes the purpose of the deployment and differentiates it from other deployments in the Configuration Manager site. By default, Configuration Manager automatically provides a name for the deployment in the following format: **Microsoft Software Updates - \\**
+ - **Description**: Specify a description for the deployment. The description provides an overview of the deployment and any other relevant information that helps to identify and differentiate the deployment among others in Configuration Manager site. The description field is optional, has a limit of 256 characters, and has a blank value by default.
+ - **Software Update/Software Update Group**: Verify that the displayed software update group, or software update, is correct.
+ - **Select Deployment Template**: Specify whether to apply a previously saved deployment template. You can configure a deployment template to contain multiple common software update deployment properties and then apply the template when you deploy subsequent software updates to ensure consistency across similar deployments and to save time.
+ - **Collection**: Specify the collection for the deployment, as applicable. Members of the collection receive the feature updates that are defined in the deployment.
+5. On the Deployment Settings page, configure the following settings:
+
+ - **Type of deployment**: Specify the deployment type for the software update deployment. Select **Required** to create a mandatory software update deployment in which the feature updates are automatically installed on clients before a configured installation deadline.
+
+ >[!IMPORTANT]
+ > After you create the software update deployment, you cannot later change the type of deployment.
+
+ >[!NOTE]
+ >A software update group deployed as Required will be downloaded in background and honor BITS settings, if configured.
+
+ - **Use Wake-on-LAN to wake up clients for required deployments**: Specify whether to enable Wake On LAN at the deadline to send wake-up packets to computers that require one or more software updates in the deployment. Any computers that are in sleep mode at the installation deadline time will be awakened so the software update installation can initiate. Clients that are in sleep mode that do not require any software updates in the deployment are not started. By default, this setting is not enabled and is available only when Type of deployment is set to Required.
+
+ >[!WARNING]
+ >Before you can use this option, computers and networks must be configured for Wake On LAN.
+
+ - **Detail level**: Specify the level of detail for the state messages that are reported by client computers.
+6. On the Scheduling page, configure the following settings:
+
+ - **Schedule evaluation**: Specify whether the available time and installation deadline times are evaluated according to UTC or the local time of the computer running the Configuration Manager console.
+
+ >[!NOTE]
+ >When you select local time, and then select **As soon as possible** for the **Software available time** or **Installation deadline**, the current time on the computer running the Configuration Manager console is used to evaluate when updates are available or when they are installed on a client. If the client is in a different time zone, these actions will occur when the client's time reaches the evaluation time.
+
+ - **Software available time**: Select **As soon as possible** to specify when the software updates will be available to clients:
+ - **As soon as possible**: Select this setting to make the software updates in the deployment available to clients as soon as possible. When the deployment is created, the client policy is updated, the clients are made aware of the deployment at their next client policy polling cycle, and then the software updates are available for installation.
+ - **Installation deadline**: Select **Specific time** to specify the installation deadline for the software updates in the deployment.
+
+ >[!NOTE]
+ >You can configure the installation deadline setting only when **Type of deployment** is set to **Required** on the Deployment Settings page.
+
+ - **Specific time**: Select this setting to automatically install the software updates in the deployment at a specific date and time. Set the date and time value to correspond with your defined maintenance window for the target collection. Allow sufficient time for clients to download the content in advance of the deadline. Adjust accordingly if clients in your environment will need additional download time. E.g., slow or unreliable network links.
+
+ >[!NOTE]
+ >The actual installation deadline time is the specific time that you configure plus a random amount of time up to 2 hours. This reduces the potential impact of all client computers in the destination collection installing the software updates in the deployment at the same time. Configure the Computer Agent client setting, Disable deadline randomization to disable the installation randomization delay for the required software updates to allow a greater chance for the installation to start and complete within your defined maintenance window. For more information, see [Computer Agent](https://docs.microsoft.com/sccm/core/clients/deploy/about-client-settings#computer-agent).
+7. On the User Experience page, configure the following settings:
+ - **User notifications**: Specify whether to display notification of the software updates in Software Center on the client computer at the configured **Software available time** and whether to display user notifications on the client computers. When **Type of deployment** is set to **Available** on the Deployment Settings page, you cannot select **Hide in Software Center and all notifications**.
+ - **Deadline behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify the behavior that is to occur when the deadline is reached for the software update deployment. Specify whether to install the software updates in the deployment. Also specify whether to perform a system restart after software update installation regardless of a configured maintenance window. For more information about maintenance windows, see [How to use maintenance windows](https://docs.microsoft.com/sccm/core/clients/manage/collections/use-maintenance-windows).
+ - **Device restart behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify whether to suppress a system restart on servers and workstations after software updates are installed and a system restart is required to complete the installation.
+
+ >[!IMPORTANT]
+ >Suppressing system restarts can be useful in server environments or for cases in which you do not want the computers that are installing the software updates to restart by default. However, doing so can leave computers in an insecure state, whereas allowing a forced restart helps to ensure immediate completion of the software update installation.
+ - **Write filter handling for Windows Embedded devices**: When you deploy software updates to Windows Embedded devices that are write filter enabled, you can specify to install the software update on the temporary overlay and either commit changes later or commit the changes at the installation deadline or during a maintenance window. When you commit changes at the installation deadline or during a maintenance window, a restart is required and the changes persist on the device.
+
+ >[!NOTE]
+ >When you deploy a software update to a Windows Embedded device, make sure that the device is a member of a collection that has a configured maintenance window.
+ - **Software updates deployment re-evaluation behavior upon restart**: Starting in Configuration Manager version 1606, select this setting to configure software updates deployments to have clients run a software updates compliance scan immediately after a client installs software updates and restarts. This enables the client to check for additional software updates that become applicable after the client restarts, and to then install them (and become compliant) during the same maintenance window.
+8. On the Alerts page, configure how Configuration Manager and System Center Operations Manager will generate alerts for this deployment. You can configure alerts only when **Type of deployment** is set to **Required** on the Deployment Settings page.
+
+ >[!NOTE]
+ >You can review recent software updates alerts from the Software Updates node in the Software Library workspace.
+9. On the Download Settings page, configure the following settings:
+ - Specify whether the client will download and install the software updates when a client is connected to a slow network or is using a fallback content location.
+ - Specify whether to have the client download and install the software updates from a fallback distribution point when the content for the software updates is not available on a preferred distribution point.
+ - **Allow clients to share content with other clients on the same subnet**: Specify whether to enable the use of BranchCache for content downloads. For more information about BranchCache, see [Fundamental concepts for content management](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/fundamental-concepts-for-content-management#branchcache).
+ - **If software updates are not available on distribution point in current, neighbor or site groups, download content from Microsoft Updates**: Select this setting to have clients that are connected to the intranet download software updates from Microsoft Update if software updates are not available on distribution points. Internet-based clients can always go to Microsoft Update for software updates content.
+ - Specify whether to allow clients to download after an installation deadline when they use metered Internet connections. Internet providers sometimes charge by the amount of data that you send and receive when you are on a metered Internet connection.
+
+ >[!NOTE]
+ >Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios).
+10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting.
+11. Click **Next** to deploy the feature update(s).
+
+### Step 4: Monitor the deployment status
+After you deploy the feature update(s), you can monitor the deployment status. Use the following procedure to monitor the deployment status:
+
+1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**.
+2. Click the software update group or software update for which you want to monitor the deployment status.
+3. On the **Home** tab, in the **Deployment** group, click **View Status**.
diff --git a/windows/deployment/update/feature-update-mission-critical.md b/windows/deployment/update/feature-update-mission-critical.md
index 61469bed82..37ed550405 100644
--- a/windows/deployment/update/feature-update-mission-critical.md
+++ b/windows/deployment/update/feature-update-mission-critical.md
@@ -1,43 +1,44 @@
----
-title: Best practices and recommendations for deploying Windows 10 Feature updates to mission critical devices
-description: Learn how to deploy feature updates to your mission critical devices
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.author: greglin
-ms.date: 07/10/2018
-ms.reviewer:
-manager: laurawi
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-# Best practices and recommendations for deploying Windows 10 Feature updates to mission critical devices
-
-**Applies to**: Windows 10
-
-Managing an environment with devices that provide mission critical services 24 hours a day, 7 days a week, can present challenges in keeping these devices current with Windows 10 feature updates. The processes that you use to keep regular devices current with Windows 10 feature updates, often aren’t the most effective to service mission critical devices. This whitepaper will focus on the recommended approach of using the System Center Configuration Manager (current branch) software updates feature to deploy Windows 10 semi-annual feature updates.
-
-For simplicity, we will outline the steps to deploy a feature update manually. If you prefer an automated approach, please see [Using Windows 10 servicing plans to deploy Windows 10 feature updates](waas-manage-updates-configuration-manager.md#use-windows-10-servicing-plans-to-deploy-windows-10-feature-updates).
-
-Devices and shared workstations that are online and available 24 hours a day, 7 days a week, can be serviced via one of two primary methods:
-
-- **Service during maintenance windows** – Devices that have established maintenance windows will need to have feature updates scheduled to fit within these windows.
-- **Service only when manually initiated** – Devices that need physical verification of the availability to update will need to have updates manually initiated by a technician.
-
-You can use Configuration Manager to deploy feature updates to Windows 10 devices in two ways. The first option is to use the software updates feature. The second option is to use a task sequence to deploy feature updates. There are times when deploying a Windows 10 feature update requires the use of a task sequence—for example:
-
-- **Upgrade to the next LTSC release.** With the LTSC servicing branch, feature updates are never provided to the Windows clients themselves. Instead, feature updates must be installed like a traditional in-place upgrade.
-- **Additional required tasks.** When deploying a feature update requires additional steps (e.g., suspending disk encryption, updating applications), you can use task sequences to orchestrate the additional steps. Software updates do not have the ability to add steps to their deployments.
-- **Language pack installs.** When deploying a feature update requires the installation of additional language packs, you can use task sequences to orchestrate the installation. Software updates do not have the ability to natively install language packs.
-
-If you need to leverage a task sequence to deploy feature updates, please see [Using a task sequence to deploy Windows 10 updates](waas-manage-updates-configuration-manager.md#use-a-task-sequence-to-deploy-windows-10-updates) for more information. If you find that your requirement for a task sequence is based solely on the need to run additional tasks preformed pre-install or pre-commit, please see the new [run custom actions](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions) functionality first introduced with Windows 10, version 1803. You may be able to leverage this functionality with the software updates deployment method.
-
-Use the following information:
-
-
-- [Deploy feature updates during maintenance windows](feature-update-maintenance-window.md)
-- [Deploy feature updates for user-initiated installations](feature-update-user-install.md)
-- [Conclusion](feature-update-conclusion.md)
+---
+title: Best practices and recommendations for deploying Windows 10 Feature updates to mission critical devices
+description: Learn how to deploy feature updates to your mission critical devices
+ms.prod: w10
+ms.mktglfcycl: manage
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationpriority: medium
+ms.author: jaimeo
+ms.date: 07/10/2018
+ms.reviewer:
+manager: laurawi
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+# Best practices and recommendations for deploying Windows 10 Feature updates to mission critical devices
+
+**Applies to**: Windows 10
+
+Managing an environment with devices that provide mission critical services 24 hours a day, 7 days a week, can present challenges in keeping these devices current with Windows 10 feature updates. The processes that you use to keep regular devices current with Windows 10 feature updates, often aren’t the most effective to service mission critical devices. This whitepaper will focus on the recommended approach of using the System Center Configuration Manager (current branch) software updates feature to deploy Windows 10 semi-annual feature updates.
+
+For simplicity, we will outline the steps to deploy a feature update manually. If you prefer an automated approach, please see [Using Windows 10 servicing plans to deploy Windows 10 feature updates](waas-manage-updates-configuration-manager.md#use-windows-10-servicing-plans-to-deploy-windows-10-feature-updates).
+
+Devices and shared workstations that are online and available 24 hours a day, 7 days a week, can be serviced via one of two primary methods:
+
+- **Service during maintenance windows** – Devices that have established maintenance windows will need to have feature updates scheduled to fit within these windows.
+- **Service only when manually initiated** – Devices that need physical verification of the availability to update will need to have updates manually initiated by a technician.
+
+You can use Configuration Manager to deploy feature updates to Windows 10 devices in two ways. The first option is to use the software updates feature. The second option is to use a task sequence to deploy feature updates. There are times when deploying a Windows 10 feature update requires the use of a task sequence—for example:
+
+- **Upgrade to the next LTSC release.** With the LTSC servicing branch, feature updates are never provided to the Windows clients themselves. Instead, feature updates must be installed like a traditional in-place upgrade.
+- **Additional required tasks.** When deploying a feature update requires additional steps (e.g., suspending disk encryption, updating applications), you can use task sequences to orchestrate the additional steps. Software updates do not have the ability to add steps to their deployments.
+- **Language pack installs.** When deploying a feature update requires the installation of additional language packs, you can use task sequences to orchestrate the installation. Software updates do not have the ability to natively install language packs.
+
+If you need to leverage a task sequence to deploy feature updates, please see [Using a task sequence to deploy Windows 10 updates](waas-manage-updates-configuration-manager.md#use-a-task-sequence-to-deploy-windows-10-updates) for more information. If you find that your requirement for a task sequence is based solely on the need to run additional tasks preformed pre-install or pre-commit, please see the new [run custom actions](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions) functionality first introduced with Windows 10, version 1803. You may be able to leverage this functionality with the software updates deployment method.
+
+Use the following information:
+
+
+- [Deploy feature updates during maintenance windows](feature-update-maintenance-window.md)
+- [Deploy feature updates for user-initiated installations](feature-update-user-install.md)
+- [Conclusion](feature-update-conclusion.md)
diff --git a/windows/deployment/update/feature-update-user-install.md b/windows/deployment/update/feature-update-user-install.md
index 8b7e286eab..e22be01edd 100644
--- a/windows/deployment/update/feature-update-user-install.md
+++ b/windows/deployment/update/feature-update-user-install.md
@@ -3,11 +3,10 @@ title: Best practices - deploy feature updates for user-initiated installations
description: Learn how to manually deploy feature updates
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
audience: itpro
-author: greg-lindsay
+author: jaimeo
ms.localizationpriority: medium
-ms.author: greglin
+ms.author: jaimeo
ms.date: 07/10/2018
ms.reviewer:
manager: laurawi
diff --git a/windows/deployment/update/fod-and-lang-packs.md b/windows/deployment/update/fod-and-lang-packs.md
index 8e8e208b29..9dbe7740b3 100644
--- a/windows/deployment/update/fod-and-lang-packs.md
+++ b/windows/deployment/update/fod-and-lang-packs.md
@@ -3,11 +3,11 @@ title: Windows 10 - How to make FoD and language packs available when you're usi
description: Learn how to make FoD and language packs available when you're using WSUS/SCCM
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
+
ms.pagetype: article
-ms.author: greglin
+ms.author: jaimeo
audience: itpro
-author: greg-lindsay
+author: jaimeo
ms.localizationpriority: medium
ms.date: 03/13/2019
ms.reviewer:
diff --git a/windows/deployment/update/how-windows-update-works.md b/windows/deployment/update/how-windows-update-works.md
index e71e615d1f..1103564dea 100644
--- a/windows/deployment/update/how-windows-update-works.md
+++ b/windows/deployment/update/how-windows-update-works.md
@@ -1,146 +1,146 @@
----
-title: How Windows Update works
-description: Learn how Windows Update works, including architecture and troubleshooting
-ms.prod: w10
-ms.mktglfcycl:
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.author: greglin
-ms.date: 09/18/2018
-ms.reviewer:
-manager: laurawi
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-# How does Windows Update work?
-
-> Applies to: Windows 10
-
-The Windows Update workflow has four core areas of functionality:
-
-### Scan
-
-1. Orchestrator schedules the scan.
-2. Orchestrator verifies admin approvals and policies for download.
-
-
-### Download
-1. Orchestrator initiates downloads.
-2. Windows Update downloads manifest files and provides them to the arbiter.
-3. The arbiter evaluates the manifest and tells the Windows Update client to download files.
-4. Windows Update client downloads files in a temporary folder.
-5. The arbiter stages the downloaded files.
-
-
-### Install
-1. Orchestrator initiates the installation.
-2. The arbiter calls the installer to install the package.
-
-
-### Commit
-1. Orchestrator initiates a restart.
-2. The arbiter finalizes before the restart.
-
-
-## How updating works
-During the updating process, the Windows Update Orchestrator operates in the background to scan, download, and install updates. It does this automatically, according to your settings, and in a silent manner that doesn’t disrupt your computer usage.
-
-## Scanning updates
-
-
-The Windows Update Orchestrator on your PC checks the Microsoft Update server or your WSUS endpoint for new updates at random intervals. The randomization ensures that the Windows Update server isn't overloaded with requests all at the same time. The Update Orchestrator searches only for updates that have been added since the last time updates were searched, allowing it to find updates quickly and efficiently.
-
-When checking for updates, the Windows Update Orchestrator evaluates whether the update is appropriate for your computer using guidelines defined by the publisher of the update, for example, Microsoft Office including enterprise group policies.
-
-Make sure you're familiar with the following terminology related to Windows Update scan:
-
-|Term|Definition|
-|----|----------|
-|Update|We use this term to mean a lot of different things, but in this context it's the actual patch or change.|
-|Bundle update|An update that contains 1-N child updates; doesn't contain payload itself.|
-|Child update|Leaf update that's bundled by another update; contains payload.|
-|Detectoid update|A special 'update' that contains "IsInstalled" applicability rule only and no payload. Used for prereq evaluation.|
-|Category update|A special 'detectoid' that has always true IsInstalled rule. Used for grouping updates and for client to filter updates. |
-|Full scan|Scan with empty datastore.|
-|Delta scan|Scan with updates from previous scan already cached in datastore.|
-|Online scan|Scan that hits network and goes against server on cloud. |
-|Offline scan|Scan that doesn't hit network and goes against local datastore. Only useful if online scan has been performed before. |
-|CatScan|Category scan where caller can specify a categoryId to get updates published under the categoryId.|
-|AppCatScan|Category scan where caller can specify an AppCategoryId to get apps published under the appCategoryId.|
-|Software sync|Part of the scan that looks at software updates only (OS and apps).|
-|Driver sync|Part of the scan that looks at Driver updates only. This is run after Software sync and is optional.|
-|ProductSync|Attributes based sync, where client provides a list of device, product and caller attributes ahead of time to allow service to evaluate applicability in the cloud. |
-
-### How Windows Update scanning works
-
-Windows Update takes the following sets of actions when it runs a scan.
-
-#### Starts the scan for updates
-When users start scanning in Windows Update through the Settings panel, the following occurs:
-
-- The scan first generates a “ComApi” message. The caller (Windows Defender Antivirus) tells the WU engine to scan for updates.
-- "Agent" messages: queueing the scan, then actually starting the work:
- - Updates are identified by the different IDs ("Id = 10", "Id = 11") and from the different thread ID numbers.
- - Windows Update uses the thread ID filtering to concentrate on one particular task.
-
- 
-
-#### Identifies service IDs
-
-- Service IDs indicate which update source is being scanned.
- Note The next screen shot shows Microsoft Update and the Flighting service.
-
-- The Windows Update engine treats every service as a separate entity, even though multiple services may contain the same updates.
- 
-- Common service IDs
-
- > [!IMPORTANT]
- > ServiceId here identifies a client abstraction, not any specific service in the cloud. No assumption should be made of which server a serviceId is pointing to, it's totally controlled by the SLS responses.
-
-|Service|ServiceId|
-|-------|---------|
-|Unspecified / Default|WU, MU or WSUS 00000000-0000-0000-0000-000000000000 |
-|WU|9482F4B4-E343-43B6-B170-9A65BC822C77|
-|MU|7971f918-a847-4430-9279-4a52d1efe18d|
-|Store|855E8A7C-ECB4-4CA3-B045-1DFA50104289|
-|OS Flighting|8B24B027-1DEE-BABB-9A95-3517DFB9C552|
-|WSUS or SCCM|Via ServerSelection::ssManagedServer 3DA21691-E39D-4da6-8A4B-B43877BCB1B7 |
-|Offline scan service|Via IUpdateServiceManager::AddScanPackageService|
-
-#### Finds network faults
-Common update failure is caused due to network issues. To find the root of the issue:
-
-- Look for "ProtocolTalker" messages to see client-server sync network traffic.
-- "SOAP faults" can be either client- or server-side issues; read the message.
-- The WU client uses SLS (Service Locator Service) to discover the configurations and endpoints of Microsoft network update sources – WU, MU, Flighting.
-
- > [!NOTE]
- > Warning messages for SLS can be ignored if the search is against WSUS/SCCM.
-
-- On sites that only use WSUS/SCCM, the SLS may be blocked at the firewall. In this case the SLS request will fail, and can’t scan against Windows Update or Microsoft Update but can still scan against WSUS/SCCM, since it’s locally configured.
- 
-
-## Downloading updates
-
-
-Once the Windows Update Orchestrator determines which updates apply to your computer, it will begin downloading the updates, if you have selected the option to automatically download updates. It does this in the background without interrupting your normal use of the computer.
-
-To ensure that your other downloads aren’t affected or slowed down because updates are downloading, Windows Update uses the Delivery Optimization (DO) technology which downloads updates and reduces bandwidth consumption.
-
-For more information see [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md).
-
-## Installing updates
-
-
-When an update is applicable, the "Arbiter" and metadata are downloaded. Depending on your Windows Update settings, when downloading is complete, the Arbiter will gather details from the device, and compare that with the downloaded metadata to create an "action list".
-
-The action list describes all the files needed from WU, and what the install agent (such as CBS or Setup) should do with them. The action list is provided to the install agent along with the payload to begin the installation.
-
-## Committing Updates
-
-
-When the option to automatically install updates is configured, the Windows Update Orchestrator, in most cases, automatically restarts the PC for you after installing the updates. This is necessary because your PC may be insecure, or not fully updated, until a restart is completed. You can use Group Policy settings, mobile device management (MDM), or the registry (not recommended) to configure when devices will restart after a Windows 10 update is installed.
-
-For more information see [Manage device restarts after updates](waas-restart.md).
+---
+title: How Windows Update works
+description: Learn how Windows Update works, including architecture and troubleshooting
+ms.prod: w10
+ms.mktglfcycl:
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationpriority: medium
+ms.author: jaimeo
+ms.reviewer:
+manager: laurawi
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+# How does Windows Update work?
+
+> Applies to: Windows 10
+
+The Windows Update workflow has four core areas of functionality:
+
+### Scan
+
+1. Orchestrator schedules the scan.
+2. Orchestrator verifies admin approvals and policies for download.
+
+
+### Download
+1. Orchestrator initiates downloads.
+2. Windows Update downloads manifest files and provides them to the arbiter.
+3. The arbiter evaluates the manifest and tells the Windows Update client to download files.
+4. Windows Update client downloads files in a temporary folder.
+5. The arbiter stages the downloaded files.
+
+
+### Install
+1. Orchestrator initiates the installation.
+2. The arbiter calls the installer to install the package.
+
+
+### Commit
+1. Orchestrator initiates a restart.
+2. The arbiter finalizes before the restart.
+
+
+## How updating works
+During the updating process, the Windows Update Orchestrator operates in the background to scan, download, and install updates. It does this automatically, according to your settings, and in a silent manner that doesn’t disrupt your computer usage.
+
+## Scanning updates
+
+
+The Windows Update Orchestrator on your PC checks the Microsoft Update server or your WSUS endpoint for new updates at random intervals. The randomization ensures that the Windows Update server isn't overloaded with requests all at the same time. The Update Orchestrator searches only for updates that have been added since the last time updates were searched, allowing it to find updates quickly and efficiently.
+
+When checking for updates, the Windows Update Orchestrator evaluates whether the update is appropriate for your computer using guidelines defined by the publisher of the update, for example, Microsoft Office including enterprise group policies.
+
+Make sure you're familiar with the following terminology related to Windows Update scan:
+
+|Term|Definition|
+|----|----------|
+|Update|We use this term to mean a lot of different things, but in this context it's the actual patch or change.|
+|Bundle update|An update that contains 1-N child updates; doesn't contain payload itself.|
+|Child update|Leaf update that's bundled by another update; contains payload.|
+|Detectoid update|A special 'update' that contains "IsInstalled" applicability rule only and no payload. Used for prereq evaluation.|
+|Category update|A special 'detectoid' that has always true IsInstalled rule. Used for grouping updates and for client to filter updates. |
+|Full scan|Scan with empty datastore.|
+|Delta scan|Scan with updates from previous scan already cached in datastore.|
+|Online scan|Scan that hits network and goes against server on cloud. |
+|Offline scan|Scan that doesn't hit network and goes against local datastore. Only useful if online scan has been performed before. |
+|CatScan|Category scan where caller can specify a categoryId to get updates published under the categoryId.|
+|AppCatScan|Category scan where caller can specify an AppCategoryId to get apps published under the appCategoryId.|
+|Software sync|Part of the scan that looks at software updates only (OS and apps).|
+|Driver sync|Part of the scan that looks at Driver updates only. This is run after Software sync and is optional.|
+|ProductSync|Attributes based sync, where client provides a list of device, product and caller attributes ahead of time to allow service to evaluate applicability in the cloud. |
+
+### How Windows Update scanning works
+
+Windows Update takes the following sets of actions when it runs a scan.
+
+#### Starts the scan for updates
+When users start scanning in Windows Update through the Settings panel, the following occurs:
+
+- The scan first generates a “ComApi” message. The caller (Windows Defender Antivirus) tells the WU engine to scan for updates.
+- "Agent" messages: queueing the scan, then actually starting the work:
+ - Updates are identified by the different IDs ("Id = 10", "Id = 11") and from the different thread ID numbers.
+ - Windows Update uses the thread ID filtering to concentrate on one particular task.
+
+ 
+
+#### Identifies service IDs
+
+- Service IDs indicate which update source is being scanned.
+ Note The next screen shot shows Microsoft Update and the Flighting service.
+
+- The Windows Update engine treats every service as a separate entity, even though multiple services may contain the same updates.
+ 
+- Common service IDs
+
+ > [!IMPORTANT]
+ > ServiceId here identifies a client abstraction, not any specific service in the cloud. No assumption should be made of which server a serviceId is pointing to, it's totally controlled by the SLS responses.
+
+|Service|ServiceId|
+|-------|---------|
+|Unspecified / Default|WU, MU or WSUS 00000000-0000-0000-0000-000000000000 |
+|WU|9482F4B4-E343-43B6-B170-9A65BC822C77|
+|MU|7971f918-a847-4430-9279-4a52d1efe18d|
+|Store|855E8A7C-ECB4-4CA3-B045-1DFA50104289|
+|OS Flighting|8B24B027-1DEE-BABB-9A95-3517DFB9C552|
+|WSUS or SCCM|Via ServerSelection::ssManagedServer 3DA21691-E39D-4da6-8A4B-B43877BCB1B7 |
+|Offline scan service|Via IUpdateServiceManager::AddScanPackageService|
+
+#### Finds network faults
+Common update failure is caused due to network issues. To find the root of the issue:
+
+- Look for "ProtocolTalker" messages to see client-server sync network traffic.
+- "SOAP faults" can be either client- or server-side issues; read the message.
+- The WU client uses SLS (Service Locator Service) to discover the configurations and endpoints of Microsoft network update sources – WU, MU, Flighting.
+
+ > [!NOTE]
+ > Warning messages for SLS can be ignored if the search is against WSUS/SCCM.
+
+- On sites that only use WSUS/SCCM, the SLS may be blocked at the firewall. In this case the SLS request will fail, and can’t scan against Windows Update or Microsoft Update but can still scan against WSUS/SCCM, since it’s locally configured.
+ 
+
+## Downloading updates
+
+
+Once the Windows Update Orchestrator determines which updates apply to your computer, it will begin downloading the updates, if you have selected the option to automatically download updates. It does this in the background without interrupting your normal use of the computer.
+
+To ensure that your other downloads aren’t affected or slowed down because updates are downloading, Windows Update uses the Delivery Optimization (DO) technology which downloads updates and reduces bandwidth consumption.
+
+For more information see [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md).
+
+## Installing updates
+
+
+When an update is applicable, the "Arbiter" and metadata are downloaded. Depending on your Windows Update settings, when downloading is complete, the Arbiter will gather details from the device, and compare that with the downloaded metadata to create an "action list".
+
+The action list describes all the files needed from WU, and what the install agent (such as CBS or Setup) should do with them. The action list is provided to the install agent along with the payload to begin the installation.
+
+## Committing Updates
+
+
+When the option to automatically install updates is configured, the Windows Update Orchestrator, in most cases, automatically restarts the PC for you after installing the updates. This is necessary because your PC may be insecure, or not fully updated, until a restart is completed. You can use Group Policy settings, mobile device management (MDM), or the registry (not recommended) to configure when devices will restart after a Windows 10 update is installed.
+
+For more information see [Manage device restarts after updates](waas-restart.md).
diff --git a/windows/deployment/update/images/UC_commercialID.png b/windows/deployment/update/images/UC_commercialID.png
new file mode 100644
index 0000000000..6896be03e6
Binary files /dev/null and b/windows/deployment/update/images/UC_commercialID.png differ
diff --git a/windows/deployment/update/images/UC_commercialID_GP.png b/windows/deployment/update/images/UC_commercialID_GP.png
new file mode 100644
index 0000000000..95d92cf6df
Binary files /dev/null and b/windows/deployment/update/images/UC_commercialID_GP.png differ
diff --git a/windows/deployment/update/images/UC_telemetrylevel.png b/windows/deployment/update/images/UC_telemetrylevel.png
new file mode 100644
index 0000000000..a11e68a5f8
Binary files /dev/null and b/windows/deployment/update/images/UC_telemetrylevel.png differ
diff --git a/windows/deployment/update/index.md b/windows/deployment/update/index.md
index 9c45228695..d08ff458c4 100644
--- a/windows/deployment/update/index.md
+++ b/windows/deployment/update/index.md
@@ -3,8 +3,7 @@ title: Update Windows 10 in enterprise deployments (Windows 10)
description: Windows as a service provides an all-new way to think about building, deploying, and servicing Windows 10.
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
-author: Jaimeo
+author: jaimeo
manager: laurawi
ms.localizationpriority: high
ms.author: jaimeo
diff --git a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md
index 4f38f8583c..396ef254fd 100644
--- a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md
+++ b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md
@@ -1,131 +1,133 @@
----
-title: Olympia Corp enrollment guidelines
-description: Olympia Corp enrollment guidelines
-ms.author: greglin
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-audience: itpro
author: greg-lindsay
-ms.reviewer:
-manager: laurawi
-keywords: insider, trial, enterprise, lab, corporation, test
----
-
-# Olympia Corp
-
-## What is Windows Insider Lab for Enterprise and Olympia Corp?
-
-Windows Insider Lab for Enterprise is intended for Windows Insiders who want to try new experimental and pre-release enterprise privacy and security features. To get the complete experience of these enterprise features, Olympia Corp, a virtual corporation has been set up to reflect the IT infrastructure of real world business. Selected customers are invited to join Olympia Corp and try these features.
-
-As an Olympia user, you will have an opportunity to:
-
-- Use various enterprise features like Windows Information Protection (WIP), Advanced Threat Protection (ATP), windows Defender Application Guard (WDAG), and Application Virtualization (APP-V).
-- Learn how Microsoft is preparing for GDPR, as well as enabling enterprise customers to prepare for their own readiness.
-- Validate and test pre-release software in your environment.
-- Provide feedback.
-- Interact with engineering team members through a variety of communication channels.
-
->[!Note]
->Enterprise features might have reduced or different security, privacy, accessibility, availability, and reliability standards relative to commercially provided services and software. We may change or discontinue any of the enterprise features at any time without notice.
-
-For more information about Olympia Corp, see [https://olympia.windows.com/Info/FAQ](https://olympia.windows.com/Info/FAQ).
-
-To request an Olympia Corp account, fill out the survey at [https://aka.ms/RegisterOlympia](https://aka.ms/RegisterOlympia).
-
-## Enrollment guidelines
-
-Welcome to Olympia Corp. Here are the steps needed to enroll.
-
-As part of Windows Insider Lab for Enterprise, you can upgrade to Windows 10 Enterprise from Windows 10 Pro. This upgrade is optional. Since certain features such as Windows Defender Application Guard are only available on Windows 10 Enterprise, we recommend you to upgrade.
-
-Choose one of the following two enrollment options:
-
-- To set up an AAD-registered device, [follow these steps](#enrollment-keep-current-edition). In this case, you log onto the device by using an existing (non-Olympia) account.
-
-- If you are running Windows 10 Pro, we recommend that you upgrade to Windows 10 Enterprise by following these steps to [set up an Azure Active Directory-joined device](#enrollment-upgrade-to-enterprise). In this case, you will be able to log on to the device with your Olympia account.
-
-
-
-### Set up an Azure Active Directory-REGISTERED Windows 10 device
-
-This is the Bring Your Own Device (BYOD) method--your device will receive Olympia policies and features, but a new account will not be created. See [Set up Azure Active Directory registered Windows 10 devices](https://docs.microsoft.com/azure/active-directory/device-management-azuread-registered-devices-windows10-setup) for additional information.
-
-1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)).
-
- 
-
-2. If you are already connected to a domain, click the existing account and then click **Disconnect**. Click **Restart Later**.
-
-3. Click **Connect** and enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**.
-
- 
-
-4. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password.
-
- > [!NOTE]
- > Passwords should contain 8-16 characters, including at least one special character or number.
-
- 
-
-5. Read the **Terms and Conditions**. Click **Accept** to participate in the program.
-
-6. If this is the first time you are logging in, fill in the additional information to help you retrieve your account details.
-
-7. Create a PIN for signing into your Olympia corporate account.
-
-8. Go to **Start > Settings > Update & Security > Windows Insider Program**. Click on the current Windows Insider account, and click **Change**. Sign in with your **Olympia corporate account**.
-
- > [!NOTE]
- > To complete this step, you will need to register your account with the [Windows Insider Program for Business](https://insider.windows.com/ForBusiness).
-
-9. Open the **Feedback Hub**, and sign in with your **Olympia corporate account**.
-
-
-
-### Set up Azure Active Directory-JOINED Windows 10 device
-
-- This method will upgrade your Windows 10 Pro license to Enterprise and create a new account. See [Set up Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/device-management-azuread-joined-devices-setup) for more information.
-
-1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)).
-
- 
-
-2. If you are already connected to a domain, click the existing account and then click **Disconnect**. Click **Restart Later**.
-
-3. Click **Connect**, then click **Join this device to Azure Active Directory**.
-
- 
-
-4. Enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**.
-
- 
-
-5. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password.
-
- > [!NOTE]
- > Passwords should contain 8-16 characters, including at least one special character or number.
-
- 
-
-6. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**.
-
-7. If this is the first time you are signing in, fill in the additional information to help you retrieve your account details.
-
-8. Create a PIN for signing into your Olympia corporate account.
-
-9. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**.
-
-10. Restart your device.
-
-11. In the sign-in screen, choose **Other User** and sign in with your **Olympia corporate account**. Your device will upgrade to Windows 10 Enterprise.
-
-12. Go to **Start > Settings > Update & Security > Windows Insider Program**. Click on the current Windows Insider account, and click **Change**. Sign in with your **Olympia corporate account**.
-
- > [!NOTE]
- > To complete this step, you will need to register your account with the [Windows Insider Program for Business](https://insider.windows.com/ForBusiness).
-
-13. Open the **Feedback Hub**, and sign in with your **Olympia corporate account**.
-
->[!NOTE]
-> Your Windows 10 Enterprise license will not be renewed if your device is not connected to Olympia.
-
+---
+title: Olympia Corp enrollment guidelines
+description: Olympia Corp enrollment guidelines
+ms.author: jaimeo
+ms.topic: article
+ms.prod: w10
+ms.technology: windows
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.reviewer:
+manager: laurawi
+keywords: insider, trial, enterprise, lab, corporation, test
+---
+
+# Olympia Corp
+
+## What is Windows Insider Lab for Enterprise and Olympia Corp?
+
+Windows Insider Lab for Enterprise is intended for Windows Insiders who want to try new experimental and pre-release enterprise privacy and security features. To get the complete experience of these enterprise features, Olympia Corp, a virtual corporation has been set up to reflect the IT infrastructure of real world business. Selected customers are invited to join Olympia Corp and try these features.
+
+As an Olympia user, you will have an opportunity to:
+
+- Use various enterprise features like Windows Information Protection (WIP), Advanced Threat Protection (ATP), windows Defender Application Guard (WDAG), and Application Virtualization (APP-V).
+- Learn how Microsoft is preparing for GDPR, as well as enabling enterprise customers to prepare for their own readiness.
+- Validate and test pre-release software in your environment.
+- Provide feedback.
+- Interact with engineering team members through a variety of communication channels.
+
+>[!Note]
+>Enterprise features might have reduced or different security, privacy, accessibility, availability, and reliability standards relative to commercially provided services and software. We may change or discontinue any of the enterprise features at any time without notice.
+
+For more information about Olympia Corp, see [https://olympia.windows.com/Info/FAQ](https://olympia.windows.com/Info/FAQ).
+
+To request an Olympia Corp account, fill out the survey at [https://aka.ms/RegisterOlympia](https://aka.ms/RegisterOlympia).
+
+## Enrollment guidelines
+
+Welcome to Olympia Corp. Here are the steps needed to enroll.
+
+As part of Windows Insider Lab for Enterprise, you can upgrade to Windows 10 Enterprise from Windows 10 Pro. This upgrade is optional. Since certain features such as Windows Defender Application Guard are only available on Windows 10 Enterprise, we recommend you to upgrade.
+
+Choose one of the following two enrollment options:
+
+- To set up an AAD-registered device, [follow these steps](#enrollment-keep-current-edition). In this case, you log onto the device by using an existing (non-Olympia) account.
+
+- If you are running Windows 10 Pro, we recommend that you upgrade to Windows 10 Enterprise by following these steps to [set up an Azure Active Directory-joined device](#enrollment-upgrade-to-enterprise). In this case, you will be able to log on to the device with your Olympia account.
+
+
+
+### Set up an Azure Active Directory-REGISTERED Windows 10 device
+
+This is the Bring Your Own Device (BYOD) method--your device will receive Olympia policies and features, but a new account will not be created. See [Set up Azure Active Directory registered Windows 10 devices](https://docs.microsoft.com/azure/active-directory/device-management-azuread-registered-devices-windows10-setup) for additional information.
+
+1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)).
+
+ 
+
+2. If you are already connected to a domain, click the existing account and then click **Disconnect**. Click **Restart Later**.
+
+3. Click **Connect** and enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**.
+
+ 
+
+4. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password.
+
+ > [!NOTE]
+ > Passwords should contain 8-16 characters, including at least one special character or number.
+
+ 
+
+5. Read the **Terms and Conditions**. Click **Accept** to participate in the program.
+
+6. If this is the first time you are logging in, fill in the additional information to help you retrieve your account details.
+
+7. Create a PIN for signing into your Olympia corporate account.
+
+8. Go to **Start > Settings > Update & Security > Windows Insider Program**. Click on the current Windows Insider account, and click **Change**. Sign in with your **Olympia corporate account**.
+
+ > [!NOTE]
+ > To complete this step, you will need to register your account with the [Windows Insider Program for Business](https://insider.windows.com/ForBusiness).
+
+9. Open the **Feedback Hub**, and sign in with your **Olympia corporate account**.
+
+
+
+### Set up Azure Active Directory-JOINED Windows 10 device
+
+- This method will upgrade your Windows 10 Pro license to Enterprise and create a new account. See [Set up Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/device-management-azuread-joined-devices-setup) for more information.
+
+1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)).
+
+ 
+
+2. If you are already connected to a domain, click the existing account and then click **Disconnect**. Click **Restart Later**.
+
+3. Click **Connect**, then click **Join this device to Azure Active Directory**.
+
+ 
+
+4. Enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**.
+
+ 
+
+5. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password.
+
+ > [!NOTE]
+ > Passwords should contain 8-16 characters, including at least one special character or number.
+
+ 
+
+6. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**.
+
+7. If this is the first time you are signing in, fill in the additional information to help you retrieve your account details.
+
+8. Create a PIN for signing into your Olympia corporate account.
+
+9. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**.
+
+10. Restart your device.
+
+11. In the sign-in screen, choose **Other User** and sign in with your **Olympia corporate account**. Your device will upgrade to Windows 10 Enterprise.
+
+12. Go to **Start > Settings > Update & Security > Windows Insider Program**. Click on the current Windows Insider account, and click **Change**. Sign in with your **Olympia corporate account**.
+
+ > [!NOTE]
+ > To complete this step, you will need to register your account with the [Windows Insider Program for Business](https://insider.windows.com/ForBusiness).
+
+13. Open the **Feedback Hub**, and sign in with your **Olympia corporate account**.
+
+>[!NOTE]
+> Your Windows 10 Enterprise license will not be renewed if your device is not connected to Olympia.
+
diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md
index 1f23ccbc44..c1083ce56e 100644
--- a/windows/deployment/update/servicing-stack-updates.md
+++ b/windows/deployment/update/servicing-stack-updates.md
@@ -1,56 +1,57 @@
----
-title: Servicing stack updates (Windows 10)
-description: Servicing stack updates improve the code that installs the other updates.
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.author: greglin
-ms.date: 11/29/2018
-ms.reviewer:
-manager: laurawi
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-# Servicing stack updates
-
-
-**Applies to**
-
-- Windows 10, Windows 8.1, Windows 8, Windows 7
-
-## What is a servicing stack update?
-Servicing stack updates provide fixes to the servicing stack, the component that installs Windows updates. Additionally, it contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month.
-
-## Why should servicing stack updates be installed and kept up to date?
-
-Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes.
-
-## When are they released?
-
-Servicing stack update are released depending on new issues or vulnerabilities. In rare occasions a servicing stack update may need to be released on demand to address an issue impacting systems installing the monthly security update. Starting in November 2018 new servicing stack updates will be classified as "Security" with a severity rating of "Critical."
-
->[!NOTE]
->You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001).
-
-## What's the difference between a servicing stack update and a cumulative update?
-
-Both Windows 10 and Windows Server use the cumulative update mechanism, in which many fixes to improve the quality and security of Windows are packaged into a single update. Each cumulative update includes the changes and fixes from all previous updates.
-
-Servicing stack updates must ship separately from the cumulative updates because they modify the component that installs Windows updates. The servicing stack is released separately because the servicing stack itself requires an update. For example, the cumulative update [KB4284880](https://support.microsoft.com/help/4284880/windows-10-update-kb4284880) requires the [May 17, 2018 servicing stack update](https://support.microsoft.com/help/4132216), which includes updates to Windows Update.
-
-
-## Is there any special guidance?
-
-Microsoft recommends you install the latest servicing stack updates for your operating system before installing the latest cumulative update.
-
-Typically, the improvements are reliability and performance improvements that do not require any specific special guidance. If there is any significant impact, it will be present in the release notes.
-
-## Installation notes
-
-* Servicing stack updates contain the full servicing stack; as a result, typically administrators only need to install the latest servicing stack update for the operating system.
-* Installing servicing stack update does not require restarting the device, so installation should not be disruptive.
-* Servicing stack update releases are specific to the operating system version (build number), much like quality updates.
-* Search to install latest available [Servicing stack update for Windows 10](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001).
+---
+title: Servicing stack updates (Windows 10)
+description: Servicing stack updates improve the code that installs the other updates.
+ms.prod: w10
+ms.mktglfcycl: manage
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationpriority: medium
+ms.author: jaimeo
+ms.reviewer:
+manager: laurawi
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+# Servicing stack updates
+
+
+**Applies to**
+
+- Windows 10, Windows 8.1, Windows 8, Windows 7
+
+## What is a servicing stack update?
+Servicing stack updates provide fixes to the servicing stack, the component that installs Windows updates. Additionally, it contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month.
+
+## Why should servicing stack updates be installed and kept up to date?
+
+Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes.
+
+## When are they released?
+
+Servicing stack update are released depending on new issues or vulnerabilities. In rare occasions a servicing stack update may need to be released on demand to address an issue impacting systems installing the monthly security update. Starting in November 2018 new servicing stack updates will be classified as "Security" with a severity rating of "Critical."
+
+>[!NOTE]
+>You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001).
+
+## What's the difference between a servicing stack update and a cumulative update?
+
+Both Windows 10 and Windows Server use the cumulative update mechanism, in which many fixes to improve the quality and security of Windows are packaged into a single update. Each cumulative update includes the changes and fixes from all previous updates.
+
+Servicing stack updates must ship separately from the cumulative updates because they modify the component that installs Windows updates. The servicing stack is released separately because the servicing stack itself requires an update. For example, the cumulative update [KB4284880](https://support.microsoft.com/help/4284880/windows-10-update-kb4284880) requires the [May 17, 2018 servicing stack update](https://support.microsoft.com/help/4132216), which includes updates to Windows Update.
+
+
+## Is there any special guidance?
+
+Microsoft recommends you install the latest servicing stack updates for your operating system before installing the latest cumulative update.
+
+Typically, the improvements are reliability and performance improvements that do not require any specific special guidance. If there is any significant impact, it will be present in the release notes.
+
+## Installation notes
+
+* Servicing stack updates contain the full servicing stack; as a result, typically administrators only need to install the latest servicing stack update for the operating system.
+* Installing servicing stack update does not require restarting the device, so installation should not be disruptive.
+* Servicing stack update releases are specific to the operating system version (build number), much like quality updates.
+* Search to install latest available [Servicing stack update for Windows 10](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001).
+* Once a servicing stack update is installed, it cannot be removed or uninstalled from the machine.
\ No newline at end of file
diff --git a/windows/deployment/update/update-compliance-delivery-optimization.md b/windows/deployment/update/update-compliance-delivery-optimization.md
index a637aea0a8..612c44e92a 100644
--- a/windows/deployment/update/update-compliance-delivery-optimization.md
+++ b/windows/deployment/update/update-compliance-delivery-optimization.md
@@ -5,7 +5,6 @@ manager: laurawi
description: new Delivery Optimization data displayed in Update Compliance
ms.prod: w10
ms.mktglfcycl: deploy
-ms.sitesec: library
ms.pagetype: deploy
audience: itpro
author: jaimeo
@@ -17,14 +16,8 @@ ms.topic: article
---
# Delivery Optimization in Update Compliance
-The Update Compliance solution of Windows Analytics provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days.
-

-
-> [!IMPORTANT]
-> There is a known issue with the way device configuration is displayed for Delivery Optimization. Some devices running Windows 10, versions 1809 or 1903 report the Delivery Optimization DownloadMode configuration value as the sequential value in the list of possible configurations rather than the actual configured value. For example, a device that is configured as HTTP + Group (2), will be shown as HTTP + Internet (3) in Update Compliance.
->
->**This issue is now fixed by installing the 2019-07 cumulative update appropriate for the device.**
+The Update Compliance solution of Windows Analytics provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days.
## Delivery Optimization Status
@@ -34,11 +27,9 @@ The Delivery Optimization Status section includes three blades:
- The **Content Distribution (%)** blade shows the percentage of bandwidth savings for each category
- The **Content Distribution (GB)** blade shows the total amount of data seen from each content type broken down by the download source (peers vs non-peers).
-
-
## Device Configuration blade
-Devices can be set to use different download modes; these download modes determine in what situations Delivery Optimization will use peer-to-peer distribution to accomplish the downloads. The top section shows the number of devices configured to use peer-to-peer distribution in *Peering On* compared to *Peering Off* modes. The table shows a breakdown of the various download mode configurations seen in your environment. For more information about the different configuration options, see [Set up Delivery Optimization for Windows 10 updates](waas-delivery-optimization-setup.md) for recommendations for different scenarios or [Delivery Optimization reference](waas-delivery-optimization-reference.md#download-mode) for complete details of this setting.
+Devices can be set to use different download modes; these download modes determine in what situations Delivery Optimization will use peer-to-peer distribution to accomplish the downloads. The top section shows the number of devices configured to use peer-to-peer distribution in *Peering On* compared to *Peering Off* modes. The table shows a breakdown of the various download mode configurations seen in your environment. For more information about the different configuration options, see [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization-setup.md).
## Content Distribution (%) blade
The first of two blades showing information on content breakdown, this blade shows a ring chart summarizing **Bandwidth Savings %**, which is the percentage of data received from peer sources out of the total data downloaded (for any device that used peer-to-peer distribution).
@@ -52,4 +43,3 @@ The download sources that could be included are:
- LAN Bytes: Bytes downloaded from LAN Peers which are other devices on the same local network
- Group Bytes: Bytes downloaded from Group Peers which are other devices that belong to the same Group (available when the “Group” download mode is used)
- HTTP Bytes: Non-peer bytes. The HTTP download source can be Microsoft Servers, Windows Update Servers, a WSUS server or an SCCM Distribution Point for Express Updates.
-
diff --git a/windows/deployment/update/update-compliance-feature-update-status.md b/windows/deployment/update/update-compliance-feature-update-status.md
index 8d6fa2501e..2d3216901c 100644
--- a/windows/deployment/update/update-compliance-feature-update-status.md
+++ b/windows/deployment/update/update-compliance-feature-update-status.md
@@ -1,49 +1,50 @@
----
-title: Update Compliance - Feature Update Status report
-ms.reviewer:
-manager: laurawi
-description: an overview of the Feature Update Status report
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.collection: M365-analytics
-ms.topic: article
----
-
-# Feature Update Status
-
-
-
-The Feature Update Status section provides information about the status of [feature updates](waas-quick-start.md#definitions) across all devices. This section tile in the [Overview Blade](update-compliance-using.md#overview-blade) gives a percentage of devices that are on the latest applicable feature update; [Servicing Channel](waas-overview.md#servicing-channels) is considered in determining applicability. Within this section are two blades; one providing a holistic view of feature updates, the other containing three **Deployment Status** tiles, each charged with tracking the deployment for a different [Servicing Channel](waas-overview.md#servicing-channels).
-
-## Overall Feature Update Status
-
-The Overall Feature Update Status blade breaks down how many devices are up-to-date or not, with a special callout for how many devices are running a build that is not supported (for a full list of feature updates, check out the [Windows 10 Release Information](https://technet.microsoft.com/windows/release-info.aspx) page). The table beneath the visualization breaks devices down by Servicing Channel and operating system version, then defining whether this combination is *up-to-date*, *not up-to-date* or *out of support*. Finally, the table provides a count of devices that fall into this category.
-
-## Deployment Status by Servicing Channel
-
-To effectively track deployment, **Deployment Status Blades** are divided into each Servicing Channel chosen for the device. This is because Deployment for each channel will happen at different periods in time and feature updates are targeted separately for each channel. Within each Deployment Status tile, devices are aggregated on their feature update distribution, and the columns list the states each device is in.
-
-Refer to the following list for what each state means:
-* **Installed** devices are devices that have completed installation for the given update.
-* When a device is counted as **In Progress**, it has begun the feature update installation.
-* Devices that are **scheduled next 7 days** are all devices that were deferred from installing the Feature update using [Windows Update for Business Settings](waas-manage-updates-wufb.md) and are set to begin installation in the next 7 days.
-* Devices that have failed the given feature update installation are counted as **Update failed**.
-* If a device should be, in some way, progressing toward this security update, but its status cannot be inferred, it will count as **Status Unknown**. Devices not using Windows Update are the most likely devices to fall into this category.
-
-## Compatibility holds
-
-Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *compatibility hold* is generated to delay the device’s upgrade and safeguard the end-user experience. Holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all compatibility holds on the Windows 10 release information page for any given release.
-
-To learn how compatibility holds are reflected in the experience, see [Update compliance perspectives](update-compliance-perspectives.md#deployment-status).
-
-### Opting out of compatibility hold
-
-Microsoft will release a device from a compatibility hold when it has determined it can safely and smoothly install a feature update, but you are ultimately in control of your devices and can opt out if desired. To opt out, set the registry key **HKLM\Software\Microsoft\Windows NT\CurrentVersion\502505fe-762c-4e80-911e-0c3fa4c63fb0** to a name of **DataRequireGatedScanForFeatureUpdates** and a value of **0**.
-
-
-Setting this registry key to **0** will force the device to opt out from *all* compatibility holds. Any other value, or deleting the key, will resume compatibility protection on the device.
-
+---
+title: Update Compliance - Feature Update Status report
+ms.reviewer:
+manager: laurawi
+description: an overview of the Feature Update Status report
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.pagetype: deploy
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.author: jaimeo
+ms.collection: M365-analytics
+ms.topic: article
+---
+
+# Feature Update Status
+
+
+
+The Feature Update Status section provides information about the status of [feature updates](waas-quick-start.md#definitions) across all devices. This section tile in the [Overview Blade](update-compliance-using.md#overview-blade) gives a percentage of devices that are on the latest applicable feature update; [Servicing Channel](waas-overview.md#servicing-channels) is considered in determining applicability. Within this section are two blades; one providing a holistic view of feature updates, the other containing three **Deployment Status** tiles, each charged with tracking the deployment for a different [Servicing Channel](waas-overview.md#servicing-channels).
+
+## Overall Feature Update Status
+
+The Overall Feature Update Status blade breaks down how many devices are up-to-date or not, with a special callout for how many devices are running a build that is not supported (for a full list of feature updates, check out the [Windows 10 Release Information](https://technet.microsoft.com/windows/release-info.aspx) page). The table beneath the visualization breaks devices down by Servicing Channel and operating system version, then defining whether this combination is *up-to-date*, *not up-to-date* or *out of support*. Finally, the table provides a count of devices that fall into this category.
+
+## Deployment Status by Servicing Channel
+
+To effectively track deployment, **Deployment Status Blades** are divided into each Servicing Channel chosen for the device. This is because Deployment for each channel will happen at different periods in time and feature updates are targeted separately for each channel. Within each Deployment Status tile, devices are aggregated on their feature update distribution, and the columns list the states each device is in.
+
+Refer to the following list for what each state means:
+* **Installed** devices are devices that have completed installation for the given update.
+* When a device is counted as **In Progress**, it has begun the feature update installation.
+* Devices that are **scheduled next 7 days** are all devices that were deferred from installing the Feature update using [Windows Update for Business Settings](waas-manage-updates-wufb.md) and are set to begin installation in the next 7 days.
+* Devices that have failed the given feature update installation are counted as **Update failed**.
+* If a device should be, in some way, progressing toward this security update, but its status cannot be inferred, it will count as **Status Unknown**. Devices not using Windows Update are the most likely devices to fall into this category.
+
+## Compatibility holds
+
+Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *compatibility hold* is generated to delay the device’s upgrade and safeguard the end-user experience. Holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all compatibility holds on the Windows 10 release information page for any given release.
+
+To learn how compatibility holds are reflected in the experience, see [Update compliance perspectives](update-compliance-perspectives.md#deployment-status).
+
+### Opting out of compatibility hold
+
+Microsoft will release a device from a compatibility hold when it has determined it can safely and smoothly install a feature update, but you are ultimately in control of your devices and can opt out if desired. To opt out, set the registry key **HKLM\Software\Microsoft\Windows NT\CurrentVersion\502505fe-762c-4e80-911e-0c3fa4c63fb0** to a name of **DataRequireGatedScanForFeatureUpdates** and a value of **0**.
+
+
+Setting this registry key to **0** will force the device to opt out from *all* compatibility holds. Any other value, or deleting the key, will resume compatibility protection on the device.
+
diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md
index 8a005eb69d..0413187d35 100644
--- a/windows/deployment/update/update-compliance-get-started.md
+++ b/windows/deployment/update/update-compliance-get-started.md
@@ -1,75 +1,128 @@
----
-title: Get started with Update Compliance (Windows 10)
-ms.reviewer:
-manager: laurawi
-description: Configure Update Compliance in Azure Portal to see the status of updates and antimalware protection on devices in your network.
-keywords: update compliance, oms, operations management suite, prerequisites, requirements, updates, upgrades, antivirus, antimalware, signature, log analytics, wdav
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.localizationpriority: medium
-ms.collection: M365-analytics
-ms.topic: article
----
-
-# Get started with Update Compliance
-This topic explains the steps necessary to configure your environment for Windows Analytics: Update Compliance.
-
-Steps are provided in sections that follow the recommended setup process:
-
-1. Ensure you meet the [Update Compliance prerequisites](#update-compliance-prerequisites).
-2. [Add Update Compliance to your Azure subscription](#add-update-compliance-to-your-azure-subscription).
-3. [Enroll devices in Windows Analytics](#enroll-devices-in-windows-analytics).
-4. [Use Update Compliance](update-compliance-using.md) to monitor Windows Updates, Windows Defender Antivirus status, and Delivery Optimization.
-
-## Update Compliance prerequisites
-Before you begin the process to add Update Compliance to your Azure subscription, first ensure you can meet the prerequisites:
-1. Update Compliance works only with Windows 10 Professional, Education, and Enterprise editions. Update Compliance only provides data for the standard Desktop Windows 10 version and is not currently compatible with Windows Server, Surface Hub, IoT, etc.
-2. Update Compliance provides detailed deployment data for devices on the Semi-Annual Channel and the Long-term Servicing Channel. Update Compliance will show Windows Insider Preview devices, but currently will not provide detailed deployment information for them.
-3. Update Compliance requires at least the Basic level of diagnostic data and a Commercial ID to be enabled on the device.
-4. To show device names for versions of Windows 10 starting with 1803 in Windows Analytics you must opt in. For details about this, see the "AllowDeviceNameinTelemetry (in Windows 10)" entry in the table in the [Distributing policies at scale](windows-analytics-get-started.md#deploying-windows-analytics-at-scale) section of [Enrolling devices in Windows Analytics](windows-analytics-get-started.md).
-5. To use the Windows Defender Status, devices must be E3-licensed and have Cloud Protection enabled. E5-licensed devices will not appear here. For E5 devices, you should use [Windows Defender ATP](https://docs.microsoft.com/sccm/protect/deploy-use/windows-defender-advanced-threat-protection) instead. For more information on Windows 10 Enterprise licensing, see [Windows 10 Enterprise: FAQ for IT Professionals](https://docs.microsoft.com/windows/deployment/planning/windows-10-enterprise-faq-itpro).
-
-## Add Update Compliance to your Azure subscription
-Update Compliance is offered as a solution which is linked to a new or existing [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal) workspace within your Azure subscription. To configure this, follow these steps:
-
-1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal.
-
-> [!NOTE]
-> Update Compliance is included at no additional cost with Windows 10 Professional, Education, and Enterprise editions. An Azure subscription is required for managing and using Update Compliance, but no Azure charges are expected to accrue to the subscription as a result of using Update Compliance.
-
-2. In the Azure portal select **+ Create a resource**, and search for “Update Compliance". You should see it in the results below.
-
-
-
-3. Select **Update Compliance** and a blade will appear summarizing the solution’s offerings. At the bottom, select **Create** to begin adding the solution to Azure.
-
-
-
-4. Choose an existing workspace or create a new workspace that will be assigned to the Update Compliance solution.
- - If you already have another Windows Analytics solution, you should use the same workspace.
- - If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started:
- - Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*.
- - For the resource group setting select **Create new** and use the same name you chose for your new workspace.
- - For the location setting, choose the Azure region where you would prefer the data to be stored.
- - For the pricing tier select **per GB**.
-
-
-
-5. The resource group and workspace creation process could take a few minutes. After this, you are able to use that workspace for Update Compliance. Select **Create**.
-
-
-
-6. Watch for a notification in the Azure portal that your deployment has been successful. This might take a few minutes. Then, select **Go to resource**.
-
-
-
-## Enroll devices in Windows Analytics
-Once you've added Update Compliance to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For Update Compliance there are two key steps for enrollment:
-1. Deploy your Commercial ID (from the Update Compliance Settings page) to your Windows 10 devices (typically by using Group Policy, [Mobile Device Management](https://docs.microsoft.com/windows/client-management/windows-10-mobile-and-mdm), [System Center Configuration Manager](https://docs.microsoft.com/sccm/core/understand/introduction) or similar).
-2. Ensure the Windows Diagnostic Data setting on devices is set to at least Basic (typically using Group Policy or similar). For full enrollment instructions and troubleshooting, see [Enrolling devices in Windows Analytics](windows-analytics-get-started.md).
-
-After enrolling your devices (by deploying your CommercialID and Windows Diagnostic Data settings), it might take 48-72 hours for the first data to appear in the solution. Until then, Update Compliance will indicate it is still assessing devices.
+---
+title: Get started with Update Compliance (Windows 10)
+ms.reviewer:
+manager: laurawi
+description: Configure Update Compliance in Azure Portal to see the status of updates and antimalware protection on devices in your network.
+keywords: update compliance, oms, operations management suite, prerequisites, requirements, updates, upgrades, antivirus, antimalware, signature, log analytics, wdav
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.pagetype: deploy
+audience: itpro
+author: jaimeo
+ms.author: jaimeo
+ms.localizationpriority: medium
+ms.collection: M365-analytics
+ms.topic: article
+---
+
+# Get started with Update Compliance
+This topic explains the steps necessary to configure your environment for Update Compliance.
+
+Steps are provided in sections that follow the recommended setup process:
+
+1. Ensure you meet the [Update Compliance prerequisites](#update-compliance-prerequisites).
+2. [Add Update Compliance to your Azure subscription](#add-update-compliance-to-your-azure-subscription).
+3. [Enroll devices in Update Compliance](#enroll-devices-in-update-compliance).
+4. [Use Update Compliance](update-compliance-using.md) to monitor Windows Updates and get Delivery Optimization insights.
+
+## Update Compliance prerequisites
+Before you begin the process to add Update Compliance to your Azure subscription, first ensure you can meet the prerequisites:
+1. Update Compliance works only with Windows 10 Professional, Education, and Enterprise editions. Update Compliance only provides data for the standard Desktop Windows 10 version and is not currently compatible with Windows Server, Surface Hub, IoT, etc.
+2. Update Compliance provides detailed deployment data for devices on the Semi-Annual Channel and the Long-term Servicing Channel. Update Compliance will show Windows Insider Preview devices, but currently will not provide detailed deployment information for them.
+3. Update Compliance requires at least the Basic level of diagnostic data and a Commercial ID to be enabled on the device.
+4. For Windows 10 1803+, device names will not appear in Update Compliance unless you opt in. The steps to accomplish this is outlined in the [Enroll devices in Update Compliance](#enroll-devices-in-update-compliance) section.
+
+## Add Update Compliance to your Azure subscription
+Update Compliance is offered as a solution which is linked to a new or existing [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal) workspace within your Azure subscription. To configure this, follow these steps:
+
+1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal.
+
+> [!NOTE]
+> Update Compliance is included at no additional cost with Windows 10 Professional, Education, and Enterprise editions. An Azure subscription is required for managing and using Update Compliance, but no Azure charges are expected to accrue to the subscription as a result of using Update Compliance.
+
+2. In the Azure portal select **+ Create a resource**, and search for “Update Compliance". You should see it in the results below.
+
+
+
+3. Select **Update Compliance** and a blade will appear summarizing the solution’s offerings. At the bottom, select **Create** to begin adding the solution to Azure.
+
+
+
+4. Choose an existing workspace or create a new workspace that will be assigned to the Update Compliance solution.
+ - [Desktop Analytics](https://docs.microsoft.com/en-us/sccm/desktop-analytics/overview) customers are advised to use the same workspace for Update Compliance.
+ - If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started:
+ - Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*.
+ - For the resource group setting select **Create new** and use the same name you chose for your new workspace.
+ - For the location setting, choose the Azure region where you would prefer the data to be stored.
+ - For the pricing tier select **per GB**.
+
+
+
+5. The resource group and workspace creation process could take a few minutes. After this, you are able to use that workspace for Update Compliance. Select **Create**.
+
+
+
+6. Watch for a notification in the Azure portal that your deployment has been successful. This might take a few minutes. Then, select **Go to resource**.
+
+
+
+## Enroll devices in Update Compliance
+Once you've added Update Compliance to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For Update Compliance there are three key steps to ensure successful enrollment:
+
+### Deploy your Commercial ID to devices
+A Commercial ID is a globally-unique identifier assigned to a specific Log Analytics workspace. This is used to identify devices as part of your environment.
+
+To find your Commercial ID within Azure:
+1. Navigate to the **Solutions** tab for your workspace, and then select the **WaaSUpdateInsights** solution.
+2. From there, select the Update Compliance Settings page on the navbar.
+3. Your Commercial ID is available in the settings page.
+
+
+
+>**Important**
+>
+>Regenerate your Commercial ID only if your Original ID key can no longer be used or if you want to completely reset your workspace. Regenerating your Commercial ID cannot be undone and will result in you losing data for all devices that have the current Commercial ID until the new Commercial ID is deployed to devices.
+
+#### Deploying Commercial ID using Group Policy
+Commercial ID can be deployed using Group Policy. The Group Policy for Commercial ID is under **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Configure the Commercial ID**.
+
+
+
+#### Deploying Commercial ID using MDM
+Commercial ID can be deployed through a [Mobile Device Management](https://docs.microsoft.com/en-us/windows/client-management/mdm/) (MDM) policy beginning with Windows 10, version 1607. Commercial ID is under the [DMClient configuration service provider](https://docs.microsoft.com/en-us/windows/client-management/mdm/dmclient-csp).
+
+### Ensure endpoints are whitelisted
+To enable data sharing between devices, your network, and Microsoft's Diagnostic Data Service, configure your proxy to whitelist the following endpoints. You may need security group approval to do this.
+
+| **Endpoint** | **Function** |
+|---------------------------------------------------------|-----------|
+| `https://v10c.events.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1803 and later. |
+| `https://v10.vortex-win.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1709 or earlier. |
+| `https://settings-win.data.microsoft.com` | Enables the compatibility update to send data to Microsoft. |
+| `http://adl.windows.com` | Allows the compatibility update to receive the latest compatibility data from Microsoft. |
+| `https://watson.telemetry.microsoft.com` | Windows Error Reporting (WER), used to provide more advanced error reporting in the event of certain Feature Update deployment failures. |
+| `https://oca.telemetry.microsoft.com` | Online Crash Analysis, used to provide device-specific recommendations and detailed errors in the event of certain crashes. |
+| `https://login.live.com` | This endpoint is optional but allows for the Update Compliance service to more reliably identify and process devices. If you want to disable end-user managed service account (MSA) access, you should apply the appropriate [policy](https://docs.microsoft.com/windows/security/identity-protection/access-control/microsoft-accounts#block-all-consumer-microsoft-account-user-authentication) instead of blocking this endpoint. |
+
+### Set diagnostic data levels
+Update Compliance requires that devices are configured to send Microsoft at least the Basic level of diagnostic data in order to function. For more information on Windows diagnostic data, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization).
+
+#### Configuring Telemetry level using Group Policy
+You can set Allow Telemetry through Group Policy, this setting is in the same place as the Commercial ID policy, under **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Allow Telemetry**. Update Compliance requires at least Basic (level 1) to function.
+
+
+
+#### Configuring Telemetry level using MDM
+Telemetry level can additionally be configured through a [Mobile Device Management](https://docs.microsoft.com/en-us/windows/client-management/mdm/) (MDM) policy. Allow Telemetry is under the [Policy Configuration Service Provider](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider) as [System/AllowTelemetry](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#system-allowtelemetry).
+
+### Enabling Device Name in telemetry
+Beginning with Windows 10, version 1803, Device Name is no longer collected as part of normal Windows Diagnostic Data and must explicitly be allowed to be sent to Microsoft. If devices do not have this policy enabled, their device name will appear as '#' instead.
+
+#### Allow Device Name in Telemetry with Group Policy
+Allow Device Name in Telemetry is under the same node as Commercial ID and Allow Telemetry policies in Group Policy, listed as **Allow device name to be sent in Windows diagnostic data**.
+
+#### Allow Device Name in Telemetry with MDM
+Allow Device Name in Telemetry is under the [Policy Configuration Service Provider](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider) as [System/AllowTelemetry](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#system-allowtelemetry).
+
+>[!NOTE]
+>After enrolling your devices (by deploying your CommercialID and Windows Diagnostic Data settings), it might take 48-72 hours for the first data to appear in the solution. Until then, Update Compliance will indicate it is still assessing devices.
\ No newline at end of file
diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md
index 1ece514b2e..e41b2f365b 100644
--- a/windows/deployment/update/update-compliance-monitor.md
+++ b/windows/deployment/update/update-compliance-monitor.md
@@ -1,57 +1,60 @@
----
-title: Monitor Windows Updates and Windows Defender AV with Update Compliance (Windows 10)
-ms.reviewer:
-manager: laurawi
-description: You can use Update Compliance in Azure Portal to monitor the progress of updates and key antimalware protection features on devices in your network.
-keywords: oms, operations management suite, wdav, updates, upgrades, antivirus, antimalware, signature, log analytics
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.localizationpriority: medium
-ms.collection: M365-analytics
-ms.topic: article
----
-
-# Monitor Windows Updates with Update Compliance
-
-## Introduction
-
-Update Compliance is a [Windows Analytics solution](windows-analytics-overview.md) that enables organizations to:
-
-* Monitor Windows 10 Professional, Education, and Enterprise security, quality, and feature updates.
-* View a report of device and update issues related to compliance that need attention.
-* See the status of Windows Defender Antivirus signatures and threats.
-* Check bandwidth savings incurred across multiple content types by using [Delivery Optimization](waas-delivery-optimization.md).
-
-Update Compliance is offered through the Azure portal, and is available free for devices that meet the [prerequisites](update-compliance-get-started.md#update-compliance-prerequisites).
-
-Update Compliance uses Windows 10 and Windows Defender Antivirus diagnostic data for all of its reporting. It collects system data including update deployment progress, [Windows Update for Business](waas-manage-updates-wufb.md) configuration data, Windows Defender Antivirus data, and Delivery Optimization usage data, and then sends this data to a secure cloud to be stored for analysis and usage in [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal).
-
-See the following topics in this guide for detailed information about configuring and using the Update Compliance solution:
-
-- [Get started with Update Compliance](update-compliance-get-started.md): How to add Update Compliance to your environment.
-- [Using Update Compliance](update-compliance-using.md): How to begin using Update Compliance.
-
-## Update Compliance architecture
-
-The Update Compliance architecture and data flow is summarized by the following four-step process:
-
-1. User computers send diagnostic data to a secure Microsoft data center using the Microsoft Data Management Service.
-2. Diagnostic data is analyzed by the Update Compliance Data Service.
-3. Diagnostic data is pushed from the Update Compliance Data Service to your Azure Monitor workspace.
-4. Diagnostic data is available in the Update Compliance solution.
-
-
->[!NOTE]
->This process assumes that Windows diagnostic data is enabled and data sharing is enabled as described in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md).
-
-
-
-
-## Related topics
-
-[Get started with Update Compliance](update-compliance-get-started.md)
-[Use Update Compliance to monitor Windows Updates](update-compliance-using.md)
+---
+title: Monitor Windows Updates and Windows Defender AV with Update Compliance (Windows 10)
+ms.reviewer:
+manager: laurawi
+description: You can use Update Compliance in Azure Portal to monitor the progress of updates and key antimalware protection features on devices in your network.
+keywords: oms, operations management suite, wdav, updates, upgrades, antivirus, antimalware, signature, log analytics
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.pagetype: deploy
+audience: itpro
+author: jaimeo
+ms.author: jaimeo
+ms.localizationpriority: medium
+ms.collection: M365-analytics
+ms.topic: article
+---
+
+# Monitor Windows Updates with Update Compliance
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+
+## Introduction
+
+Update Compliance is a [Windows Analytics solution](windows-analytics-overview.md) that enables organizations to:
+
+* Monitor security, quality, and feature updates for Windows 10 Professional, Education, and Enterprise editions.
+* View a report of device and update issues related to compliance that need attention.
+* Check bandwidth savings incurred across multiple content types by using [Delivery Optimization](waas-delivery-optimization.md).
+
+Update Compliance is offered through the Azure portal, and is included as part of Windows 10 licenses listed in the [prerequisites](update-compliance-get-started.md#update-compliance-prerequisites).
+
+Update Compliance uses Windows 10 and Windows Defender Antivirus diagnostic data for all of its reporting. It collects system data including update deployment progress, [Windows Update for Business](waas-manage-updates-wufb.md) configuration data, Windows Defender Antivirus data, and Delivery Optimization usage data, and then sends this data to a secure cloud to be stored for analysis and usage in [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal).
+
+See the following topics in this guide for detailed information about configuring and using the Update Compliance solution:
+
+- [Get started with Update Compliance](update-compliance-get-started.md): How to add Update Compliance to your environment.
+- [Using Update Compliance](update-compliance-using.md): How to begin using Update Compliance.
+
+## Update Compliance architecture
+
+The Update Compliance architecture and data flow follows this process:
+
+1. User computers send diagnostic data to a secure Microsoft data center using the Microsoft Data Management Service.
+2. Diagnostic data is analyzed by the Update Compliance Data Service.
+3. Diagnostic data is pushed from the Update Compliance Data Service to your Azure Monitor workspace.
+4. Diagnostic data is available in the Update Compliance solution.
+
+
+>[!NOTE]
+>This process assumes that Windows diagnostic data is enabled and data sharing is enabled as outlined in the enrollment section of [Get started with Update Compliance](update-compliance-get-started.md).
+
+
+
+
+## Related topics
+
+[Get started with Update Compliance](update-compliance-get-started.md)
+[Use Update Compliance to monitor Windows Updates](update-compliance-using.md)
\ No newline at end of file
diff --git a/windows/deployment/update/update-compliance-need-attention.md b/windows/deployment/update/update-compliance-need-attention.md
index be35a79469..a4b940a236 100644
--- a/windows/deployment/update/update-compliance-need-attention.md
+++ b/windows/deployment/update/update-compliance-need-attention.md
@@ -1,46 +1,47 @@
----
-title: Update Compliance - Need Attention! report
-ms.reviewer:
-manager: laurawi
-description: an overview of the Update Compliance Need Attention! report
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.collection: M365-analytics
-ms.topic: article
----
-
-# Needs attention!
-
-
-The **Needs attention!** section provides a breakdown of all Windows 10 device and update issues detected by Update Compliance. The summary tile for this section counts the number of devices that have issues, while the blades within break down the issues encountered. Finally, a [list of queries](#list-of-queries) blade in this section contains queries that provide values but do not fit within any other main section.
-
->[!NOTE]
->The summary tile counts the number of devices that have issues, while the blades within the section break down the issues encountered. A single device can have more than one issue, so these numbers might not add up.
-
-The different issues are broken down by Device Issues and Update Issues:
-
-## Device Issues
-
-* **Missing multiple security updates:** This issue occurs when a device is behind by two or more security updates. These devices might be more vulnerable and should be investigated and updated.
-* **Out of support OS Version:** This issue occurs when a device has fallen out of support due to the version of Windows 10 it is running. When a device has fallen out of support, it will no longer receive important security updates, and might be vulnerable. These devices should be updated to a supported version of Windows 10.
-
-## Update Issues
-
-* **Failed:** This issue occurs when an error halts the process of downloading and applying an update on a device. Some of these errors might be transient, but should be investigated further to be sure.
-* **Cancelled**: This issue occurs when a user cancels the update process.
-* **Rollback**: This issue occurs when a fatal error occurs during a feature update, and the device is rolled back to the previous version.
-* **Uninstalled**: This issue occurs when a feature update is uninstalled from a device by a user or an administrator. Note that this might not be a problem if the uninstallation was intentional, but is highlighted as it might need attention.
-* **Progress stalled:** This issue occurs when an update is in progress, but has not completed over a period of 10 days.
-
-Selecting any of the issues will take you to a [Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal) view with all devices that have the given issue.
-
->[!NOTE]
->This blade also has a link to the [Setup Diagnostic Tool](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag), a standalone tool you can use to obtain details about why a Windows 10 feature update was unsuccessful.
-
-## List of Queries
-
-The **List of Queries** blade is in the **Needs Attention** section of Update Compliance. This blade contains a list of queries with a description and a link to the query. These queries contain important meta-information that did not fit within any specific section or were listed to serve as a good starting point for modification into custom queries.
+---
+title: Update Compliance - Need Attention! report
+ms.reviewer:
+manager: laurawi
+description: an overview of the Update Compliance Need Attention! report
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.pagetype: deploy
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.author: jaimeo
+ms.collection: M365-analytics
+ms.topic: article
+---
+
+# Needs attention!
+
+
+The **Needs attention!** section provides a breakdown of all Windows 10 device and update issues detected by Update Compliance. The summary tile for this section counts the number of devices that have issues, while the blades within break down the issues encountered. Finally, a [list of queries](#list-of-queries) blade in this section contains queries that provide values but do not fit within any other main section.
+
+>[!NOTE]
+>The summary tile counts the number of devices that have issues, while the blades within the section break down the issues encountered. A single device can have more than one issue, so these numbers might not add up.
+
+The different issues are broken down by Device Issues and Update Issues:
+
+## Device Issues
+
+* **Missing multiple security updates:** This issue occurs when a device is behind by two or more security updates. These devices might be more vulnerable and should be investigated and updated.
+* **Out of support OS Version:** This issue occurs when a device has fallen out of support due to the version of Windows 10 it is running. When a device has fallen out of support, it will no longer receive important security updates, and might be vulnerable. These devices should be updated to a supported version of Windows 10.
+
+## Update Issues
+
+* **Failed:** This issue occurs when an error halts the process of downloading and applying an update on a device. Some of these errors might be transient, but should be investigated further to be sure.
+* **Cancelled**: This issue occurs when a user cancels the update process.
+* **Rollback**: This issue occurs when a fatal error occurs during a feature update, and the device is rolled back to the previous version.
+* **Uninstalled**: This issue occurs when a feature update is uninstalled from a device by a user or an administrator. Note that this might not be a problem if the uninstallation was intentional, but is highlighted as it might need attention.
+* **Progress stalled:** This issue occurs when an update is in progress, but has not completed over a period of 10 days.
+
+Selecting any of the issues will take you to a [Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal) view with all devices that have the given issue.
+
+>[!NOTE]
+>This blade also has a link to the [Setup Diagnostic Tool](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag), a standalone tool you can use to obtain details about why a Windows 10 feature update was unsuccessful.
+
+## List of Queries
+
+The **List of Queries** blade is in the **Needs Attention** section of Update Compliance. This blade contains a list of queries with a description and a link to the query. These queries contain important meta-information that did not fit within any specific section or were listed to serve as a good starting point for modification into custom queries.
diff --git a/windows/deployment/update/update-compliance-perspectives.md b/windows/deployment/update/update-compliance-perspectives.md
index 4af9e5897a..b38df5c5af 100644
--- a/windows/deployment/update/update-compliance-perspectives.md
+++ b/windows/deployment/update/update-compliance-perspectives.md
@@ -1,65 +1,66 @@
----
-title: Update Compliance - Perspectives
-ms.reviewer:
-manager: laurawi
-description: an overview of Update Compliance Perspectives
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.collection: M365-analytics
-ms.topic: article
----
-
-# Perspectives
-
-
-
-Perspectives are elaborations on specific queries hand-crafted by developers which data views that provide deeper insight into your data. Perspectives are loaded whenever clicking into more detailed views from both the Security Update Status section and Feature Update Status section of Update Compliance.
-
-There is only one perspective framework; it is for **Update Deployment Status**. The same framework is utilized for both feature and quality updates.
-
-The first blade is the **Build Summary** blade. This blade summarizes the most important aspects of the given build being queried, listing the total number of devices, the total number of update failures for the build, and a breakdown of the different errors encountered.
-
-The second blade is the **Deferral Configurations** blade, breaking down Windows Update for Business deferral settings (if any).
-
-## Deployment status
-
-The third blade is the **Deployment Status** blade. This defines how many days it has been since the queried version has been released, and breaks down the various states in the update funnel each device has reported to be in. The possible states are as follows:
-
-| State | Description |
-| --- | --- |
-| Update Completed | When a device has finished the update process and is on the queried update, it will display here as Update completed. |
-| In Progress | Devices that report they are “In Progress” are one of the various stages of installing an update; these stages are reported in the Detailed Deployment Status blade. |
-| Deferred | When a device’s Windows Update for Business deferral policy dictates that the update is not yet applicable due to deferral, it will report as such in this blade. |
-| Progress stalled | Devices that report as “Progress stalled” have been stuck at “In progress” for more than 7 days. |
-| Cancelled | The update was cancelled. |
-| Blocked | There is a hard block on the update being completed. This could be that another update must be completed before this one, or some other task is blocking the installation of the update. |
-| Unknown | Devices that do not report detailed information on the status of their updates will report Unknown. This is most likely devices that do not use Windows Update for deployment. |
-| Update paused | These devices have Windows Update for Business pause enabled, preventing this update from being installed. |
-| Failed | A device is unable to install an update. This failure could be linked to a serious error in the update installation process or, in some cases, a [compatibility hold](update-compliance-feature-update-status.md#compatibility-holds). |
-
-## Detailed deployment status
-
-The final blade is the **Detailed Deployment Status** blade. This blade breaks down the detailed stage of deployment a device is in, beyond the generalized terms defined in Deployment Status. The following are the possible stages a device can report:
-
-| State | Description |
-| --- | --- |
-| Update deferred | When a device’s Windows Update for Business policy dictates the update is deferred. |
-| Update paused | The device’s Windows Update for Business policy dictates the update is paused from being offered. |
-| Update offered | The device has been offered the update, but has not begun downloading it. |
-| Pre-Download tasks passed | The device has finished all necessary tasks prior to downloading the update. |
-| Compatibility hold | The device has been placed under a *compatibility hold* to ensure a smooth feature update experience and will not resume the update until the hold has been cleared. For more information see [Feature Update Status report](update-compliance-feature-update-status.md#compatibility-holds) |
-| Download Started | The update has begun downloading on the device. |
-| Download Succeeded | The update has successfully completed downloading. |
-| Pre-Install Tasks Passed | Tasks that must be completed prior to installing the update have been completed. |
-| Install Started | Installation of the update has begun. |
-| Reboot Required | The device has finished installing the update, and a reboot is required before the update can be completed.
-| Reboot Pending | The device has a scheduled reboot to apply the update. |
-| Reboot Initiated | The scheduled reboot has been initiated. |
-| Update Completed/Commit | The update has successfully installed. |
-
->[!NOTE]
->Interacting with any rows in the perspective view will automatically apply the given value to the query and execute it with the new parameter, narrowing the perspective to devices that satisfy that criteria. For example, clicking “Not configured (-1)” devices in Deferral Configurations will filter the query to only contain devices that do not have a deferral configuration. These filters can also be applied to queries via the filter sidebar.
+---
+title: Update Compliance - Perspectives
+ms.reviewer:
+manager: laurawi
+description: an overview of Update Compliance Perspectives
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.pagetype: deploy
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.author: jaimeo
+ms.collection: M365-analytics
+ms.topic: article
+---
+
+# Perspectives
+
+
+
+Perspectives are elaborations on specific queries hand-crafted by developers which data views that provide deeper insight into your data. Perspectives are loaded whenever clicking into more detailed views from both the Security Update Status section and Feature Update Status section of Update Compliance.
+
+There is only one perspective framework; it is for **Update Deployment Status**. The same framework is utilized for both feature and quality updates.
+
+The first blade is the **Build Summary** blade. This blade summarizes the most important aspects of the given build being queried, listing the total number of devices, the total number of update failures for the build, and a breakdown of the different errors encountered.
+
+The second blade is the **Deferral Configurations** blade, breaking down Windows Update for Business deferral settings (if any).
+
+## Deployment status
+
+The third blade is the **Deployment Status** blade. This defines how many days it has been since the queried version has been released, and breaks down the various states in the update funnel each device has reported to be in. The possible states are as follows:
+
+| State | Description |
+| --- | --- |
+| Update Completed | When a device has finished the update process and is on the queried update, it will display here as Update completed. |
+| In Progress | Devices that report they are “In Progress” are one of the various stages of installing an update; these stages are reported in the Detailed Deployment Status blade. |
+| Deferred | When a device’s Windows Update for Business deferral policy dictates that the update is not yet applicable due to deferral, it will report as such in this blade. |
+| Progress stalled | Devices that report as “Progress stalled” have been stuck at “In progress” for more than 7 days. |
+| Cancelled | The update was cancelled. |
+| Blocked | There is a hard block on the update being completed. This could be that another update must be completed before this one, or some other task is blocking the installation of the update. |
+| Unknown | Devices that do not report detailed information on the status of their updates will report Unknown. This is most likely devices that do not use Windows Update for deployment. |
+| Update paused | These devices have Windows Update for Business pause enabled, preventing this update from being installed. |
+| Failed | A device is unable to install an update. This failure could be linked to a serious error in the update installation process or, in some cases, a [compatibility hold](update-compliance-feature-update-status.md#compatibility-holds). |
+
+## Detailed deployment status
+
+The final blade is the **Detailed Deployment Status** blade. This blade breaks down the detailed stage of deployment a device is in, beyond the generalized terms defined in Deployment Status. The following are the possible stages a device can report:
+
+| State | Description |
+| --- | --- |
+| Update deferred | When a device’s Windows Update for Business policy dictates the update is deferred. |
+| Update paused | The device’s Windows Update for Business policy dictates the update is paused from being offered. |
+| Update offered | The device has been offered the update, but has not begun downloading it. |
+| Pre-Download tasks passed | The device has finished all necessary tasks prior to downloading the update. |
+| Compatibility hold | The device has been placed under a *compatibility hold* to ensure a smooth feature update experience and will not resume the update until the hold has been cleared. For more information see [Feature Update Status report](update-compliance-feature-update-status.md#compatibility-holds) |
+| Download Started | The update has begun downloading on the device. |
+| Download Succeeded | The update has successfully completed downloading. |
+| Pre-Install Tasks Passed | Tasks that must be completed prior to installing the update have been completed. |
+| Install Started | Installation of the update has begun. |
+| Reboot Required | The device has finished installing the update, and a reboot is required before the update can be completed.
+| Reboot Pending | The device has a scheduled reboot to apply the update. |
+| Reboot Initiated | The scheduled reboot has been initiated. |
+| Update Completed/Commit | The update has successfully installed. |
+
+>[!NOTE]
+>Interacting with any rows in the perspective view will automatically apply the given value to the query and execute it with the new parameter, narrowing the perspective to devices that satisfy that criteria. For example, clicking “Not configured (-1)” devices in Deferral Configurations will filter the query to only contain devices that do not have a deferral configuration. These filters can also be applied to queries via the filter sidebar.
diff --git a/windows/deployment/update/update-compliance-security-update-status.md b/windows/deployment/update/update-compliance-security-update-status.md
index d299981e93..fa252c9db1 100644
--- a/windows/deployment/update/update-compliance-security-update-status.md
+++ b/windows/deployment/update/update-compliance-security-update-status.md
@@ -5,7 +5,6 @@ manager: laurawi
description: an overview of the Security Update Status report
ms.prod: w10
ms.mktglfcycl: deploy
-ms.sitesec: library
ms.pagetype: deploy
author: jaimeo
ms.author: jaimeo
diff --git a/windows/deployment/update/update-compliance-using.md b/windows/deployment/update/update-compliance-using.md
index 501c1bcb57..3f9b6fbcbb 100644
--- a/windows/deployment/update/update-compliance-using.md
+++ b/windows/deployment/update/update-compliance-using.md
@@ -1,94 +1,93 @@
----
-title: Using Update Compliance (Windows 10)
-ms.reviewer:
-manager: laurawi
-description: Explains how to begin usihg Update Compliance.
-keywords: oms, operations management suite, wdav, updates, upgrades, antivirus, antimalware, signature, log analytics
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.localizationpriority: medium
-ms.collection: M365-analytics
-ms.topic: article
----
-
-# Use Update Compliance
-
-In this section you'll learn how to use Update Compliance to monitor your device's Windows updates and Windows Defender Antivirus status. To configure your environment for use with Update Compliance, refer to [Get started with Update Compliance](update-compliance-get-started.md).
-
-
-Update Compliance:
-- Provides detailed deployment data for Windows 10 security, quality, and feature updates.
-- Reports when devices have issues related to updates that need attention.
-- Shows Windows Defender AV status information for devices that use it and meet the [prerequisites](update-compliance-get-started.md#update-compliance-prerequisites).
-- Shows bandwidth usage and savings for devices that are configured to use [Delivery Optimization](waas-delivery-optimization.md).
-- Provides all of the above data in [Log Analytics](#using-log-analytics), which affords additional querying and export capabilities.
-
-## The Update Compliance tile
-After Update Compliance has successfully been [added to your Azure subscription](update-compliance-get-started.md#add-update-compliance-to-your-azure-subscription), you’ll see this tile:
-
-
-
-When the solution is added, data is not immediately available. Data will begin to be collected after data is sent up that belongs to the Commercial ID associated with the device. This process assumes that Windows diagnostic data is enabled and data sharing is enabled as described in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). After Microsoft has collected and processed any device data associated with your Commercial ID, the tile will be replaced with the following summary:
-
-
-
-The summary details the total number of devices that Microsoft has received data from with your Commercial ID. It also provides the number of devices that need attention if any. Finally, it details the last point at which your Update Compliance workspace was refreshed.
-
-## The Update Compliance workspace
-
-
-
-When you select this tile, you will be redirected to the Update Compliance workspace. The workspace is organized with the Overview blade providing a hub from which to navigate to different reports of your devices' data.
-
-### Overview blade
-
-
-
-Update Compliance’s overview blade summarizes all the data Update Compliance provides. It functions as a hub from which you can navigate to different sections. The total number of devices detected by Update Compliance is reported in the title of this blade. What follows is a distribution for all devices as to whether they are up to date on the following items:
-* Security updates: A device is up to date on quality updates whenever it has the latest applicable quality update installed. Quality updates are monthly cumulative updates that are specific to a version of Windows 10.
-* Feature updates: A device is up to date on feature updates whenever it has the latest applicable feature update installed. Update Compliance considers [Servicing Channel](waas-overview.md#servicing-channels) when determining update applicability.
-* AV Signature: A device is up to date on Antivirus Signature when the latest Windows Defender Signatures have been downloaded. This distribution only considers devices that are running Windows Defender Antivirus.
-
-The blade also provides the time at which your Update Compliance workspace was [refreshed](#update-compliance-data-latency).
-
-The following is a breakdown of the different sections available in Update Compliance:
-* [Need Attention!](update-compliance-need-attention.md) - This section is the default section when arriving to your Update Compliance workspace. It provides a summary of the different issues devices are facing relative to Windows 10 updates.
-* [Security Update Status](update-compliance-security-update-status.md) - This section lists the percentage of devices that are on the latest security update released for the version of Windows 10 it is running. Selecting this section provides blades that summarize the overall status of security updates across all devices and a summary of their deployment progress towards the latest two security updates.
-* [Feature Update Status](update-compliance-feature-update-status.md) - This section lists the percentage of devices that are on the latest feature update that is applicable to a given device. Selecting this section provides blades that summarize the overall feature update status across all devices and a summary of deployment status for different versions of Windows 10 in your environment.
-* [Windows Defender AV Status](update-compliance-wd-av-status.md) - This section lists the percentage of devices running Windows Defender Antivirus that are not sufficiently protected. Selecting this section provides a summary of signature and threat status across all devices that are running Windows Defender Antivirus. This section is not applicable to devices not running Windows Defender Antivirus or devices that do not meet the [prerequisites](update-compliance-get-started.md#update-compliance-prerequisites) to be assessed.
-* [Delivery Optimization Status](update-compliance-delivery-optimization.md) - This section summarizes bandwidth savings incurred by utilizing Delivery Optimization in your environment. It provides a breakdown of Delivery Optimization configuration across devices, and summarizes bandwidth savings and utilization across multiple content types.
-
-
-## Update Compliance data latency
-Update Compliance uses Windows 10 diagnostic data as its data source. After you add Update Compliance and appropriately configure your devices, it could take 48-72 hours before they first appear. The process that follows is as follows:
-
-Update Compliance is refreshed every 12 hours. This means that every 12 hours all data that has been gathered over the last 12-hour interval is pushed to Log Analytics. However, the rate that each data type is sent and how long it takes to be ready for Update Compliance varies, roughly outlined below.
-
-| Data Type | Refresh Rate | Data Latency |
-|--|--|--|
-|WaaSUpdateStatus | Once per day |4 hours |
-|WaaSInsiderStatus| Once per day |4 hours |
-|WaaSDeploymentStatus|Every update event (Download, install, etc.)|24-36 hours |
-|WDAVStatus|On signature update|24 hours |
-|WDAVThreat|On threat detection|24 hours |
-|WUDOAggregatedStatus|On update event, aggregated over time|24-36 hours |
-|WUDOStatus|Once per day|12 hours |
-
-This means you should generally expect to see new data every 24-36 hours, except for WaaSDeploymentStatus and WUDOAggregatedStatus, which may take 36-48 hours (if it misses the 36th hour refresh, it would be in the 48th, so the data will be present in the 48th hour refresh).
-
-## Using Log Analytics
-
-Update Compliance is built on the Log Analytics platform that is integrated into Operations Management Suite. All data in the workspace is the direct result of a query. Understanding the tools and features at your disposal, all integrated within Azure Portal, can deeply enhance your experience and complement Update Compliance.
-
-See below for a few topics related to Log Analytics:
-* Learn how to effectively execute custom Log Searches by referring to Microsoft Azure’s excellent documentation on [querying data in Log Analytics](https://docs.microsoft.com/azure/log-analytics/log-analytics-log-searches).
-* To develop your own custom data views in Operations Management Suite or [Power BI](https://powerbi.microsoft.com/); check out documentation on [analyzing data for use in Log Analytics](https://docs.microsoft.com/azure/log-analytics/log-analytics-dashboards).
-* [Gain an overview of Log Analytics’ alerts](https://docs.microsoft.com/azure/log-analytics/log-analytics-alerts) and learn how to use it to always stay informed about the most critical issues you care about.
-
-## Related topics
-
-[Get started with Update Compliance](update-compliance-get-started.md)
+---
+title: Using Update Compliance (Windows 10)
+ms.reviewer:
+manager: laurawi
+description: Explains how to begin using Update Compliance.
+keywords: oms, operations management suite, wdav, updates, upgrades, antivirus, antimalware, signature, log analytics
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.pagetype: deploy
+audience: itpro
+author: jaimeo
+ms.author: jaimeo
+ms.localizationpriority: medium
+ms.collection: M365-analytics
+ms.topic: article
+---
+
+# Use Update Compliance
+
+In this section you'll learn how to use Update Compliance to monitor your device's Windows updates and Windows Defender Antivirus status. To configure your environment for use with Update Compliance, refer to [Get started with Update Compliance](update-compliance-get-started.md).
+
+
+Update Compliance:
+- Provides detailed deployment data for Windows 10 security, quality, and feature updates.
+- Reports when devices have issues related to updates that need attention.
+- Shows Windows Defender AV status information for devices that use it and meet the [prerequisites](update-compliance-get-started.md#update-compliance-prerequisites).
+- Shows bandwidth usage and savings for devices that are configured to use [Delivery Optimization](waas-delivery-optimization.md).
+- Provides all of the above data in [Log Analytics](#using-log-analytics), which affords additional querying and export capabilities.
+
+## The Update Compliance tile
+After Update Compliance has successfully been [added to your Azure subscription](update-compliance-get-started.md#add-update-compliance-to-your-azure-subscription), you’ll see this tile:
+
+
+
+When the solution is added, data is not immediately available. Data will begin to be collected after data is sent up that belongs to the Commercial ID associated with the device. This process assumes that Windows diagnostic data is enabled and data sharing is enabled as described in [Enrolling devices in Update Compliance](update-compliance-get-started.md#enroll-devices-in-update-compliance). After Microsoft has collected and processed any device data associated with your Commercial ID, the tile will be replaced with the following summary:
+
+
+
+The summary details the total number of devices that Microsoft has received data from with your Commercial ID. It also provides the number of devices that need attention if any. Finally, it details the last point at which your Update Compliance workspace was refreshed.
+
+## The Update Compliance workspace
+
+
+
+When you select this tile, you will be redirected to the Update Compliance workspace. The workspace is organized with the Overview blade providing a hub from which to navigate to different reports of your devices' data.
+
+### Overview blade
+
+
+
+Update Compliance’s overview blade summarizes all the data Update Compliance provides. It functions as a hub from which you can navigate to different sections. The total number of devices detected by Update Compliance is reported in the title of this blade. What follows is a distribution for all devices as to whether they are up to date on the following items:
+* Security updates: A device is up to date on quality updates whenever it has the latest applicable quality update installed. Quality updates are monthly cumulative updates that are specific to a version of Windows 10.
+* Feature updates: A device is up to date on feature updates whenever it has the latest applicable feature update installed. Update Compliance considers [Servicing Channel](waas-overview.md#servicing-channels) when determining update applicability.
+* AV Signature: A device is up to date on Antivirus Signature when the latest Windows Defender Signatures have been downloaded. This distribution only considers devices that are running Windows Defender Antivirus.
+
+The blade also provides the time at which your Update Compliance workspace was [refreshed](#update-compliance-data-latency).
+
+The following is a breakdown of the different sections available in Update Compliance:
+* [Need Attention!](update-compliance-need-attention.md) - This section is the default section when arriving to your Update Compliance workspace. It provides a summary of the different issues devices are facing relative to Windows 10 updates.
+* [Security Update Status](update-compliance-security-update-status.md) - This section lists the percentage of devices that are on the latest security update released for the version of Windows 10 it is running. Selecting this section provides blades that summarize the overall status of security updates across all devices and a summary of their deployment progress towards the latest two security updates.
+* [Feature Update Status](update-compliance-feature-update-status.md) - This section lists the percentage of devices that are on the latest feature update that is applicable to a given device. Selecting this section provides blades that summarize the overall feature update status across all devices and a summary of deployment status for different versions of Windows 10 in your environment.
+* [Delivery Optimization Status](update-compliance-delivery-optimization.md) - This section summarizes bandwidth savings incurred by utilizing Delivery Optimization in your environment. It provides a breakdown of Delivery Optimization configuration across devices, and summarizes bandwidth savings and utilization across multiple content types.
+
+
+## Update Compliance data latency
+Update Compliance uses Windows 10 diagnostic data as its data source. After you add Update Compliance and appropriately configure your devices, it could take 48-72 hours before they first appear. The process that follows is as follows:
+
+Update Compliance is refreshed every 12 hours. This means that every 12 hours all data that has been gathered over the last 12-hour interval is pushed to Log Analytics. However, the rate at which each type of data is sent from the device and how long it takes to be ready for Update Compliance varies, roughly outlined below.
+
+| Data Type | Data upload rate from device | Data Latency |
+|--|--|--|
+|WaaSUpdateStatus | Once per day |4 hours |
+|WaaSInsiderStatus| Once per day |4 hours |
+|WaaSDeploymentStatus|Every update event (Download, install, etc.)|24-36 hours |
+|WDAVStatus|On signature update|24 hours |
+|WDAVThreat|On threat detection|24 hours |
+|WUDOAggregatedStatus|On update event, aggregated over time|24-36 hours |
+|WUDOStatus|Once per day|12 hours |
+
+This means you should generally expect to see new data device data every 24 hours, except for WaaSDeploymentStatus and WUDOAggregatedStatus, which may take 36-48 hours (if it misses the 36th hour refresh, it would be in the 48th, so the data will be present in the 48th hour refresh).
+
+## Using Log Analytics
+
+Update Compliance is built on the Log Analytics platform that is integrated into Operations Management Suite. All data in the workspace is the direct result of a query. Understanding the tools and features at your disposal, all integrated within Azure Portal, can deeply enhance your experience and complement Update Compliance.
+
+See below for a few topics related to Log Analytics:
+* Learn how to effectively execute custom Log Searches by referring to Microsoft Azure’s excellent documentation on [querying data in Log Analytics](https://docs.microsoft.com/azure/log-analytics/log-analytics-log-searches).
+* To develop your own custom data views in Operations Management Suite or [Power BI](https://powerbi.microsoft.com/); check out documentation on [analyzing data for use in Log Analytics](https://docs.microsoft.com/azure/log-analytics/log-analytics-dashboards).
+* [Gain an overview of Log Analytics’ alerts](https://docs.microsoft.com/azure/log-analytics/log-analytics-alerts) and learn how to use it to always stay informed about the most critical issues you care about.
+
+## Related topics
+
+[Get started with Update Compliance](update-compliance-get-started.md)
\ No newline at end of file
diff --git a/windows/deployment/update/update-compliance-wd-av-status.md b/windows/deployment/update/update-compliance-wd-av-status.md
index 74250033ff..a6c324c71c 100644
--- a/windows/deployment/update/update-compliance-wd-av-status.md
+++ b/windows/deployment/update/update-compliance-wd-av-status.md
@@ -1,42 +1,43 @@
----
-title: Update Compliance - Windows Defender AV Status report
-ms.reviewer:
-manager: laurawi
-description: an overview of the Windows Defender AV Status report
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.collection: M365-analytics
-ms.topic: article
----
-
-# Windows Defender AV Status
-
-
-
-The Windows Defender AV Status section deals with data concerning signature and threat status for devices that use Windows Defender Antivirus. The section tile in the [Overview Blade](update-compliance-using.md#overview-blade) provides the percentage of devices with insufficient protection – this percentage only considers devices using Windows Defender Antivirus.
-
->[!NOTE]
->Update Compliance's Windows Defender Antivirus status is compatible with E3, B, F1, VL Professional and below licenses. Devices with an E5 license are not shown here; devices with an E5 license can be monitored using the [Windows Defender ATP portal](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection). If you'd like to learn more about Windows 10 licensing, see the [Windows 10 product licensing options](https://www.microsoft.com/Licensing/product-licensing/windows10.aspx).
-
-# Windows Defender AV Status sections
-The **Protection Status** blade gives a count for devices that have either out-of-date signatures or real-time protection turned off. Below, it gives a more detailed breakdown of the two issues. Selecting any of these statuses will navigate you to a Log Search view containing the query.
-
-The **Threat Status** blade shows, among devices that have encountered threats, how many were and were not remediated successfully. It also provides a detailed count. Selecting either of these will take you to the respective query in Log Search for further investigation.
-
-Here are some important terms to consider when using the Windows Defender AV Status section of Update Compliance:
-* **Signature out of date** devices are devices with a signature older than 14 days.
-* **No real-time protection** devices are devices that are using Windows Defender AV but have turned off real-time protection.
-* **Recently disappeared** devices are devices that were previously seen by Windows Defender AV and are no longer seen in the past 7 days.
-* **Remediation failed** devices are devices where Windows Defender AV failed to remediate the threat. This could be due to a number of reasons, including a full disk, network error, operation aborted, etc. Manual intervention might be needed from IT team.
-* **Not assessed** devices are devices where either a non-Microsoft AV solution is used or it has been more than 7 days since the device recently disappeared.
-
-## Windows Defender data latency
-Because of the way Windows Defender is associated with the rest of Windows device data, Defender data for new devices might take much longer to appear than other data types. This process could take up to 28 days.
-
-## Related topics
-
-- [Windows Defender Antivirus pre-requisites](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting#confirm-pre-requisites)
+---
+title: Update Compliance - Windows Defender AV Status report
+ms.reviewer:
+manager: laurawi
+description: an overview of the Windows Defender AV Status report
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.pagetype: deploy
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.author: jaimeo
+ms.collection: M365-analytics
+ms.topic: article
+---
+
+# Windows Defender AV Status
+
+
+
+The Windows Defender AV Status section deals with data concerning signature and threat status for devices that use Windows Defender Antivirus. The section tile in the [Overview Blade](update-compliance-using.md#overview-blade) provides the percentage of devices with insufficient protection – this percentage only considers devices using Windows Defender Antivirus.
+
+>[!NOTE]
+>Update Compliance's Windows Defender Antivirus status is compatible with E3, B, F1, VL Professional and below licenses. Devices with an E5 license are not shown here; devices with an E5 license can be monitored using the [Windows Defender ATP portal](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection). If you'd like to learn more about Windows 10 licensing, see the [Windows 10 product licensing options](https://www.microsoft.com/Licensing/product-licensing/windows10.aspx).
+
+# Windows Defender AV Status sections
+The **Protection Status** blade gives a count for devices that have either out-of-date signatures or real-time protection turned off. Below, it gives a more detailed breakdown of the two issues. Selecting any of these statuses will navigate you to a Log Search view containing the query.
+
+The **Threat Status** blade shows, among devices that have encountered threats, how many were and were not remediated successfully. It also provides a detailed count. Selecting either of these will take you to the respective query in Log Search for further investigation.
+
+Here are some important terms to consider when using the Windows Defender AV Status section of Update Compliance:
+* **Signature out of date** devices are devices with a signature older than 14 days.
+* **No real-time protection** devices are devices that are using Windows Defender AV but have turned off real-time protection.
+* **Recently disappeared** devices are devices that were previously seen by Windows Defender AV and are no longer seen in the past 7 days.
+* **Remediation failed** devices are devices where Windows Defender AV failed to remediate the threat. This could be due to a number of reasons, including a full disk, network error, operation aborted, etc. Manual intervention might be needed from IT team.
+* **Not assessed** devices are devices where either a non-Microsoft AV solution is used or it has been more than 7 days since the device recently disappeared.
+
+## Windows Defender data latency
+Because of the way Windows Defender is associated with the rest of Windows device data, Defender data for new devices might take much longer to appear than other data types. This process could take up to 28 days.
+
+## Related topics
+
+- [Windows Defender Antivirus pre-requisites](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting#confirm-pre-requisites)
diff --git a/windows/deployment/update/waas-branchcache.md b/windows/deployment/update/waas-branchcache.md
index 6e8a4ba345..aee88e8e01 100644
--- a/windows/deployment/update/waas-branchcache.md
+++ b/windows/deployment/update/waas-branchcache.md
@@ -3,11 +3,9 @@ title: Configure BranchCache for Windows 10 updates (Windows 10)
description: Use BranchCache to optimize network bandwidth during update deployment.
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
-author: greg-lindsay
+author: jaimeo
ms.localizationpriority: medium
-ms.author: greglin
-ms.date: 07/27/2017
+ms.author: jaimeo
ms.reviewer:
manager: laurawi
ms.topic: article
diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md
index c6b56e8162..81adf9756d 100644
--- a/windows/deployment/update/waas-configure-wufb.md
+++ b/windows/deployment/update/waas-configure-wufb.md
@@ -5,7 +5,7 @@ manager: laurawi
description: You can use Group Policy or your mobile device management (MDM) service to configure Windows Update for Business settings for your devices.
ms.prod: w10
ms.mktglfcycl: deploy
-ms.sitesec: library
+
audience: itpro
author: jaimeo
ms.localizationpriority: medium
diff --git a/windows/deployment/update/waas-delivery-optimization-reference.md b/windows/deployment/update/waas-delivery-optimization-reference.md
index fec88b2720..ab1a485ac8 100644
--- a/windows/deployment/update/waas-delivery-optimization-reference.md
+++ b/windows/deployment/update/waas-delivery-optimization-reference.md
@@ -6,11 +6,11 @@ description: Reference of all Delivery Optimization settings and descriptions of
keywords: oms, operations management suite, wdav, updates, downloads, log analytics
ms.prod: w10
ms.mktglfcycl: deploy
-ms.sitesec: library
+
audience: itpro
-author: greg-lindsay
+author: jaimeo
ms.localizationpriority: medium
-ms.author: greglin
+ms.author: jaimeo
ms.collection: M365-modern-desktop
ms.topic: article
---
diff --git a/windows/deployment/update/waas-delivery-optimization-setup.md b/windows/deployment/update/waas-delivery-optimization-setup.md
index f21112405f..61a6af8b7c 100644
--- a/windows/deployment/update/waas-delivery-optimization-setup.md
+++ b/windows/deployment/update/waas-delivery-optimization-setup.md
@@ -1,190 +1,191 @@
----
-title: Set up Delivery Optimization
-ms.reviewer:
-manager: laurawi
-description: Delivery Optimization is a new peer-to-peer distribution method in Windows 10
-keywords: oms, operations management suite, wdav, updates, downloads, log analytics
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.author: greglin
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-# Set up Delivery Optimization for Windows 10 updates
-
-**Applies to**
-
-- Windows 10
-
-> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
-
-## Recommended Delivery Optimization settings
-
-Delivery Optimization offers a great many settings to fine-tune its behavior (see [Delivery Optimization reference](waas-delivery-optimization-reference.md) for a comprehensive list), but for the most efficient performance, there are just a few key parameters that will have the greates impact if particular situations exist in your deployment:
-
-- Does your topology include multiple breakouts to the internet (i.e., a "hybrid WAN") or are there only a few connections to the internet, so that all requests appear to come from a single external IP address (a "hub and spoke" topology)?
-- If you use boundary groups in your topology, how many devices are present in a given group?
-- What percentage of your devices are mobile?
-- Do your devices have a lot of free space on their drives?
-- Do you have a lab scenario with many devices on AC power?
-
->[!NOTE]
->These scenarios (and the recommended settings for each) are not mutually exclusive. It's possible that your deployment might involve more than one of these scenarios, in which case you can employ the related settings in any combination as needed. In all cases, however, "download mode" is the most important one to set.
-
-Quick-reference table:
-
-| Use case | Policy | Recommended value | Reason |
-| --- | --- | --- | --- |
-| Hub & spoke topology | Download mode | 1 or 2 | Automatic grouping of peers to match your topology |
-| Sites with > 30 devices | Minimum file size to cache | 10 MB (or 1 MB) | Leverage peers-to-peer capability in more downloads |
-| Large number of mobile devices | Allow uploads on battery power | 60% | Increase # of devices that can upload while limiting battery drain |
-| Labs with AC-powered devices | Content Expiration | 7 (up to 30) days | Leverage devices that can upload more for a longer period |
-
-
-### Hybrid WAN scenario
-
-For this scenario, grouping devices by domain allows devices to be included in peer downloads and uploads across VLANs. **Set Download Mode to 2 - Group**. The default group is the authenticated domain or Active Directory site. If your domain-based group is too wide, or your Active Directory sites aren’t aligned with your site network topology, then you should consider additional options for dynamically creating groups, for example by using the GroupIDSrc parameter.
-
-
-
-
-To do this in Group Policy go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**.
-
-To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set DODownloadMode to 1 or 2.
-
-### Hub and spoke topology with boundary groups
-
-The default download mode setting is **1**; this means all devices breaking out to the internet using the same public IP will be considered as a single peer group. To prevent peer-to-peer activity across groups, you should set the download mode to **2**. If you have already defined Active Directory sites per hub or branch office, then you don't need to do anything else. If you're not using Active Directory sites, you should set *RestrictPeerSelectionBy* policies to restrict the activity to the subnet or set a different source for Groups by using the GroupIDSrc parameter. See [Select a method to restrict peer selection](waas-delivery-optimization-reference.md#select-a-method-to-restrict-peer-selection).
-
-
-
-To do this in Group Policy go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**.
-
-To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DODownloadMode** to **2**.
-
-
-### Large number of mobile devices
-
-If you have a mobile workforce with a great many mobile devices, set Delivery Optimization to allow uploads on battery power, while limiting the use to prevent battery drain. A setting for **DOMinBatteryPercentageAllowedToUpload** of 60% is a good starting point, though you might want to adjust it later.
-
-To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Allow uploads while the device is on battery while under set Battery level** to 60.
-
-To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DOMinBatteryPercentageAllowedToUpload** to 60.
-
-### Plentiful free space and large numbers of devices
-
-Many devices now come with large internal drives. You can set Delivery Optimization to take better advantage of this space (especially if you have large numbers of devices) by changing the minimum file size to cache. If you have more than 30 devices in your local network or group, change it from the default 50 MB to 10 MB. If you have more than 100 devices (and are running Windows 10, version 1803 or later), set this value to 1 MB.
-
-[//]: # (default of 50 aimed at consumer)
-
-To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Minimum Peer Caching Content File Size** to 100 (if you have more than 30 devices) or 1 (if you have more than 100 devices).
-
-To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DOMinFileSizeToCache** to 100 (if you have more than 30 devices) or 1 (if you have more than 100 devices).
-
-### Lab scenario
-
-In a lab situation, you typically have a large number of devices that are plugged in and have a lot of free disk space. By increasing the content expiration interval, you can take advantage of these devices, using them as excellent upload sources in order to upload much more content over a longer period.
-
-To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Max Cache Age** to **6048000** (7 days) or more (up to 30 days).
-
-To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set DOMaxCacheAge to 7 or more (up to 30 days).
-
-[//]: # (material about "preferred" devices; remove MinQos/MaxCacheAge; table format?)
-
-
-## Monitor Delivery Optimization
-[//]: # (How to tell if it’s working? What values are reasonable; which are not? If not, which way to adjust and how? -- check PercentPeerCaching for files > minimum >= 50%)
-
-### Windows PowerShell cmdlets
-
-**Starting in Windows 10, version 1703**, you can use new PowerShell cmdlets to check the performance of Delivery Optimization.
-
-#### Analyze usage
-
-`Get-DeliveryOptimizationStatus` returns a real-time snapshot of all current Delivery Optimization jobs.
-
-| Key | Value |
-| --- | --- |
-| File ID | A GUID that identifies the file being processed |
-| Priority | Priority of the download; values are **foreground** or **background** |
-| FileSize | Size of the file |
-| TotalBytesDownloaded | The number of bytes from any source downloaded so far |
-| PercentPeerCaching |The percentage of bytes downloaded from peers versus over HTTP |
-| BytesFromPeers | Total bytes downloaded from peer devices (sum of bytes downloaded from LAN, Group, and Internet Peers) |
-| BytesfromHTTP | Total number of bytes received over HTTP |
-| DownloadDuration | Total download time in seconds |
-| Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but is not uploading yet); **Caching** (download completed successfully and is ready to upload or uploading); **Paused** (download/upload paused by caller) |
-| NumPeers | Indicates the total number of peers returned from the service. |
-| PredefinedCallerApplication | Indicates the last caller that initiated a request for the file. |
-| ExpireOn | The target expiration date and time for the file. |
-| Pinned | A yes/no value indicating whether an item has been "pinned" in the cache (see `setDeliveryOptmizationStatus`). |
-
-`Get-DeliveryOptimizationPerfSnap` returns a list of key performance data:
-
-- Number of files downloaded
-- Number of files uploaded
-- Total bytes downloaded
-- Total bytes uploaded
-- Average transfer size (download); that is, the number bytes downloaded divided by the number of files
-- Average transfer size (upload); the number of bytes uploaded divided by the number of files
-- Peer efficiency; same as PercentPeerCaching
-
-Using the `-Verbose` option returns additional information:
-
-- Bytes from peers (per type)
-- Bytes from CDN (the number of bytes received over HTTP)
-- Average number of peer connections per download
-
-Starting in Window 10, version 1903, `get-DeliveryOptimizationPerfSnap` has a new option `-CacheSummary` which provides a summary of the cache status.
-
-Starting in Windows 10, version 1803, `Get-DeliveryOptimizationPerfSnapThisMonth` returns data similar to that from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month.
-
-#### Manage the Delivery Optimization cache
-
-**Starting in Windows 10, version 1903:**
-
-`set-DeliveryOptimizationStatus -ExpireOn [date time]` extends the expiration of all files in the cache. You can set the expiration immediately for all files that are in the "caching" state. For files in progress ("downloading"), the expiration is applied once the download is complete. You can set the expiration up to one year from the current date and time.
-
-`set-DeliveryOptimizationStatus -ExpireOn [date time] -FileID [FileID]` extends expiration for a single specific file in the cache.
-
-You can now "pin" files to keep them persistent in the cache. You can only do this with files that are downloaded in modes 1, 2, or 3.
-
-`set-DeliveryOptimizationStatus -Pin [True] -File ID [FileID]` keeps a specific file in the cache such that it won't be deleted until the expiration date and time (which you set with `set-DeliveryOptimizationStatus -ExpireOn [date time] -FileID [FileID]`). The file is also excluded from the cache quota calculation.
-
-`set-DeliveryOptimizationStatus -Pin [False] -File ID [FileID]` "unpins" a file, so that it will be deleted when the expiration date and time are rreached. The file is included in the cache quota calculation.
-
-`delete-DeliveryOptimizationCache` lets you clear files from the cache and remove all persisted data related to them. You can use these options with this cmdlet:
-
-- `-FileID` specifies a particular file to delete.
-- `-IncludePinnedFiles` deletes all files that are pinned.
-- `-Force` deletes the cache with no prompts.
-
-
-#### Work with Delivery Optimization logs
-
-**Starting in Windows 10, version 1803:**
-
-`Get-DeliveryOptimizationLog [-Path ] [-Flush]`
-
-If `Path` is not specified, this cmdlet reads all logs from the dosvc log directory, which requires administrator permissions. If `Flush` is specified, the cmdlet stops dosvc before reading logs.
-
-Log entries are written to the PowerShell pipeline as objects. To dump logs to a text file, run `Get-DeliveryOptimizationLog | Set-Content ` or something similar.
-
-[//]: # (section on what to look for in logs, list of peers, connection failures)
-
-
-
-[//]: # (possibly move to Troubleshooting)
-
-### Monitor with Update Compliance
-
-The Update Compliance solution of Windows Analytics provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days.
-
-
-
-For details, see [Delivery Optimization in Update Compliance](update-compliance-delivery-optimization.md).
-
+---
+title: Set up Delivery Optimization
+ms.reviewer:
+manager: laurawi
+description: Delivery Optimization is a new peer-to-peer distribution method in Windows 10
+keywords: oms, operations management suite, wdav, updates, downloads, log analytics
+ms.prod: w10
+ms.mktglfcycl: deploy
+
+audience: itpro
+author: jaimeo
+ms.localizationpriority: medium
+ms.author: jaimeo
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+# Set up Delivery Optimization for Windows 10 updates
+
+**Applies to**
+
+- Windows 10
+
+> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
+
+## Recommended Delivery Optimization settings
+
+Delivery Optimization offers a great many settings to fine-tune its behavior (see [Delivery Optimization reference](waas-delivery-optimization-reference.md) for a comprehensive list), but for the most efficient performance, there are just a few key parameters that will have the greatest impact if particular situations exist in your deployment:
+
+- Does your topology include multiple breakouts to the internet (i.e., a "hybrid WAN") or are there only a few connections to the internet, so that all requests appear to come from a single external IP address (a "hub and spoke" topology)?
+- If you use boundary groups in your topology, how many devices are present in a given group?
+- What percentage of your devices are mobile?
+- Do your devices have a lot of free space on their drives?
+- Do you have a lab scenario with many devices on AC power?
+
+>[!NOTE]
+>These scenarios (and the recommended settings for each) are not mutually exclusive. It's possible that your deployment might involve more than one of these scenarios, in which case you can employ the related settings in any combination as needed. In all cases, however, "download mode" is the most important one to set.
+
+Quick-reference table:
+
+| Use case | Policy | Recommended value | Reason |
+| --- | --- | --- | --- |
+| Hub & spoke topology | Download mode | 1 or 2 | Automatic grouping of peers to match your topology |
+| Sites with > 30 devices | Minimum file size to cache | 10 MB (or 1 MB) | Leverage peers-to-peer capability in more downloads |
+| Large number of mobile devices | Allow uploads on battery power | 60% | Increase # of devices that can upload while limiting battery drain |
+| Labs with AC-powered devices | Content Expiration | 7 (up to 30) days | Leverage devices that can upload more for a longer period |
+
+
+### Hybrid WAN scenario
+
+For this scenario, grouping devices by domain allows devices to be included in peer downloads and uploads across VLANs. **Set Download Mode to 2 - Group**. The default group is the authenticated domain or Active Directory site. If your domain-based group is too wide, or your Active Directory sites aren’t aligned with your site network topology, then you should consider additional options for dynamically creating groups, for example by using the GroupIDSrc parameter.
+
+
+
+
+To do this in Group Policy go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**.
+
+To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set DODownloadMode to 1 or 2.
+
+### Hub and spoke topology with boundary groups
+
+The default download mode setting is **1**; this means all devices breaking out to the internet using the same public IP will be considered as a single peer group. To prevent peer-to-peer activity across groups, you should set the download mode to **2**. If you have already defined Active Directory sites per hub or branch office, then you don't need to do anything else. If you're not using Active Directory sites, you should set *RestrictPeerSelectionBy* policies to restrict the activity to the subnet or set a different source for Groups by using the GroupIDSrc parameter. See [Select a method to restrict peer selection](waas-delivery-optimization-reference.md#select-a-method-to-restrict-peer-selection).
+
+
+
+To do this in Group Policy go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**.
+
+To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DODownloadMode** to **2**.
+
+
+### Large number of mobile devices
+
+If you have a mobile workforce with a great many mobile devices, set Delivery Optimization to allow uploads on battery power, while limiting the use to prevent battery drain. A setting for **DOMinBatteryPercentageAllowedToUpload** of 60% is a good starting point, though you might want to adjust it later.
+
+To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Allow uploads while the device is on battery while under set Battery level** to 60.
+
+To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DOMinBatteryPercentageAllowedToUpload** to 60.
+
+### Plentiful free space and large numbers of devices
+
+Many devices now come with large internal drives. You can set Delivery Optimization to take better advantage of this space (especially if you have large numbers of devices) by changing the minimum file size to cache. If you have more than 30 devices in your local network or group, change it from the default 50 MB to 10 MB. If you have more than 100 devices (and are running Windows 10, version 1803 or later), set this value to 1 MB.
+
+[//]: # (default of 50 aimed at consumer)
+
+To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Minimum Peer Caching Content File Size** to 100 (if you have more than 30 devices) or 1 (if you have more than 100 devices).
+
+To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DOMinFileSizeToCache** to 100 (if you have more than 30 devices) or 1 (if you have more than 100 devices).
+
+### Lab scenario
+
+In a lab situation, you typically have a large number of devices that are plugged in and have a lot of free disk space. By increasing the content expiration interval, you can take advantage of these devices, using them as excellent upload sources in order to upload much more content over a longer period.
+
+To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Max Cache Age** to **6048000** (7 days) or more (up to 30 days).
+
+To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set DOMaxCacheAge to 7 or more (up to 30 days).
+
+[//]: # (material about "preferred" devices; remove MinQos/MaxCacheAge; table format?)
+
+
+## Monitor Delivery Optimization
+[//]: # (How to tell if it’s working? What values are reasonable; which are not? If not, which way to adjust and how? -- check PercentPeerCaching for files > minimum >= 50%)
+
+### Windows PowerShell cmdlets
+
+**Starting in Windows 10, version 1703**, you can use new PowerShell cmdlets to check the performance of Delivery Optimization.
+
+#### Analyze usage
+
+`Get-DeliveryOptimizationStatus` returns a real-time snapshot of all current Delivery Optimization jobs.
+
+| Key | Value |
+| --- | --- |
+| File ID | A GUID that identifies the file being processed |
+| Priority | Priority of the download; values are **foreground** or **background** |
+| FileSize | Size of the file |
+| TotalBytesDownloaded | The number of bytes from any source downloaded so far |
+| PercentPeerCaching |The percentage of bytes downloaded from peers versus over HTTP |
+| BytesFromPeers | Total bytes downloaded from peer devices (sum of bytes downloaded from LAN, Group, and Internet Peers) |
+| BytesfromHTTP | Total number of bytes received over HTTP |
+| DownloadDuration | Total download time in seconds |
+| Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but is not uploading yet); **Caching** (download completed successfully and is ready to upload or uploading); **Paused** (download/upload paused by caller) |
+| NumPeers | Indicates the total number of peers returned from the service. |
+| PredefinedCallerApplication | Indicates the last caller that initiated a request for the file. |
+| ExpireOn | The target expiration date and time for the file. |
+| Pinned | A yes/no value indicating whether an item has been "pinned" in the cache (see `setDeliveryOptmizationStatus`). |
+
+`Get-DeliveryOptimizationPerfSnap` returns a list of key performance data:
+
+- Number of files downloaded
+- Number of files uploaded
+- Total bytes downloaded
+- Total bytes uploaded
+- Average transfer size (download); that is, the number bytes downloaded divided by the number of files
+- Average transfer size (upload); the number of bytes uploaded divided by the number of files
+- Peer efficiency; same as PercentPeerCaching
+
+Using the `-Verbose` option returns additional information:
+
+- Bytes from peers (per type)
+- Bytes from CDN (the number of bytes received over HTTP)
+- Average number of peer connections per download
+
+Starting in Window 10, version 1903, `get-DeliveryOptimizationPerfSnap` has a new option `-CacheSummary` which provides a summary of the cache status.
+
+Starting in Windows 10, version 1803, `Get-DeliveryOptimizationPerfSnapThisMonth` returns data similar to that from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month.
+
+#### Manage the Delivery Optimization cache
+
+**Starting in Windows 10, version 1903:**
+
+`set-DeliveryOptimizationStatus -ExpireOn [date time]` extends the expiration of all files in the cache. You can set the expiration immediately for all files that are in the "caching" state. For files in progress ("downloading"), the expiration is applied once the download is complete. You can set the expiration up to one year from the current date and time.
+
+`set-DeliveryOptimizationStatus -ExpireOn [date time] -FileID [FileID]` extends expiration for a single specific file in the cache.
+
+You can now "pin" files to keep them persistent in the cache. You can only do this with files that are downloaded in modes 1, 2, or 3.
+
+`set-DeliveryOptimizationStatus -Pin [True] -File ID [FileID]` keeps a specific file in the cache such that it won't be deleted until the expiration date and time (which you set with `set-DeliveryOptimizationStatus -ExpireOn [date time] -FileID [FileID]`). The file is also excluded from the cache quota calculation.
+
+`set-DeliveryOptimizationStatus -Pin [False] -File ID [FileID]` "unpins" a file, so that it will be deleted when the expiration date and time are reached. The file is included in the cache quota calculation.
+
+`delete-DeliveryOptimizationCache` lets you clear files from the cache and remove all persisted data related to them. You can use these options with this cmdlet:
+
+- `-FileID` specifies a particular file to delete.
+- `-IncludePinnedFiles` deletes all files that are pinned.
+- `-Force` deletes the cache with no prompts.
+
+
+#### Work with Delivery Optimization logs
+
+**Starting in Windows 10, version 1803:**
+
+`Get-DeliveryOptimizationLog [-Path ] [-Flush]`
+
+If `Path` is not specified, this cmdlet reads all logs from the dosvc log directory, which requires administrator permissions. If `Flush` is specified, the cmdlet stops dosvc before reading logs.
+
+Log entries are written to the PowerShell pipeline as objects. To dump logs to a text file, run `Get-DeliveryOptimizationLog | Set-Content ` or something similar.
+
+[//]: # (section on what to look for in logs, list of peers, connection failures)
+
+
+
+[//]: # (possibly move to Troubleshooting)
+
+### Monitor with Update Compliance
+
+The Update Compliance solution of Windows Analytics provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days.
+
+
+
+For details, see [Delivery Optimization in Update Compliance](update-compliance-delivery-optimization.md).
+
diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md
index 64deb7803d..6d7bf33b2a 100644
--- a/windows/deployment/update/waas-delivery-optimization.md
+++ b/windows/deployment/update/waas-delivery-optimization.md
@@ -6,7 +6,7 @@ description: Delivery Optimization is a peer-to-peer distribution method in Wind
keywords: oms, operations management suite, wdav, updates, downloads, log analytics
ms.prod: w10
ms.mktglfcycl: deploy
-ms.sitesec: library
+
audience: itpro
author: jaimeo
ms.localizationpriority: medium
@@ -63,9 +63,9 @@ The following table lists the minimum Windows 10 version that supports Delivery
-By default in Windows 10 Enterprise and Education editions, Delivery Optimization allows peer-to-peer sharing on the organization's own network only (specifically, all of the devices must be behind the same NAT), but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune.
+In Windows 10 Enterprise, Professional, and Education editions, Delivery Optimization is enabled by default for peer-to-peer sharing on the local network (NAT). Specifically, all of the devices must be behind the same NAT, but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune.
-For more details, see "Download mode" in [Delivery optimization reference](waas-delivery-optimization-reference.md#download-mode).
+For more details, see "Download mode" in [Delivery optimization reference](waas-delivery-optimization-reference.md).
## Set up Delivery Optimization
diff --git a/windows/deployment/update/waas-deployment-rings-windows-10-updates.md b/windows/deployment/update/waas-deployment-rings-windows-10-updates.md
index 30023d81bb..d5eab1b3c4 100644
--- a/windows/deployment/update/waas-deployment-rings-windows-10-updates.md
+++ b/windows/deployment/update/waas-deployment-rings-windows-10-updates.md
@@ -3,7 +3,6 @@ title: Build deployment rings for Windows 10 updates (Windows 10)
description: Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades.
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
diff --git a/windows/deployment/update/waas-integrate-wufb.md b/windows/deployment/update/waas-integrate-wufb.md
index 1bc196ce0e..d28b788ca7 100644
--- a/windows/deployment/update/waas-integrate-wufb.md
+++ b/windows/deployment/update/waas-integrate-wufb.md
@@ -3,10 +3,9 @@ title: Integrate Windows Update for Business with management solutions (Windows
description: Use Windows Update for Business deployments with management tools such as Windows Server Update Services (WSUS) and System Center Configuration Manager.
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
-author: greg-lindsay
+author: jaimeo
ms.localizationpriority: medium
-ms.author: greglin
+ms.author: jaimeo
ms.date: 07/27/2017
ms.reviewer:
manager: laurawi
diff --git a/windows/deployment/update/waas-manage-updates-configuration-manager.md b/windows/deployment/update/waas-manage-updates-configuration-manager.md
index 5ab254f79d..7563d572b3 100644
--- a/windows/deployment/update/waas-manage-updates-configuration-manager.md
+++ b/windows/deployment/update/waas-manage-updates-configuration-manager.md
@@ -3,7 +3,6 @@ title: Deploy Windows 10 updates using System Center Configuration Manager (Wind
description: System Center Configuration Manager provides maximum control over quality and feature updates for Windows 10.
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
diff --git a/windows/deployment/update/waas-manage-updates-wsus.md b/windows/deployment/update/waas-manage-updates-wsus.md
index cda79baf8e..e24cc6ff0b 100644
--- a/windows/deployment/update/waas-manage-updates-wsus.md
+++ b/windows/deployment/update/waas-manage-updates-wsus.md
@@ -3,7 +3,6 @@ title: Deploy Windows 10 updates using Windows Server Update Services (Windows 1
description: WSUS allows companies to defer, selectively approve, choose when delivered, and determine which devices receive updates.
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md
index b80b9132c8..96e833ec0a 100644
--- a/windows/deployment/update/waas-manage-updates-wufb.md
+++ b/windows/deployment/update/waas-manage-updates-wufb.md
@@ -5,7 +5,6 @@ manager: laurawi
description: Windows Update for Business lets you manage when devices received updates from Windows Update.
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
diff --git a/windows/deployment/update/waas-mobile-updates.md b/windows/deployment/update/waas-mobile-updates.md
index 73652f10a9..e425484498 100644
--- a/windows/deployment/update/waas-mobile-updates.md
+++ b/windows/deployment/update/waas-mobile-updates.md
@@ -3,7 +3,6 @@ title: Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile
description: tbd
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
diff --git a/windows/deployment/update/waas-morenews.md b/windows/deployment/update/waas-morenews.md
index bf740f50c0..ecc49de5af 100644
--- a/windows/deployment/update/waas-morenews.md
+++ b/windows/deployment/update/waas-morenews.md
@@ -1,51 +1,53 @@
----
-title: Windows as a service
-ms.prod: w10
-ms.topic: article
-ms.manager: elizapo
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.date: 12/19/2018
-ms.reviewer:
-manager: laurawi
-ms.localizationpriority: high
-ms.topic: article
----
-# Windows as a service - More news
-
-Here's more news about [Windows as a service](windows-as-a-service.md):
-
-
- Improving the Windows 10 update experience with control, quality and transparency - April 4, 2019
-Call to action: review your Windows Update for Business deferral values - April 3, 2019
- Windows 10, version 1809 designated for broad deployment - March 28, 2019
-Data, insights and listening to improve the customer experience - March 6, 2019
-Getting to know the Windows update history pages - February 21, 2019
-Windows Update for Business and the retirement of SAC-T - February 14, 2019
-Application compatibility in the Windows ecosystem - January 15, 2019
-Windows monthly security and quality updates overview - January 10, 2019
-Driver quality in the Windows ecosystem - December 19, 2018
-Modern Desktop Podcast - Episode 001 – Windows 10 Monthly Quality Updates - December 18, 2018
-Measuring Delivery Optimization and its impact to your network - December 13, 2018
-LTSC: What is it, and when should it be used? - November 29, 2018
-Local Experience Packs: What are they and when should you use them? - November 14, 2018
-Resuming the Rollout of the Windows 10 October 2018 Update - November 13, 2018
-Windows 10 Quality Approach for a Complex Ecosystem - November 13, 2018
-Delivery Optimization: Scenarios and Configuration Options - October 30, 2018
-Language Pack Acquisition and Retention for Enterprise Devices - October 18, 2018
-Updated Version of Windows 10 October 2018 Update Released to Windows Insiders - October 9, 2018
-How to get the Windows 10 October 2018 Update - October 2, 2018
-Reducing Windows 10 Package Size Downloads for x64 Systems - September 26, 2018
-Windows 7 Servicing Stack Updates: Managing Change and Appreciating Cumulative Updates - September 21, 2018
-Helping customers shift to a modern desktop - September 6, 2018
-Windows Update for Business & Windows Analytics: a real-world experience - September 5, 2018
-What's next for Windows 10 and Windows Server quality updates - August 16, 2018
-Windows 10 monthly updates - August 1, 2018 (video )
-Windows 10 update servicing cadence - August 1, 2018
-Windows 10 quality updates explained and the end of delta updates - July 11, 2018
-AI Powers Windows 10 April 2018 Update Rollout - June 14, 2018
-Windows Server 2008 SP2 Servicing Changes - June 12, 2018
-Windows Update for Business - Enhancements, diagnostics, configuration - June 7, 2018
-Windows 10 and the disappearing SAC-T - May 31, 2018
-Manage update download size using Windows as a service - March 30, 2018
-
+---
+title: Windows as a service
+ms.prod: w10
+ms.topic: article
+ms.manager: elizapo
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.author: jaimeo
+ms.date: 12/19/2018
+ms.reviewer:
+manager: laurawi
+ms.localizationpriority: high
+ms.topic: article
+---
+# Windows as a service - More news
+
+Here's more news about [Windows as a service](windows-as-a-service.md):
+
+
+ Improving the Windows 10 update experience with control, quality and transparency - April 4, 2019
+Call to action: review your Windows Update for Business deferral values - April 3, 2019
+ Windows 10, version 1809 designated for broad deployment - March 28, 2019
+Data, insights and listening to improve the customer experience - March 6, 2019
+Getting to know the Windows update history pages - February 21, 2019
+Windows Update for Business and the retirement of SAC-T - February 14, 2019
+Application compatibility in the Windows ecosystem - January 15, 2019
+Windows monthly security and quality updates overview - January 10, 2019
+Driver quality in the Windows ecosystem - December 19, 2018
+Modern Desktop Podcast - Episode 001 – Windows 10 Monthly Quality Updates - December 18, 2018
+Measuring Delivery Optimization and its impact to your network - December 13, 2018
+LTSC: What is it, and when should it be used? - November 29, 2018
+Local Experience Packs: What are they and when should you use them? - November 14, 2018
+Resuming the Rollout of the Windows 10 October 2018 Update - November 13, 2018
+Windows 10 Quality Approach for a Complex Ecosystem - November 13, 2018
+Delivery Optimization: Scenarios and Configuration Options - October 30, 2018
+Language Pack Acquisition and Retention for Enterprise Devices - October 18, 2018
+Updated Version of Windows 10 October 2018 Update Released to Windows Insiders - October 9, 2018
+How to get the Windows 10 October 2018 Update - October 2, 2018
+Reducing Windows 10 Package Size Downloads for x64 Systems - September 26, 2018
+Windows 7 Servicing Stack Updates: Managing Change and Appreciating Cumulative Updates - September 21, 2018
+Helping customers shift to a modern desktop - September 6, 2018
+Windows Update for Business & Windows Analytics: a real-world experience - September 5, 2018
+What's next for Windows 10 and Windows Server quality updates - August 16, 2018
+Windows 10 monthly updates - August 1, 2018 (video )
+Windows 10 update servicing cadence - August 1, 2018
+Windows 10 quality updates explained and the end of delta updates - July 11, 2018
+AI Powers Windows 10 April 2018 Update Rollout - June 14, 2018
+Windows Server 2008 SP2 Servicing Changes - June 12, 2018
+Windows Update for Business - Enhancements, diagnostics, configuration - June 7, 2018
+Windows 10 and the disappearing SAC-T - May 31, 2018
+Manage update download size using Windows as a service - March 30, 2018
+
diff --git a/windows/deployment/update/waas-optimize-windows-10-updates.md b/windows/deployment/update/waas-optimize-windows-10-updates.md
index 993d1f887d..71135004a4 100644
--- a/windows/deployment/update/waas-optimize-windows-10-updates.md
+++ b/windows/deployment/update/waas-optimize-windows-10-updates.md
@@ -3,7 +3,6 @@ title: Optimize update delivery for Windows 10 updates (Windows 10)
description: Two methods of peer-to-peer content distribution are available in Windows 10, Delivery Optimization and BranchCache.
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
diff --git a/windows/deployment/update/waas-overview.md b/windows/deployment/update/waas-overview.md
index 02b95b42a5..23a3c73b90 100644
--- a/windows/deployment/update/waas-overview.md
+++ b/windows/deployment/update/waas-overview.md
@@ -4,7 +4,6 @@ description: In Windows 10, Microsoft has streamlined servicing to make operatin
keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
diff --git a/windows/deployment/update/waas-quick-start.md b/windows/deployment/update/waas-quick-start.md
index b7e23d8a0a..b2f7bf1b6a 100644
--- a/windows/deployment/update/waas-quick-start.md
+++ b/windows/deployment/update/waas-quick-start.md
@@ -4,7 +4,6 @@ description: In Windows 10, Microsoft has streamlined servicing to make operatin
keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md
index 0ea4468377..e1866cfcc0 100644
--- a/windows/deployment/update/waas-restart.md
+++ b/windows/deployment/update/waas-restart.md
@@ -3,7 +3,7 @@ title: Manage device restarts after updates (Windows 10)
description: tbd
ms.prod: w10
ms.mktglfcycl: deploy
-ms.sitesec: library
+
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
diff --git a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md
index 2375cfd6b8..453488ddf0 100644
--- a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md
+++ b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md
@@ -3,7 +3,7 @@ title: Assign devices to servicing channels for Windows 10 updates (Windows 10)
description: tbd
ms.prod: w10
ms.mktglfcycl: deploy
-ms.sitesec: library
+
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
diff --git a/windows/deployment/update/waas-servicing-differences.md b/windows/deployment/update/waas-servicing-differences.md
index 1b5f466c3f..6a9df9bd4f 100644
--- a/windows/deployment/update/waas-servicing-differences.md
+++ b/windows/deployment/update/waas-servicing-differences.md
@@ -6,12 +6,11 @@ description: Learn the differences between servicing Windows 10 and servicing ol
keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
audience: itpro
-author: greg-lindsay
+author: jaimeo
ms.localizationpriority: medium
ms.audience: itpro
-author: greg-lindsay
+author: jaimeo
ms.topic: article
ms.collection: M365-modern-desktop
---
diff --git a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md
index 32e06ed8f5..66702a34a3 100644
--- a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md
+++ b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md
@@ -3,7 +3,6 @@ title: Prepare servicing strategy for Windows 10 updates (Windows 10)
description: A strong Windows 10 deployment strategy begins with establishing a simple, repeatable process for testing and deploying each feature update.
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md
index 2b84969903..3967a511a8 100644
--- a/windows/deployment/update/waas-wu-settings.md
+++ b/windows/deployment/update/waas-wu-settings.md
@@ -3,7 +3,7 @@ title: Manage additional Windows Update settings (Windows 10)
description: Additional settings to control the behavior of Windows Update (WU) in Windows 10
ms.prod: w10
ms.mktglfcycl: deploy
-ms.sitesec: library
+
audience: itpro
author: jaimeo
ms.localizationpriority: medium
diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md
index d45100b41b..d3aee0caf9 100644
--- a/windows/deployment/update/waas-wufb-group-policy.md
+++ b/windows/deployment/update/waas-wufb-group-policy.md
@@ -3,7 +3,6 @@ title: Walkthrough use Group Policy to configure Windows Update for Business - W
description: Configure Windows Update for Business settings using Group Policy.
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
diff --git a/windows/deployment/update/waas-wufb-intune.md b/windows/deployment/update/waas-wufb-intune.md
index 7736d4e6c7..71296b4265 100644
--- a/windows/deployment/update/waas-wufb-intune.md
+++ b/windows/deployment/update/waas-wufb-intune.md
@@ -3,12 +3,11 @@ title: Walkthrough use Intune to configure Windows Update for Business (Windows
description: Configure Windows Update for Business settings using Microsoft Intune.
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
audience: itpro
-author: greg-lindsay
+author: jaimeo
ms.localizationpriority: medium
ms.audience: itpro
-author: greg-lindsay
+author: jaimeo
ms.date: 07/27/2017
ms.reviewer:
manager: laurawi
diff --git a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md
index 1cf1ddcb0a..4f04e51290 100644
--- a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md
+++ b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md
@@ -6,12 +6,11 @@ description: Frequently asked questions about Windows Analytics and steps to tak
keywords: windows analytics, oms, operations management suite, prerequisites, requirements, updates, upgrades, log analytics, health, FAQ, problems, troubleshooting, error
ms.prod: w10
ms.mktglfcycl: deploy
-ms.sitesec: library
ms.pagetype: deploy
audience: itpro
-author: greg-lindsay
+author: jaimeo
ms.audience: itpro
-author: greg-lindsay
+author: jaimeo
ms.localizationpriority: medium
ms.collection: M365-analytics
ms.topic: article
@@ -19,6 +18,9 @@ ms.topic: article
# Frequently asked questions and troubleshooting Windows Analytics
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
>[!IMPORTANT]
>**The OMS portal has been deprecated; you should start using the [Azure portal](https://portal.azure.com) instead as soon as possible.** Many experiences are the same in the two portals, but there are some key differences. See [Windows Analytics in the Azure Portal](windows-analytics-azure-portal.md) for steps to use Windows Analytics in the Azure portal. For much more information about the transition from OMS to Azure, see [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition).
@@ -150,7 +152,7 @@ For more information, see [Enrolling devices in Windows Analytics](windows-analy
### Apps not appearing in Device Health App Reliability
-[](images/app-reliability.png)
+[](images/app-reliability.png)
If apps that you know are crashing do not appear in App Reliability, follow these steps to investigate the issue:
diff --git a/windows/deployment/update/windows-analytics-azure-portal.md b/windows/deployment/update/windows-analytics-azure-portal.md
index 77c86f443d..610deb2695 100644
--- a/windows/deployment/update/windows-analytics-azure-portal.md
+++ b/windows/deployment/update/windows-analytics-azure-portal.md
@@ -1,71 +1,75 @@
----
-title: Windows Analytics in the Azure Portal
-ms.reviewer:
-manager: laurawi
-description: Use the Azure Portal to add and configure Windows Analytics solutions
-keywords: Device Health, oms, Azure, portal, operations management suite, add, manage, configure, Upgrade Readiness, Update Compliance
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
-ms.audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.collection: M365-analytics
-ms.topic: article
----
-
-# Windows Analytics in the Azure Portal
-
-Windows Analytics uses Azure Log Analytics workspaces (formerly known as Operations Management Suite or OMS), a collection of cloud-based services for monitoring and automating your on-premises and cloud environments.
-
-**The OMS portal has been deprecated; you should start using the [Azure portal](https://portal.azure.com) instead as soon as possible.** Many experiences are the same in the two portals, but there are some key differences, which this topic will explain. For much more information about the transition from OMS to Azure, see [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition).
-
-## Navigation and permissions in the Azure portal
-
-Go to the [Azure portal](https://portal.azure.com), select **All services**, and search for *Log Analytics workspaces*. Once it appears, you can select the star to add it to your favorites for easy access in the future.
-
-[](images/azure-portal-LAfav1.png)
-
-### Permissions
-
-It's important to understand the difference between Azure Active Directory and an Azure subscription:
-
-**Azure Active Directory** is the directory that Azure uses. Azure Active Directory (Azure AD) is a separate service which sits by itself and is used by all of Azure and also Office 365.
-
-An **Azure subscription** is a container for billing, but also acts as a security boundary. Every Azure subscription has a trust relationship with at least one Azure AD instance. This means that a subscription trusts that directory to authenticate users, services, and devices.
-
-
->[!IMPORTANT]
->Unlike the OMS portal (which only requires permission to access the Azure Log Analytics workspace), the Azure portal also requires access to be configured to either the linked *Azure subscription* or Azure resource group.
-
-To check the Log Analytics workspaces you can access, select **Log Analytics workspaces**. You should see a grid control listing all workspaces, along with the Azure subscription each is linked to:
-
-[](images/azure-portal-LAmain-wkspc-subname-sterile.png)
-
-If you do not see your workspace in this view, but you are able to access the workspace from the classic portal, that means you do not have access to the workspace's Azure subscription or resource group. To remedy this, you will need to find someone with admin rights to grant you access, which they can do by selecting the subscription name and selecting **Access control (IAM)** (alternatively they can configure your access at the resource group level). They should either grant you "Log Analytics Reader" access (for read-only access) or "Log Analytics Contributor" access (which enables making changes such as creating deployment plans and changing application readiness states).
-
-When permissions are configured, you can select the workspace and then select **Workspace summary** to see information similar to what was shown in the OMS overview page.
-
-[](images/azure-portal-LA-wkspcsumm_sterile.png)
-
-## Adding Windows Analytics solutions
-
-In the Azure portal, the simplest way to add Windows Analytics solutions (Upgrade Readiness, Update Compliance, and Device Health) is to select **+ Create a resource** and then type the solution name in the search box. In this example, the search is for "Device Health":
-
-[](images/azure-portal-create-resource-boxes.png)
-
-Select the solution from the list that is returned by the search, and then select **Create** to add the solution.
-
-## Navigating to Windows Analytics solutions settings
-
-To adjust settings for a Windows Analytics solution, first navigate to the **Solutions** tab for your workspace, and then select the solution to configure. In this example, Upgrade Readiness is being adjusted by selecting **CompatibilityAssessment**:
-
-[](images/temp-azure-portal-soltn-setting.png)
-
-From there, select the settings page to adjust specific settings:
-
-[](images/azure-portal-UR-settings.png)
-
->[!NOTE]
->To access these settings, both the subscription and workspace require "contributor" permissions. You can view your current role and make changes in other roles by using the **Access control (IAM)** tab in Azure.
+---
+title: Windows Analytics in the Azure Portal
+ms.reviewer:
+manager: laurawi
+description: Use the Azure Portal to add and configure Windows Analytics solutions
+keywords: Device Health, oms, Azure, portal, operations management suite, add, manage, configure, Upgrade Readiness, Update Compliance
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.pagetype: deploy
+audience: itpro
+author: jaimeo
+ms.audience: itpro
+author: jaimeo
+ms.localizationpriority: medium
+ms.collection: M365-analytics
+ms.topic: article
+---
+
+# Windows Analytics in the Azure Portal
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+Windows Analytics uses Azure Log Analytics workspaces (formerly known as Operations Management Suite or OMS), a collection of cloud-based services for monitoring and automating your on-premises and cloud environments.
+
+**The OMS portal has been deprecated; you should start using the [Azure portal](https://portal.azure.com) instead as soon as possible.** Many experiences are the same in the two portals, but there are some key differences, which this topic will explain. For much more information about the transition from OMS to Azure, see [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition).
+
+## Navigation and permissions in the Azure portal
+
+Go to the [Azure portal](https://portal.azure.com), select **All services**, and search for *Log Analytics workspaces*. Once it appears, you can select the star to add it to your favorites for easy access in the future.
+
+[](images/azure-portal-LAfav1.png)
+
+### Permissions
+
+It's important to understand the difference between Azure Active Directory and an Azure subscription:
+
+**Azure Active Directory** is the directory that Azure uses. Azure Active Directory (Azure AD) is a separate service which sits by itself and is used by all of Azure and also Office 365.
+
+An **Azure subscription** is a container for billing, but also acts as a security boundary. Every Azure subscription has a trust relationship with at least one Azure AD instance. This means that a subscription trusts that directory to authenticate users, services, and devices.
+
+
+>[!IMPORTANT]
+>Unlike the OMS portal (which only requires permission to access the Azure Log Analytics workspace), the Azure portal also requires access to be configured to either the linked *Azure subscription* or Azure resource group.
+
+To check the Log Analytics workspaces you can access, select **Log Analytics workspaces**. You should see a grid control listing all workspaces, along with the Azure subscription each is linked to:
+
+[](images/azure-portal-LAmain-wkspc-subname-sterile.png)
+
+If you do not see your workspace in this view, but you are able to access the workspace from the classic portal, that means you do not have access to the workspace's Azure subscription or resource group. To remedy this, you will need to find someone with admin rights to grant you access, which they can do by selecting the subscription name and selecting **Access control (IAM)** (alternatively they can configure your access at the resource group level). They should either grant you "Log Analytics Reader" access (for read-only access) or "Log Analytics Contributor" access (which enables making changes such as creating deployment plans and changing application readiness states).
+
+When permissions are configured, you can select the workspace and then select **Workspace summary** to see information similar to what was shown in the OMS overview page.
+
+[](images/azure-portal-LA-wkspcsumm_sterile.png)
+
+## Adding Windows Analytics solutions
+
+In the Azure portal, the simplest way to add Windows Analytics solutions (Upgrade Readiness, Update Compliance, and Device Health) is to select **+ Create a resource** and then type the solution name in the search box. In this example, the search is for "Device Health":
+
+[](images/azure-portal-create-resource-boxes.png)
+
+Select the solution from the list that is returned by the search, and then select **Create** to add the solution.
+
+## Navigating to Windows Analytics solutions settings
+
+To adjust settings for a Windows Analytics solution, first navigate to the **Solutions** tab for your workspace, and then select the solution to configure. In this example, Upgrade Readiness is being adjusted by selecting **CompatibilityAssessment**:
+
+[](images/temp-azure-portal-soltn-setting.png)
+
+From there, select the settings page to adjust specific settings:
+
+[](images/azure-portal-UR-settings.png)
+
+>[!NOTE]
+>To access these settings, both the subscription and workspace require "contributor" permissions. You can view your current role and make changes in other roles by using the **Access control (IAM)** tab in Azure.
diff --git a/windows/deployment/update/windows-analytics-get-started.md b/windows/deployment/update/windows-analytics-get-started.md
index 91642db1c4..8b3ebe0b50 100644
--- a/windows/deployment/update/windows-analytics-get-started.md
+++ b/windows/deployment/update/windows-analytics-get-started.md
@@ -6,7 +6,6 @@ description: Enroll devices to enable use of Update Compliance, Upgrade Readines
keywords: windows analytics, oms, operations management suite, prerequisites, requirements, updates, upgrades, log analytics, health, azure portal
ms.prod: w10
ms.mktglfcycl: deploy
-ms.sitesec: library
ms.pagetype: deploy
author: jaimeo
ms.author: jaimeo
@@ -17,6 +16,9 @@ ms.topic: article
# Enrolling devices in Windows Analytics
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
If you have not already done so, consult the topics for any of the three Windows Analytics solutions (Update Compliance, Upgrade Readiness, and Device Health) you intend to use and follow the steps there to add the solutions to Azure Portal.
- [Get started with Device Health](device-health-get-started.md)
@@ -37,7 +39,7 @@ To find your commercial ID, first navigate to the **Solutions** tab for your wor
From there, select the settings page, where you can find and copy your commercial ID:
-[](images/azure-portal-UR-settings.png)
+[](images/azure-portal-UR-settings.png)
@@ -107,7 +109,7 @@ The compatibility update scans your devices and enables application usage tracki
With Windows diagnostic data enabled, the Connected User Experience and Telemetry service (DiagTrack) collects system, application, and driver data. Microsoft analyzes this data, and shares it back to you through Windows Analytics. For the best experience, install these updates depending upon the operating system version.
- For Windows 10, install the latest Windows 10 cumulative update.
-- For Windows 8.1, nstall the October 2018 monthly rollup, [KB4462926](https://support.microsoft.com/help/4462926)
+- For Windows 8.1, install the October 2018 monthly rollup, [KB4462926](https://support.microsoft.com/help/4462926)
- For Windows 7, install the October 2018 monthly rollup, [KB4462923](https://support.microsoft.com/help/4462923)
@@ -206,7 +208,7 @@ For more information about Internet Explorer Security Zones, see [About URL Secu
We recommend using the deployment script to configure devices. However if this is not an option, you can still manage settings by policy as described in the previous section. However, if you don't run the deployment script, you won't benefit from its error checking, and you might have to wait a long time (possibly weeks) before devices send the initial full inventory scan.
-Note that it is possible to intiate a full inventory scan on a device by calling these commands:
+Note that it is possible to initiate a full inventory scan on a device by calling these commands:
- CompatTelRunner.exe -m:generaltel.dll -f:DoCensusRun
- CompatTelRunner.exe -m:appraiser.dll -f:DoScheduledTelemetryRun ent
diff --git a/windows/deployment/update/windows-analytics-overview.md b/windows/deployment/update/windows-analytics-overview.md
index 833f2db650..43531d972c 100644
--- a/windows/deployment/update/windows-analytics-overview.md
+++ b/windows/deployment/update/windows-analytics-overview.md
@@ -1,59 +1,54 @@
----
-title: Windows Analytics
-ms.reviewer:
-manager: laurawi
-description: Introduction and overview of Windows Analytics
-keywords: Device Health, Upgrade Readiness, Update Compliance, oms, operations management suite, prerequisites, requirements, monitoring, crash, drivers
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
-ms.audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.collection: M365-analytics
-ms.topic: article
----
-
-# Windows Analytics overview
-
-Windows Analytics is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. There are currently three solutions which you can use singly or in any combination:
-
-## Device Health
-
-[Device Health](device-health-get-started.md) provides the following:
-
-- Identification of devices that crash frequently, and therefore might need to be rebuilt or replaced
-- Identification of device drivers that are causing device crashes, with suggestions of alternative versions of those drivers that might reduce the number of crashes
-- Notification of Windows Information Protection misconfigurations that send prompts to end users
-
-
-## Update Compliance
-
-[Update Compliance](update-compliance-get-started.md) shows you the state of your devices with respect to the Windows updates so that you can ensure that they are on the most current updates as appropriate. In addition, Update Compliance provides the following:
-
-- Dedicated drill-downs for devices that might need attention
-- An inventory of devices, including the version of Windows they are running and their update status
-- The ability to track protection and threat status for Windows Defender Antivirus-enabled devices
-- An overview of Windows Update for Business deferral configurations (Windows 10, version 1607 and later)
-- Powerful built-in log analytics to create useful custom queries
-- Cloud-connected access utilizing Windows 10 diagnostic data means no need for new complex, customized infrastructure
-
-## Upgrade Readiness
-
-[Upgrade Readiness](../upgrade/upgrade-readiness-get-started.md) offers a set of tools to plan and manage the upgrade process end to end, allowing you to adopt new Windows releases more quickly. With new Windows versions being released multiple times a year, ensuring application and driver compatibility on an ongoing basis is key to adopting new Windows versions as they are released. Upgrade Readiness not only supports upgrade management from Windows 7 and Windows 8.1 to Windows 10, but also Windows 10 upgrades in the Windows as a service model.
-
-Use Upgrade Readiness to get:
-
-- A visual workflow that guides you from pilot to production
-- Detailed computer and application inventory
-- Powerful computer-level search and drill-downs
-- Guidance and insights into application and driver compatibility issues, with suggested fixes
-- Data-driven application rationalization tools
-- Application usage information, allowing targeted validation; workflow to track validation progress and decisions
-- Data export to commonly used software deployment tools, including System Center Configuration Manager
-
-To get started with any of these solutions, visit the links for instructions to add it to Azure Portal.
-
->[!NOTE]
-> For details about licensing requirements and costs associated with using Windows Analytics solutions, see [What are the requirements and costs for Windows Analytics solutions?](windows-analytics-FAQ-troubleshooting.md#what-are-the-requirements-and-costs-for-windows-analytics-solutions).
+---
+title: Windows Analytics
+ms.reviewer:
+manager: laurawi
+description: Introduction and overview of Windows Analytics
+keywords: Device Health, Upgrade Readiness, Update Compliance, oms, operations management suite, prerequisites, requirements, monitoring, crash, drivers
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.pagetype: deploy
+audience: itpro
+author: jaimeo
+ms.audience: itpro
+author: jaimeo
+ms.localizationpriority: medium
+ms.collection: M365-analytics
+ms.topic: article
+---
+
+# Windows Analytics overview
+
+Windows Analytics is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. There are currently three solutions which you can use singly or in any combination:
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+
+## Device Health
+
+[Device Health](device-health-get-started.md) provides the following:
+
+- Identification of devices that crash frequently, and therefore might need to be rebuilt or replaced
+- Identification of device drivers that are causing device crashes, with suggestions of alternative versions of those drivers that might reduce the number of crashes
+- Notification of Windows Information Protection misconfigurations that send prompts to end users
+
+
+
+## Upgrade Readiness
+
+[Upgrade Readiness](../upgrade/upgrade-readiness-get-started.md) offers a set of tools to plan and manage the upgrade process end to end, allowing you to adopt new Windows releases more quickly. With new Windows versions being released multiple times a year, ensuring application and driver compatibility on an ongoing basis is key to adopting new Windows versions as they are released. Upgrade Readiness not only supports upgrade management from Windows 7 and Windows 8.1 to Windows 10, but also Windows 10 upgrades in the Windows as a service model.
+
+Use Upgrade Readiness to get:
+
+- A visual workflow that guides you from pilot to production
+- Detailed computer and application inventory
+- Powerful computer-level search and drill-downs
+- Guidance and insights into application and driver compatibility issues, with suggested fixes
+- Data-driven application rationalization tools
+- Application usage information, allowing targeted validation; workflow to track validation progress and decisions
+- Data export to commonly used software deployment tools, including System Center Configuration Manager
+
+To get started with any of these solutions, visit the links for instructions to add it to Azure Portal.
+
+>[!NOTE]
+> For details about licensing requirements and costs associated with using Windows Analytics solutions, see [What are the requirements and costs for Windows Analytics solutions?](windows-analytics-FAQ-troubleshooting.md#what-are-the-requirements-and-costs-for-windows-analytics-solutions).
diff --git a/windows/deployment/update/windows-analytics-privacy.md b/windows/deployment/update/windows-analytics-privacy.md
index d6749b666d..f0b2a4f3af 100644
--- a/windows/deployment/update/windows-analytics-privacy.md
+++ b/windows/deployment/update/windows-analytics-privacy.md
@@ -6,12 +6,11 @@ description: How Windows Analytics uses data
keywords: windows analytics, oms, privacy, data, diagnostic, operations management suite, prerequisites, requirements, updates, upgrades, log analytics, health, FAQ, problems, troubleshooting, error
ms.prod: w10
ms.mktglfcycl: deploy
-ms.sitesec: library
ms.pagetype: deploy
audience: itpro
-author: greg-lindsay
+author: jaimeo
ms.audience: itpro
-author: greg-lindsay
+author: jaimeo
ms.localizationpriority: high
ms.collection: M365-analytics
ms.topic: article
@@ -19,6 +18,9 @@ ms.topic: article
# Windows Analytics and privacy
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
Windows Analytics is fully committed to privacy, centering on these tenets:
- **Transparency:** We fully document the Windows Analytics diagnostic events (see the links for additional information) so you can review them with your company’s security and compliance teams. The Diagnostic Data Viewer lets you see diagnostic data sent from a given device (see [Diagnostic Data Viewer Overview](https://docs.microsoft.com/windows/configuration/diagnostic-data-viewer-overview) for details).
diff --git a/windows/deployment/update/windows-as-a-service.md b/windows/deployment/update/windows-as-a-service.md
index d7d45d741a..91ff545345 100644
--- a/windows/deployment/update/windows-as-a-service.md
+++ b/windows/deployment/update/windows-as-a-service.md
@@ -1,131 +1,133 @@
----
-title: Windows as a service
-ms.prod: windows-10
-layout: LandingPage
-ms.topic: landing-page
-ms.manager: elizapo
-audience: itpro
author: greg-lindsay
-ms.audience: itpro
author: greg-lindsay
-ms.date: 01/24/2019
-ms.reviewer:
-manager: laurawi
-ms.localizationpriority: high
-ms.collection: M365-modern-desktop
----
-# Windows as a service
-
-Find the tools and resources you need to help deploy and support Windows as a service in your organization.
-
-## Latest news, videos, & podcasts
-
-Find the latest and greatest news on Windows 10 deployment and servicing.
-
-**Discovering the Windows 10 Update history pages**
-> [!VIDEO https://www.youtube-nocookie.com/embed/mTnAb9XjMPY]
-
-Everyone wins when transparency is a top priority. We want you to know when updates are available, as well as alert you to any potential issues you may encounter during or after you install an update. Bookmark the Windows release health dashboard for near real-time information on known issues, workarounds, and resolutions--as well as the current status of the latest feature update rollout.
-
-The latest news:
-
-Upgrading Windows 10 devices with installation media different than the original OS install language - July 9, 2019
-Moving to the next Windows 10 feature update for commercial customers - July 1, 2019
-Updating Windows 10, version 1903 using Configuration Manager or WSUS - May 23, 2019
-What’s new in Windows Update for Business in Windows 10, version 1903 - May 21, 2019
-What’s new for IT pros in Windows 10, version 1903 - May 21, 2019
-How to get the Windows 10 May 2019 Update - May 21, 2019
- The benefits of Windows 10 Dynamic Update - April 17, 2019
-
-
-[See more news](waas-morenews.md). You can also check out the [Windows 10 blog](https://techcommunity.microsoft.com/t5/Windows-10-Blog/bg-p/Windows10Blog).
-
-## IT pro champs corner
-Written by IT pros for IT pros, sharing real world examples and scenarios for Windows 10 deployment and servicing.
-
-
-
-**NEW** Tactical considerations for creating Windows deployment rings
-
-**NEW** Windows 10 Enterprise vs. Windows 10 Pro: Modern management considerations for your organization
-
-Deployment rings: The hidden [strategic] gem of Windows as a service
-
-Classifying Windows updates in common deployment tools
-
-Express updates for Windows Server 2016 re-enabled for November 2018 update
-
-
-2019 SHA-2 Code Signing Support requirement for Windows and WSUS
-
-Deploying Windows 10 Feature Updates to 24/7 Mission Critical Devices
-
-## Discover
-
-Learn more about Windows as a service and its value to your organization.
-
-
-
-Overview of Windows as a service
-
-Quick guide to Windows as a service
-
-Windows Analytics overview
-
-What's new in Windows 10 deployment
-
-How Microsoft IT deploys Windows 10
-
-## Plan
-
-Prepare to implement Windows as a service effectively using the right tools, products, and strategies.
-
-
-
-Simplified updates
-
-Windows 10 end user readiness
-
-Ready for Windows
-
-Manage Windows upgrades with Upgrade Readiness
-
-Preparing your organization for a seamless Windows 10 deployment
-
-## Deploy
-
-Secure your organization's deployment investment.
-
-
-
-Update Windows 10 in the enterprise
-
-Deploying as an in-place upgrade
-
-Configure Windows Update for Business
-
-Express update delivery
-
-Windows 10 deployment considerations
-
-
-## Microsoft Ignite 2018
-
-
-Looking to learn more? These informative session replays from Microsoft Ignite 2018 (complete with downloadable slide decks) can provide some great insights on Windows as a service.
-
-[BRK2417: What’s new in Windows Analytics: An Intro to Desktop Analytics](https://myignite.techcommunity.microsoft.com/sessions/64324#ignite-html-anchor)
-
-[BRK3018: Deploying Windows 10 in the enterprise using traditional and modern techniques](https://myignite.techcommunity.microsoft.com/sessions/64509#ignite-html-anchor)
-
-[BRK3019: Delivery Optimization deep dive: How to reduce internet bandwidth impact on your network](https://myignite.techcommunity.microsoft.com/sessions/64510#ignite-html-anchor)
-
-[BRK3020: Using AI to automate Windows and Office update staging with Windows Update for Business](https://myignite.techcommunity.microsoft.com/sessions/64513#ignite-html-anchor)
-
-[BRK3027: Deploying Windows 10: Making the update experience smooth and seamless](https://myignite.techcommunity.microsoft.com/sessions/64612#ignite-html-anchor)
-
-[BRK3039: Windows 10 and Microsoft Office 365 ProPlus lifecycle and servicing update](https://myignite.techcommunity.microsoft.com/sessions/66763#ignite-html-anchor)
-
-[BRK3211: Ask the Experts: Successfully deploying, servicing, managing Windows 10](https://myignite.techcommunity.microsoft.com/sessions/65963#ignite-html-anchor)
-
-[THR2234: Windows servicing and delivery fundamentals](https://myignite.techcommunity.microsoft.com/sessions/66741#ignite-html-anchor)
-
-[THR3006: The pros and cons of LTSC in the enterprise](https://myignite.techcommunity.microsoft.com/sessions/64512#ignite-html-anchor)
+---
+title: Windows as a service
+ms.prod: windows-10
+layout: LandingPage
+ms.topic: landing-page
+ms.manager: elizapo
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.audience: itpro
+author: jaimeo
+ms.reviewer:
+manager: laurawi
+ms.localizationpriority: high
+ms.collection: M365-modern-desktop
+---
+# Windows as a service
+
+Find the tools and resources you need to help deploy and support Windows as a service in your organization.
+
+## Latest news, videos, & podcasts
+
+Find the latest and greatest news on Windows 10 deployment and servicing.
+
+**Discovering the Windows 10 Update history pages**
+> [!VIDEO https://www.youtube-nocookie.com/embed/mTnAb9XjMPY]
+
+Everyone wins when transparency is a top priority. We want you to know when updates are available, as well as alert you to any potential issues you may encounter during or after you install an update. Bookmark the Windows release health dashboard for near real-time information on known issues, workarounds, and resolutions--as well as the current status of the latest feature update rollout.
+
+The latest news:
+
+Upgrading Windows 10 devices with installation media different than the original OS install language - July 9, 2019
+Moving to the next Windows 10 feature update for commercial customers - July 1, 2019
+Updating Windows 10, version 1903 using Configuration Manager or WSUS - May 23, 2019
+What’s new in Windows Update for Business in Windows 10, version 1903 - May 21, 2019
+What’s new for IT pros in Windows 10, version 1903 - May 21, 2019
+How to get the Windows 10 May 2019 Update - May 21, 2019
+ The benefits of Windows 10 Dynamic Update - April 17, 2019
+
+
+[See more news](waas-morenews.md). You can also check out the [Windows 10 blog](https://techcommunity.microsoft.com/t5/Windows-10-Blog/bg-p/Windows10Blog).
+
+## IT pro champs corner
+Written by IT pros for IT pros, sharing real world examples and scenarios for Windows 10 deployment and servicing.
+
+
+
+**NEW** Tactical considerations for creating Windows deployment rings
+
+**NEW** Windows 10 Enterprise vs. Windows 10 Pro: Modern management considerations for your organization
+
+Deployment rings: The hidden [strategic] gem of Windows as a service
+
+Classifying Windows updates in common deployment tools
+
+Express updates for Windows Server 2016 re-enabled for November 2018 update
+
+
+2019 SHA-2 Code Signing Support requirement for Windows and WSUS
+
+Deploying Windows 10 Feature Updates to 24/7 Mission Critical Devices
+
+## Discover
+
+Learn more about Windows as a service and its value to your organization.
+
+
+
+Overview of Windows as a service
+
+Quick guide to Windows as a service
+
+Windows Analytics overview
+
+What's new in Windows 10 deployment
+
+How Microsoft IT deploys Windows 10
+
+## Plan
+
+Prepare to implement Windows as a service effectively using the right tools, products, and strategies.
+
+
+
+Simplified updates
+
+Windows 10 end user readiness
+
+Ready for Windows
+
+Manage Windows upgrades with Upgrade Readiness
+
+Preparing your organization for a seamless Windows 10 deployment
+
+## Deploy
+
+Secure your organization's deployment investment.
+
+
+
+Update Windows 10 in the enterprise
+
+Deploying as an in-place upgrade
+
+Configure Windows Update for Business
+
+Express update delivery
+
+Windows 10 deployment considerations
+
+
+## Microsoft Ignite 2018
+
+
+Looking to learn more? These informative session replays from Microsoft Ignite 2018 (complete with downloadable slide decks) can provide some great insights on Windows as a service.
+
+[BRK2417: What’s new in Windows Analytics: An Intro to Desktop Analytics](https://myignite.techcommunity.microsoft.com/sessions/64324#ignite-html-anchor)
+
+[BRK3018: Deploying Windows 10 in the enterprise using traditional and modern techniques](https://myignite.techcommunity.microsoft.com/sessions/64509#ignite-html-anchor)
+
+[BRK3019: Delivery Optimization deep dive: How to reduce internet bandwidth impact on your network](https://myignite.techcommunity.microsoft.com/sessions/64510#ignite-html-anchor)
+
+[BRK3020: Using AI to automate Windows and Office update staging with Windows Update for Business](https://myignite.techcommunity.microsoft.com/sessions/64513#ignite-html-anchor)
+
+[BRK3027: Deploying Windows 10: Making the update experience smooth and seamless](https://myignite.techcommunity.microsoft.com/sessions/64612#ignite-html-anchor)
+
+[BRK3039: Windows 10 and Microsoft Office 365 ProPlus lifecycle and servicing update](https://myignite.techcommunity.microsoft.com/sessions/66763#ignite-html-anchor)
+
+[BRK3211: Ask the Experts: Successfully deploying, servicing, managing Windows 10](https://myignite.techcommunity.microsoft.com/sessions/65963#ignite-html-anchor)
+
+[THR2234: Windows servicing and delivery fundamentals](https://myignite.techcommunity.microsoft.com/sessions/66741#ignite-html-anchor)
+
+[THR3006: The pros and cons of LTSC in the enterprise](https://myignite.techcommunity.microsoft.com/sessions/64512#ignite-html-anchor)
diff --git a/windows/deployment/update/windows-update-error-reference.md b/windows/deployment/update/windows-update-error-reference.md
index 52969656a5..dc7f8eaa52 100644
--- a/windows/deployment/update/windows-update-error-reference.md
+++ b/windows/deployment/update/windows-update-error-reference.md
@@ -1,365 +1,367 @@
----
-title: Windows Update error code list by component
-description: Reference information for Windows Update error codes
-ms.prod: w10
-ms.mktglfcycl:
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.audience: itpro
author: greg-lindsay
-ms.date: 09/18/2018
-ms.reviewer:
-manager: laurawi
-ms.topic: article
----
-
-# Windows Update error codes by component
-
->Applies to: Windows 10
-
-
-This section lists the error codes for Microsoft Windows Update.
-
-## Automatic Update Errors
-
-| Error code | Message | Description |
-|------------|-------------------------------|--------------------------------------------------------------------------------------------------------|
-| 0x80243FFF | WU_E_AUCLIENT_UNEXPECTED | There was a user interface error not covered by another WU_E_AUCLIENT_\* error code. |
-| 0x8024A000 | WU_E_AU_NOSERVICE | Automatic Updates was unable to service incoming requests. |
-| 0x8024A002 | WU_E_AU_NONLEGACYSERVER | The old version of the Automatic Updates client has stopped because the WSUS server has been upgraded. |
-| 0x8024A003 | WU_E_AU_LEGACYCLIENTDISABLED | The old version of the Automatic Updates client was disabled. |
-| 0x8024A004 | WU_E_AU_PAUSED | Automatic Updates was unable to process incoming requests because it was paused. |
-| 0x8024A005 | WU_E_AU_NO_REGISTERED_SERVICE | No unmanaged service is registered with AU. |
-| 0x8024AFFF | WU_E_AU_UNEXPECTED | An Automatic Updates error not covered by another WU_E_AU \* code. |
-
-## Windows Update UI errors
-
-| Error code | Message | Description |
-|------------|-------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|
-| 0x80243001 | WU_E_INSTALLATION_RESULTS_UNKNOWN_VERSION | The results of download and installation could not be read from the registry due to an unrecognized data format version. |
-| 0x80243002 | WU_E_INSTALLATION_RESULTS_INVALID_DATA | The results of download and installation could not be read from the registry due to an invalid data format. |
-| 0x80243003 | WU_E_INSTALLATION_RESULTS_NOT_FOUND | The results of download and installation are not available; the operation may have failed to start. |
-| 0x80243004 | WU_E_TRAYICON_FAILURE | A failure occurred when trying to create an icon in the taskbar notification area. |
-| 0x80243FFD | WU_E_NON_UI_MODE | Unable to show UI when in non-UI mode; WU client UI modules may not be installed. |
-| 0x80243FFE | WU_E_WUCLTUI_UNSUPPORTED_VERSION | Unsupported version of WU client UI exported functions. |
-| 0x80243FFF | WU_E_AUCLIENT_UNEXPECTED | There was a user interface error not covered by another WU_E_AUCLIENT_\* error code. |
-
-## Inventory errors
-
-| Error code | Message | Description |
-|------------|-------------------------------------------|-------------------------------------------------------------------------------|
-| 0x80249001 | WU_E_INVENTORY_PARSEFAILED | Parsing of the rule file failed. |
-| 0x80249002 | WU_E_INVENTORY_GET_INVENTORY_TYPE_FAILED | Failed to get the requested inventory type from the server. |
-| 0x80249003 | WU_E_INVENTORY_RESULT_UPLOAD_FAILED | Failed to upload inventory result to the server. |
-| 0x80249004 | WU_E_INVENTORY_UNEXPECTED | There was an inventory error not covered by another error code. |
-| 0x80249005 | WU_E_INVENTORY_WMI_ERROR | A WMI error occurred when enumerating the instances for a particular class. |
-
-## Expression evaluator errors
-
-| Error code | Message | Description |
-|-------------|--------------------------------|----------------------------------------------------------------------------------------------------------------------------------|
-| 0x8024E001 | WU_E_EE_UNKNOWN_EXPRESSION | An expression evaluator operation could not be completed because an expression was unrecognized. |
-| 0x8024E002 | WU_E_EE_INVALID_EXPRESSION | An expression evaluator operation could not be completed because an expression was invalid. |
-| 0x8024E003 | WU_E_EE_MISSING_METADATA | An expression evaluator operation could not be completed because an expression contains an incorrect number of metadata nodes. |
-| 0x8024E004 | WU_E_EE_INVALID_VERSION | An expression evaluator operation could not be completed because the version of the serialized expression data is invalid. |
-| 0x8024E005 | WU_E_EE_NOT_INITIALIZED | The expression evaluator could not be initialized. |
-| 0x8024E006 | WU_E_EE_INVALID_ATTRIBUTEDATA | An expression evaluator operation could not be completed because there was an invalid attribute. |
-| 0x8024E007 | WU_E_EE_CLUSTER_ERROR | An expression evaluator operation could not be completed because the cluster state of the computer could not be determined. |
-| 0x8024EFFF | WU_E_EE_UNEXPECTED | There was an expression evaluator error not covered by another WU_E_EE_\* error code. |
-
-## Reporter errors
-
-| Error code | Message | Description |
-|-------------|------------------------------------------|-----------------------------------------------------------------------------------------------------------------------|
-| 0x80247001 | WU_E_OL_INVALID_SCANFILE | An operation could not be completed because the scan package was invalid. |
-| 0x80247002 | WU_E_OL_NEWCLIENT_REQUIRED | An operation could not be completed because the scan package requires a greater version of the Windows Update Agent. |
-| 0x80247FFF | WU_E_OL_UNEXPECTED | Search using the scan package failed. |
-| 0x8024F001 | WU_E_REPORTER_EVENTCACHECORRUPT | The event cache file was defective. |
-| 0x8024F002 | WU_E_REPORTER_EVENTNAMESPACEPARSEFAILED | The XML in the event namespace descriptor could not be parsed. |
-| 0x8024F003 | WU_E_INVALID_EVENT | The XML in the event namespace descriptor could not be parsed. |
-| 0x8024F004 | WU_E_SERVER_BUSY | The server rejected an event because the server was too busy. |
-| 0x8024FFFF | WU_E_REPORTER_UNEXPECTED | There was a reporter error not covered by another error code. |
-
-## Redirector errors
-The components that download the Wuredir.cab file and then parse the Wuredir.cab file generate the following errors.
-
-|Error code|Message|Description |
-|-|-|-|
-| 0x80245001| WU_E_REDIRECTOR_LOAD_XML| The redirector XML document could not be loaded into the DOM class. |
-| 0x80245002| WU_E_REDIRECTOR_S_FALSE| The redirector XML document is missing some required information. |
-| 0x80245003| WU_E_REDIRECTOR_ID_SMALLER| The redirectorId in the downloaded redirector cab is less than in the cached cab. |
-| 0x80245FFF| WU_E_REDIRECTOR_UNEXPECTED| The redirector failed for reasons not covered by another WU_E_REDIRECTOR_* error code. |
-
-## Protocol Talker errors
-The following errors map to SOAPCLIENT_ERRORs through the Atlsoap.h file. These errors are obtained when the CClientWebService object calls the GetClientError() method.
-
-
-| Error code | Message | Description |
-|-------------|---------------------------------|------------------------------------------------------------------------------------------------------------------------------------|
-| 0x80244000 | WU_E_PT_SOAPCLIENT_BASE | WU_E_PT_SOAPCLIENT_\* error codes map to the SOAPCLIENT_ERROR enum of the ATL Server Library. |
-| 0x80244001 | WU_E_PT_SOAPCLIENT_INITIALIZE | Same as SOAPCLIENT_INITIALIZE_ERROR - initialization of the SOAP client failed possibly because of an MSXML installation failure. |
-| 0x80244002 | WU_E_PT_SOAPCLIENT_OUTOFMEMORY | Same as SOAPCLIENT_OUTOFMEMORY - SOAP client failed because it ran out of memory. |
-| 0x80244003 | WU_E_PT_SOAPCLIENT_GENERATE | Same as SOAPCLIENT_GENERATE_ERROR - SOAP client failed to generate the request. |
-| 0x80244004 | WU_E_PT_SOAPCLIENT_CONNECT | Same as SOAPCLIENT_CONNECT_ERROR - SOAP client failed to connect to the server. |
-| 0x80244005 | WU_E_PT_SOAPCLIENT_SEND | Same as SOAPCLIENT_SEND_ERROR - SOAP client failed to send a message for reasons of WU_E_WINHTTP_\* error codes. |
-| 0x80244006 | WU_E_PT_SOAPCLIENT_SERVER | Same as SOAPCLIENT_SERVER_ERROR - SOAP client failed because there was a server error. |
-| 0x80244007 | WU_E_PT_SOAPCLIENT_SOAPFAULT | Same as SOAPCLIENT_SOAPFAULT - SOAP client failed because there was a SOAP fault for reasons of WU_E_PT_SOAP_\* error codes. |
-| 0x80244008 | WU_E_PT_SOAPCLIENT_PARSEFAULT | Same as SOAPCLIENT_PARSEFAULT_ERROR - SOAP client failed to parse a SOAP fault. |
-| 0x80244009 | WU_E_PT_SOAPCLIENT_READ | Same as SOAPCLIENT_READ_ERROR - SOAP client failed while reading the response from the server. |
-| 0x8024400A | WU_E_PT_SOAPCLIENT_PARSE | Same as SOAPCLIENT_PARSE_ERROR - SOAP client failed to parse the response from the server. |
-
-## Other Protocol Talker errors
-The following errors map to SOAP_ERROR_CODEs from the Atlsoap.h file. These errors are obtained from the m_fault.m_soapErrCode member of the CClientWebService object when GetClientError() returns SOAPCLIENT_SOAPFAULT.
-
-
-| Error code | Message | Description |
-|-------------|---------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| 0x8024400B | WU_E_PT_SOAP_VERSION | Same as SOAP_E_VERSION_MISMATCH - SOAP client found an unrecognizable namespace for the SOAP envelope. |
-| 0x8024400C | WU_E_PT_SOAP_MUST_UNDERSTAND | Same as SOAP_E_MUST_UNDERSTAND - SOAP client was unable to understand a header. |
-| 0x8024400D | WU_E_PT_SOAP_CLIENT | Same as SOAP_E_CLIENT - SOAP client found the message was malformed; fix before resending. |
-| 0x8024400E | WU_E_PT_SOAP_SERVER | Same as SOAP_E_SERVER - The SOAP message could not be processed due to a server error; resend later. |
-| 0x8024400F | WU_E_PT_WMI_ERROR | There was an unspecified Windows Management Instrumentation (WMI) error. |
-| 0x80244010 | WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS | The number of round trips to the server exceeded the maximum limit. |
-| 0x80244011 | WU_E_PT_SUS_SERVER_NOT_SET | WUServer policy value is missing in the registry. |
-| 0x80244012 | WU_E_PT_DOUBLE_INITIALIZATION | Initialization failed because the object was already initialized. |
-| 0x80244013 | WU_E_PT_INVALID_COMPUTER_NAME | The computer name could not be determined. |
-| 0x80244015 | WU_E_PT_REFRESH_CACHE_REQUIRED | The reply from the server indicates that the server was changed or the cookie was invalid; refresh the state of the internal cache and retry. |
-| 0x80244016 | WU_E_PT_HTTP_STATUS_BAD_REQUEST | Same as HTTP status 400 - the server could not process the request due to invalid syntax. |
-| 0x80244017 | WU_E_PT_HTTP_STATUS_DENIED | Same as HTTP status 401 - the requested resource requires user authentication. |
-| 0x80244018 | WU_E_PT_HTTP_STATUS_FORBIDDEN | Same as HTTP status 403 - server understood the request but declined to fulfill it. |
-| 0x80244019 | WU_E_PT_HTTP_STATUS_NOT_FOUND | Same as HTTP status 404 - the server cannot find the requested URI (Uniform Resource Identifier). |
-| 0x8024401A | WU_E_PT_HTTP_STATUS_BAD_METHOD | Same as HTTP status 405 - the HTTP method is not allowed. |
-| 0x8024401B | WU_E_PT_HTTP_STATUS_PROXY_AUTH_REQ | Same as HTTP status 407 - proxy authentication is required. |
-| 0x8024401C | WU_E_PT_HTTP_STATUS_REQUEST_TIMEOUT | Same as HTTP status 408 - the server timed out waiting for the request. |
-| 0x8024401D | WU_E_PT_HTTP_STATUS_CONFLICT | Same as HTTP status 409 - the request was not completed due to a conflict with the current state of the resource. |
-| 0x8024401E | WU_E_PT_HTTP_STATUS_GONE | Same as HTTP status 410 - requested resource is no longer available at the server. |
-| 0x8024401F | WU_E_PT_HTTP_STATUS_SERVER_ERROR | Same as HTTP status 500 - an error internal to the server prevented fulfilling the request. |
-| 0x80244020 | WU_E_PT_HTTP_STATUS_NOT_SUPPORTED | Same as HTTP status 500 - server does not support the functionality required to fulfill the request. |
-| 0x80244021 | WU_E_PT_HTTP_STATUS_BAD_GATEWAY | Same as HTTP status 502 - the server while acting as a gateway or a proxy received an invalid response from the upstream server it accessed in attempting to fulfil the request. |
-| 0x80244022 | WU_E_PT_HTTP_STATUS_SERVICE_UNAVAIL | Same as HTTP status 503 - the service is temporarily overloaded. |
-| 0x80244023 | WU_E_PT_HTTP_STATUS_GATEWAY_TIMEOUT | Same as HTTP status 503 - the request was timed out waiting for a gateway. |
-| 0x80244024 | WU_E_PT_HTTP_STATUS_VERSION_NOT_SUP | Same as HTTP status 505 - the server does not support the HTTP protocol version used for the request. |
-| 0x80244025 | WU_E_PT_FILE_LOCATIONS_CHANGED | Operation failed due to a changed file location; refresh internal state and resend. |
-| 0x80244026 | WU_E_PT_REGISTRATION_NOT_SUPPORTED | Operation failed because Windows Update Agent does not support registration with a non-WSUS server. |
-| 0x80244027 | WU_E_PT_NO_AUTH_PLUGINS_REQUESTED | The server returned an empty authentication information list. |
-| 0x80244028 | WU_E_PT_NO_AUTH_COOKIES_CREATED | Windows Update Agent was unable to create any valid authentication cookies. |
-| 0x80244029 | WU_E_PT_INVALID_CONFIG_PROP | A configuration property value was wrong. |
-| 0x8024402A | WU_E_PT_CONFIG_PROP_MISSING | A configuration property value was missing. |
-| 0x8024402B | WU_E_PT_HTTP_STATUS_NOT_MAPPED | The HTTP request could not be completed and the reason did not correspond to any of the WU_E_PT_HTTP_\* error codes. |
-| 0x8024402C | WU_E_PT_WINHTTP_NAME_NOT_RESOLVED | Same as ERROR_WINHTTP_NAME_NOT_RESOLVED - the proxy server or target server name cannot be resolved. |
-| 0x8024402F | WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS | External cab file processing completed with some errors. |
-| 0x80244030 | WU_E_PT_ECP_INIT_FAILED | The external cab processor initialization did not complete. |
-| 0x80244031 | WU_E_PT_ECP_INVALID_FILE_FORMAT | The format of a metadata file was invalid. |
-| 0x80244032 | WU_E_PT_ECP_INVALID_METADATA | External cab processor found invalid metadata. |
-| 0x80244033 | WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST | The file digest could not be extracted from an external cab file. |
-| 0x80244034 | WU_E_PT_ECP_FAILURE_TO_DECOMPRESS_CAB_FILE | An external cab file could not be decompressed. |
-| 0x80244035 | WU_E_PT_ECP_FILE_LOCATION_ERROR | External cab processor was unable to get file locations. |
-| 0x80244FFF | WU_E_PT_UNEXPECTED | A communication error not covered by another WU_E_PT_\* error code. |
-| 0x8024502D | WU_E_PT_SAME_REDIR_ID | Windows Update Agent failed to download a redirector cabinet file with a new redirectorId value from the server during the recovery. |
-| 0x8024502E | WU_E_PT_NO_MANAGED_RECOVER | A redirector recovery action did not complete because the server is managed. |
-
-## Download Manager errors
-
-| Error code | Message | Description |
-|-------------|----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|
-| 0x80246001 | WU_E_DM_URLNOTAVAILABLE | A download manager operation could not be completed because the requested file does not have a URL. |
-| 0x80246002 | WU_E_DM_INCORRECTFILEHASH | A download manager operation could not be completed because the file digest was not recognized. |
-| 0x80246003 | WU_E_DM_UNKNOWNALGORITHM | A download manager operation could not be completed because the file metadata requested an unrecognized hash algorithm. |
-| 0x80246004 | WU_E_DM_NEEDDOWNLOADREQUEST | An operation could not be completed because a download request is required from the download handler. |
-| 0x80246005 | WU_E_DM_NONETWORK | A download manager operation could not be completed because the network connection was unavailable. |
-| 0x80246006 | WU_E_DM_WRONGBITSVERSION | A download manager operation could not be completed because the version of Background Intelligent Transfer Service (BITS) is incompatible. |
-| 0x80246007 | WU_E_DM_NOTDOWNLOADED | The update has not been downloaded. |
-| 0x80246008 | WU_E_DM_FAILTOCONNECTTOBITS | A download manager operation failed because the download manager was unable to connect the Background Intelligent Transfer Service (BITS). |
-| 0x80246009 | WU_E_DM_BITSTRANSFERERROR | A download manager operation failed because there was an unspecified Background Intelligent Transfer Service (BITS) transfer error. |
-| 0x8024600A | WU_E_DM_DOWNLOADLOCATIONCHANGED | A download must be restarted because the location of the source of the download has changed. |
-| 0x8024600B | WU_E_DM_CONTENTCHANGED | A download must be restarted because the update content changed in a new revision. |
-| 0x80246FFF | WU_E_DM_UNEXPECTED | There was a download manager error not covered by another WU_E_DM_\* error code. |
-
-## Update Handler errors
-
-| Error code | Message | Description |
-|-------------|---------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|
-| 0x80242000 | WU_E_UH_REMOTEUNAVAILABLE | 9 A request for a remote update handler could not be completed because no remote process is available. |
-| 0x80242001 | WU_E_UH_LOCALONLY | A request for a remote update handler could not be completed because the handler is local only. |
-| 0x80242002 | WU_E_UH_UNKNOWNHANDLER | A request for an update handler could not be completed because the handler could not be recognized. |
-| 0x80242003 | WU_E_UH_REMOTEALREADYACTIVE | A remote update handler could not be created because one already exists. |
-| 0x80242004 | WU_E_UH_DOESNOTSUPPORTACTION | A request for the handler to install (uninstall) an update could not be completed because the update does not support install (uninstall). |
-| 0x80242005 | WU_E_UH_WRONGHANDLER | An operation did not complete because the wrong handler was specified. |
-| 0x80242006 | WU_E_UH_INVALIDMETADATA | A handler operation could not be completed because the update contains invalid metadata. |
-| 0x80242007 | WU_E_UH_INSTALLERHUNG | An operation could not be completed because the installer exceeded the time limit. |
-| 0x80242008 | WU_E_UH_OPERATIONCANCELLED | An operation being done by the update handler was cancelled. |
-| 0x80242009 | WU_E_UH_BADHANDLERXML | An operation could not be completed because the handler-specific metadata is invalid. |
-| 0x8024200A | WU_E_UH_CANREQUIREINPUT | A request to the handler to install an update could not be completed because the update requires user input. |
-| 0x8024200B | WU_E_UH_INSTALLERFAILURE | The installer failed to install (uninstall) one or more updates. |
-| 0x8024200C | WU_E_UH_FALLBACKTOSELFCONTAINED | The update handler should download self-contained content rather than delta-compressed content for the update. |
-| 0x8024200D | WU_E_UH_NEEDANOTHERDOWNLOAD | The update handler did not install the update because it needs to be downloaded again. |
-| 0x8024200E | WU_E_UH_NOTIFYFAILURE | The update handler failed to send notification of the status of the install (uninstall) operation. |
-| 0x8024200F | WU_E_UH_INCONSISTENT_FILE_NAMES | The file names contained in the update metadata and in the update package are inconsistent. |
-| 0x80242010 | WU_E_UH_FALLBACKERROR | The update handler failed to fall back to the self-contained content. |
-| 0x80242011 | WU_E_UH_TOOMANYDOWNLOADREQUESTS | The update handler has exceeded the maximum number of download requests. |
-| 0x80242012 | WU_E_UH_UNEXPECTEDCBSRESPONSE | The update handler has received an unexpected response from CBS. |
-| 0x80242013 | WU_E_UH_BADCBSPACKAGEID | The update metadata contains an invalid CBS package identifier. |
-| 0x80242014 | WU_E_UH_POSTREBOOTSTILLPENDING | The post-reboot operation for the update is still in progress. |
-| 0x80242015 | WU_E_UH_POSTREBOOTRESULTUNKNOWN | The result of the post-reboot operation for the update could not be determined. |
-| 0x80242016 | WU_E_UH_POSTREBOOTUNEXPECTEDSTATE | The state of the update after its post-reboot operation has completed is unexpected. |
-| 0x80242017 | WU_E_UH_NEW_SERVICING_STACK_REQUIRED | The OS servicing stack must be updated before this update is downloaded or installed. |
-| 0x80242FFF | WU_E_UH_UNEXPECTED | An update handler error not covered by another WU_E_UH_\* code. |
-
-## Data Store errors
-
-| Error code | Message | Description |
-|-------------|-------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| 0x80248000 | WU_E_DS_SHUTDOWN | An operation failed because Windows Update Agent is shutting down. |
-| 0x80248001 | WU_E_DS_INUSE | An operation failed because the data store was in use. |
-| 0x80248002 | WU_E_DS_INVALID | The current and expected states of the data store do not match. |
-| 0x80248003 | WU_E_DS_TABLEMISSING | The data store is missing a table. |
-| 0x80248004 | WU_E_DS_TABLEINCORRECT | The data store contains a table with unexpected columns. |
-| 0x80248005 | WU_E_DS_INVALIDTABLENAME | A table could not be opened because the table is not in the data store. |
-| 0x80248006 | WU_E_DS_BADVERSION | The current and expected versions of the data store do not match. |
-| 0x80248007 | WU_E_DS_NODATA | The information requested is not in the data store. |
-| 0x80248008 | WU_E_DS_MISSINGDATA | The data store is missing required information or has a NULL in a table column that requires a non-null value. |
-| 0x80248009 | WU_E_DS_MISSINGREF | The data store is missing required information or has a reference to missing license terms file localized property or linked row. |
-| 0x8024800A | WU_E_DS_UNKNOWNHANDLER | The update was not processed because its update handler could not be recognized. |
-| 0x8024800B | WU_E_DS_CANTDELETE | The update was not deleted because it is still referenced by one or more services. |
-| 0x8024800C | WU_E_DS_LOCKTIMEOUTEXPIRED | The data store section could not be locked within the allotted time. |
-| 0x8024800D | WU_E_DS_NOCATEGORIES | The category was not added because it contains no parent categories and is not a top-level category itself. |
-| 0x8024800E | WU_E_DS_ROWEXISTS | The row was not added because an existing row has the same primary key. |
-| 0x8024800F | WU_E_DS_STOREFILELOCKED | The data store could not be initialized because it was locked by another process. |
-| 0x80248010 | WU_E_DS_CANNOTREGISTER | The data store is not allowed to be registered with COM in the current process. |
-| 0x80248011 | WU_E_DS_UNABLETOSTART | Could not create a data store object in another process. |
-| 0x80248013 | WU_E_DS_DUPLICATEUPDATEID | The server sent the same update to the client with two different revision IDs. |
-| 0x80248014 | WU_E_DS_UNKNOWNSERVICE | An operation did not complete because the service is not in the data store. |
-| 0x80248015 | WU_E_DS_SERVICEEXPIRED | An operation did not complete because the registration of the service has expired. |
-| 0x80248016 | WU_E_DS_DECLINENOTALLOWED | A request to hide an update was declined because it is a mandatory update or because it was deployed with a deadline. |
-| 0x80248017 | WU_E_DS_TABLESESSIONMISMATCH | A table was not closed because it is not associated with the session. |
-| 0x80248018 | WU_E_DS_SESSIONLOCKMISMATCH | A table was not closed because it is not associated with the session. |
-| 0x80248019 | WU_E_DS_NEEDWINDOWSSERVICE | A request to remove the Windows Update service or to unregister it with Automatic Updates was declined because it is a built-in service and/or Automatic Updates cannot fall back to another service. |
-| 0x8024801A | WU_E_DS_INVALIDOPERATION | A request was declined because the operation is not allowed. |
-| 0x8024801B | WU_E_DS_SCHEMAMISMATCH | The schema of the current data store and the schema of a table in a backup XML document do not match. |
-| 0x8024801C | WU_E_DS_RESETREQUIRED | The data store requires a session reset; release the session and retry with a new session. |
-| 0x8024801D | WU_E_DS_IMPERSONATED | A data store operation did not complete because it was requested with an impersonated identity. |
-| 0x80248FFF | WU_E_DS_UNEXPECTED | A data store error not covered by another WU_E_DS_\* code. |
-
-## Driver Util errors
-The PnP enumerated device is removed from the System Spec because one of the hardware IDs or the compatible IDs matches an installed printer driver. This is not a fatal error, and the device is merely skipped.
-
-|Error code|Message|Description
-|-|-|-|
-| 0x8024C001 | WU_E_DRV_PRUNED| A driver was skipped.
-| 0x8024C002 |WU_E_DRV_NOPROP_OR_LEGACY| A property for the driver could not be found. It may not conform with required specifications.
-| 0x8024C003 | WU_E_DRV_REG_MISMATCH| The registry type read for the driver does not match the expected type.
-| 0x8024C004 | WU_E_DRV_NO_METADATA| The driver update is missing metadata.
-| 0x8024C005 | WU_E_DRV_MISSING_ATTRIBUTE| The driver update is missing a required attribute.
-| 0x8024C006| WU_E_DRV_SYNC_FAILED| Driver synchronization failed.
-| 0x8024C007 | WU_E_DRV_NO_PRINTER_CONTENT| Information required for the synchronization of applicable printers is missing.
-| 0x8024CFFF | WU_E_DRV_UNEXPECTED| A driver error not covered by another WU_E_DRV_* code.
-
-## Windows Update error codes
-
-|Error code|Message|Description
-|-|-|-|
-| 0x80240001 | WU_E_NO_SERVICE| Windows Update Agent was unable to provide the service.
-| 0x80240002 | WU_E_MAX_CAPACITY_REACHED | The maximum capacity of the service was exceeded.
-| 0x80240003 | WU_E_UNKNOWN_ID| An ID cannot be found.
-| 0x80240004 | WU_E_NOT_INITIALIZED| The object could not be initialized.
-| 0x80240005 | WU_E_RANGEOVERLAP |The update handler requested a byte range overlapping a previously requested range.
-| 0x80240006 | WU_E_TOOMANYRANGES| The requested number of byte ranges exceeds the maximum number (2^31 - 1).
-| 0x80240007 | WU_E_INVALIDINDEX| The index to a collection was invalid.
-| 0x80240008 | WU_E_ITEMNOTFOUND| The key for the item queried could not be found.
-| 0x80240009 | WU_E_OPERATIONINPROGRESS| Another conflicting operation was in progress. Some operations such as installation cannot be performed twice simultaneously.
-| 0x8024000A | WU_E_COULDNOTCANCEL| Cancellation of the operation was not allowed.
-| 0x8024000B | WU_E_CALL_CANCELLED| Operation was cancelled.
-| 0x8024000C | WU_E_NOOP| No operation was required.
-| 0x8024000D | WU_E_XML_MISSINGDATA| Windows Update Agent could not find required information in the update's XML data.
-| 0x8024000E | WU_E_XML_INVALID| Windows Update Agent found invalid information in the update's XML data.
-| 0x8024000F | WU_E_CYCLE_DETECTED | Circular update relationships were detected in the metadata.
-| 0x80240010 | WU_E_TOO_DEEP_RELATION| Update relationships too deep to evaluate were evaluated.
-| 0x80240011 | WU_E_INVALID_RELATIONSHIP| An invalid update relationship was detected.
-| 0x80240012 | WU_E_REG_VALUE_INVALID| An invalid registry value was read.
-| 0x80240013 | WU_E_DUPLICATE_ITEM| Operation tried to add a duplicate item to a list.
-| 0x80240016 | WU_E_INSTALL_NOT_ALLOWED| Operation tried to install while another installation was in progress or the system was pending a mandatory restart.
-| 0x80240017 | WU_E_NOT_APPLICABLE| Operation was not performed because there are no applicable updates.
-| 0x80240018 | WU_E_NO_USERTOKEN| Operation failed because a required user token is missing.
-| 0x80240019 | WU_E_EXCLUSIVE_INSTALL_CONFLICT| An exclusive update cannot be installed with other updates at the same time.
-| 0x8024001A | WU_E_POLICY_NOT_SET | A policy value was not set.
-| 0x8024001B | WU_E_SELFUPDATE_IN_PROGRESS| The operation could not be performed because the Windows Update Agent is self-updating.
-| 0x8024001D | WU_E_INVALID_UPDATE| An update contains invalid metadata.
-| 0x8024001E | WU_E_SERVICE_STOP| Operation did not complete because the service or system was being shut down.
-| 0x8024001F | WU_E_NO_CONNECTION| Operation did not complete because the network connection was unavailable.
-| 0x80240020 | WU_E_NO_INTERACTIVE_USER| Operation did not complete because there is no logged-on interactive user.
-| 0x80240021 | WU_E_TIME_OUT| Operation did not complete because it timed out.
-| 0x80240022 | WU_E_ALL_UPDATES_FAILED| Operation failed for all the updates.
-| 0x80240023 | WU_E_EULAS_DECLINED| The license terms for all updates were declined.
-| 0x80240024 | WU_E_NO_UPDATE| There are no updates.
-| 0x80240025 | WU_E_USER_ACCESS_DISABLED| Group Policy settings prevented access to Windows Update.
-| 0x80240026 | WU_E_INVALID_UPDATE_TYPE| The type of update is invalid.
-| 0x80240027 | WU_E_URL_TOO_LONG| The URL exceeded the maximum length.
-| 0x80240028 | WU_E_UNINSTALL_NOT_ALLOWED| The update could not be uninstalled because the request did not originate from a WSUS server.
-| 0x80240029 | WU_E_INVALID_PRODUCT_LICENSE| Search may have missed some updates before there is an unlicensed application on the system.
-| 0x8024002A | WU_E_MISSING_HANDLER| A component required to detect applicable updates was missing.
-| 0x8024002B | WU_E_LEGACYSERVER| An operation did not complete because it requires a newer version of server.
-| 0x8024002C | WU_E_BIN_SOURCE_ABSENT| A delta-compressed update could not be installed because it required the source.
-| 0x8024002D | WU_E_SOURCE_ABSENT| A full-file update could not be installed because it required the source.
-| 0x8024002E | WU_E_WU_DISABLED| Access to an unmanaged server is not allowed.
-| 0x8024002F | WU_E_CALL_CANCELLED_BY_POLICY| Operation did not complete because the DisableWindowsUpdateAccess policy was set.
-| 0x80240030 | WU_E_INVALID_PROXY_SERVER| The format of the proxy list was invalid.
-| 0x80240031 | WU_E_INVALID_FILE| The file is in the wrong format.
-| 0x80240032 | WU_E_INVALID_CRITERIA| The search criteria string was invalid.
-| 0x80240033 | WU_E_EULA_UNAVAILABLE| License terms could not be downloaded.
-| 0x80240034 | WU_E_DOWNLOAD_FAILED| Update failed to download.
-| 0x80240035 | WU_E_UPDATE_NOT_PROCESSED| The update was not processed.
-| 0x80240036 | WU_E_INVALID_OPERATION| The object's current state did not allow the operation.
-| 0x80240037 | WU_E_NOT_SUPPORTED| The functionality for the operation is not supported.
-| 0x80240038 | WU_E_WINHTTP_INVALID_FILE| The downloaded file has an unexpected content type.
-| 0x80240039 | WU_E_TOO_MANY_RESYNC| Agent is asked by server to resync too many times.
-| 0x80240040 | WU_E_NO_SERVER_CORE_SUPPORT| WUA API method does not run on Server Core installation.
-| 0x80240041 | WU_E_SYSPREP_IN_PROGRESS| Service is not available while sysprep is running.
-| 0x80240042 | WU_E_UNKNOWN_SERVICE| The update service is no longer registered with AU.
-| 0x80240043 | WU_E_NO_UI_SUPPORT| There is no support for WUA UI.
-| 0x80240FFF | WU_E_UNEXPECTED| An operation failed due to reasons not covered by another error code.
-
-## Windows Update success codes
-
-|Error code|Message|Description
-|-|-|-|
-| 0x00240001| WU_S_SERVICE_STOP| Windows Update Agent was stopped successfully.
-| 0x00240002 | WU_S_SELFUPDATE| Windows Update Agent updated itself.
-| 0x00240003 | WU_S_UPDATE_ERROR| Operation completed successfully but there were errors applying the updates.
-| 0x00240004 | WU_S_MARKED_FOR_DISCONNECT| A callback was marked to be disconnected later because the request to disconnect the operation came while a callback was executing.
-| 0x00240005 | WU_S_REBOOT_REQUIRED| The system must be restarted to complete installation of the update.
-| 0x00240006 | WU_S_ALREADY_INSTALLED| The update to be installed is already installed on the system.
-| 0x00240007 | WU_S_ALREADY_UNINSTALLED | The update to be removed is not installed on the system.
-| 0x00240008 | WU_S_ALREADY_DOWNLOADED| The update to be downloaded has already been downloaded.
-
-## Windows Installer minor errors
-The following errors are used to indicate that part of a search fails because of Windows Installer problems. Another part of the search may successfully return updates. All Windows Installer minor codes must share the same error code range so that the caller can tell that they are related to Windows Installer.
-
-|Error code|Message|Description
-|-|-|-|
-| 0x80241001 |WU_E_MSI_WRONG_VERSION| Search may have missed some updates because the Windows Installer is less than version 3.1.
-| 0x80241002 | WU_E_MSI_NOT_CONFIGURED| Search may have missed some updates because the Windows Installer is not configured.
-| 0x80241003 | WU_E_MSP_DISABLED| Search may have missed some updates because policy has disabled Windows Installer patching.
-| 0x80241004 | WU_E_MSI_WRONG_APP_CONTEXT| An update could not be applied because the application is installed per-user.
-| 0x80241FFF | WU_E_MSP_UNEXPECTED| Search may have missed some updates because there was a failure of the Windows Installer.
-
-## Windows Update Agent update and setup errors
-
-|Error code|Message|Description
-|-|-|-|
-| 0x8024D001 | WU_E_SETUP_INVALID_INFDATA| Windows Update Agent could not be updated because an INF file contains invalid information.
-| 0x8024D002 | WU_E_SETUP_INVALID_IDENTDATA| Windows Update Agent could not be updated because the wuident.cab file contains invalid information.
-| 0x8024D003 | WU_E_SETUP_ALREADY_INITIALIZED| Windows Update Agent could not be updated because of an internal error that caused setup initialization to be performed twice.
-| 0x8024D004 | WU_E_SETUP_NOT_INITIALIZED| Windows Update Agent could not be updated because setup initialization never completed successfully.
-| 0x8024D005 | WU_E_SETUP_SOURCE_VERSION_MISMATCH| Windows Update Agent could not be updated because the versions specified in the INF do not match the actual source file versions.
-| 0x8024D006 | WU_E_SETUP_TARGET_VERSION_GREATER| Windows Update Agent could not be updated because a WUA file on the target system is newer than the corresponding source file.
-| 0x8024D007 | WU_E_SETUP_REGISTRATION_FAILED| Windows Update Agent could not be updated because regsvr32.exe returned an error.
-| 0x8024D009 | WU_E_SETUP_SKIP_UPDATE| An update to the Windows Update Agent was skipped due to a directive in the wuident.cab file.
-| 0x8024D00A | WU_E_SETUP_UNSUPPORTED_CONFIGURATION| Windows Update Agent could not be updated because the current system configuration is not supported.
-| 0x8024D00B | WU_E_SETUP_BLOCKED_CONFIGURATION| Windows Update Agent could not be updated because the system is configured to block the update.
-| 0x8024D00C | WU_E_SETUP_REBOOT_TO_FIX| Windows Update Agent could not be updated because a restart of the system is required.
-| 0x8024D00D | WU_E_SETUP_ALREADYRUNNING| Windows Update Agent setup is already running.
-| 0x8024D00E | WU_E_SETUP_REBOOTREQUIRED| Windows Update Agent setup package requires a reboot to complete installation.
-| 0x8024D00F | WU_E_SETUP_HANDLER_EXEC_FAILURE| Windows Update Agent could not be updated because the setup handler failed during execution.
-| 0x8024D010 | WU_E_SETUP_INVALID_REGISTRY_DATA| Windows Update Agent could not be updated because the registry contains invalid information.
-| 0x8024D013 | WU_E_SETUP_WRONG_SERVER_VERSION| Windows Update Agent could not be updated because the server does not contain update information for this version.
-| 0x8024DFFF | WU_E_SETUP_UNEXPECTED| Windows Update Agent could not be updated because of an error not covered by another WU_E_SETUP_* error code.
+---
+title: Windows Update error code list by component
+description: Reference information for Windows Update error codes
+ms.prod: w10
+ms.mktglfcycl:
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationprioauthor: jaimeo
+ms.audience: itpro
+author: jaimeo
+ms.date: 09/18/2018
+ms.reviewer:
+manager: laurawi
+ms.topic: article
+---
+
+# Windows Update error codes by component
+
+> Applies to: Windows 10
+
+
+This section lists the error codes for Microsoft Windows Update.
+
+## Automatic Update Errors
+
+| Error code | Message | Description |
+|------------|---------------------------------|--------------------------------------------------------------------------------------------------------|
+| 0x80243FFF | `WU_E_AUCLIENT_UNEXPECTED` | There was a user interface error not covered by another `WU_E_AUCLIENT_*` error code. |
+| 0x8024A000 | `WU_E_AU_NOSERVICE` | Automatic Updates was unable to service incoming requests. |
+| 0x8024A002 | `WU_E_AU_NONLEGACYSERVER` | The old version of the Automatic Updates client has stopped because the WSUS server has been upgraded. |
+| 0x8024A003 | `WU_E_AU_LEGACYCLIENTDISABLED` | The old version of the Automatic Updates client was disabled. |
+| 0x8024A004 | `WU_E_AU_PAUSED` | Automatic Updates was unable to process incoming requests because it was paused. |
+| 0x8024A005 | `WU_E_AU_NO_REGISTERED_SERVICE` | No unmanaged service is registered with `AU`. |
+| 0x8024AFFF | `WU_E_AU_UNEXPECTED` | An Automatic Updates error not covered by another `WU_E_AU*` code. |
+
+## Windows Update UI errors
+
+| Error code | Message | Description |
+|------------|---------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|
+| 0x80243001 | `WU_E_INSTALLATION_RESULTS_UNKNOWN_VERSION` | The results of download and installation could not be read from the registry due to an unrecognized data format version. |
+| 0x80243002 | `WU_E_INSTALLATION_RESULTS_INVALID_DATA` | The results of download and installation could not be read from the registry due to an invalid data format. |
+| 0x80243003 | `WU_E_INSTALLATION_RESULTS_NOT_FOUND` | The results of download and installation are not available; the operation may have failed to start. |
+| 0x80243004 | `WU_E_TRAYICON_FAILURE` | A failure occurred when trying to create an icon in the taskbar notification area. |
+| 0x80243FFD | `WU_E_NON_UI_MODE` | Unable to show UI when in non-UI mode; WU client UI modules may not be installed. |
+| 0x80243FFE | `WU_E_WUCLTUI_UNSUPPORTED_VERSION` | Unsupported version of WU client UI exported functions. |
+| 0x80243FFF | `WU_E_AUCLIENT_UNEXPECTED` | There was a user interface error not covered by another `WU_E_AUCLIENT_*` error code. |
+
+## Inventory errors
+
+| Error code | Message | Description |
+|------------|--------------------------------------------|-------------------------------------------------------------------------------|
+| 0x80249001 | `WU_E_INVENTORY_PARSEFAILED` | Parsing of the rule file failed. |
+| 0x80249002 | `WU_E_INVENTORY_GET_INVENTORY_TYPE_FAILED` | Failed to get the requested inventory type from the server. |
+| 0x80249003 | `WU_E_INVENTORY_RESULT_UPLOAD_FAILED` | Failed to upload inventory result to the server. |
+| 0x80249004 | `WU_E_INVENTORY_UNEXPECTED` | There was an inventory error not covered by another error code. |
+| 0x80249005 | `WU_E_INVENTORY_WMI_ERROR` | A WMI error occurred when enumerating the instances for a particular class. |
+
+## Expression evaluator errors
+
+| Error code | Message | Description |
+|------------|---------------------------------|--------------------------------------------------------------------------------------------------------------------------------|
+| 0x8024E001 | `WU_E_EE_UNKNOWN_EXPRESSION` | An expression evaluator operation could not be completed because an expression was unrecognized. |
+| 0x8024E002 | `WU_E_EE_INVALID_EXPRESSION` | An expression evaluator operation could not be completed because an expression was invalid. |
+| 0x8024E003 | `WU_E_EE_MISSING_METADATA` | An expression evaluator operation could not be completed because an expression contains an incorrect number of metadata nodes. |
+| 0x8024E004 | `WU_E_EE_INVALID_VERSION` | An expression evaluator operation could not be completed because the version of the serialized expression data is invalid. |
+| 0x8024E005 | `WU_E_EE_NOT_INITIALIZED` | The expression evaluator could not be initialized. |
+| 0x8024E006 | `WU_E_EE_INVALID_ATTRIBUTEDATA` | An expression evaluator operation could not be completed because there was an invalid attribute. |
+| 0x8024E007 | `WU_E_EE_CLUSTER_ERROR` | An expression evaluator operation could not be completed because the cluster state of the computer could not be determined. |
+| 0x8024EFFF | `WU_E_EE_UNEXPECTED` | There was an expression evaluator error not covered by another `WU_E_EE_*` error code. |
+
+## Reporter errors
+
+| Error code | Message | Description |
+|------------|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------|
+| 0x80247001 | `WU_E_OL_INVALID_SCANFILE` | An operation could not be completed because the scan package was invalid. |
+| 0x80247002 | `WU_E_OL_NEWCLIENT_REQUIRED` | An operation could not be completed because the scan package requires a greater version of the Windows Update Agent. |
+| 0x80247FFF | `WU_E_OL_UNEXPECTED` | Search using the scan package failed. |
+| 0x8024F001 | `WU_E_REPORTER_EVENTCACHECORRUPT` | The event cache file was defective. |
+| 0x8024F002 | `WU_E_REPORTER_EVENTNAMESPACEPARSEFAILED` | The XML in the event namespace descriptor could not be parsed. |
+| 0x8024F003 | `WU_E_INVALID_EVENT` | The XML in the event namespace descriptor could not be parsed. |
+| 0x8024F004 | `WU_E_SERVER_BUSY` | The server rejected an event because the server was too busy. |
+| 0x8024FFFF | `WU_E_REPORTER_UNEXPECTED` | There was a reporter error not covered by another error code. |
+
+## Redirector errors
+The components that download the `Wuredir.cab` file and then parse the `Wuredir.cab` file generate the following errors.
+
+| Error code | Message | Description |
+|----------- |------------------------------|------------------------------------------------------------------------------------------|
+| 0x80245001 | `WU_E_REDIRECTOR_LOAD_XML` | The redirector XML document could not be loaded into the DOM class. |
+| 0x80245002 | `WU_E_REDIRECTOR_S_FALSE` | The redirector XML document is missing some required information. |
+| 0x80245003 | `WU_E_REDIRECTOR_ID_SMALLER` | The redirectorId in the downloaded redirector cab is less than in the cached cab. |
+| 0x80245FFF | `WU_E_REDIRECTOR_UNEXPECTED` | The redirector failed for reasons not covered by another `WU_E_REDIRECTOR_*` error code. |
+
+## Protocol Talker errors
+The following errors map to `SOAPCLIENT_ERROR`s through the `Atlsoap.h` file. These errors are obtained when the `CClientWebService` object calls the `GetClientError()` method.
+
+
+| Error code | Message | Description |
+|------------|----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
+| 0x80244000 | `WU_E_PT_SOAPCLIENT_BASE` | `WU_E_PT_SOAPCLIENT_*` error codes map to the `SOAPCLIENT_ERROR` enum of the ATL Server Library. |
+| 0x80244001 | `WU_E_PT_SOAPCLIENT_INITIALIZE` | Same as `SOAPCLIENT_INITIALIZE_ERROR` - initialization of the `SOAP` client failed possibly because of an MSXML installation failure. |
+| 0x80244002 | `WU_E_PT_SOAPCLIENT_OUTOFMEMORY` | Same as `SOAPCLIENT_OUTOFMEMORY` - `SOAP` client failed because it ran out of memory. |
+| 0x80244003 | `WU_E_PT_SOAPCLIENT_GENERATE` | Same as `SOAPCLIENT_GENERATE_ERROR` - `SOAP` client failed to generate the request. |
+| 0x80244004 | `WU_E_PT_SOAPCLIENT_CONNECT` | Same as `SOAPCLIENT_CONNECT_ERROR` - `SOAP` client failed to connect to the server. |
+| 0x80244005 | `WU_E_PT_SOAPCLIENT_SEND` | Same as `SOAPCLIENT_SEND_ERROR` - `SOAP` client failed to send a message for reasons of `WU_E_WINHTTP_*` error codes. |
+| 0x80244006 | `WU_E_PT_SOAPCLIENT_SERVER` | Same as `SOAPCLIENT_SERVER_ERROR` - `SOAP` client failed because there was a server error. |
+| 0x80244007 | `WU_E_PT_SOAPCLIENT_SOAPFAULT` | Same as `SOAPCLIENT_SOAPFAULT` - `SOAP` client failed because there was a SOAP fault for reasons of `WU_E_PT_SOAP_*` error codes. |
+| 0x80244008 | `WU_E_PT_SOAPCLIENT_PARSEFAULT` | Same as `SOAPCLIENT_PARSEFAULT_ERROR` - `SOAP` client failed to parse a `SOAP` fault. |
+| 0x80244009 | `WU_E_PT_SOAPCLIENT_READ` | Same as `SOAPCLIENT_READ_ERROR` - `SOAP` client failed while reading the response from the server. |
+| 0x8024400A | `WU_E_PT_SOAPCLIENT_PARSE` | Same as `SOAPCLIENT_PARSE_ERROR` - `SOAP` client failed to parse the response from the server. |
+
+## Other Protocol Talker errors
+The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These errors are obtained from the `m_fault.m_soapErrCode` member of the `CClientWebService` object when `GetClientError()` returns `SOAPCLIENT_SOAPFAULT`.
+
+
+| Error code | Message | Description |
+|------------|----------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| 0x8024400B | `WU_E_PT_SOAP_VERSION` | Same as `SOAP_E_VERSION_MISMATCH` - `SOAP` client found an unrecognizable namespace for the `SOAP` envelope. |
+| 0x8024400C | `WU_E_PT_SOAP_MUST_UNDERSTAND` | Same as `SOAP_E_MUST_UNDERSTAND` - `SOAP` client was unable to understand a header. |
+| 0x8024400D | `WU_E_PT_SOAP_CLIENT` | Same as `SOAP_E_CLIENT` - `SOAP` client found the message was malformed; fix before resending. |
+| 0x8024400E | `WU_E_PT_SOAP_SERVER` | Same as `SOAP_E_SERVER` - The `SOAP` message could not be processed due to a server error; resend later. |
+| 0x8024400F | `WU_E_PT_WMI_ERROR` | There was an unspecified Windows Management Instrumentation (WMI) error. |
+| 0x80244010 | `WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS` | The number of round trips to the server exceeded the maximum limit. |
+| 0x80244011 | `WU_E_PT_SUS_SERVER_NOT_SET` | WUServer policy value is missing in the registry. |
+| 0x80244012 | `WU_E_PT_DOUBLE_INITIALIZATION` | Initialization failed because the object was already initialized. |
+| 0x80244013 | `WU_E_PT_INVALID_COMPUTER_NAME` | The computer name could not be determined. |
+| 0x80244015 | `WU_E_PT_REFRESH_CACHE_REQUIRED` | The reply from the server indicates that the server was changed or the cookie was invalid; refresh the state of the internal cache and retry. |
+| 0x80244016 | `WU_E_PT_HTTP_STATUS_BAD_REQUEST` | Same as HTTP status 400 - the server could not process the request due to invalid syntax. |
+| 0x80244017 | `WU_E_PT_HTTP_STATUS_DENIED` | Same as HTTP status 401 - the requested resource requires user authentication. |
+| 0x80244018 | `WU_E_PT_HTTP_STATUS_FORBIDDEN` | Same as HTTP status 403 - server understood the request but declined to fulfill it. |
+| 0x80244019 | `WU_E_PT_HTTP_STATUS_NOT_FOUND` | Same as HTTP status 404 - the server cannot find the requested URI (Uniform Resource Identifier). |
+| 0x8024401A | `WU_E_PT_HTTP_STATUS_BAD_METHOD` | Same as HTTP status 405 - the HTTP method is not allowed. |
+| 0x8024401B | `WU_E_PT_HTTP_STATUS_PROXY_AUTH_REQ` | Same as HTTP status 407 - proxy authentication is required. |
+| 0x8024401C | `WU_E_PT_HTTP_STATUS_REQUEST_TIMEOUT` | Same as HTTP status 408 - the server timed out waiting for the request. |
+| 0x8024401D | `WU_E_PT_HTTP_STATUS_CONFLICT` | Same as HTTP status 409 - the request was not completed due to a conflict with the current state of the resource. |
+| 0x8024401E | `WU_E_PT_HTTP_STATUS_GONE` | Same as HTTP status 410 - requested resource is no longer available at the server. |
+| 0x8024401F | `WU_E_PT_HTTP_STATUS_SERVER_ERROR` | Same as HTTP status 500 - an error internal to the server prevented fulfilling the request. |
+| 0x80244020 | `WU_E_PT_HTTP_STATUS_NOT_SUPPORTED` | Same as HTTP status 500 - server does not support the functionality required to fulfill the request. |
+| 0x80244021 | `WU_E_PT_HTTP_STATUS_BAD_GATEWAY` | Same as HTTP status 502 - the server while acting as a gateway or a proxy received an invalid response from the upstream server it accessed in attempting to fulfil the request. |
+| 0x80244022 | `WU_E_PT_HTTP_STATUS_SERVICE_UNAVAIL` | Same as HTTP status 503 - the service is temporarily overloaded. |
+| 0x80244023 | `WU_E_PT_HTTP_STATUS_GATEWAY_TIMEOUT` | Same as HTTP status 503 - the request was timed out waiting for a gateway. |
+| 0x80244024 | `WU_E_PT_HTTP_STATUS_VERSION_NOT_SUP` | Same as HTTP status 505 - the server does not support the HTTP protocol version used for the request. |
+| 0x80244025 | `WU_E_PT_FILE_LOCATIONS_CHANGED` | Operation failed due to a changed file location; refresh internal state and resend. |
+| 0x80244026 | `WU_E_PT_REGISTRATION_NOT_SUPPORTED` | Operation failed because Windows Update Agent does not support registration with a non-WSUS server. |
+| 0x80244027 | `WU_E_PT_NO_AUTH_PLUGINS_REQUESTED` | The server returned an empty authentication information list. |
+| 0x80244028 | `WU_E_PT_NO_AUTH_COOKIES_CREATED` | Windows Update Agent was unable to create any valid authentication cookies. |
+| 0x80244029 | `WU_E_PT_INVALID_CONFIG_PROP` | A configuration property value was wrong. |
+| 0x8024402A | `WU_E_PT_CONFIG_PROP_MISSING` | A configuration property value was missing. |
+| 0x8024402B | `WU_E_PT_HTTP_STATUS_NOT_MAPPED` | The HTTP request could not be completed and the reason did not correspond to any of the `WU_E_PT_HTTP_*` error codes. |
+| 0x8024402C | `WU_E_PT_WINHTTP_NAME_NOT_RESOLVED` | Same as ERROR_WINHTTP_NAME_NOT_RESOLVED - the proxy server or target server name cannot be resolved. |
+| 0x8024402F | `WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS` | External cab file processing completed with some errors. |
+| 0x80244030 | `WU_E_PT_ECP_INIT_FAILED` | The external cab processor initialization did not complete. |
+| 0x80244031 | `WU_E_PT_ECP_INVALID_FILE_FORMAT` | The format of a metadata file was invalid. |
+| 0x80244032 | `WU_E_PT_ECP_INVALID_METADATA` | External cab processor found invalid metadata. |
+| 0x80244033 | `WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST` | The file digest could not be extracted from an external cab file. |
+| 0x80244034 | `WU_E_PT_ECP_FAILURE_TO_DECOMPRESS_CAB_FILE` | An external cab file could not be decompressed. |
+| 0x80244035 | `WU_E_PT_ECP_FILE_LOCATION_ERROR` | External cab processor was unable to get file locations. |
+| 0x80244FFF | `WU_E_PT_UNEXPECTED` | A communication error not covered by another `WU_E_PT_*` error code. |
+| 0x8024502D | `WU_E_PT_SAME_REDIR_ID` | Windows Update Agent failed to download a redirector cabinet file with a new redirectorId value from the server during the recovery. |
+| 0x8024502E | `WU_E_PT_NO_MANAGED_RECOVER` | A redirector recovery action did not complete because the server is managed. |
+
+## Download Manager errors
+
+| Error code | Message | Description |
+|------------|-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|
+| 0x80246001 | `WU_E_DM_URLNOTAVAILABLE` | A download manager operation could not be completed because the requested file does not have a URL. |
+| 0x80246002 | `WU_E_DM_INCORRECTFILEHASH` | A download manager operation could not be completed because the file digest was not recognized. |
+| 0x80246003 | `WU_E_DM_UNKNOWNALGORITHM` | A download manager operation could not be completed because the file metadata requested an unrecognized hash algorithm. |
+| 0x80246004 | `WU_E_DM_NEEDDOWNLOADREQUEST` | An operation could not be completed because a download request is required from the download handler. |
+| 0x80246005 | `WU_E_DM_NONETWORK` | A download manager operation could not be completed because the network connection was unavailable. |
+| 0x80246006 | `WU_E_DM_WRONGBITSVERSION` | A download manager operation could not be completed because the version of Background Intelligent Transfer Service (BITS) is incompatible. |
+| 0x80246007 | `WU_E_DM_NOTDOWNLOADED` | The update has not been downloaded. |
+| 0x80246008 | `WU_E_DM_FAILTOCONNECTTOBITS` | A download manager operation failed because the download manager was unable to connect the Background Intelligent Transfer Service (BITS). |
+| 0x80246009 | `WU_E_DM_BITSTRANSFERERROR` | A download manager operation failed because there was an unspecified Background Intelligent Transfer Service (BITS) transfer error. |
+| 0x8024600A | `WU_E_DM_DOWNLOADLOCATIONCHANGED` | A download must be restarted because the location of the source of the download has changed. |
+| 0x8024600B | `WU_E_DM_CONTENTCHANGED` | A download must be restarted because the update content changed in a new revision. |
+| 0x80246FFF | `WU_E_DM_UNEXPECTED` | There was a download manager error not covered by another `WU_E_DM_*` error code. |
+
+## Update Handler errors
+
+| Error code | Message | Description |
+|------------|----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|
+| 0x80242000 | `WU_E_UH_REMOTEUNAVAILABLE` | A request for a remote update handler could not be completed because no remote process is available. |
+| 0x80242001 | `WU_E_UH_LOCALONLY` | A request for a remote update handler could not be completed because the handler is local only. |
+| 0x80242002 | `WU_E_UH_UNKNOWNHANDLER` | A request for an update handler could not be completed because the handler could not be recognized. |
+| 0x80242003 | `WU_E_UH_REMOTEALREADYACTIVE` | A remote update handler could not be created because one already exists. |
+| 0x80242004 | `WU_E_UH_DOESNOTSUPPORTACTION` | A request for the handler to install (uninstall) an update could not be completed because the update does not support install (uninstall). |
+| 0x80242005 | `WU_E_UH_WRONGHANDLER` | An operation did not complete because the wrong handler was specified. |
+| 0x80242006 | `WU_E_UH_INVALIDMETADATA` | A handler operation could not be completed because the update contains invalid metadata. |
+| 0x80242007 | `WU_E_UH_INSTALLERHUNG` | An operation could not be completed because the installer exceeded the time limit. |
+| 0x80242008 | `WU_E_UH_OPERATIONCANCELLED` | An operation being done by the update handler was canceled. |
+| 0x80242009 | `WU_E_UH_BADHANDLERXML` | An operation could not be completed because the handler-specific metadata is invalid. |
+| 0x8024200A | `WU_E_UH_CANREQUIREINPUT` | A request to the handler to install an update could not be completed because the update requires user input. |
+| 0x8024200B | `WU_E_UH_INSTALLERFAILURE` | The installer failed to install (uninstall) one or more updates. |
+| 0x8024200C | `WU_E_UH_FALLBACKTOSELFCONTAINED` | The update handler should download self-contained content rather than delta-compressed content for the update. |
+| 0x8024200D | `WU_E_UH_NEEDANOTHERDOWNLOAD` | The update handler did not install the update because it needs to be downloaded again. |
+| 0x8024200E | `WU_E_UH_NOTIFYFAILURE` | The update handler failed to send notification of the status of the install (uninstall) operation. |
+| 0x8024200F | `WU_E_UH_INCONSISTENT_FILE_NAMES` | The file names contained in the update metadata and in the update package are inconsistent. |
+| 0x80242010 | `WU_E_UH_FALLBACKERROR` | The update handler failed to fall back to the self-contained content. |
+| 0x80242011 | `WU_E_UH_TOOMANYDOWNLOADREQUESTS` | The update handler has exceeded the maximum number of download requests. |
+| 0x80242012 | `WU_E_UH_UNEXPECTEDCBSRESPONSE` | The update handler has received an unexpected response from CBS. |
+| 0x80242013 | `WU_E_UH_BADCBSPACKAGEID` | The update metadata contains an invalid CBS package identifier. |
+| 0x80242014 | `WU_E_UH_POSTREBOOTSTILLPENDING` | The post-reboot operation for the update is still in progress. |
+| 0x80242015 | `WU_E_UH_POSTREBOOTRESULTUNKNOWN` | The result of the post-reboot operation for the update could not be determined. |
+| 0x80242016 | `WU_E_UH_POSTREBOOTUNEXPECTEDSTATE` | The state of the update after its post-reboot operation has completed is unexpected. |
+| 0x80242017 | `WU_E_UH_NEW_SERVICING_STACK_REQUIRED` | The OS servicing stack must be updated before this update is downloaded or installed. |
+| 0x80242FFF | `WU_E_UH_UNEXPECTED` | An update handler error not covered by another `WU_E_UH_*` code. |
+
+## Data Store errors
+
+| Error code | Message | Description |
+|------------|--------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| 0x80248000 | `WU_E_DS_SHUTDOWN` | An operation failed because Windows Update Agent is shutting down. |
+| 0x80248001 | `WU_E_DS_INUSE` | An operation failed because the data store was in use. |
+| 0x80248002 | `WU_E_DS_INVALID` | The current and expected states of the data store do not match. |
+| 0x80248003 | `WU_E_DS_TABLEMISSING` | The data store is missing a table. |
+| 0x80248004 | `WU_E_DS_TABLEINCORRECT` | The data store contains a table with unexpected columns. |
+| 0x80248005 | `WU_E_DS_INVALIDTABLENAME` | A table could not be opened because the table is not in the data store. |
+| 0x80248006 | `WU_E_DS_BADVERSION` | The current and expected versions of the data store do not match. |
+| 0x80248007 | `WU_E_DS_NODATA` | The information requested is not in the data store. |
+| 0x80248008 | `WU_E_DS_MISSINGDATA` | The data store is missing required information or has a NULL in a table column that requires a non-null value. |
+| 0x80248009 | `WU_E_DS_MISSINGREF` | The data store is missing required information or has a reference to missing license terms file localized property or linked row. |
+| 0x8024800A | `WU_E_DS_UNKNOWNHANDLER` | The update was not processed because its update handler could not be recognized. |
+| 0x8024800B | `WU_E_DS_CANTDELETE` | The update was not deleted because it is still referenced by one or more services. |
+| 0x8024800C | `WU_E_DS_LOCKTIMEOUTEXPIRED` | The data store section could not be locked within the allotted time. |
+| 0x8024800D | `WU_E_DS_NOCATEGORIES` | The category was not added because it contains no parent categories and is not a top-level category itself. |
+| 0x8024800E | `WU_E_DS_ROWEXISTS` | The row was not added because an existing row has the same primary key. |
+| 0x8024800F | `WU_E_DS_STOREFILELOCKED` | The data store could not be initialized because it was locked by another process. |
+| 0x80248010 | `WU_E_DS_CANNOTREGISTER` | The data store is not allowed to be registered with COM in the current process. |
+| 0x80248011 | `WU_E_DS_UNABLETOSTART` | Could not create a data store object in another process. |
+| 0x80248013 | `WU_E_DS_DUPLICATEUPDATEID` | The server sent the same update to the client with two different revision IDs. |
+| 0x80248014 | `WU_E_DS_UNKNOWNSERVICE` | An operation did not complete because the service is not in the data store. |
+| 0x80248015 | `WU_E_DS_SERVICEEXPIRED` | An operation did not complete because the registration of the service has expired. |
+| 0x80248016 | `WU_E_DS_DECLINENOTALLOWED` | A request to hide an update was declined because it is a mandatory update or because it was deployed with a deadline. |
+| 0x80248017 | `WU_E_DS_TABLESESSIONMISMATCH` | A table was not closed because it is not associated with the session. |
+| 0x80248018 | `WU_E_DS_SESSIONLOCKMISMATCH` | A table was not closed because it is not associated with the session. |
+| 0x80248019 | `WU_E_DS_NEEDWINDOWSSERVICE` | A request to remove the Windows Update service or to unregister it with Automatic Updates was declined because it is a built-in service and/or Automatic Updates cannot fall back to another service. |
+| 0x8024801A | `WU_E_DS_INVALIDOPERATION` | A request was declined because the operation is not allowed. |
+| 0x8024801B | `WU_E_DS_SCHEMAMISMATCH` | The schema of the current data store and the schema of a table in a backup XML document do not match. |
+| 0x8024801C | `WU_E_DS_RESETREQUIRED` | The data store requires a session reset; release the session and retry with a new session. |
+| 0x8024801D | `WU_E_DS_IMPERSONATED` | A data store operation did not complete because it was requested with an impersonated identity. |
+| 0x80248FFF | `WU_E_DS_UNEXPECTED` | A data store error not covered by another `WU_E_DS_*` code. |
+
+## Driver Util errors
+The PnP enumerated device is removed from the System Spec because one of the hardware IDs or the compatible IDs matches an installed printer driver. This is not a fatal error, and the device is merely skipped.
+
+| Error code | Message | Description |
+|------------|-------------------------------|------------------------------------------------------------------------------------------------|
+| 0x8024C001 | `WU_E_DRV_PRUNED` | A driver was skipped. |
+| 0x8024C002 | `WU_E_DRV_NOPROP_OR_LEGACY` | A property for the driver could not be found. It may not conform with required specifications. |
+| 0x8024C003 | `WU_E_DRV_REG_MISMATCH` | The registry type read for the driver does not match the expected type. |
+| 0x8024C004 | `WU_E_DRV_NO_METADATA` | The driver update is missing metadata. |
+| 0x8024C005 | `WU_E_DRV_MISSING_ATTRIBUTE` | The driver update is missing a required attribute. |
+| 0x8024C006 | `WU_E_DRV_SYNC_FAILED` | Driver synchronization failed. |
+| 0x8024C007 | `WU_E_DRV_NO_PRINTER_CONTENT` | Information required for the synchronization of applicable printers is missing. |
+| 0x8024CFFF | `WU_E_DRV_UNEXPECTED` | A driver error not covered by another `WU_E_DRV_*` code. |
+
+## Windows Update error codes
+
+| Error code | Message | Description |
+|------------|-----------------------------------|--------------------------------------------------------------|
+| 0x80240001 | `WU_E_NO_SERVICE` | Windows Update Agent was unable to provide the service.
+| 0x80240002 | `WU_E_MAX_CAPACITY_REACHED` | The maximum capacity of the service was exceeded.
+| 0x80240003 | `WU_E_UNKNOWN_ID` | An ID cannot be found.
+| 0x80240004 | `WU_E_NOT_INITIALIZED` | The object could not be initialized.
+| 0x80240005 | `WU_E_RANGEOVERLAP` | The update handler requested a byte range overlapping a previously requested range.
+| 0x80240006 | `WU_E_TOOMANYRANGES` | The requested number of byte ranges exceeds the maximum number (2^31 - 1).
+| 0x80240007 | `WU_E_INVALIDINDEX` | The index to a collection was invalid.
+| 0x80240008 | `WU_E_ITEMNOTFOUND` | The key for the item queried could not be found.
+| 0x80240009 | `WU_E_OPERATIONINPROGRESS` | Another conflicting operation was in progress. Some operations such as installation cannot be performed twice simultaneously.
+| 0x8024000A | `WU_E_COULDNOTCANCEL` | Cancellation of the operation was not allowed.
+| 0x8024000B | `WU_E_CALL_CANCELLED` | Operation was canceled.
+| 0x8024000C | `WU_E_NOOP` | No operation was required.
+| 0x8024000D | `WU_E_XML_MISSINGDATA` | Windows Update Agent could not find required information in the update's XML data.
+| 0x8024000E | `WU_E_XML_INVALID` | Windows Update Agent found invalid information in the update's XML data.
+| 0x8024000F | `WU_E_CYCLE_DETECTED` | Circular update relationships were detected in the metadata.
+| 0x80240010 | `WU_E_TOO_DEEP_RELATION` | Update relationships too deep to evaluate were evaluated.
+| 0x80240011 | `WU_E_INVALID_RELATIONSHIP` | An invalid update relationship was detected.
+| 0x80240012 | `WU_E_REG_VALUE_INVALID` | An invalid registry value was read.
+| 0x80240013 | `WU_E_DUPLICATE_ITEM` | Operation tried to add a duplicate item to a list.
+| 0x80240016 | `WU_E_INSTALL_NOT_ALLOWED` | Operation tried to install while another installation was in progress or the system was pending a mandatory restart.
+| 0x80240017 | `WU_E_NOT_APPLICABLE` | Operation was not performed because there are no applicable updates.
+| 0x80240018 | `WU_E_NO_USERTOKEN` | Operation failed because a required user token is missing.
+| 0x80240019 | `WU_E_EXCLUSIVE_INSTALL_CONFLICT` | An exclusive update cannot be installed with other updates at the same time.
+| 0x8024001A | `WU_E_POLICY_NOT_SET` | A policy value was not set.
+| 0x8024001B | `WU_E_SELFUPDATE_IN_PROGRESS` | The operation could not be performed because the Windows Update Agent is self-updating.
+| 0x8024001D | `WU_E_INVALID_UPDATE` | An update contains invalid metadata.
+| 0x8024001E | `WU_E_SERVICE_STOP` | Operation did not complete because the service or system was being shut down.
+| 0x8024001F | `WU_E_NO_CONNECTION` | Operation did not complete because the network connection was unavailable.
+| 0x80240020 | `WU_E_NO_INTERACTIVE_USER` | Operation did not complete because there is no logged-on interactive user.
+| 0x80240021 | `WU_E_TIME_OUT` | Operation did not complete because it timed out.
+| 0x80240022 | `WU_E_ALL_UPDATES_FAILED` | Operation failed for all the updates.
+| 0x80240023 | `WU_E_EULAS_DECLINED` | The license terms for all updates were declined.
+| 0x80240024 | `WU_E_NO_UPDATE` | There are no updates.
+| 0x80240025 | `WU_E_USER_ACCESS_DISABLED` | Group Policy settings prevented access to Windows Update.
+| 0x80240026 | `WU_E_INVALID_UPDATE_TYPE` | The type of update is invalid.
+| 0x80240027 | `WU_E_URL_TOO_LONG` | The URL exceeded the maximum length.
+| 0x80240028 | `WU_E_UNINSTALL_NOT_ALLOWED` | The update could not be uninstalled because the request did not originate from a WSUS server.
+| 0x80240029 | `WU_E_INVALID_PRODUCT_LICENSE` | Search may have missed some updates before there is an unlicensed application on the system.
+| 0x8024002A | `WU_E_MISSING_HANDLER` | A component required to detect applicable updates was missing.
+| 0x8024002B | `WU_E_LEGACYSERVER` | An operation did not complete because it requires a newer version of server.
+| 0x8024002C | `WU_E_BIN_SOURCE_ABSENT` | A delta-compressed update could not be installed because it required the source.
+| 0x8024002D | `WU_E_SOURCE_ABSENT` | A full-file update could not be installed because it required the source.
+| 0x8024002E | `WU_E_WU_DISABLED` | Access to an unmanaged server is not allowed.
+| 0x8024002F | `WU_E_CALL_CANCELLED_BY_POLICY` | Operation did not complete because the DisableWindowsUpdateAccess policy was set.
+| 0x80240030 | `WU_E_INVALID_PROXY_SERVER` | The format of the proxy list was invalid.
+| 0x80240031 | `WU_E_INVALID_FILE` | The file is in the wrong format.
+| 0x80240032 | `WU_E_INVALID_CRITERIA` | The search criteria string was invalid.
+| 0x80240033 | `WU_E_EULA_UNAVAILABLE` | License terms could not be downloaded.
+| 0x80240034 | `WU_E_DOWNLOAD_FAILED` | Update failed to download.
+| 0x80240035 | `WU_E_UPDATE_NOT_PROCESSED` | The update was not processed.
+| 0x80240036 | `WU_E_INVALID_OPERATION` | The object's current state did not allow the operation.
+| 0x80240037 | `WU_E_NOT_SUPPORTED` | The functionality for the operation is not supported.
+| 0x80240038 | `WU_E_WINHTTP_INVALID_FILE` | The downloaded file has an unexpected content type.
+| 0x80240039 | `WU_E_TOO_MANY_RESYNC` | Agent is asked by server to resync too many times.
+| 0x80240040 | `WU_E_NO_SERVER_CORE_SUPPORT` | `WUA API` method does not run on Server Core installation.
+| 0x80240041 | `WU_E_SYSPREP_IN_PROGRESS` | Service is not available while sysprep is running.
+| 0x80240042 | `WU_E_UNKNOWN_SERVICE` | The update service is no longer registered with `AU`.
+| 0x80240043 | `WU_E_NO_UI_SUPPORT` | There is no support for `WUA UI`.
+| 0x80240FFF | `WU_E_UNEXPECTED` | An operation failed due to reasons not covered by another error code.
+
+## Windows Update success codes
+
+| Error code | Message | Description |
+|------------|------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|
+| 0x00240001 | `WU_S_SERVICE_STOP` | Windows Update Agent was stopped successfully. |
+| 0x00240002 | `WU_S_SELFUPDATE` | Windows Update Agent updated itself. |
+| 0x00240003 | `WU_S_UPDATE_ERROR` | Operation completed successfully but there were errors applying the updates. |
+| 0x00240004 | `WU_S_MARKED_FOR_DISCONNECT` | A callback was marked to be disconnected later because the request to disconnect the operation came while a callback was executing. |
+| 0x00240005 | `WU_S_REBOOT_REQUIRED` | The system must be restarted to complete installation of the update. |
+| 0x00240006 | `WU_S_ALREADY_INSTALLED` | The update to be installed is already installed on the system. |
+| 0x00240007 | `WU_S_ALREADY_UNINSTALLED` | The update to be removed is not installed on the system. |
+| 0x00240008 | `WU_S_ALREADY_DOWNLOADED` | The update to be downloaded has already been downloaded. |
+
+## Windows Installer minor errors
+The following errors are used to indicate that part of a search fails because of Windows Installer problems. Another part of the search may successfully return updates. All Windows Installer minor codes must share the same error code range so that the caller can tell that they are related to Windows Installer.
+
+| Error code | Message | Description |
+|------------|------------------------------|---------------------------------------------------------------------------------------------|
+| 0x80241001 | `WU_E_MSI_WRONG_VERSION` | Search may have missed some updates because the Windows Installer is less than version 3.1. |
+| 0x80241002 | `WU_E_MSI_NOT_CONFIGURED` | Search may have missed some updates because the Windows Installer is not configured. |
+| 0x80241003 | `WU_E_MSP_DISABLED` | Search may have missed some updates because policy has disabled Windows Installer patching. |
+| 0x80241004 | `WU_E_MSI_WRONG_APP_CONTEXT` | An update could not be applied because the application is installed per-user. |
+| 0x80241FFF | `WU_E_MSP_UNEXPECTED` | Search may have missed some updates because there was a failure of the Windows Installer. |
+
+## Windows Update Agent update and setup errors
+
+| Error code | Message | Description |
+|------------|----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
+| 0x8024D001 | `WU_E_SETUP_INVALID_INFDATA` | Windows Update Agent could not be updated because an INF file contains invalid information. |
+| 0x8024D002 | `WU_E_SETUP_INVALID_IDENTDATA` | Windows Update Agent could not be updated because the `wuident.cab` file contains invalid information. |
+| 0x8024D003 | `WU_E_SETUP_ALREADY_INITIALIZED` | Windows Update Agent could not be updated because of an internal error that caused setup initialization to be performed twice. |
+| 0x8024D004 | `WU_E_SETUP_NOT_INITIALIZED` | Windows Update Agent could not be updated because setup initialization never completed successfully. |
+| 0x8024D005 | `WU_E_SETUP_SOURCE_VERSION_MISMATCH` | Windows Update Agent could not be updated because the versions specified in the INF do not match the actual source file versions. |
+| 0x8024D006 | `WU_E_SETUP_TARGET_VERSION_GREATER` | Windows Update Agent could not be updated because a WUA file on the target system is newer than the corresponding source file. |
+| 0x8024D007 | `WU_E_SETUP_REGISTRATION_FAILED` | Windows Update Agent could not be updated because `regsvr32.exe` returned an error. |
+| 0x8024D009 | `WU_E_SETUP_SKIP_UPDATE` | An update to the Windows Update Agent was skipped due to a directive in the `wuident.cab` file. |
+| 0x8024D00A | `WU_E_SETUP_UNSUPPORTED_CONFIGURATION` | Windows Update Agent could not be updated because the current system configuration is not supported. |
+| 0x8024D00B | `WU_E_SETUP_BLOCKED_CONFIGURATION` | Windows Update Agent could not be updated because the system is configured to block the update. |
+| 0x8024D00C | `WU_E_SETUP_REBOOT_TO_FIX` | Windows Update Agent could not be updated because a restart of the system is required. |
+| 0x8024D00D | `WU_E_SETUP_ALREADYRUNNING` | Windows Update Agent setup is already running. |
+| 0x8024D00E | `WU_E_SETUP_REBOOTREQUIRED` | Windows Update Agent setup package requires a reboot to complete installation. |
+| 0x8024D00F | `WU_E_SETUP_HANDLER_EXEC_FAILURE` | Windows Update Agent could not be updated because the setup handler failed during execution. |
+| 0x8024D010 | `WU_E_SETUP_INVALID_REGISTRY_DATA` | Windows Update Agent could not be updated because the registry contains invalid information. |
+| 0x8024D013 | `WU_E_SETUP_WRONG_SERVER_VERSION` | Windows Update Agent could not be updated because the server does not contain update information for this version. |
+| 0x8024DFFF | `WU_E_SETUP_UNEXPECTED` | Windows Update Agent could not be updated because of an error not covered by another `WU_E_SETUP_*` error code. |
diff --git a/windows/deployment/update/windows-update-errors.md b/windows/deployment/update/windows-update-errors.md
index 049bedc236..cdb6ea9f85 100644
--- a/windows/deployment/update/windows-update-errors.md
+++ b/windows/deployment/update/windows-update-errors.md
@@ -1,40 +1,42 @@
----
-title: Windows Update common errors and mitigation
-description: Learn about some common issues you might experience with Windows Update
-ms.prod: w10
-ms.mktglfcycl:
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.audience: itpro
author: greg-lindsay
-ms.date: 09/18/2018
-ms.reviewer:
-manager: laurawi
-ms.topic: article
----
-
-# Windows Update common errors and mitigation
-
->Applies to: Windows 10
-
-The following table provides information about common errors you might run into with Windows Update, as well as steps to help you mitigate them.
-
-
-| Error Code | Message | Description | Mitigation |
-|------------------------------------------|-----------------------------------|-----------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| 0x8024402F | WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS | External cab file processing completed with some errors | One of the reasons we see this issue is due to the design of a software called Lightspeed Rocket for Web filtering. The IP addresses of the computers you want to get updates successfully on, should be added to the exceptions list of Lightspeed |
-| 0x80242006 | WU_E_UH_INVALIDMETADATA | A handler operation could not be completed because the update contains invalid metadata. | Rename Software Redistribution Folder and attempt to download the updates again: Rename the following folders to \*.BAK: - %systemroot%\system32\catroot2 To do this, type the following commands at a command prompt. Press ENTER after you type each command. - Ren %systemroot%\SoftwareDistribution\DataStore \*.bak - Ren %systemroot%\SoftwareDistribution\Download \*.bak Ren %systemroot%\system32\catroot2 \*.bak |
-| 0x80070BC9 | ERROR_FAIL_REBOOT_REQUIRED | The requested operation failed. A system reboot is required to roll back changes made. | Ensure that we do not have any policies that control the start behavior for the Windows Module Installer. This service should not be hardened to any start value and should be managed by the OS. |
-| 0x80200053 | BG_E_VALIDATION_FAILED | NA | Ensure that there is no Firewalls that filter downloads. The Firewall filtering may lead to invalid responses being received by the Windows Update Client. If the issue still persists, run the [WU reset script](https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc). |
-| 0x80072EE2 | WININET_E_TIMEOUT | The operation timed out | This error message can be caused if the computer isn't connected to Internet. To fix this issue, following these steps: make sure these URLs are not blocked: http://.update.microsoft.com https:// .update.microsoft.com Additionally , you can take a network trace and see what is timing out. \ |
-| 0x80072EFD 0x80072EFE 0x80D02002 | TIME_OUT_ERRORS | The operation timed out | Make sure there are no firewall rules or proxy to block Microsoft download URLs. Take a network monitor trace to understand better. \ |
-| 0X8007000D | ERROR_INVALID_DATA | Indicates invalid data downloaded or corruption occurred. | Attempt to re-download the update and initiate installation. |
-| 0x8024A10A | USO_E_SERVICE_SHUTTING_DOWN | Indicates that the WU Service is shutting down. | This may happen due to a very long period of time of inactivity, a system hang leading to the service being idle and leading to the shutdown of the service. Ensure that the system remains active and the connections remain established to complete the upgrade. |
-| 0x80240020 | WU_E_NO_INTERACTIVE_USER | Operation did not complete because there is no logged-on interactive user. | Please login to the system to initiate the installation and allow the system to be rebooted. |
-| 0x80242014 | WU_E_UH_POSTREBOOTSTILLPENDING | The post-reboot operation for the update is still in progress. | Some Windows Updates require the system to be restarted. Reboot the system to complete the installation of the Updates. |
-| 0x80246017 | WU_E_DM_UNAUTHORIZED_LOCAL_USER | The download failed because the local user was denied authorization to download the content. | Ensure that the user attempting to download and install updates has been provided with sufficient privileges to install updates (Local Administrator). |
-| 0x8024000B | WU_E_CALL_CANCELLED | Operation was cancelled. | This indicates that the operation was cancelled by the user/service. You may also encounter this error when we are unable to filter the results. Run the [Decline Superseded PowerShell script](https://gallery.technet.microsoft.com/scriptcenter/Cleanup-WSUS-server-4424c9d6) to allow the filtering process to complete. |
-| 0x8024000E | WU_E_XML_INVALID | Windows Update Agent found invalid information in the update's XML data. | Certain drivers contain additional metadata information in the update.xml, which could lead Orchestrator to understand it as invalid data. Ensure that you have the latest Windows Update Agent installed on the machine. |
-| 0x8024D009 | WU_E_SETUP_SKIP_UPDATE | An update to the Windows Update Agent was skipped due to a directive in the wuident.cab file. | You may encounter this error when WSUS is not sending the Self-update to the clients. Review [KB920659](https://support.microsoft.com/help/920659/the-microsoft-windows-server-update-services-wsus-selfupdate-service-d) for instructions to resolve the issue. |
-| 0x80244007 | WU_E_PT_SOAPCLIENT_SOAPFAULT | SOAP client failed because there was a SOAP fault for reasons of WU_E_PT_SOAP_\* error codes. | This issue occurs because Windows cannot renew the cookies for Windows Update. Review [KB2883975](https://support.microsoft.com/help/2883975/0x80244007-error-when-windows-tries-to-scan-for-updates-on-a-wsus-serv) for instructions to resolve the issue. |
-
+---
+title: Windows Update common errors and mitigation
+description: Learn about some common issues you might experience with Windows Update
+ms.prod: w10
+ms.mktglfcycl:
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationprioauthor: jaimeo
+ms.audience: itpro
+author: jaimeo
+ms.date: 09/18/2018
+ms.reviewer:
+manager: laurawi
+ms.topic: article
+---
+
+# Windows Update common errors and mitigation
+
+>Applies to: Windows 10
+
+The following table provides information about common errors you might run into with Windows Update, as well as steps to help you mitigate them.
+
+
+| Error Code | Message | Description | Mitigation |
+|------------------------------------------|-----------------------------------|-----------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| 0x8024402F | WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS | External cab file processing completed with some errors | One of the reasons we see this issue is due to the design of a software called Lightspeed Rocket for Web filtering. The IP addresses of the computers you want to get updates successfully on, should be added to the exceptions list of Lightspeed |
+| 0x80242006 | WU_E_UH_INVALIDMETADATA | A handler operation could not be completed because the update contains invalid metadata. | Rename Software Redistribution Folder and attempt to download the updates again: Rename the following folders to \*.BAK: - %systemroot%\system32\catroot2 To do this, type the following commands at a command prompt. Press ENTER after you type each command. - Ren %systemroot%\SoftwareDistribution\DataStore \*.bak - Ren %systemroot%\SoftwareDistribution\Download \*.bak Ren %systemroot%\system32\catroot2 \*.bak |
+| 0x80070BC9 | ERROR_FAIL_REBOOT_REQUIRED | The requested operation failed. A system reboot is required to roll back changes made. | Ensure that we do not have any policies that control the start behavior for the Windows Module Installer. This service should not be hardened to any start value and should be managed by the OS. |
+| 0x80200053 | BG_E_VALIDATION_FAILED | NA | Ensure that there is no Firewalls that filter downloads. The Firewall filtering may lead to invalid responses being received by the Windows Update Client. If the issue still persists, run the [WU reset script](https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc). |
+| 0x80072EE2 | WININET_E_TIMEOUT | The operation timed out | This error message can be caused if the computer isn't connected to Internet. To fix this issue, following these steps: make sure these URLs are not blocked: http://.update.microsoft.com https:// .update.microsoft.com Additionally , you can take a network trace and see what is timing out. \ |
+| 0x80072EFD 0x80072EFE 0x80D02002 | TIME_OUT_ERRORS | The operation timed out | Make sure there are no firewall rules or proxy to block Microsoft download URLs. Take a network monitor trace to understand better. \ |
+| 0X8007000D | ERROR_INVALID_DATA | Indicates invalid data downloaded or corruption occurred. | Attempt to re-download the update and initiate installation. |
+| 0x8024A10A | USO_E_SERVICE_SHUTTING_DOWN | Indicates that the WU Service is shutting down. | This may happen due to a very long period of time of inactivity, a system hang leading to the service being idle and leading to the shutdown of the service. Ensure that the system remains active and the connections remain established to complete the upgrade. |
+| 0x80240020 | WU_E_NO_INTERACTIVE_USER | Operation did not complete because there is no logged-on interactive user. | Please login to the system to initiate the installation and allow the system to be rebooted. |
+| 0x80242014 | WU_E_UH_POSTREBOOTSTILLPENDING | The post-reboot operation for the update is still in progress. | Some Windows Updates require the system to be restarted. Reboot the system to complete the installation of the Updates. |
+| 0x80246017 | WU_E_DM_UNAUTHORIZED_LOCAL_USER | The download failed because the local user was denied authorization to download the content. | Ensure that the user attempting to download and install updates has been provided with sufficient privileges to install updates (Local Administrator). |
+| 0x8024000B | WU_E_CALL_CANCELLED | Operation was cancelled. | This indicates that the operation was cancelled by the user/service. You may also encounter this error when we are unable to filter the results. Run the [Decline Superseded PowerShell script](https://gallery.technet.microsoft.com/scriptcenter/Cleanup-WSUS-server-4424c9d6) to allow the filtering process to complete. |
+| 0x8024000E | WU_E_XML_INVALID | Windows Update Agent found invalid information in the update's XML data. | Certain drivers contain additional metadata information in the update.xml, which could lead Orchestrator to understand it as invalid data. Ensure that you have the latest Windows Update Agent installed on the machine. |
+| 0x8024D009 | WU_E_SETUP_SKIP_UPDATE | An update to the Windows Update Agent was skipped due to a directive in the wuident.cab file. | You may encounter this error when WSUS is not sending the Self-update to the clients. Review [KB920659](https://support.microsoft.com/help/920659/the-microsoft-windows-server-update-services-wsus-selfupdate-service-d) for instructions to resolve the issue. |
+| 0x80244007 | WU_E_PT_SOAPCLIENT_SOAPFAULT | SOAP client failed because there was a SOAP fault for reasons of WU_E_PT_SOAP_\* error codes. | This issue occurs because Windows cannot renew the cookies for Windows Update. Review [KB2883975](https://support.microsoft.com/help/2883975/0x80244007-error-when-windows-tries-to-scan-for-updates-on-a-wsus-serv) for instructions to resolve the issue. |
+
diff --git a/windows/deployment/update/windows-update-logs.md b/windows/deployment/update/windows-update-logs.md
index 7eec34d793..1e9deff347 100644
--- a/windows/deployment/update/windows-update-logs.md
+++ b/windows/deployment/update/windows-update-logs.md
@@ -1,147 +1,149 @@
----
-title: Windows Update log files
-description: Learn about the Windows Update log files
-ms.prod: w10
-ms.mktglfcycl:
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.audience: itpro
author: greg-lindsay
-ms.date: 09/18/2018
-ms.reviewer:
-manager: laurawi
-ms.topic: article
----
-
-# Windows Update log files
-
->Applies to: Windows 10
-
-The following table describes the log files created by Windows Update.
-
-
-|Log file|Location|Description|When to Use |
-|-|-|-|-|
-|windowsupdate.log|C:\Windows\Logs\WindowsUpdate|Starting in Windows 8.1 and continuing in Windows 10, Windows Update client uses Event Tracing for Windows (ETW) to generate diagnostic logs.|If you receive an error message when you run Windows Update (WU), you can use the information that is included in the Windowsupdate.log log file to troubleshoot the issue.|
-|UpdateSessionOrchestration.etl|C:\ProgramData\USOShared\Logs|Starting Windows 10, the Update Orchestrator is responsible for sequence of downloading and installing various update types from Windows Update. And the events are logged to these etl files.|When you see that the updates are available but download is not getting triggered. When Updates are downloaded but installation is not triggered. When Updates are installed but reboot is not triggered. |
-|NotificationUxBroker.etl|C:\ProgramData\USOShared\Logs|Starting Windows 10, the notification toast or the banner is triggered by this NotificationUxBroker.exe . And the logs to check its working is this etl. |When you want to check whether the Notification was triggered or not for reboot or update availability etc. |
-|CBS.log|%systemroot%\Logs\CBS|This logs provides insight on the update installation part in the servicing stack.|To troubleshoot the issues related to WU installation.|
-
-## Generating WindowsUpdate.log
-To merge and convert WU trace files (.etl files) into a single readable WindowsUpdate.log file, see [Get-WindowsUpdateLog](https://docs.microsoft.com/powershell/module/windowsupdate/get-windowsupdatelog?view=win10-ps).
-
->[!NOTE]
->When you run the **Get-WindowsUpdateLog** cmdlet, an copy of WindowsUpdate.log file is created as a static log file. It does not update as the old WindowsUpate.log unless you run **Get-WindowsUpdateLog** again.
-
-### Windows Update log components
-The WU engine has different component names. The following are some of the most common components that appear in the WindowsUpdate.log file:
-
-- AGENT- Windows Update agent
-- AU - Automatic Updates is performing this task
-- AUCLNT- Interaction between AU and the logged-on user
-- CDM- Device Manager
-- CMPRESS- Compression agent
-- COMAPI- Windows Update API
-- DRIVER- Device driver information
-- DTASTOR- Handles database transactions
-- EEHNDLER- Expression handler that's used to evaluate update applicability
-- HANDLER- Manages the update installers
-- MISC- General service information
-- OFFLSNC- Detects available updates without network connection
-- PARSER- Parses expression information
-- PT- Synchronizes updates information to the local datastore
-- REPORT- Collects reporting information
-- SERVICE- Startup/shutdown of the Automatic Updates service
-- SETUP- Installs new versions of the Windows Update client when it is available
-- SHUTDWN- Install at shutdown feature
-- WUREDIR- The Windows Update redirector files
-- WUWEB- The Windows Update ActiveX control
-- ProtocolTalker - Client-server sync
-- DownloadManager - Creates and monitors payload downloads
-- Handler, Setup - Installer handlers (CBS, and so on)
-- EEHandler - Evaluating update applicability rules
-- DataStore - Caching update data locally
-- IdleTimer - Tracking active calls, stopping a service
-
->[!NOTE]
->Many component log messages are invaluable if you are looking for problems in that specific area. However, they can be useless if you don't filter to exclude irrelevant components so that you can focus on what’s important.
-
-### Windows Update log structure
-The Windows update log structure is separated into four main identities:
-
-- Time Stamps
-- Process ID and Thread ID
-- Component Name
-- Update Identifiers
- - Update ID and Revision Number
- - Revision ID
- - Local ID
- - Inconsistent terminology
-
-The WindowsUpdate.log structure is discussed in the following sections.
-
-#### Time stamps
-The time stamp indicates the time at which the logging occurs.
-- Messages are usually in chronological order, but there may be exceptions.
-- A pause during a sync can indicate a network problem, even if the scan succeeds.
-- A long pause near the end of a scan can indicate a supersedence chain issue.
- 
-
-
-#### Process ID and thread ID
-The Process IDs and Thread IDs are random, and they can vary from log to log and even from service session to service session within the same log.
-- The first four hex digits are the process ID.
-- The next four hex digits are the thread ID.
-- Each component, such as the USO, WU engine, COM API callers, and WU installer handlers, has its own process ID.
- 
-
-
-#### Component name
-Search for and identify the components that are associated with the IDs. Different parts of the WU engine have different component names. Some of them are as follows:
-
-- ProtocolTalker - Client-server sync
-- DownloadManager - Creates and monitors payload downloads
-- Handler, Setup - Installer handlers (CBS, etc.)
-- EEHandler - Evaluating update applicability rules
-- DataStore - Caching update data locally
-- IdleTimer - Tracking active calls, stopping service
-
-
-
-
-#### Update identifiers
-
-##### Update ID and revision number
-There are different identifiers for the same update in different contexts. It’s important to know the identifier schemes.
-- Update ID: A GUID (indicated in the previous screen shot) that's assigned to a given update at publication time
-- Revision number: A number incremented every time that a given update (that has a given update ID) is modified and republished on a service
-- Revision numbers are reused from one update to another (not a unique identifier).
-- The update ID and revision number are often shown together as "{GUID}.revision."
- 
-
-
-##### Revision ID
-- A Revision ID (do no confuse this with “revision number”) is a serial number that's issued when an update is initially published or revised on a given service.
-- An existing update that’s revised keeps the same update ID (GUID), has its revision number incremented (for example, from 100 to 101), but gets a completely new revision ID that is not related to the previous ID.
-- Revision IDs are unique on a given update source, but not across multiple sources.
-- The same update revision may have completely different revision IDs on WU and WSUS.
-- The same revision ID may represent different updates on WU and WSUS.
-
-##### Local ID
-- Local ID is a serial number issued when an update is received from a service by a given WU client
-- Usually seen in debug logs, especially involving the local cache for update info (Datastore)
-- Different client PCs will assign different Local IDs to the same update
-- You can find the local IDs that a client is using by getting the client’s %WINDIR%\SoftwareDistribution\Datastore\Datastore.edb file
-
-##### Inconsistent terminology
-- Sometimes the logs use terms inconsistently. For example, the InstalledNonLeafUpdateIDs list actually contains revision IDs, not update IDs.
-- Recognize IDs by form and context:
-
- - GUIDs are update IDs
- - Small integers that appear alongside an update ID are revision numbers
- - Large integers are typically revision IDs
- - Small integers (especially in Datastore) can be local IDs
- 
-
-## Windows Setup log files analysis using SetupDiag tool
-SetupDiag is a diagnostic tool that can be used for analysis of logs related to installation of Windows Updates. For detailed information, see [SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag).
+---
+title: Windows Update log files
+description: Learn about the Windows Update log files
+ms.prod: w10
+ms.mktglfcycl:
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationprioauthor: jaimeo
+ms.audience: itpro
+author: jaimeo
+ms.date: 09/18/2018
+ms.reviewer:
+manager: laurawi
+ms.topic: article
+---
+
+# Windows Update log files
+
+>Applies to: Windows 10
+
+The following table describes the log files created by Windows Update.
+
+
+|Log file|Location|Description|When to Use |
+|-|-|-|-|
+|windowsupdate.log|C:\Windows\Logs\WindowsUpdate|Starting in Windows 8.1 and continuing in Windows 10, Windows Update client uses Event Tracing for Windows (ETW) to generate diagnostic logs.|If you receive an error message when you run Windows Update (WU), you can use the information that is included in the Windowsupdate.log log file to troubleshoot the issue.|
+|UpdateSessionOrchestration.etl|C:\ProgramData\USOShared\Logs|Starting Windows 10, the Update Orchestrator is responsible for sequence of downloading and installing various update types from Windows Update. And the events are logged to these etl files.|When you see that the updates are available but download is not getting triggered. When Updates are downloaded but installation is not triggered. When Updates are installed but reboot is not triggered. |
+|NotificationUxBroker.etl|C:\ProgramData\USOShared\Logs|Starting Windows 10, the notification toast or the banner is triggered by this NotificationUxBroker.exe . And the logs to check its working is this etl. |When you want to check whether the Notification was triggered or not for reboot or update availability etc. |
+|CBS.log|%systemroot%\Logs\CBS|This logs provides insight on the update installation part in the servicing stack.|To troubleshoot the issues related to WU installation.|
+
+## Generating WindowsUpdate.log
+To merge and convert WU trace files (.etl files) into a single readable WindowsUpdate.log file, see [Get-WindowsUpdateLog](https://docs.microsoft.com/powershell/module/windowsupdate/get-windowsupdatelog?view=win10-ps).
+
+>[!NOTE]
+>When you run the **Get-WindowsUpdateLog** cmdlet, an copy of WindowsUpdate.log file is created as a static log file. It does not update as the old WindowsUpate.log unless you run **Get-WindowsUpdateLog** again.
+
+### Windows Update log components
+The WU engine has different component names. The following are some of the most common components that appear in the WindowsUpdate.log file:
+
+- AGENT- Windows Update agent
+- AU - Automatic Updates is performing this task
+- AUCLNT- Interaction between AU and the logged-on user
+- CDM- Device Manager
+- CMPRESS- Compression agent
+- COMAPI- Windows Update API
+- DRIVER- Device driver information
+- DTASTOR- Handles database transactions
+- EEHNDLER- Expression handler that's used to evaluate update applicability
+- HANDLER- Manages the update installers
+- MISC- General service information
+- OFFLSNC- Detects available updates without network connection
+- PARSER- Parses expression information
+- PT- Synchronizes updates information to the local datastore
+- REPORT- Collects reporting information
+- SERVICE- Startup/shutdown of the Automatic Updates service
+- SETUP- Installs new versions of the Windows Update client when it is available
+- SHUTDWN- Install at shutdown feature
+- WUREDIR- The Windows Update redirector files
+- WUWEB- The Windows Update ActiveX control
+- ProtocolTalker - Client-server sync
+- DownloadManager - Creates and monitors payload downloads
+- Handler, Setup - Installer handlers (CBS, and so on)
+- EEHandler - Evaluating update applicability rules
+- DataStore - Caching update data locally
+- IdleTimer - Tracking active calls, stopping a service
+
+>[!NOTE]
+>Many component log messages are invaluable if you are looking for problems in that specific area. However, they can be useless if you don't filter to exclude irrelevant components so that you can focus on what’s important.
+
+### Windows Update log structure
+The Windows update log structure is separated into four main identities:
+
+- Time Stamps
+- Process ID and Thread ID
+- Component Name
+- Update Identifiers
+ - Update ID and Revision Number
+ - Revision ID
+ - Local ID
+ - Inconsistent terminology
+
+The WindowsUpdate.log structure is discussed in the following sections.
+
+#### Time stamps
+The time stamp indicates the time at which the logging occurs.
+- Messages are usually in chronological order, but there may be exceptions.
+- A pause during a sync can indicate a network problem, even if the scan succeeds.
+- A long pause near the end of a scan can indicate a supersedence chain issue.
+ 
+
+
+#### Process ID and thread ID
+The Process IDs and Thread IDs are random, and they can vary from log to log and even from service session to service session within the same log.
+- The first four hex digits are the process ID.
+- The next four hex digits are the thread ID.
+- Each component, such as the USO, WU engine, COM API callers, and WU installer handlers, has its own process ID.
+ 
+
+
+#### Component name
+Search for and identify the components that are associated with the IDs. Different parts of the WU engine have different component names. Some of them are as follows:
+
+- ProtocolTalker - Client-server sync
+- DownloadManager - Creates and monitors payload downloads
+- Handler, Setup - Installer handlers (CBS, etc.)
+- EEHandler - Evaluating update applicability rules
+- DataStore - Caching update data locally
+- IdleTimer - Tracking active calls, stopping service
+
+
+
+
+#### Update identifiers
+
+##### Update ID and revision number
+There are different identifiers for the same update in different contexts. It’s important to know the identifier schemes.
+- Update ID: A GUID (indicated in the previous screen shot) that's assigned to a given update at publication time
+- Revision number: A number incremented every time that a given update (that has a given update ID) is modified and republished on a service
+- Revision numbers are reused from one update to another (not a unique identifier).
+- The update ID and revision number are often shown together as "{GUID}.revision."
+ 
+
+
+##### Revision ID
+- A Revision ID (do no confuse this with “revision number”) is a serial number that's issued when an update is initially published or revised on a given service.
+- An existing update that’s revised keeps the same update ID (GUID), has its revision number incremented (for example, from 100 to 101), but gets a completely new revision ID that is not related to the previous ID.
+- Revision IDs are unique on a given update source, but not across multiple sources.
+- The same update revision may have completely different revision IDs on WU and WSUS.
+- The same revision ID may represent different updates on WU and WSUS.
+
+##### Local ID
+- Local ID is a serial number issued when an update is received from a service by a given WU client
+- Usually seen in debug logs, especially involving the local cache for update info (Datastore)
+- Different client PCs will assign different Local IDs to the same update
+- You can find the local IDs that a client is using by getting the client’s %WINDIR%\SoftwareDistribution\Datastore\Datastore.edb file
+
+##### Inconsistent terminology
+- Sometimes the logs use terms inconsistently. For example, the InstalledNonLeafUpdateIDs list actually contains revision IDs, not update IDs.
+- Recognize IDs by form and context:
+
+ - GUIDs are update IDs
+ - Small integers that appear alongside an update ID are revision numbers
+ - Large integers are typically revision IDs
+ - Small integers (especially in Datastore) can be local IDs
+ 
+
+## Windows Setup log files analysis using SetupDiag tool
+SetupDiag is a diagnostic tool that can be used for analysis of logs related to installation of Windows Updates. For detailed information, see [SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag).
diff --git a/windows/deployment/update/windows-update-overview.md b/windows/deployment/update/windows-update-overview.md
index 3eda438f80..2590530152 100644
--- a/windows/deployment/update/windows-update-overview.md
+++ b/windows/deployment/update/windows-update-overview.md
@@ -1,57 +1,59 @@
----
-title: Get started with Windows Update
-description: Learn how Windows Update works, including architecture and troubleshooting
-ms.prod: w10
-ms.mktglfcycl:
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.audience: itpro
author: greg-lindsay
-ms.date: 09/18/2018
-ms.reviewer:
-manager: laurawi
-ms.topic: article
----
-
-# Get started with Windows Update
-
->Applies to: Windows 10
-
-With the release of Windows 10, we moved the update model to the Unified Update Platform. Unified Update Platform (UUP) is a single publishing, hosting, scan and download model for all types of OS updates, desktop and mobile for all Windows-based operating systems, for everything from monthly quality updates to new feature updates.
-
-Ues the following information to get started with Windows Update:
-
-- Understand the UUP architecture
-- Understand [how Windows Update works](how-windows-update-works.md)
-- Find [Windows Update log files](windows-update-logs.md)
-- Learn how to [troubleshoot Windows Update](windows-update-troubleshooting.md)
-- Review [common Windows Update errors](windows-update-errors.md) and check out the [error code reference](windows-update-error-reference.md)
-- Review [other resources](windows-update-resources.md) to help you use Windows Update
-
-## Unified Update Platform (UUP) architecture
-To understand the changes to the Windows Update architecture that UUP introduces let's start with some new key terms.
-
-
-
-- **Update UI** – The user interface to initiate Windows Update check and history. Available under **Settings --> Update & Security --> Windows Update**.
-- **Update Session Orchestrator (USO)**- A Windows OS component that orchestrates the sequence of downloading and installing various update types from Windows Update.
-
- Update types-
- - OS Feature updates
- - OS Security updates
- - Device drivers
- - Defender definition updates
-
- >[!NOTE]
- > Other types of updates, like Office desktop updates, are installed if the user opts into Microsoft Update.
- >
- >Store apps aren't installed by USO, today they are separate.
-
-- **WU Client/ UpdateAgent** - The component running on your PC. It's essentially a DLL that is downloaded to the device when an update is applicable. It surfaces the APIs needed to perform an update, including those needed to generate a list of payloads to download, as well as starts stage and commit operations. It provides a unified interface that abstracts away the underlying update technologies from the caller.
-- **WU Arbiter handle**- Code that is included in the UpdateAgent binary. The arbiter gathers information about the device, and uses the CompDB(s) to output an action list. It is responsible for determining the final "composition state" of your device, and which payloads (like ESDs or packages) are needed to get your device up to date.
-- **Deployment Arbiter**- A deployment manager that calls different installers. For example, CBS.
-
-Additional components include the following-
-
-- **CompDB** – A generic term to refer to the XML describing information about target build composition, available diff packages, and conditional rules.
-- **Action List** – The payload and additional information needed to perform an update. The action list is consumed by the UpdateAgent, as well as other installers to determine what payload to download. It's also consumed by the "Install Agent" to determine what actions need to be taken, such as installing or removing packages.
+---
+title: Get started with Windows Update
+description: Learn how Windows Update works, including architecture and troubleshooting
+ms.prod: w10
+ms.mktglfcycl:
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationprioauthor: jaimeo
+ms.audience: itpro
+author: jaimeo
+ms.date: 09/18/2018
+ms.reviewer:
+manager: laurawi
+ms.topic: article
+---
+
+# Get started with Windows Update
+
+>Applies to: Windows 10
+
+With the release of Windows 10, we moved the update model to the Unified Update Platform. Unified Update Platform (UUP) is a single publishing, hosting, scan and download model for all types of OS updates, desktop and mobile for all Windows-based operating systems, for everything from monthly quality updates to new feature updates.
+
+Ues the following information to get started with Windows Update:
+
+- Understand the UUP architecture
+- Understand [how Windows Update works](how-windows-update-works.md)
+- Find [Windows Update log files](windows-update-logs.md)
+- Learn how to [troubleshoot Windows Update](windows-update-troubleshooting.md)
+- Review [common Windows Update errors](windows-update-errors.md) and check out the [error code reference](windows-update-error-reference.md)
+- Review [other resources](windows-update-resources.md) to help you use Windows Update
+
+## Unified Update Platform (UUP) architecture
+To understand the changes to the Windows Update architecture that UUP introduces let's start with some new key terms.
+
+
+
+- **Update UI** – The user interface to initiate Windows Update check and history. Available under **Settings --> Update & Security --> Windows Update**.
+- **Update Session Orchestrator (USO)**- A Windows OS component that orchestrates the sequence of downloading and installing various update types from Windows Update.
+
+ Update types-
+ - OS Feature updates
+ - OS Security updates
+ - Device drivers
+ - Defender definition updates
+
+ >[!NOTE]
+ > Other types of updates, like Office desktop updates, are installed if the user opts into Microsoft Update.
+ >
+ >Store apps aren't installed by USO, today they are separate.
+
+- **WU Client/ UpdateAgent** - The component running on your PC. It's essentially a DLL that is downloaded to the device when an update is applicable. It surfaces the APIs needed to perform an update, including those needed to generate a list of payloads to download, as well as starts stage and commit operations. It provides a unified interface that abstracts away the underlying update technologies from the caller.
+- **WU Arbiter handle**- Code that is included in the UpdateAgent binary. The arbiter gathers information about the device, and uses the CompDB(s) to output an action list. It is responsible for determining the final "composition state" of your device, and which payloads (like ESDs or packages) are needed to get your device up to date.
+- **Deployment Arbiter**- A deployment manager that calls different installers. For example, CBS.
+
+Additional components include the following-
+
+- **CompDB** – A generic term to refer to the XML describing information about target build composition, available diff packages, and conditional rules.
+- **Action List** – The payload and additional information needed to perform an update. The action list is consumed by the UpdateAgent, as well as other installers to determine what payload to download. It's also consumed by the "Install Agent" to determine what actions need to be taken, such as installing or removing packages.
diff --git a/windows/deployment/update/windows-update-resources.md b/windows/deployment/update/windows-update-resources.md
index ead5fd7aaf..16e2488d65 100644
--- a/windows/deployment/update/windows-update-resources.md
+++ b/windows/deployment/update/windows-update-resources.md
@@ -3,12 +3,12 @@ title: Windows Update - Additional resources
description: Additional resources for Windows Update
ms.prod: w10
ms.mktglfcycl:
-ms.sitesec: library
+
audience: itpro
-author: greg-lindsay
+author: jaimeo
ms.localizationpriority: medium
ms.audience: itpro
-author: greg-lindsay
+author: jaimeo
ms.date: 09/18/2018
ms.reviewer:
manager: laurawi
diff --git a/windows/deployment/update/windows-update-troubleshooting.md b/windows/deployment/update/windows-update-troubleshooting.md
index ac0087fb59..a1784e6a6e 100644
--- a/windows/deployment/update/windows-update-troubleshooting.md
+++ b/windows/deployment/update/windows-update-troubleshooting.md
@@ -1,217 +1,218 @@
----
-title: Windows Update troubleshooting
-description: Learn how to troubleshoot Windows Update
-ms.prod: w10
-ms.mktglfcycl:
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.audience: itpro
author: greg-lindsay
-ms.date: 09/18/2018
-ms.reviewer:
-manager: laurawi
-ms.topic: article
----
-
-# Windows Update troubleshooting
-
->Applies to: Windows 10
-
-If you run into problems when using Windows Update, start with the following steps:
-
-1. Run the built-in Windows Update troubleshooter to fix common issues. Navigate to **Settings > Update & Security > Troubleshoot > Windows Update**.
-2. Install the most recent Servicing Stack Update (SSU) that matches your version of Windows from the Microsoft Update Catalog. See [Servicing stack updates](servicing-stack-updates.md) for more details on SSU.
-3. Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update history for your system:
-
- - [Windows 10, version 1809 and Windows Server 2019](https://support.microsoft.com/help/4464619/windows-10-update-history)
- - [Windows 10, version 1803](https://support.microsoft.com/help/4099479/windows-10-update-history)
- - [Windows 10, version 1709](https://support.microsoft.com/help/4043454)
- - [Windows 10, version 1703](https://support.microsoft.com/help/4018124)
- - [Windows 10 and Windows Server 2016](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history)
- - [Windows 8.1 and Windows Server 2012 R2](https://support.microsoft.com/help/4009470/windows-8-1-windows-server-2012-r2-update-history)
- - [Windows Server 2012](https://support.microsoft.com/help/4009471/windows-server-2012-update-history)
- - [Windows 7 SP1 and Windows Server 2008 R2 SP1](https://support.microsoft.com/help/4009469/windows-7-sp1-windows-server-2008-r2-sp1-update-history)
-
-Advanced users can also refer to the [log](windows-update-logs.md) generated by Windows Update for further investigation.
-
-You might encounter the following scenarios when using Windows Update.
-
-## Why am I offered an older update/upgrade?
-The update that is offered to a device depends on several factors. Some of the most common attributes include the following:
-
-- OS Build
-- OS Branch
-- OS Locale
-- OS Architecture
-- Device update management configuration
-
-If the update you're offered isn't the most current available, it might be because your device is being managed by a WSUS server, and you're being offered the updates available on that server. It's also possible, if your device is part of a Windows as a Service deployment ring, that your admin is intentionally slowing the rollout of updates. Since the WaaS rollout is slow and measured to begin with, all devices will not receive the update on the same day.
-
-## My machine is frozen at scan. Why?
-The Settings UI is talking to the Update Orchestrator service which in turn is talking to Windows Update service. If these services stop unexpectedly then you might see this behavior. In such cases, do the following:
-1. Close the Settings app and reopen it.
-2. Launch Services.msc and check if the following services are running:
- - Update State Orchestrator
- - Windows Update
-
-## Feature updates are not being offered while other updates are
-On computers running [Windows 10 1709 or higher](#BKMK_DCAT) configured to update from Windows Update (usually WUfB scenario) servicing and definition updates are being installed successfully, but feature updates are never offered.
-
-Checking the WindowsUpdate.log reveals the following error:
-```
-YYYY/MM/DD HH:mm:ss:SSS PID TID Agent * START * Finding updates CallerId = Update;taskhostw Id = 25
-YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Online = Yes; Interactive = No; AllowCachedResults = No; Ignore download priority = No
-YYYY/MM/DD HH:mm:ss:SSS PID TID Agent ServiceID = {855E8A7C-ECB4-4CA3-B045-1DFA50104289} Third party service
-YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Search Scope = {Current User}
-YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Caller SID for Applicability: S-1-12-1-2933642503-1247987907-1399130510-4207851353
-YYYY/MM/DD HH:mm:ss:SSS PID TID Misc Got 855E8A7C-ECB4-4CA3-B045-1DFA50104289 redir Client/Server URL: https://fe3.delivery.mp.microsoft.com/ClientWebService/client.asmx""
-YYYY/MM/DD HH:mm:ss:SSS PID TID Misc Token Requested with 0 category IDs.
-YYYY/MM/DD HH:mm:ss:SSS PID TID Misc GetUserTickets: No user tickets found. Returning WU_E_NO_USERTOKEN.
-YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [AuthTicketHelper::GetDeviceTickets:570]
-YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [AuthTicketHelper::GetDeviceTickets:570]
-YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] GetDeviceTickets
-YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [AuthTicketHelper::AddTickets:1092]
-YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [CUpdateEndpointProvider::GenerateSecurityTokenWithAuthTickets:1587]
-YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] GetAgentTokenFromServer
-YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] GetAgentToken
-YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] EP:Call to GetEndpointToken
-YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Failed to obtain service 855E8A7C-ECB4-4CA3-B045-1DFA50104289 plugin Client/Server auth token of type 0x00000001
-YYYY/MM/DD HH:mm:ss:SSS PID TID ProtocolTalker *FAILED* [80070426] Method failed [CAgentProtocolTalkerContext::DetermineServiceEndpoint:377]
-YYYY/MM/DD HH:mm:ss:SSS PID TID ProtocolTalker *FAILED* [80070426] Initialization failed for Protocol Talker Context
-YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Exit code = 0x80070426
-YYYY/MM/DD HH:mm:ss:SSS PID TID Agent * END * Finding updates CallerId = Update;taskhostw Id = 25
-```
-
-The 0x80070426 error code translates to:
-```
-ERROR_SERVICE_NOT_ACTIVE - # The service has not been started.
-```
-
-Microsoft Account Sign In Assistant (MSA or wlidsvc) is the service in question. The DCAT Flighting service (ServiceId: 855E8A7C-ECB4-4CA3-B045-1DFA50104289) relies on the Microsoft Account Sign In Assistant (MSA) to get the Global Device ID for the device. Without the MSA service running, the global device ID will not be generated and sent by the client and the search for feature updates never completes successfully.
-
-In order to solve this issue, we need to reset the MSA service to the default StartType of manual.
-
-## Issues related to HTTP/Proxy
-Windows Update uses WinHttp with Partial Range requests (RFC 7233) to download updates and applications from Windows Update servers or on-premises WSUS servers. Because of this proxy servers configured on the network must support HTTP RANGE requests. If a proxy was configured in Internet Explorer (User level) but not in WinHTTP (System level), connections to Windows Update will fail.
-
-To fix this issue, configure a proxy in WinHTTP by using the following netsh command:
-
-```
-netsh winhttp set proxy ProxyServerName:PortNumber
-```
-
->[!NOTE]
-> You can also import the proxy settings from Internet Explorer by using the following command: netsh winhttp import proxy source=ie
-
-If downloads through a proxy server fail with a 0x80d05001 DO_E_HTTP_BLOCKSIZE_MISMATCH error, or if you notice high CPU usage while updates are downloading, check the proxy configuration to permit HTTP RANGE requests to run.
-
-You may choose to apply a rule to permit HTTP RANGE requests for the following URLs:
-
-*.download.windowsupdate.com
-*.dl.delivery.mp.microsoft.com
-*.emdl.ws.microsoft.com
-
-If you cannot permit RANGE requests, keep in mind that this means you are downloading more content than needed in updates (as delta patching will not work).
-
-
-## The update is not applicable to your computer
-The most common reasons for this error are described in the following table:
-
-|Cause|Explanation|Resolution|
-|-----|-----------|----------|
-|Update is superseded|As updates for a component are released, the updated component will supersede an older component that is already on the system. When this occurs, the previous update is marked as superseded. If the update that you're trying to install already has a newer version of the payload on your system, you may encounter this error message.|Check that the package that you are installing contains newer versions of the binaries. Or, check that the package is superseded by another new package. |
-|Update is already installed|If the update that you're trying to install was previously installed, for example, by another update that carried the same payload, you may encounter this error message.|Verify that the package that you are trying to install was not previously installed.|
-|Wrong update for architecture|Updates are published by CPU architecture. If the update that you're trying to install does not match the architecture for your CPU, you may encounter this error message. |Verify that the package that you're trying to install matches the Windows version that you are using. The Windows version information can be found in the "Applies To" section of the article for each update. For example, Windows Server 2012-only updates cannot be installed on Windows Server 2012 R2-based computers. Also, verify that the package that you are installing matches the processor architecture of the Windows version that you are using. For example, an x86-based update cannot be installed on x64-based installations of Windows. |
-|Missing prerequisite update|Some updates require a prerequisite update before they can be applied to a system. If you are missing a prerequisite update, you may encounter this error message. For example, KB 2919355 must be installed on Windows 8.1 and Windows Server 2012 R2 computers before many of the updates that were released after April 2014 can be installed.|Check the related articles about the package in the Microsoft Knowledge Base (KB) to make sure that you have the prerequisite updates installed. For example, if you encounter the error message on Windows 8.1 or Windows Server 2012 R2, you may have to install the April 2014 update 2919355 as a prerequisite and one or more pre-requisite servicing updates (KB 2919442 and KB 3173424). Note: To determine if these prerequisite updates are installed, run the following PowerShell command: get-hotfix KB3173424,KB2919355,KB2919442 If the updates are installed, the command will return the installed date in the "InstalledOn" section of the output.
-
-## Issues related to firewall configuration
-Error that may be seen in the WU logs:
-```
-DownloadManager Error 0x800706d9 occurred while downloading update; notifying dependent calls.
-```
-Or
-```
-[DownloadManager] BITS job {A4AC06DD-D6E6-4420-8720-7407734FDAF2} hit a transient error, updateId = {D053C08A-6250-4C43-A111-56C5198FE142}.200 , error = 0x800706D9
-```
-Or
-```
-DownloadManager [0]12F4.1FE8::09/29/2017-13:45:08.530 [agent]DO job {C6E2F6DC-5B78-4608-B6F1-0678C23614BD} hit a transient error, updateId = 5537BD35-BB74-40B2-A8C3-B696D3C97CBA.201 , error = 0x80D0000A
-```
-
-Go to Services.msc and ensure that Windows Firewall Service is enabled. Stopping the service associated with Windows Firewall with Advanced Security is not supported by Microsoft. For more information, see [I need to disable Windows Firewall](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc766337(v=ws.10)).
-
-## Issues arising from configuration of conflicting policies
-Windows Update provides a wide range configuration policies to control the behavior of WU service in a managed environment. While these policies let you configure the settings at a granular level, misconfiguration or setting conflicting polices may lead to unexpected behaviors.
-
-See [How to configure automatic updates by using Group Policy or registry settings](https://support.microsoft.com/help/328010/how-to-configure-automatic-updates-by-using-group-policy-or-registry-s) for more information.
-
-
-## Updates aren't downloading from the intranet endpoint (WSUS/SCCM)
-Windows 10 devices can receive updates from a variety of sources, including Windows Update online, a Windows Server Update Services server, and others. To determine the source of Windows Updates currently being used on a device, follow these steps:
-1. Start Windows PowerShell as an administrator
-2. Run \$MUSM = New-Object -ComObject "Microsoft.Update.ServiceManager".
-3. Run \$MUSM.Services.
-
-Check the output for the Name and OffersWindowsUPdates parameters, which you can interpret according to this table.
-
-|Output|Interpretation|
-|-|-|
-|- Name: Microsoft Update -OffersWindowsUpdates: True| - The update source is Microsoft Update, which means that updates for other Microsoft products besides the operating system could also be delivered. - Indicates that the client is configured to receive updates for all Microsoft Products (Office, etc.) |
-|- Name: DCat Flighting Prod - OffersWindowsUpdates: True |- Starting with Windows 10 1709, feature updates are always delivered through the DCAT service. - Indicates that the client is configured to receive feature updates from Windows Update. |
-|- Name: Windows Store (DCat Prod) - OffersWindowsUpdates: False |-The update source is Insider Updates for Store Apps. - Indicates that the client will not receive or is not configured to receive these updates.|
-|- Name: Windows Server Update Service - OffersWindowsUpdates: True |- The source is a Windows Server Updates Services server. - The client is configured to receive updates from WSUS. |
-|- Name: Windows Update - OffersWindowsUpdates: True|- The source is Windows Update. - The client is configured to receive updates from Windows Update Online.|
-
-## You have a bad setup in the environment
-If we look at the GPO being set through registry, the system is configured to use WSUS to download updates:
-
-```
-HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
-"UseWUServer"=dword:00000001 ===================================> it says use WSUS server.
-```
-
-From the WU logs:
-```
-2018-08-06 09:33:31:085 480 1118 Agent ** START ** Agent: Finding updates [CallerId = OperationalInsight Id = 49]
-2018-08-06 09:33:31:085 480 1118 Agent *********
-2018-08-06 09:33:31:085 480 1118 Agent * Include potentially superseded updates
-2018-08-06 09:33:31:085 480 1118 Agent * Online = No; Ignore download priority = No
-2018-08-06 09:33:31:085 480 1118 Agent * Criteria = "IsHidden = 0 AND DeploymentAction=*"
-2018-08-06 09:33:31:085 480 1118 Agent * ServiceID = {00000000-0000-0000-0000-000000000000} Third party service
-2018-08-06 09:33:31:085 480 1118 Agent * Search Scope = {Machine}
-2018-08-06 09:33:32:554 480 1118 Agent * Found 83 updates and 83 categories in search; evaluated appl. rules of 517 out of 1473 deployed entities
-2018-08-06 09:33:32:554 480 1118 Agent *********
-2018-08-06 09:33:32:554 480 1118 Agent ** END ** Agent: Finding updates [CallerId = OperationalInsight Id = 49]
-```
-
-In the above log snippet, we see that the Criteria = "IsHidden = 0 AND DeploymentAction=*". "*" means there is nothing specified from the server. So, the scan happens but there is no direction to download or install to the agent. So it just scans the update and provides the results.
-
-Now if you look at the below logs, the Automatic update runs the scan and finds no update approved for it. So it reports there are 0 updates to install or download. This is due to bad setup or configuration in the environment. The WSUS side should approve the patches for WU so that it fetches the updates and installs it on the specified time according to the policy. Since this scenario doesn't include SCCM, there's no way to install unapproved updates. And that is the problem you are facing. You expect that the scan should be done by the operational insight agent and automatically trigger download and install but that won’t happen here.
-
-```
-2018-08-06 10:58:45:992 480 5d8 Agent ** START ** Agent: Finding updates [CallerId = AutomaticUpdates Id = 57]
-2018-08-06 10:58:45:992 480 5d8 Agent *********
-2018-08-06 10:58:45:992 480 5d8 Agent * Online = Yes; Ignore download priority = No
-2018-08-06 10:58:45:992 480 5d8 Agent * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
-
-2018-08-06 10:58:46:617 480 5d8 PT + SyncUpdates round trips: 2
-2018-08-06 10:58:47:383 480 5d8 Agent * Found 0 updates and 83 categories in search; evaluated appl. rules of 617 out of 1473 deployed entities
-2018-08-06 10:58:47:383 480 5d8 Agent Reporting status event with 0 installable, 83 installed, 0 installed pending, 0 failed and 0 downloaded updates
-2018-08-06 10:58:47:383 480 5d8 Agent *********
-2018-08-06 10:58:47:383 480 5d8 Agent ** END ** Agent: Finding updates [CallerId = AutomaticUpdates Id = 57]
-```
-
-## High bandwidth usage on Windows 10 by Windows Update
-Users may see that Windows 10 is consuming all the bandwidth in the different offices under the system context. This behavior is by design. Components that may consume bandwidth expand beyond Windows Update components.
-
-The following group policies can help mitigate this:
-
-- Blocking access to Windows Update servers: [Policy Turn off access to all Windows Update features](http://gpsearch.azurewebsites.net/#4728) (Set to enabled)
-- Driver search: [Policy Specify search order for device driver source locations](http://gpsearch.azurewebsites.net/#183) (Set to "Do not search Windows Update")
-- Windows Store automatic update: [Policy Turn off Automatic Download and Install of updates](http://gpsearch.azurewebsites.net/#10876) (Set to enabled)
-
-Other components that reach out to the internet:
-
-- Windows Spotlight: [Policy Configure Windows spotlight on lock screen](http://gpsearch.azurewebsites.net/#13362) (Set to disabled)
-- Consumer experiences: [Policy Turn off Microsoft consumer experiences](http://gpsearch.azurewebsites.net/#13329) (Set to enabled)
-- Background traffic from Windows apps: [Policy Let Windows apps run in the background](http://gpsearch.azurewebsites.net/#13571)
+---
+title: Windows Update troubleshooting
+description: Learn how to troubleshoot Windows Update
+ms.prod: w10
+ms.mktglfcycl:
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationprioauthor: jaimeo
+ms.audience: itpro
+author: jaimeo
+ms.reviewer:
+manager: laurawi
+ms.topic: article
+---
+
+# Windows Update troubleshooting
+
+>Applies to: Windows 10
+
+If you run into problems when using Windows Update, start with the following steps:
+
+1. Run the built-in Windows Update troubleshooter to fix common issues. Navigate to **Settings > Update & Security > Troubleshoot > Windows Update**.
+2. Install the most recent Servicing Stack Update (SSU) that matches your version of Windows from the Microsoft Update Catalog. See [Servicing stack updates](servicing-stack-updates.md) for more details on SSU.
+3. Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update history for your system:
+
+ - [Windows 10, version 1809 and Windows Server 2019](https://support.microsoft.com/help/4464619/windows-10-update-history)
+ - [Windows 10, version 1803](https://support.microsoft.com/help/4099479/windows-10-update-history)
+ - [Windows 10, version 1709](https://support.microsoft.com/help/4043454)
+ - [Windows 10, version 1703](https://support.microsoft.com/help/4018124)
+ - [Windows 10 and Windows Server 2016](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history)
+ - [Windows 8.1 and Windows Server 2012 R2](https://support.microsoft.com/help/4009470/windows-8-1-windows-server-2012-r2-update-history)
+ - [Windows Server 2012](https://support.microsoft.com/help/4009471/windows-server-2012-update-history)
+ - [Windows 7 SP1 and Windows Server 2008 R2 SP1](https://support.microsoft.com/help/4009469/windows-7-sp1-windows-server-2008-r2-sp1-update-history)
+
+Advanced users can also refer to the [log](windows-update-logs.md) generated by Windows Update for further investigation.
+
+You might encounter the following scenarios when using Windows Update.
+
+## Why am I offered an older update/upgrade?
+The update that is offered to a device depends on several factors. Some of the most common attributes include the following:
+
+- OS Build
+- OS Branch
+- OS Locale
+- OS Architecture
+- Device update management configuration
+
+If the update you're offered isn't the most current available, it might be because your device is being managed by a WSUS server, and you're being offered the updates available on that server. It's also possible, if your device is part of a Windows as a Service deployment ring, that your admin is intentionally slowing the rollout of updates. Since the WaaS rollout is slow and measured to begin with, all devices will not receive the update on the same day.
+
+## My machine is frozen at scan. Why?
+The Settings UI is talking to the Update Orchestrator service which in turn is talking to Windows Update service. If these services stop unexpectedly then you might see this behavior. In such cases, do the following:
+1. Close the Settings app and reopen it.
+2. Launch Services.msc and check if the following services are running:
+ - Update State Orchestrator
+ - Windows Update
+
+## Feature updates are not being offered while other updates are
+On computers running [Windows 10 1709 or higher](#BKMK_DCAT) configured to update from Windows Update (usually WUfB scenario) servicing and definition updates are being installed successfully, but feature updates are never offered.
+
+Checking the WindowsUpdate.log reveals the following error:
+```
+YYYY/MM/DD HH:mm:ss:SSS PID TID Agent * START * Finding updates CallerId = Update;taskhostw Id = 25
+YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Online = Yes; Interactive = No; AllowCachedResults = No; Ignore download priority = No
+YYYY/MM/DD HH:mm:ss:SSS PID TID Agent ServiceID = {855E8A7C-ECB4-4CA3-B045-1DFA50104289} Third party service
+YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Search Scope = {Current User}
+YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Caller SID for Applicability: S-1-12-1-2933642503-1247987907-1399130510-4207851353
+YYYY/MM/DD HH:mm:ss:SSS PID TID Misc Got 855E8A7C-ECB4-4CA3-B045-1DFA50104289 redir Client/Server URL: https://fe3.delivery.mp.microsoft.com/ClientWebService/client.asmx""
+YYYY/MM/DD HH:mm:ss:SSS PID TID Misc Token Requested with 0 category IDs.
+YYYY/MM/DD HH:mm:ss:SSS PID TID Misc GetUserTickets: No user tickets found. Returning WU_E_NO_USERTOKEN.
+YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [AuthTicketHelper::GetDeviceTickets:570]
+YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [AuthTicketHelper::GetDeviceTickets:570]
+YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] GetDeviceTickets
+YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [AuthTicketHelper::AddTickets:1092]
+YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Method failed [CUpdateEndpointProvider::GenerateSecurityTokenWithAuthTickets:1587]
+YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] GetAgentTokenFromServer
+YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] GetAgentToken
+YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] EP:Call to GetEndpointToken
+YYYY/MM/DD HH:mm:ss:SSS PID TID Misc *FAILED* [80070426] Failed to obtain service 855E8A7C-ECB4-4CA3-B045-1DFA50104289 plugin Client/Server auth token of type 0x00000001
+YYYY/MM/DD HH:mm:ss:SSS PID TID ProtocolTalker *FAILED* [80070426] Method failed [CAgentProtocolTalkerContext::DetermineServiceEndpoint:377]
+YYYY/MM/DD HH:mm:ss:SSS PID TID ProtocolTalker *FAILED* [80070426] Initialization failed for Protocol Talker Context
+YYYY/MM/DD HH:mm:ss:SSS PID TID Agent Exit code = 0x80070426
+YYYY/MM/DD HH:mm:ss:SSS PID TID Agent * END * Finding updates CallerId = Update;taskhostw Id = 25
+```
+
+The 0x80070426 error code translates to:
+```
+ERROR_SERVICE_NOT_ACTIVE - # The service has not been started.
+```
+
+Microsoft Account Sign In Assistant (MSA or wlidsvc) is the service in question. The DCAT Flighting service (ServiceId: 855E8A7C-ECB4-4CA3-B045-1DFA50104289) relies on the Microsoft Account Sign In Assistant (MSA) to get the Global Device ID for the device. Without the MSA service running, the global device ID will not be generated and sent by the client and the search for feature updates never completes successfully.
+
+In order to solve this issue, we need to reset the MSA service to the default StartType of manual.
+
+## Issues related to HTTP/Proxy
+Windows Update uses WinHttp with Partial Range requests (RFC 7233) to download updates and applications from Windows Update servers or on-premises WSUS servers. Because of this proxy servers configured on the network must support HTTP RANGE requests. If a proxy was configured in Internet Explorer (User level) but not in WinHTTP (System level), connections to Windows Update will fail.
+
+To fix this issue, configure a proxy in WinHTTP by using the following netsh command:
+
+```
+netsh winhttp set proxy ProxyServerName:PortNumber
+```
+
+>[!NOTE]
+> You can also import the proxy settings from Internet Explorer by using the following command: netsh winhttp import proxy source=ie
+
+If downloads through a proxy server fail with a 0x80d05001 DO_E_HTTP_BLOCKSIZE_MISMATCH error, or if you notice high CPU usage while updates are downloading, check the proxy configuration to permit HTTP RANGE requests to run.
+
+You may choose to apply a rule to permit HTTP RANGE requests for the following URLs:
+
+*.download.windowsupdate.com
+*.dl.delivery.mp.microsoft.com
+*.emdl.ws.microsoft.com
+
+If you cannot permit RANGE requests, keep in mind that this means you are downloading more content than needed in updates (as delta patching will not work).
+
+
+## The update is not applicable to your computer
+The most common reasons for this error are described in the following table:
+
+|Cause|Explanation|Resolution|
+|-----|-----------|----------|
+|Update is superseded|As updates for a component are released, the updated component will supersede an older component that is already on the system. When this occurs, the previous update is marked as superseded. If the update that you're trying to install already has a newer version of the payload on your system, you may encounter this error message.|Check that the package that you are installing contains newer versions of the binaries. Or, check that the package is superseded by another new package. |
+|Update is already installed|If the update that you're trying to install was previously installed, for example, by another update that carried the same payload, you may encounter this error message.|Verify that the package that you are trying to install was not previously installed.|
+|Wrong update for architecture|Updates are published by CPU architecture. If the update that you're trying to install does not match the architecture for your CPU, you may encounter this error message. |Verify that the package that you're trying to install matches the Windows version that you are using. The Windows version information can be found in the "Applies To" section of the article for each update. For example, Windows Server 2012-only updates cannot be installed on Windows Server 2012 R2-based computers. Also, verify that the package that you are installing matches the processor architecture of the Windows version that you are using. For example, an x86-based update cannot be installed on x64-based installations of Windows. |
+|Missing prerequisite update|Some updates require a prerequisite update before they can be applied to a system. If you are missing a prerequisite update, you may encounter this error message. For example, KB 2919355 must be installed on Windows 8.1 and Windows Server 2012 R2 computers before many of the updates that were released after April 2014 can be installed.|Check the related articles about the package in the Microsoft Knowledge Base (KB) to make sure that you have the prerequisite updates installed. For example, if you encounter the error message on Windows 8.1 or Windows Server 2012 R2, you may have to install the April 2014 update 2919355 as a prerequisite and one or more pre-requisite servicing updates (KB 2919442 and KB 3173424). Note: To determine if these prerequisite updates are installed, run the following PowerShell command: get-hotfix KB3173424,KB2919355,KB2919442 If the updates are installed, the command will return the installed date in the "InstalledOn" section of the output.
+
+## Issues related to firewall configuration
+Error that may be seen in the WU logs:
+```
+DownloadManager Error 0x800706d9 occurred while downloading update; notifying dependent calls.
+```
+Or
+```
+[DownloadManager] BITS job {A4AC06DD-D6E6-4420-8720-7407734FDAF2} hit a transient error, updateId = {D053C08A-6250-4C43-A111-56C5198FE142}.200 , error = 0x800706D9
+```
+Or
+```
+DownloadManager [0]12F4.1FE8::09/29/2017-13:45:08.530 [agent]DO job {C6E2F6DC-5B78-4608-B6F1-0678C23614BD} hit a transient error, updateId = 5537BD35-BB74-40B2-A8C3-B696D3C97CBA.201 , error = 0x80D0000A
+```
+
+Go to Services.msc and ensure that Windows Firewall Service is enabled. Stopping the service associated with Windows Firewall with Advanced Security is not supported by Microsoft. For more information, see [I need to disable Windows Firewall](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc766337(v=ws.10)).
+
+## Issues arising from configuration of conflicting policies
+Windows Update provides a wide range configuration policies to control the behavior of WU service in a managed environment. While these policies let you configure the settings at a granular level, misconfiguration or setting conflicting polices may lead to unexpected behaviors.
+
+See [How to configure automatic updates by using Group Policy or registry settings](https://support.microsoft.com/help/328010/how-to-configure-automatic-updates-by-using-group-policy-or-registry-s) for more information.
+
+
+## Updates aren't downloading from the intranet endpoint (WSUS/SCCM)
+Windows 10 devices can receive updates from a variety of sources, including Windows Update online, a Windows Server Update Services server, and others. To determine the source of Windows Updates currently being used on a device, follow these steps:
+1. Start Windows PowerShell as an administrator
+2. Run \$MUSM = New-Object -ComObject "Microsoft.Update.ServiceManager".
+3. Run \$MUSM.Services.
+
+Check the output for the Name and OffersWindowsUPdates parameters, which you can interpret according to this table.
+
+|Output|Interpretation|
+|-|-|
+|- Name: Microsoft Update -OffersWindowsUpdates: True| - The update source is Microsoft Update, which means that updates for other Microsoft products besides the operating system could also be delivered. - Indicates that the client is configured to receive updates for all Microsoft Products (Office, etc.) |
+|- Name: DCat Flighting Prod - OffersWindowsUpdates: True |- Starting with Windows 10 1709, feature updates are always delivered through the DCAT service. - Indicates that the client is configured to receive feature updates from Windows Update. |
+|- Name: Windows Store (DCat Prod) - OffersWindowsUpdates: False |-The update source is Insider Updates for Store Apps. - Indicates that the client will not receive or is not configured to receive these updates.|
+|- Name: Windows Server Update Service - OffersWindowsUpdates: True |- The source is a Windows Server Updates Services server. - The client is configured to receive updates from WSUS. |
+|- Name: Windows Update - OffersWindowsUpdates: True|- The source is Windows Update. - The client is configured to receive updates from Windows Update Online.|
+
+## You have a bad setup in the environment
+If we look at the GPO being set through registry, the system is configured to use WSUS to download updates:
+
+```
+HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
+"UseWUServer"=dword:00000001 ===================================> it says use WSUS server.
+```
+
+From the WU logs:
+```
+2018-08-06 09:33:31:085 480 1118 Agent ** START ** Agent: Finding updates [CallerId = OperationalInsight Id = 49]
+2018-08-06 09:33:31:085 480 1118 Agent *********
+2018-08-06 09:33:31:085 480 1118 Agent * Include potentially superseded updates
+2018-08-06 09:33:31:085 480 1118 Agent * Online = No; Ignore download priority = No
+2018-08-06 09:33:31:085 480 1118 Agent * Criteria = "IsHidden = 0 AND DeploymentAction=*"
+2018-08-06 09:33:31:085 480 1118 Agent * ServiceID = {00000000-0000-0000-0000-000000000000} Third party service
+2018-08-06 09:33:31:085 480 1118 Agent * Search Scope = {Machine}
+2018-08-06 09:33:32:554 480 1118 Agent * Found 83 updates and 83 categories in search; evaluated appl. rules of 517 out of 1473 deployed entities
+2018-08-06 09:33:32:554 480 1118 Agent *********
+2018-08-06 09:33:32:554 480 1118 Agent ** END ** Agent: Finding updates [CallerId = OperationalInsight Id = 49]
+```
+
+In the above log snippet, we see that the Criteria = "IsHidden = 0 AND DeploymentAction=*". "*" means there is nothing specified from the server. So, the scan happens but there is no direction to download or install to the agent. So it just scans the update and provides the results.
+
+Now if you look at the below logs, the Automatic update runs the scan and finds no update approved for it. So it reports there are 0 updates to install or download. This is due to bad setup or configuration in the environment. The WSUS side should approve the patches for WU so that it fetches the updates and installs it on the specified time according to the policy. Since this scenario doesn't include SCCM, there's no way to install unapproved updates. And that is the problem you are facing. You expect that the scan should be done by the operational insight agent and automatically trigger download and install but that won’t happen here.
+
+```
+2018-08-06 10:58:45:992 480 5d8 Agent ** START ** Agent: Finding updates [CallerId = AutomaticUpdates Id = 57]
+2018-08-06 10:58:45:992 480 5d8 Agent *********
+2018-08-06 10:58:45:992 480 5d8 Agent * Online = Yes; Ignore download priority = No
+2018-08-06 10:58:45:992 480 5d8 Agent * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
+
+2018-08-06 10:58:46:617 480 5d8 PT + SyncUpdates round trips: 2
+2018-08-06 10:58:47:383 480 5d8 Agent * Found 0 updates and 83 categories in search; evaluated appl. rules of 617 out of 1473 deployed entities
+2018-08-06 10:58:47:383 480 5d8 Agent Reporting status event with 0 installable, 83 installed, 0 installed pending, 0 failed and 0 downloaded updates
+2018-08-06 10:58:47:383 480 5d8 Agent *********
+2018-08-06 10:58:47:383 480 5d8 Agent ** END ** Agent: Finding updates [CallerId = AutomaticUpdates Id = 57]
+```
+
+## High bandwidth usage on Windows 10 by Windows Update
+Users may see that Windows 10 is consuming all the bandwidth in the different offices under the system context. This behavior is by design. Components that may consume bandwidth expand beyond Windows Update components.
+
+The following group policies can help mitigate this:
+
+- Blocking access to Windows Update servers: [Policy Turn off access to all Windows Update features](http://gpsearch.azurewebsites.net/#4728) (Set to enabled)
+- Driver search: [Policy Specify search order for device driver source locations](http://gpsearch.azurewebsites.net/#183) (Set to "Do not search Windows Update")
+- Windows Store automatic update: [Policy Turn off Automatic Download and Install of updates](http://gpsearch.azurewebsites.net/#10876) (Set to enabled)
+
+Other components that reach out to the internet:
+
+- Windows Spotlight: [Policy Configure Windows spotlight on lock screen](http://gpsearch.azurewebsites.net/#13362) (Set to disabled)
+- Consumer experiences: [Policy Turn off Microsoft consumer experiences](http://gpsearch.azurewebsites.net/#13329) (Set to enabled)
+- Background traffic from Windows apps: [Policy Let Windows apps run in the background](http://gpsearch.azurewebsites.net/#13571)
diff --git a/windows/deployment/update/wufb-autoupdate.md b/windows/deployment/update/wufb-autoupdate.md
index 9bdabe44ba..0d7b34374e 100644
--- a/windows/deployment/update/wufb-autoupdate.md
+++ b/windows/deployment/update/wufb-autoupdate.md
@@ -1,37 +1,39 @@
----
-title: Setting up Automatic Update in Windows Update for Business (Windows 10)
-description: Learn how to get started using Windows Update for Business.
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.audience: itpro
author: greg-lindsay
-ms.date: 06/20/2018
-ms.reviewer:
-manager: laurawi
-ms.topic: article
----
-
-# Set up Automatic Update in Windows Update for Business with group policies
-
->Applies to: Windows 10
-
-Use the Automatic Update group policies to manage the interaction between Windows Update and clients.
-
-Automatic Update governs the "behind the scenes" download and installation processes. It's important to keep in mind the device limitation in your environment as the download and install process can consume processing power. The below section outlines the ideal configuration for devices with the least amount of user experience degradation.
-
-|Policy|Description |
-|-|-|
-|Configure Automatic Updates|Governs the installation activity that happens in the background. This allows you to configure the installation to happen during the [maintenance window](https://docs.microsoft.com/sccm/core/clients/manage/collections/use-maintenance-windows). Also, you can specify an installation time where the device will also try to install the latest packages. You can also pick a certain day and or week.|
-|Automatic Update Detection Frequency|Lets you set the scan frequency the device will use to connect to Windows Update to see if there is any available content. Default is 22 hours, but you can increase or decrease the frequency. Keep in mind a desktop computer may need to scan less frequently than laptops, which can have intermittent internet connection.|
-|Specify Intranet Microsoft Update Service Location|Used for Windows Server Update Services or System Center Configuration Manager users who want to install custom packages that are not offered through Windows Update.|
-|Do not connect to any Windows Update Internet locations Required for Dual Scan|Prevents access to Windows Update.|
-
-## Suggested configuration
-
-|Policy|Location|Suggested configuration|
-|-|-|-|
-|Configure Automatic Updates| GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates| **Attention**: If you are using this policy, don't set it/configure it to get the default behavior. If you have set this policy, delete the reg key. This ensures the device uses the default behavior. Note that this is not the same as the default setting within the policy. **Default behavior**: Download and installation happen automatically. The device will then be in a pending reboot state. **Pro tip**: You can configure the scan frequency to be more frequent with the policy below.|
-|Automatic Update Detection Frequency|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Automatic Updates detection frequency|State: Enabled **Check for updates on the following interval (hours)**: 22|
-|Do not connect to any Windows Update Internet locations (Required for Dual Scan) | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not connect to any Windows Update Internet locations |State: Disabled |
+---
+title: Setting up Automatic Update in Windows Update for Business (Windows 10)
+description: Learn how to get started using Windows Update for Business.
+ms.prod: w10
+ms.mktglfcycl: manage
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationprioauthor: jaimeo
+ms.audience: itpro
+author: jaimeo
+ms.date: 06/20/2018
+ms.reviewer:
+manager: laurawi
+ms.topic: article
+---
+
+# Set up Automatic Update in Windows Update for Business with group policies
+
+>Applies to: Windows 10
+
+Use the Automatic Update group policies to manage the interaction between Windows Update and clients.
+
+Automatic Update governs the "behind the scenes" download and installation processes. It's important to keep in mind the device limitation in your environment as the download and install process can consume processing power. The below section outlines the ideal configuration for devices with the least amount of user experience degradation.
+
+|Policy|Description |
+|-|-|
+|Configure Automatic Updates|Governs the installation activity that happens in the background. This allows you to configure the installation to happen during the [maintenance window](https://docs.microsoft.com/sccm/core/clients/manage/collections/use-maintenance-windows). Also, you can specify an installation time where the device will also try to install the latest packages. You can also pick a certain day and or week.|
+|Automatic Update Detection Frequency|Lets you set the scan frequency the device will use to connect to Windows Update to see if there is any available content. Default is 22 hours, but you can increase or decrease the frequency. Keep in mind a desktop computer may need to scan less frequently than laptops, which can have intermittent internet connection.|
+|Specify Intranet Microsoft Update Service Location|Used for Windows Server Update Services or System Center Configuration Manager users who want to install custom packages that are not offered through Windows Update.|
+|Do not connect to any Windows Update Internet locations Required for Dual Scan|Prevents access to Windows Update.|
+
+## Suggested configuration
+
+|Policy|Location|Suggested configuration|
+|-|-|-|
+|Configure Automatic Updates| GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates| **Attention**: If you are using this policy, don't set it/configure it to get the default behavior. If you have set this policy, delete the reg key. This ensures the device uses the default behavior. Note that this is not the same as the default setting within the policy. **Default behavior**: Download and installation happen automatically. The device will then be in a pending reboot state. **Pro tip**: You can configure the scan frequency to be more frequent with the policy below.|
+|Automatic Update Detection Frequency|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Automatic Updates detection frequency|State: Enabled **Check for updates on the following interval (hours)**: 22|
+|Do not connect to any Windows Update Internet locations (Required for Dual Scan) | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not connect to any Windows Update Internet locations |State: Disabled |
diff --git a/windows/deployment/update/wufb-basics.md b/windows/deployment/update/wufb-basics.md
index e1e9419e08..11483f0c9b 100644
--- a/windows/deployment/update/wufb-basics.md
+++ b/windows/deployment/update/wufb-basics.md
@@ -1,29 +1,31 @@
----
-title: Configure the Basic group policy for Windows Update for Business
-description: Learn how to get started using the Basic GPO in Windows Update for Business.
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.audience: itpro
author: greg-lindsay
-ms.date: 06/20/2018
-ms.reviewer:
-manager: laurawi
-ms.topic: article
----
-# Configure the Basic group policy for Windows Update for Business
-
-For Windows Update for Business configurations to work, devices need to be configured with minimum [diagnostic data](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) level of "Basic." Additionally, compliance reporting for configured devices is obtained using [Update Compliance in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor). To view your data in Update Compliance [diagnostics data must be enabled](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#set-diagnostic-data-levels) and the devices must be configured with a commercial ID, a unique GUID created for an enterprise at the time of onboarding to the Windows Analytics solution.
-
-|Policy name|Description |
-|-|-|
-|Allow Telemetry|Enables Microsoft to run diagnostics on your device and troubleshoot.|
-|Configure Commercial ID|This policy allows you to join the device to an entity.|
-
-## Suggested configuration
-
-|Policy|Location|Suggested configuration|
-|-|-|-|
-|Allow Telemetry |GPO: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Allow Telemetry |State: Enabled **Option**: 1-Basic|
-|Configure Commercial ID|GPO: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Commercial ID |State: Enabled **Commercial ID**: The GUID created for you at the time of onboarding to Windows Analytics|
+---
+title: Configure the Basic group policy for Windows Update for Business
+description: Learn how to get started using the Basic GPO in Windows Update for Business.
+ms.prod: w10
+ms.mktglfcycl: manage
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationprioauthor: jaimeo
+ms.audience: itpro
+author: jaimeo
+ms.date: 06/20/2018
+ms.reviewer:
+manager: laurawi
+ms.topic: article
+---
+# Configure the Basic group policy for Windows Update for Business
+
+For Windows Update for Business configurations to work, devices need to be configured with minimum [diagnostic data](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) level of "Basic." Additionally, compliance reporting for configured devices is obtained using [Update Compliance in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor). To view your data in Update Compliance [diagnostics data must be enabled](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#set-diagnostic-data-levels) and the devices must be configured with a commercial ID, a unique GUID created for an enterprise at the time of onboarding to the Windows Analytics solution.
+
+|Policy name|Description |
+|-|-|
+|Allow Telemetry|Enables Microsoft to run diagnostics on your device and troubleshoot.|
+|Configure Commercial ID|This policy allows you to join the device to an entity.|
+
+## Suggested configuration
+
+|Policy|Location|Suggested configuration|
+|-|-|-|
+|Allow Telemetry |GPO: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Allow Telemetry |State: Enabled **Option**: 1-Basic|
+|Configure Commercial ID|GPO: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Commercial ID |State: Enabled **Commercial ID**: The GUID created for you at the time of onboarding to Windows Analytics|
diff --git a/windows/deployment/update/wufb-compliancedeadlines.md b/windows/deployment/update/wufb-compliancedeadlines.md
index 1edad940a4..df08dd3caa 100644
--- a/windows/deployment/update/wufb-compliancedeadlines.md
+++ b/windows/deployment/update/wufb-compliancedeadlines.md
@@ -3,7 +3,6 @@ title: Enforce compliance deadlines with policies in Windows Update for Business
description: Learn how to enforce compliance deadlines using Windows Update for Business.
ms.prod: w10
ms.mktglfcycl: manage
-ms.sitesec: library
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
diff --git a/windows/deployment/update/wufb-managedrivers.md b/windows/deployment/update/wufb-managedrivers.md
index a43179a6a8..0fe22b0935 100644
--- a/windows/deployment/update/wufb-managedrivers.md
+++ b/windows/deployment/update/wufb-managedrivers.md
@@ -1,68 +1,70 @@
----
-title: Managing drivers, dual-managed environments, and Delivery Optimization with group policies in Windows Update for Business
-description: Learn how to manage drivers, dual managed environments, and bandwidth (Delivery Optimization) with GPOs in Windows Update for Business.
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.audience: itpro
author: greg-lindsay
-ms.date: 06/21/2018
-ms.reviewer:
-manager: laurawi
-ms.topic: article
----
-# Managing drivers, dual-managed environments, and Delivery Optimization with group policies
-
->Applies to: Windows 10
-
-Use the following group policy information to manage drivers, to manage environments using both Windows Update for Business and Windows Server Update Services, and to manage the bandwidth required for updates with Delivery Optimization.
-
-## Managing drivers
-Windows Update for Business provides the ability to manage drivers from the Windows Update service. By default, drivers will be offered to your Windows Update-connected devices. Our guidance here is to continue to receive drivers from Windows Update. Alternatively, you can enable the following policy to stop receiving drivers from Windows Update.
-
-### Policy overview
-
-|Policy| Description |
-|-|-|
-|Do not include drivers with Windows Update |When enabled prevents Windows Update from offering drivers.|
-
-### Suggested configuration
-
-|Policy| Location|Suggested configuration |
-|-|-|-|
-|Do not include drivers with Windows Update |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not include drivers with Windows Updates|State: Disabled |
-
-## Dual-managed environment
-
-You can use an on-premises catalog, like WSUS, to deploy 3rd Party patches and use Windows Update to deploy feature and quality updates. We provide capabilities to deploy content from both Windows Update Service and from WSUS. In addition to the policies for managing drivers, apply the following configurations to your environment.
-
-|Policy| Description |
-|-|-|
-|Specify Intranet Microsoft Update Service Location| Used for WSUS/System Center Configuration Manager customers who want to install custom packages that are not offered through Windows Update.|
-
-### Suggested configuration
-
-|Policy| Location|Suggested configuration |
-|-|-|-|
-|Specify Intranet Microsoft Update Service Location|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify Intranet Microsoft update service location|State: Enabled **Set the Intranet Update service for detecting updates**: **Set the Intranet statistics server**: **Set the alternate download server**: |
-
-## Download Optimization - Managing your bandwidth
-
-[Delivery Optimization](waas-delivery-optimization.md) is Windows 10's built-in downloader and peer-caching technology that can benefit CSE for network bandwidth reduction of Windows 10 servicing updates. Windows 10 clients can source content from other devices on their local network that have already downloaded the same updates in addition to downloading these updates from Microsoft. Using the settings available for Delivery Optimization, clients can be configured into groups, allowing organizations to identify devices that are possibly the best candidates to fulfil peer-to-peer requests. To configure devices for delivery optimization, ensure the following configurations are set.
-
-|Policy| Description |
-|-|-|
-|Download Mode| 2=HTTP blended with peering across a private group. Peering occurs on devices in the same Active Directory Site (if exist) or the same domain by default. When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2|
-|Minimum Peer Caching Content File Size (in MB)|Specifies the minimum content file size in MB enabled to use peer caching. Choose a size that meets your environment's constraints.|
-|Allow uploads while the device is on battery while under set battery level (percentage)|Specify a battery level from 1-100, where the device will pause uploads once the battery level drops below that percentage. |
-|Max Cache Age (in seconds)|Maximum number of seconds to keep data in cache.|
-
-### Suggested configuration
-
-|Policy| Location| Suggested configuration |
-|-|-|-|
-|Download Mode|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Download Mode|State: Enabled **Download Mode**: Group (2)|
-|Minimum Peer Caching Content File Size (in MB)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Minimum Peer Caching Content File Size (in MB)|State: Enabled **Minimum Peer caching content file size (in MB)**: 10 MB|
-|Allow uploads while the device is on battery while under set battery level (percentage)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Allow uploads while the device is on battery while under set battery level (percentage)|State: Enabled **Minimum battery level (Percentage)**: 60|
-|Max Cache Age (in seconds)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Max Cache Age (in seconds)|State: Enabled **Max Cache Age (in seconds)**: 604800 ~ 7 days|
+---
+title: Managing drivers, dual-managed environments, and Delivery Optimization with group policies in Windows Update for Business
+description: Learn how to manage drivers, dual managed environments, and bandwidth (Delivery Optimization) with GPOs in Windows Update for Business.
+ms.prod: w10
+ms.mktglfcycl: manage
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationprioauthor: jaimeo
+ms.audience: itpro
+author: jaimeo
+ms.date: 06/21/2018
+ms.reviewer:
+manager: laurawi
+ms.topic: article
+---
+# Managing drivers, dual-managed environments, and Delivery Optimization with group policies
+
+>Applies to: Windows 10
+
+Use the following group policy information to manage drivers, to manage environments using both Windows Update for Business and Windows Server Update Services, and to manage the bandwidth required for updates with Delivery Optimization.
+
+## Managing drivers
+Windows Update for Business provides the ability to manage drivers from the Windows Update service. By default, drivers will be offered to your Windows Update-connected devices. Our guidance here is to continue to receive drivers from Windows Update. Alternatively, you can enable the following policy to stop receiving drivers from Windows Update.
+
+### Policy overview
+
+|Policy| Description |
+|-|-|
+|Do not include drivers with Windows Update |When enabled prevents Windows Update from offering drivers.|
+
+### Suggested configuration
+
+|Policy| Location|Suggested configuration |
+|-|-|-|
+|Do not include drivers with Windows Update |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not include drivers with Windows Updates|State: Disabled |
+
+## Dual-managed environment
+
+You can use an on-premises catalog, like WSUS, to deploy 3rd Party patches and use Windows Update to deploy feature and quality updates. We provide capabilities to deploy content from both Windows Update Service and from WSUS. In addition to the policies for managing drivers, apply the following configurations to your environment.
+
+|Policy| Description |
+|-|-|
+|Specify Intranet Microsoft Update Service Location| Used for WSUS/System Center Configuration Manager customers who want to install custom packages that are not offered through Windows Update.|
+
+### Suggested configuration
+
+|Policy| Location|Suggested configuration |
+|-|-|-|
+|Specify Intranet Microsoft Update Service Location|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify Intranet Microsoft update service location|State: Enabled **Set the Intranet Update service for detecting updates**: **Set the Intranet statistics server**: **Set the alternate download server**: |
+
+## Download Optimization - Managing your bandwidth
+
+[Delivery Optimization](waas-delivery-optimization.md) is Windows 10's built-in downloader and peer-caching technology that can benefit CSE for network bandwidth reduction of Windows 10 servicing updates. Windows 10 clients can source content from other devices on their local network that have already downloaded the same updates in addition to downloading these updates from Microsoft. Using the settings available for Delivery Optimization, clients can be configured into groups, allowing organizations to identify devices that are possibly the best candidates to fulfil peer-to-peer requests. To configure devices for delivery optimization, ensure the following configurations are set.
+
+|Policy| Description |
+|-|-|
+|Download Mode| 2=HTTP blended with peering across a private group. Peering occurs on devices in the same Active Directory Site (if exist) or the same domain by default. When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2|
+|Minimum Peer Caching Content File Size (in MB)|Specifies the minimum content file size in MB enabled to use peer caching. Choose a size that meets your environment's constraints.|
+|Allow uploads while the device is on battery while under set battery level (percentage)|Specify a battery level from 1-100, where the device will pause uploads once the battery level drops below that percentage. |
+|Max Cache Age (in seconds)|Maximum number of seconds to keep data in cache.|
+
+### Suggested configuration
+
+|Policy| Location| Suggested configuration |
+|-|-|-|
+|Download Mode|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Download Mode|State: Enabled **Download Mode**: Group (2)|
+|Minimum Peer Caching Content File Size (in MB)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Minimum Peer Caching Content File Size (in MB)|State: Enabled **Minimum Peer caching content file size (in MB)**: 10 MB|
+|Allow uploads while the device is on battery while under set battery level (percentage)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Allow uploads while the device is on battery while under set battery level (percentage)|State: Enabled **Minimum battery level (Percentage)**: 60|
+|Max Cache Age (in seconds)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Max Cache Age (in seconds)|State: Enabled **Max Cache Age (in seconds)**: 604800 ~ 7 days|
diff --git a/windows/deployment/update/wufb-manageupdate.md b/windows/deployment/update/wufb-manageupdate.md
index 6ba3572c05..f1513ece69 100644
--- a/windows/deployment/update/wufb-manageupdate.md
+++ b/windows/deployment/update/wufb-manageupdate.md
@@ -1,59 +1,61 @@
----
-title: Managing feature and quality updates with policies in Windows Update for Business (Windows 10)
-description: Learn how to get started using Windows Update for Business.
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.audience: itpro
author: greg-lindsay
-ms.date: 06/20/2018
-ms.reviewer:
-manager: laurawi
-ms.topic: article
----
-
-# Manage feature and quality updates with group policies
-
->Applies to: Windows 10
-
-Windows Update for Business allows users to control when devices should receive a feature or quality update from Windows Update. Depending on the size of your organization you may want to do a wave deployment of updates. The first step in this process is to determine which Branch Readiness Level you want your organization on. For more information on which level is right for your organization review [Overview of Windows as a service](waas-overview.md).
-
-The following policies let you configure when you want a device to see a feature and or quality update from Windows Update.
-
-## Policy overview
-
-|Policy name| Description |
-|-|-|
-|Select when Quality Updates are received|Configures when the device should receive quality update. In this policy you can also select a date to pause receiving Quality Updates until. |
-|Select when Preview Builds & feature Updates are received|Configures when the device should receive a feature update. You can also configure your branch readiness level. This policy also provides the ability to "pause" updates until a certain point. |
-|Do not allow update deferral policies to cause scans against Windows Update|When enabled will not allow the deferral policies to cause scans against Windows Update.|
-
-## Suggested configuration for a non-wave deployment
-
-If you don't need a wave deployment and have a small set of devices to manage, we recommend the following configuration:
-
-|Policy| Location|Suggested configuration |
-|-|-|-|
-|Select when Quality Updates are received | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Quality Updates are received|State: Enabled **Defer receiving it for this many days**: 0 **Pause Quality Updates**: Blank *Note: use this functionality to prevent the device from receiving a quality update until the time passes|
-|Select when Preview Builds & feature Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are received|State: Enabled **Select Windows Readiness Level**: SAC **Defer receiving for this many days**: 0-365 **Pause Feature Updates**: Blank *Note: use this functionality to prevent the device from receiving a feature update until the time passes|
-|Do not allow update deferral policies to cause scans against Windows Update|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not allow update deferral policies to cause scans against Windows Update|State: Disabled|
-
-## Suggested configuration for a wave deployment
-
-
-## Early validation and testing
-Depending on your organizational size and requirements you might be able to test feature updates earlier to identify if there are impacts to Line of Business applications. Our recommendation is to enroll a set of devices that are a good representation of your device ecosystem (for example, devices with accounting software or engineering software). Learn more about [different deployment rings](https://insider.windows.com/how-to-pc/#working-with-rings).
-
-|Policy|Location|Suggested configuration |
-|-|-|-|
-|Select when Preview Builds & feature Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are received|State: Enabled **Select Windows Readiness Level**: WIP Fast or WIP slow **Defer receiving for this many days**: 0 **Pause Feature Updates**: Blank *Note: use this functionality to prevent the device from receiving a feature update until the time passes.|
-|Select when Quality Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Quality Updates are received|State: Enabled **Defer receiving it for this many days**: 0 **Pause Quality Updates**: Blank *Note: use this functionality to prevent the device from receiving a quality update until the time passes|
-
-## Wave deployment for feature updates
-
-If you want to deploy feature updates in waves we suggest using the following configuration. For the deferral days we recommend staging them out in 1-month increments. Manage your risk by placing critical devices later in the wave (deferrals > 30 or 60 days) while placing your low risk devices earlier in the wave (deferrals < 30 days). Using deferrals days is a great method to manage your wave deployment. Using this in combination with our suggested early validation will help you prepare your environment for the latest updates from Windows.
-
-|Policy|Location|Suggested configuration |
-|-|-|-|
-|Select when Preview Builds & feature Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are received|State: Enabled **Select Windows Readiness Level**: SAC **Defer receiving for this many days**: 0, 30, 60, 90, 120 **Pause Feature Updates**: Blank *Note: use this functionality to prevent the device from receiving a feature update until the time passes
+---
+title: Managing feature and quality updates with policies in Windows Update for Business (Windows 10)
+description: Learn how to get started using Windows Update for Business.
+ms.prod: w10
+ms.mktglfcycl: manage
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationprioauthor: jaimeo
+ms.audience: itpro
+author: jaimeo
+ms.date: 06/20/2018
+ms.reviewer:
+manager: laurawi
+ms.topic: article
+---
+
+# Manage feature and quality updates with group policies
+
+>Applies to: Windows 10
+
+Windows Update for Business allows users to control when devices should receive a feature or quality update from Windows Update. Depending on the size of your organization you may want to do a wave deployment of updates. The first step in this process is to determine which Branch Readiness Level you want your organization on. For more information on which level is right for your organization review [Overview of Windows as a service](waas-overview.md).
+
+The following policies let you configure when you want a device to see a feature and or quality update from Windows Update.
+
+## Policy overview
+
+|Policy name| Description |
+|-|-|
+|Select when Quality Updates are received|Configures when the device should receive quality update. In this policy you can also select a date to pause receiving Quality Updates until. |
+|Select when Preview Builds & feature Updates are received|Configures when the device should receive a feature update. You can also configure your branch readiness level. This policy also provides the ability to "pause" updates until a certain point. |
+|Do not allow update deferral policies to cause scans against Windows Update|When enabled will not allow the deferral policies to cause scans against Windows Update.|
+
+## Suggested configuration for a non-wave deployment
+
+If you don't need a wave deployment and have a small set of devices to manage, we recommend the following configuration:
+
+|Policy| Location|Suggested configuration |
+|-|-|-|
+|Select when Quality Updates are received | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Quality Updates are received|State: Enabled **Defer receiving it for this many days**: 0 **Pause Quality Updates**: Blank *Note: use this functionality to prevent the device from receiving a quality update until the time passes|
+|Select when Preview Builds & feature Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are received|State: Enabled **Select Windows Readiness Level**: SAC **Defer receiving for this many days**: 0-365 **Pause Feature Updates**: Blank *Note: use this functionality to prevent the device from receiving a feature update until the time passes|
+|Do not allow update deferral policies to cause scans against Windows Update|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not allow update deferral policies to cause scans against Windows Update|State: Disabled|
+
+## Suggested configuration for a wave deployment
+
+
+## Early validation and testing
+Depending on your organizational size and requirements you might be able to test feature updates earlier to identify if there are impacts to Line of Business applications. Our recommendation is to enroll a set of devices that are a good representation of your device ecosystem (for example, devices with accounting software or engineering software). Learn more about [different deployment rings](https://insider.windows.com/how-to-pc/#working-with-rings).
+
+|Policy|Location|Suggested configuration |
+|-|-|-|
+|Select when Preview Builds & feature Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are received|State: Enabled **Select Windows Readiness Level**: WIP Fast or WIP slow **Defer receiving for this many days**: 0 **Pause Feature Updates**: Blank *Note: use this functionality to prevent the device from receiving a feature update until the time passes.|
+|Select when Quality Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Quality Updates are received|State: Enabled **Defer receiving it for this many days**: 0 **Pause Quality Updates**: Blank *Note: use this functionality to prevent the device from receiving a quality update until the time passes|
+
+## Wave deployment for feature updates
+
+If you want to deploy feature updates in waves we suggest using the following configuration. For the deferral days we recommend staging them out in 1-month increments. Manage your risk by placing critical devices later in the wave (deferrals > 30 or 60 days) while placing your low risk devices earlier in the wave (deferrals < 30 days). Using deferrals days is a great method to manage your wave deployment. Using this in combination with our suggested early validation will help you prepare your environment for the latest updates from Windows.
+
+|Policy|Location|Suggested configuration |
+|-|-|-|
+|Select when Preview Builds & feature Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are received|State: Enabled **Select Windows Readiness Level**: SAC **Defer receiving for this many days**: 0, 30, 60, 90, 120 **Pause Feature Updates**: Blank *Note: use this functionality to prevent the device from receiving a feature update until the time passes
diff --git a/windows/deployment/update/wufb-onboard.md b/windows/deployment/update/wufb-onboard.md
index 98d62be2fa..058f595090 100644
--- a/windows/deployment/update/wufb-onboard.md
+++ b/windows/deployment/update/wufb-onboard.md
@@ -1,47 +1,49 @@
----
-title: Onboarding to Windows Update for Business (Windows 10)
-description: Learn how to get started using Windows Update for Business.
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-audience: itpro
author: greg-lindsay
-ms.localizationpriority: medium
-ms.audience: itpro
author: greg-lindsay
-ms.reviewer:
-manager: laurawi
-ms.topic: article
----
-
-# Onboarding to Windows Update for Business in Windows 10
-
->Applies to: Windows 10
-
-Windows Update for Business is a tool that enables IT pros and power users to manage content they want to receive from Windows Update Service. Windows Update for Business can control the following:
-
-- Interaction between the client and Windows Update service
-- End user notification for pending updates
-- Compliance deadlines for feature or quality updates
-- Configure wave deployment for feature or quality updates bandwidth optimization
-
-We also provide additional functionality to manage your environment when risk or issues arise such as applications being blocked:
-
-- Uninstall latest feature or quality update
-- Pause for a duration of time
-
-Use the following information to set up your environment using Windows Update for Business policies:
-
-- [Supported SKUs](#supported-editions)
-- [Windows Update for Business basics](wufb-basics.md)
-- [Setting up automatic update](wufb-autoupdate.md)
-- [Managing feature and quality updates](wufb-manageupdate.md)
-- [Enforcing compliance deadlines](wufb-compliancedeadlines.md)
-- [Managing drivers, environments with both Windows Update for Business and WSUS, and Download Optmization](wufb-managedrivers.md)
-
-## Supported editions
-
-Windows Update for Business is supported on the following editions of Windows 10:
-
-- Windows 10 Education
-- Windows 10 Enterprise
-- Windows 10 Pro
-- Windows 10 S (for Windows 10, version 1709 and earlier)
+---
+title: Onboarding to Windows Update for Business (Windows 10)
+description: Learn how to get started using Windows Update for Business.
+ms.prod: w10
+ms.mktglfcycl: manage
+audience: itpro
+itproauthor: jaimeo
+author: jaimeo
+ms.localizationprioauthor: jaimeo
+ms.audience: itpro
+author: jaimeo
+ms.reviewer:
+manager: laurawi
+ms.topic: article
+---
+
+# Onboarding to Windows Update for Business in Windows 10
+
+>Applies to: Windows 10
+
+Windows Update for Business is a tool that enables IT pros and power users to manage content they want to receive from Windows Update Service. Windows Update for Business can control the following:
+
+- Interaction between the client and Windows Update service
+- End user notification for pending updates
+- Compliance deadlines for feature or quality updates
+- Configure wave deployment for feature or quality updates bandwidth optimization
+
+We also provide additional functionality to manage your environment when risk or issues arise such as applications being blocked:
+
+- Uninstall latest feature or quality update
+- Pause for a duration of time
+
+Use the following information to set up your environment using Windows Update for Business policies:
+
+- [Supported SKUs](#supported-editions)
+- [Windows Update for Business basics](wufb-basics.md)
+- [Setting up automatic update](wufb-autoupdate.md)
+- [Managing feature and quality updates](wufb-manageupdate.md)
+- [Enforcing compliance deadlines](wufb-compliancedeadlines.md)
+- [Managing drivers, environments with both Windows Update for Business and WSUS, and Download Optmization](wufb-managedrivers.md)
+
+## Supported editions
+
+Windows Update for Business is supported on the following editions of Windows 10:
+
+- Windows 10 Education
+- Windows 10 Enterprise
+- Windows 10 Pro
+- Windows 10 S (for Windows 10, version 1709 and earlier)
diff --git a/windows/deployment/upgrade/upgrade-readiness-additional-insights.md b/windows/deployment/upgrade/upgrade-readiness-additional-insights.md
index c6c73aa23e..253142dec4 100644
--- a/windows/deployment/upgrade/upgrade-readiness-additional-insights.md
+++ b/windows/deployment/upgrade/upgrade-readiness-additional-insights.md
@@ -2,17 +2,20 @@
title: Upgrade Readiness - Additional insights
ms.reviewer:
manager: laurawi
-ms.author: greglin
+ms.author: jaimeo
description: Explains additional features of Upgrade Readiness.
ms.prod: w10
audience: itpro
-author: greg-lindsay
+author: jaimeo
ms.topic: article
ms.collection: M365-analytics
---
# Upgrade Readiness - Additional insights
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
This topic provides information on additional features that are available in Upgrade Readiness to provide insights into your environment. These include:
- [Site discovery](#site-discovery): An inventory of web sites that are accessed by client computers running Windows 7, Windows 8.1, or Windows 10 using Internet Explorer.
diff --git a/windows/deployment/upgrade/upgrade-readiness-architecture.md b/windows/deployment/upgrade/upgrade-readiness-architecture.md
index e5d5a0d480..d9bc229c23 100644
--- a/windows/deployment/upgrade/upgrade-readiness-architecture.md
+++ b/windows/deployment/upgrade/upgrade-readiness-architecture.md
@@ -1,35 +1,39 @@
----
-title: Upgrade Readiness architecture (Windows 10)
-ms.reviewer:
-manager: laurawi
-ms.author: greglin
-description: Describes Upgrade Readiness architecture.
-ms.prod: w10
-audience: itpro
author: greg-lindsay
-ms.topic: article
-ms.collection: M365-analytics
----
-
-# Upgrade Readiness architecture
-
-Microsoft analyzes system, application, and driver diagnostic data to help you determine when computers are upgrade-ready, allowing you to simplify and accelerate Windows upgrades in your organization. The diagram below illustrates how Upgrade Readiness components work together in a typical installation.
-
-
-
-
-
-After you enable Windows diagnostic data on user computers and install the compatibility update KB (1), user computers send computer, application and driver diagnostic data to a secure Microsoft data center through the Microsoft Data Management Service (2). After you configure Upgrade Readiness, diagnostic data is analyzed by the Upgrade Readiness Service (3) and pushed to your workspace (4). You can then use the Upgrade Readiness solution (5) to plan and manage Windows upgrades.
-
-For more information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see:
-
-[Configure Windows diagnostic data in your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization)
-[Manage connections from Windows operating system components to Microsoft services](/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services)
-[Windows 7, Windows 8, and Windows 8.1 appraiser diagnostic data events and fields](https://go.microsoft.com/fwlink/?LinkID=822965)
-
-## **Related topics**
-
-[Upgrade Readiness requirements](upgrade-readiness-requirements.md)
-[Upgrade Readiness release notes](upgrade-readiness-requirements.md#important-information-about-this-release)
-[Get started with Upgrade Readiness](upgrade-readiness-get-started.md)
+---
+title: Upgrade Readiness architecture (Windows 10)
+ms.reviewer:
+manager: laurawi
+ms.author: jaimeo
+description: Describes Upgrade Readiness architecture.
+ms.prod: w10
+audience: itpro
+author: jaimeo
+ms.topic: article
+ms.collection: M365-analytics
+---
+
+# Upgrade Readiness architecture
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+Microsoft analyzes system, application, and driver diagnostic data to help you determine when computers are upgrade-ready, allowing you to simplify and accelerate Windows upgrades in your organization. The diagram below illustrates how Upgrade Readiness components work together in a typical installation.
+
+
+
+
+
+After you enable Windows diagnostic data on user computers and install the compatibility update KB (1), user computers send computer, application and driver diagnostic data to a secure Microsoft data center through the Microsoft Data Management Service (2). After you configure Upgrade Readiness, diagnostic data is analyzed by the Upgrade Readiness Service (3) and pushed to your workspace (4). You can then use the Upgrade Readiness solution (5) to plan and manage Windows upgrades.
+
+For more information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see:
+
+[Configure Windows diagnostic data in your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization)
+[Manage connections from Windows operating system components to Microsoft services](/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services)
+[Windows 7, Windows 8, and Windows 8.1 appraiser diagnostic data events and fields](https://go.microsoft.com/fwlink/?LinkID=822965)
+
+## **Related topics**
+
+[Upgrade Readiness requirements](upgrade-readiness-requirements.md)
+[Upgrade Readiness release notes](upgrade-readiness-requirements.md#important-information-about-this-release)
+[Get started with Upgrade Readiness](upgrade-readiness-get-started.md)
diff --git a/windows/deployment/upgrade/upgrade-readiness-data-sharing.md b/windows/deployment/upgrade/upgrade-readiness-data-sharing.md
index 0bbda9f3df..322316fb07 100644
--- a/windows/deployment/upgrade/upgrade-readiness-data-sharing.md
+++ b/windows/deployment/upgrade/upgrade-readiness-data-sharing.md
@@ -1,57 +1,61 @@
----
-title: Upgrade Readiness data sharing
-ms.reviewer:
-manager: laurawi
-ms.author: greglin
-description: Connectivity scenarios for data sharing with Upgrade Readiness
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
-ms.topic: article
-ms.collection: M365-analytics
----
-
-# Upgrade Readiness data sharing
-
-To enable data sharing with the Upgrade Readiness solution, double-check the endpoints list in [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md#enable-data-sharing) to be sure they are whitelisted.
-
-## Connectivity to the Internet
-
-There are several different methods your organization can use to connect to the Internet, and these methods can affect how authentication is performed by the deployment script.
-
-### Direct connection to the Internet
-
-This scenario is very simple since there is no proxy involved. If you are using a network firewall which is blocking outgoing traffic, please keep in mind that even though we provide DNS names for the endpoints needed to communicate to the Microsoft diagnostic data backend, We therefore do not recommend to attempt to whitelist endpoints on your firewall based on IP-addresses.
-
-In order to use the direct connection scenario, set the parameter **ClientProxy=Direct** in **runconfig.bat**.
-
-### Connection through the WinHTTP proxy
-
-This is the first and most simple proxy scenario. The WinHTTP stack was designed for use in services and does not support proxy autodetection, PAC scripts or authentication.
-
-In order to set the WinHTTP proxy system-wide on your computers, you need to
-- Use the command netsh winhttp set proxy \:\
-- Set ClientProxy=System in runconfig.bat
-
-The WinHTTP scenario is most appropriate for customers who use a single proxy. If you have more advanced proxy requirements, refer to Scenario 3.
-
-If you want to learn more about proxy considerations on Windows, see [Understanding Web Proxy Configuration](https://blogs.msdn.microsoft.com/ieinternals/2013/10/11/understanding-web-proxy-configuration/).
-
-### Logged-in user’s Internet connection
-
-In order to accommodate complex proxy scenarios, we also support using the currently logged-in user’s internet connection. This scenario supports PAC scripts, proxy autodetection and authentication. Essentially, if the logged in user can reach the Windows diagnostic data endpoints, the diagnostic data client can send data. If runconfig.bat runs while no user is logged in, diagnostic data events get written into a buffer which gets flushed when a user logs in.
-
-In order to enable this scenario, you need:
-- A current quality update Rollup for Windows 7, 8.1 or Windows 10 Version 1511. Updates shipped after October 2016 have the needed code
-- Set the reg key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection\DisableEnterpriseAuthProxy to 0. If the value does not exist, create a new DWORD, name it DisableEnterpriseAuthProxy and set the value to 0. The deployment script will check this is configured correctly.
-- Set ClientProxy=User in bat.
-
-> [!IMPORTANT]
-> Using **Logged-in user's internet connection** with **DisableEnterpriseAuthProxy = 0** scenario is incompatible with ATP where the required value of that attribute is 1.(Read more here)[]
-
-
-
-
-
+---
+title: Upgrade Readiness data sharing
+ms.reviewer:
+manager: laurawi
+ms.author: jaimeo
+description: Connectivity scenarios for data sharing with Upgrade Readiness
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: deploy
+audience: itpro
+author: jaimeo
+ms.topic: article
+ms.collection: M365-analytics
+---
+
+# Upgrade Readiness data sharing
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+To enable data sharing with the Upgrade Readiness solution, double-check the endpoints list in [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md#enable-data-sharing) to be sure they are whitelisted.
+
+## Connectivity to the Internet
+
+There are several different methods your organization can use to connect to the Internet, and these methods can affect how authentication is performed by the deployment script.
+
+### Direct connection to the Internet
+
+This scenario is very simple since there is no proxy involved. If you are using a network firewall which is blocking outgoing traffic, please keep in mind that even though we provide DNS names for the endpoints needed to communicate to the Microsoft diagnostic data backend, We therefore do not recommend to attempt to whitelist endpoints on your firewall based on IP-addresses.
+
+In order to use the direct connection scenario, set the parameter **ClientProxy=Direct** in **runconfig.bat**.
+
+### Connection through the WinHTTP proxy
+
+This is the first and most simple proxy scenario. The WinHTTP stack was designed for use in services and does not support proxy autodetection, PAC scripts or authentication.
+
+In order to set the WinHTTP proxy system-wide on your computers, you need to
+- Use the command netsh winhttp set proxy \:\
+- Set ClientProxy=System in runconfig.bat
+
+The WinHTTP scenario is most appropriate for customers who use a single proxy. If you have more advanced proxy requirements, refer to Scenario 3.
+
+If you want to learn more about proxy considerations on Windows, see [Understanding Web Proxy Configuration](https://blogs.msdn.microsoft.com/ieinternals/2013/10/11/understanding-web-proxy-configuration/).
+
+### Logged-in user’s Internet connection
+
+In order to accommodate complex proxy scenarios, we also support using the currently logged-in user’s internet connection. This scenario supports PAC scripts, proxy autodetection and authentication. Essentially, if the logged in user can reach the Windows diagnostic data endpoints, the diagnostic data client can send data. If runconfig.bat runs while no user is logged in, diagnostic data events get written into a buffer which gets flushed when a user logs in.
+
+In order to enable this scenario, you need:
+- A current quality update Rollup for Windows 7, 8.1 or Windows 10 Version 1511. Updates shipped after October 2016 have the needed code
+- Set the reg key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection\DisableEnterpriseAuthProxy to 0. If the value does not exist, create a new DWORD, name it DisableEnterpriseAuthProxy and set the value to 0. The deployment script will check this is configured correctly.
+- Set ClientProxy=User in bat.
+
+> [!IMPORTANT]
+> Using **Logged-in user's internet connection** with **DisableEnterpriseAuthProxy = 0** scenario is incompatible with ATP where the required value of that attribute is 1.(Read more here)[]
+
+
+
+
+
diff --git a/windows/deployment/upgrade/upgrade-readiness-deploy-windows.md b/windows/deployment/upgrade/upgrade-readiness-deploy-windows.md
index b097017757..eb4c1d88d8 100644
--- a/windows/deployment/upgrade/upgrade-readiness-deploy-windows.md
+++ b/windows/deployment/upgrade/upgrade-readiness-deploy-windows.md
@@ -1,102 +1,106 @@
----
-title: Upgrade Readiness - Get a list of computers that are upgrade ready (Windows 10)
-ms.reviewer:
-manager: laurawi
-ms.author: greglin
-description: Describes how to get a list of computers that are ready to be upgraded in Upgrade Readiness.
-ms.prod: w10
-audience: itpro
author: greg-lindsay
-ms.topic: article
-ms.collection: M365-analytics
----
-
-# Upgrade Readiness - Step 3: Deploy Windows
-
-All of your work up to now involved reviewing and resolving application and driver issues. Along the way, as you’ve resolved issues and decided which applications and drivers are ready to upgrade, you’ve been building a list of computers that are upgrade ready.
-The blades in the **Deploy** section are:
-
-- [Deploy eligible computers](#deploy-eligible-computers)
-- [Deploy computers by group](#computer-groups)
-
->Computers that are listed in this step are assigned an **UpgradeDecision** value, and the total count of computers in each upgrade decision category is displayed. Additionally, computers are assigned an **UpgradeAssessment** value. This value is displayed by drilling down into a specific upgrade decision category. For information about upgrade assessment values, see [Upgrade assessment](#upgrade-assessment).
-
-## Deploy eligible computers
-
-In this blade, computers grouped by upgrade decision are listed. The upgrade decision on the machines is a calculated value based on the upgrade decision status for the apps and drivers installed on the computer. This value cannot be modified directly. The upgrade decision is calculated in the following ways:
-- **Review in progress**: At least one app or driver installed on the computer is marked **Review in progress**.
-- **Ready to upgrade**: All apps and drivers installed on the computer are marked as **Ready to Upgrade**.
-- **Won’t upgrade**: At least one app or driver installed on the computer is marked as **Won’t upgrade**, or a system requirement is not met.
-
-
-
-
-
-Select **Export computers** for more details, including computer name, manufacturer and model, and Windows edition currently running on the computer. Sort or further query the data and then select **Export** to generate and save a comma-separated value (csv) list of upgrade-ready computers.
-
->**Important** When viewing inventory items in table view, the maximum number of rows that can be viewed and exported is limited to 5,000. If you need to view or export more than 5,000 items, reduce the scope of the query so you can export fewer items at a time.
-
-## Computer groups
-
-Computer groups allow you to segment your environment by creating device groups based on log search results, or by importing groups from Active Directory, WSUS or System Center Configuration Manager. Computer groups are an OMS feature. For more information, see [Computer groups in OMS](https://blogs.technet.microsoft.com/msoms/2016/04/04/computer-groups-in-oms/).
-
-Query based computer groups are recommended in the initial release of this feature. A feature known as **Configuration Manager Upgrade Readiness Connector** is anticipated in a future release that will enable synchronization of **ConfigMgr Collections** with computer groups in OMS.
-
-### Getting started with Computer Groups
-
-When you sign in to OMS, you will see a new blade entitled **Computer Groups**. See the following example:
-
-
-
-To create a computer group, open **Log Search** and create a query based on **Type=UAComputer**, for example:
-
-```
-Type=UAComputer Manufacturer=DELL
-```
-
-
-
-When you are satisfied that the query is returning the intended results, add the following text to your search:
-
-```
-| measure count() by Computer
-```
-
-This will ensure every computer only shows up once. Then, save your group by clicking **Save** and **Yes**. See the following example:
-
-
-
-Your new computer group will now be available in Upgrade Readiness. See the following example:
-
-
-
-### Using Computer Groups
-
-When you drill into a computer group, you will see that computers are categorized by **UpgradeDecision**. For computers with the status **Review in progress** or **Won’t upgrade** you can drill down to view issues that cause a computer to be in each category, or you can simply display a list of the computers in the category. For computers that are designated **Ready to upgrade**, you can go directly to the list of computers that are ready.
-
-
-
-Viewing a list of computers in a certain status is self-explanatory, Let’s look at what happens when you click the details link on **Review in progress**:
-
-
-
-Next, select if you want to see application issues (**UAApp**) or driver issues (**UADriver**). See the following example of selecting **UAApp**:
-
-
-
-A list of apps that require review so that Dell Computers are ready for upgrade to Windows 10 is displayed.
-
-### Upgrade assessment
-
-Upgrade assessment and guidance details are explained in the following table.
-
-| Upgrade assessment | Action required before or after upgrade pilot? | Issue | What it means | Guidance |
-|-----------------------|------------------------------------------------|----------|-----------------|---------------|
-| No known issues | No | None | Computers will upgrade seamlessly. | OK to use as-is in pilot. |
-| OK to pilot, fixed during upgrade | No, for awareness only | Application or driver will not migrate to new OS | The currently installed version of an application or driver won’t migrate to the new operating system; however, a compatible version is installed with the new operating system. | OK to use as-is in pilot. |
-| OK to pilot with new driver from Windows Update | Yes | Driver will not migrate to new OS | The currently installed version of a driver won’t migrate to the new operating system; however, a newer, compatible version is available from Windows Update. | Although a compatible version of the driver is installed during upgrade, a newer version is available from Windows Update. If the computer automatically receives updates from Windows Update, no action is required. Otherwise, replace the new in-box driver with the Windows Update version after upgrading. |
-
-Select **Export computers** to view pilot-ready computers organized by operating system. After you select the computers you want to use in a pilot, click Export to generate and save a comma-separated value (csv) file.
-
->**Important**> When viewing inventory items in table view, the maximum number of rows that can be viewed and exported is limited to 5,000. If you need to view or export more than 5,000 items, reduce the scope of the query so you can export fewer items at a time.
+---
+title: Upgrade Readiness - Get a list of computers that are upgrade ready (Windows 10)
+ms.reviewer:
+manager: laurawi
+ms.author: jaimeo
+description: Describes how to get a list of computers that are ready to be upgraded in Upgrade Readiness.
+ms.prod: w10
+audience: itpro
+author: jaimeo
+ms.topic: article
+ms.collection: M365-analytics
+---
+
+# Upgrade Readiness - Step 3: Deploy Windows
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+All of your work up to now involved reviewing and resolving application and driver issues. Along the way, as you’ve resolved issues and decided which applications and drivers are ready to upgrade, you’ve been building a list of computers that are upgrade ready.
+The blades in the **Deploy** section are:
+
+- [Deploy eligible computers](#deploy-eligible-computers)
+- [Deploy computers by group](#computer-groups)
+
+>Computers that are listed in this step are assigned an **UpgradeDecision** value, and the total count of computers in each upgrade decision category is displayed. Additionally, computers are assigned an **UpgradeAssessment** value. This value is displayed by drilling down into a specific upgrade decision category. For information about upgrade assessment values, see [Upgrade assessment](#upgrade-assessment).
+
+## Deploy eligible computers
+
+In this blade, computers grouped by upgrade decision are listed. The upgrade decision on the machines is a calculated value based on the upgrade decision status for the apps and drivers installed on the computer. This value cannot be modified directly. The upgrade decision is calculated in the following ways:
+- **Review in progress**: At least one app or driver installed on the computer is marked **Review in progress**.
+- **Ready to upgrade**: All apps and drivers installed on the computer are marked as **Ready to Upgrade**.
+- **Won’t upgrade**: At least one app or driver installed on the computer is marked as **Won’t upgrade**, or a system requirement is not met.
+
+
+
+
+
+Select **Export computers** for more details, including computer name, manufacturer and model, and Windows edition currently running on the computer. Sort or further query the data and then select **Export** to generate and save a comma-separated value (csv) list of upgrade-ready computers.
+
+>**Important** When viewing inventory items in table view, the maximum number of rows that can be viewed and exported is limited to 5,000. If you need to view or export more than 5,000 items, reduce the scope of the query so you can export fewer items at a time.
+
+## Computer groups
+
+Computer groups allow you to segment your environment by creating device groups based on log search results, or by importing groups from Active Directory, WSUS or System Center Configuration Manager. Computer groups are an OMS feature. For more information, see [Computer groups in OMS](https://blogs.technet.microsoft.com/msoms/2016/04/04/computer-groups-in-oms/).
+
+Query based computer groups are recommended in the initial release of this feature. A feature known as **Configuration Manager Upgrade Readiness Connector** is anticipated in a future release that will enable synchronization of **ConfigMgr Collections** with computer groups in OMS.
+
+### Getting started with Computer Groups
+
+When you sign in to OMS, you will see a new blade entitled **Computer Groups**. See the following example:
+
+
+
+To create a computer group, open **Log Search** and create a query based on **Type=UAComputer**, for example:
+
+```
+Type=UAComputer Manufacturer=DELL
+```
+
+
+
+When you are satisfied that the query is returning the intended results, add the following text to your search:
+
+```
+| measure count() by Computer
+```
+
+This will ensure every computer only shows up once. Then, save your group by clicking **Save** and **Yes**. See the following example:
+
+
+
+Your new computer group will now be available in Upgrade Readiness. See the following example:
+
+
+
+### Using Computer Groups
+
+When you drill into a computer group, you will see that computers are categorized by **UpgradeDecision**. For computers with the status **Review in progress** or **Won’t upgrade** you can drill down to view issues that cause a computer to be in each category, or you can simply display a list of the computers in the category. For computers that are designated **Ready to upgrade**, you can go directly to the list of computers that are ready.
+
+
+
+Viewing a list of computers in a certain status is self-explanatory, Let’s look at what happens when you click the details link on **Review in progress**:
+
+
+
+Next, select if you want to see application issues (**UAApp**) or driver issues (**UADriver**). See the following example of selecting **UAApp**:
+
+
+
+A list of apps that require review so that Dell Computers are ready for upgrade to Windows 10 is displayed.
+
+### Upgrade assessment
+
+Upgrade assessment and guidance details are explained in the following table.
+
+| Upgrade assessment | Action required before or after upgrade pilot? | Issue | What it means | Guidance |
+|-----------------------|------------------------------------------------|----------|-----------------|---------------|
+| No known issues | No | None | Computers will upgrade seamlessly. | OK to use as-is in pilot. |
+| OK to pilot, fixed during upgrade | No, for awareness only | Application or driver will not migrate to new OS | The currently installed version of an application or driver won’t migrate to the new operating system; however, a compatible version is installed with the new operating system. | OK to use as-is in pilot. |
+| OK to pilot with new driver from Windows Update | Yes | Driver will not migrate to new OS | The currently installed version of a driver won’t migrate to the new operating system; however, a newer, compatible version is available from Windows Update. | Although a compatible version of the driver is installed during upgrade, a newer version is available from Windows Update. If the computer automatically receives updates from Windows Update, no action is required. Otherwise, replace the new in-box driver with the Windows Update version after upgrading. |
+
+Select **Export computers** to view pilot-ready computers organized by operating system. After you select the computers you want to use in a pilot, click Export to generate and save a comma-separated value (csv) file.
+
+>**Important**> When viewing inventory items in table view, the maximum number of rows that can be viewed and exported is limited to 5,000. If you need to view or export more than 5,000 items, reduce the scope of the query so you can export fewer items at a time.
diff --git a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md
index 8ad77cca4e..a56896ded3 100644
--- a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md
+++ b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md
@@ -2,20 +2,23 @@
title: Upgrade Readiness deployment script (Windows 10)
ms.reviewer:
manager: laurawi
-ms.author: greglin
+ms.author: jaimeo
description: Deployment script for Upgrade Readiness.
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: deploy
audience: itpro
-author: greg-lindsay
+author: jaimeo
ms.topic: article
ms.collection: M365-analytics
---
# Upgrade Readiness deployment script
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
To automate the steps provided in [Get started with Upgrade Readiness](upgrade-readiness-get-started.md), and to troubleshoot data sharing issues, you can run the [Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409), developed by Microsoft.
>[!IMPORTANT]
@@ -140,7 +143,7 @@ Error creating or updating registry key: **CommercialId** at **HKLM:\SOFTWARE\Mi
| 45 - Diagtrack.dll was not found. | Update the device using Windows Update or Windows Server Update Services. |
| 48 - **CommercialID** mentioned in RunConfig.bat should be a GUID. | Copy the commercial ID from your workspace. To find your commercial ID, first navigate to the Solutions tab for your workspace in Azure Portal, and then select the solution. From there, select the **Settings** page, where you can find and copy your commercial ID.|
| 50 - Diagtrack Service is not running. | The Diagtrack service is required to send data to Microsoft. Enable and run the "Connected User Experiences and Telemetry" service. |
-| 51 - RunCensus failed with an unexpected exception. | RunCensus explitly runs the process used to collect device information. The method failed with an unexpected exception. The most common cause is incorrect setup of diagnostic data. Check the ExceptionHResult and ExceptionMessage for more details. |
+| 51 - RunCensus failed with an unexpected exception. | RunCensus explicitly runs the process used to collect device information. The method failed with an unexpected exception. The most common cause is incorrect setup of diagnostic data. Check the ExceptionHResult and ExceptionMessage for more details. |
| 52 - DeviceCensus.exe not found on a Windows 10 machine. | On computers running Windows 10, the process devicecensus.exe should be present in the \system32 directory. Error code 52 is returned if the process was not found. Ensure that it exists at the specified location. |
| 53 - There is a different CommercialID present at the GPO path: **HKLM:\SOFTWARE\Policies\Microsoft \Windows\DataCollection**. This will take precedence over the CommercialID provided in the script. | Provide the correct CommercialID at the GPO location. |
| 54 - Microsoft Account Sign In Assistant Service is Disabled. | This service is required for devices running Windows 10. The diagnostic data client relies on the Microsoft Account Sign In Assistant (MSA) to get the Global Device ID for the device. Without the MSA service running, the global device ID will not be generated and sent by the client and Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). |
diff --git a/windows/deployment/upgrade/upgrade-readiness-get-started.md b/windows/deployment/upgrade/upgrade-readiness-get-started.md
index 47a7fc7fe2..bbac04bea3 100644
--- a/windows/deployment/upgrade/upgrade-readiness-get-started.md
+++ b/windows/deployment/upgrade/upgrade-readiness-get-started.md
@@ -1,81 +1,82 @@
----
-title: Get started with Upgrade Readiness (Windows 10)
-ms.reviewer:
-manager: laurawi
-description: Explains how to get started with Upgrade Readiness.
-keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics,
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.localizationpriority: medium
-ms.topic: article
-ms.collection: M365-analytics
----
-
-# Get started with Upgrade Readiness
-
->[!IMPORTANT]
->**The OMS portal has been deprecated; you should start using the [Azure portal](https://portal.azure.com) instead as soon as possible.** Many experiences are the same in the two portals, but there are some key differences. See [Windows Analytics in the Azure Portal](../update/windows-analytics-azure-portal.md) for steps to use Windows Analytics in the Azure portal. For much more information about the transition from OMS to Azure, see [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition).
-
-This topic explains how to obtain and configure Upgrade Readiness for your organization.
-
-You can use Upgrade Readiness to plan and manage your upgrade project end-to-end. Upgrade Readiness works by establishing communications between computers in your organization and Microsoft. Upgrade Readiness collects computer, application, and driver data for analysis. This data is used to identify compatibility issues that can block your upgrade and to suggest fixes that are known to Microsoft.
-
-Before you begin, consider reviewing the following helpful information:
- - [Upgrade Readiness requirements](upgrade-readiness-requirements.md): Provides detailed requirements to use Upgrade Readiness.
- - [Upgrade Readiness blog](https://techcommunity.microsoft.com/t5/Windows-Analytics-Blog/bg-p/WindowsAnalyticsBlog): Contains announcements of new features and provides helpful tips for using Upgrade Readiness.
-
->If you are using System Center Configuration Manager, also check out information about how to integrate Upgrade Readiness with Configuration Manager: [Integrate Upgrade Readiness with System Center Configuration Manager](https://docs.microsoft.com/sccm/core/clients/manage/upgrade/upgrade-analytics).
-
-When you are ready to begin using Upgrade Readiness, perform the following steps:
-
-1. Review [data collection and privacy](#data-collection-and-privacy) information.
-2. [Add the Upgrade Readiness solution to your Azure subsctiption](#add-the-upgrade-readiness-solution-to-your-azure-subscription).
-3. [Enroll devices in Windows Analytics](#enroll-devices-in-windows-analytics).
-4. [Use Upgrade Readiness to manage Windows Upgrades](#use-upgrade-readiness-to-manage-windows-upgrades) once your devices are enrolled.
-
-## Data collection and privacy
-
-To enable system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see the following topics, refer to [Frequently asked questions and troubleshooting Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-FAQ-troubleshooting), which discusses the issues and provides links to still more detailed information.
-
-## Add the Upgrade Readiness solution to your Azure subscription
-
-Upgrade Readiness is offered as a *solution* which you link to a new or existing [Azure Log Analytics](https://azure.microsoft.com/services/log-analytics/) *workspace* within your Azure *subscription*. To configure this, follows these steps:
-
-1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal.
-
- >[!NOTE]
- > Upgrade Readiness is included at no additional cost with Windows 10 Professional, Education, and Enterprise editions. An Azure subscription is required for managing and using Upgrade Readiness, but no Azure charges are expected to accrue to the subscription as a result of using Upgrade Readiness.
-
-2. In the Azure portal select **Create a resource**, search for "Upgrade Readiness", and then select **Create** on the **Upgrade Readiness** solution.
- 
-
- 
-3. Choose an existing workspace or create a new workspace to host the Upgrade Readiness solution.
- 
- - If you are using other Windows Analytics solutions (Device Health or Update Compliance) you should add Upgrade Readiness to the same workspace.
- - If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started:
- - Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*.
- - For the resource group setting select **Create new** and use the same name you chose for your new workspace.
- - For the location setting, choose the Azure region where you would prefer the data to be stored.
- - For the pricing tier select **per GB**.
-4. Now that you have selected a workspace, you can go back to the Upgrade Readiness blade and select **Create**.
- 
-5. Watch for a Notification (in the Azure portal) that "Deployment 'Microsoft.CompatibilityAssessmentOMS' to resource group 'YourResourceGroupName' was successful." and then select **Go to resource** This might take several minutes to appear.
- 
- - Suggestion: Choose the **Pin to Dashboard** option to make it easy to navigate to your newly added Upgrade Readiness solution.
- - Suggestion: If a "resource unavailable" error occurs when navigating to the solution, try again after one hour.
-
-## Enroll devices in Windows Analytics
-
-
-Once you've added Upgrade Readiness to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For full instructions, see [Enrolling devices in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started).
-
-
-
-## Use Upgrade Readiness to manage Windows Upgrades
-
-Now that your devices are enrolled, you can move on to [Use Upgrade Readiness to manage Windows Upgrades](https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades).
+---
+title: Get started with Upgrade Readiness (Windows 10)
+ms.reviewer:
+manager: laurawi
+description: Explains how to get started with Upgrade Readiness.
+keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics,
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: deploy
+audience: itpro
+author: jaimeo
+ms.author: jaimeo
+ms.localizationpriority: medium
+ms.topic: article
+ms.collection: M365-analytics
+---
+
+# Get started with Upgrade Readiness
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+This topic explains how to obtain and configure Upgrade Readiness for your organization.
+
+You can use Upgrade Readiness to plan and manage your upgrade project end to end. Upgrade Readiness works by establishing communications between computers in your organization and Microsoft. Upgrade Readiness collects computer, application, and driver data for analysis. This data is used to identify compatibility issues that can block your upgrade and to suggest fixes that are known to Microsoft.
+
+Before you begin, consider reviewing the following helpful information:
+ - [Upgrade Readiness requirements](upgrade-readiness-requirements.md): Provides detailed requirements to use Upgrade Readiness.
+ - [Upgrade Readiness blog](https://techcommunity.microsoft.com/t5/Windows-Analytics-Blog/bg-p/WindowsAnalyticsBlog): Contains announcements of new features and provides helpful tips for using Upgrade Readiness.
+
+>If you are using System Center Configuration Manager, also check out information about how to integrate Upgrade Readiness with Configuration Manager: [Integrate Upgrade Readiness with System Center Configuration Manager](https://docs.microsoft.com/sccm/core/clients/manage/upgrade/upgrade-analytics).
+
+When you are ready to begin using Upgrade Readiness, perform the following steps:
+
+1. Review [data collection and privacy](#data-collection-and-privacy) information.
+2. [Add the Upgrade Readiness solution to your Azure subscription](#add-the-upgrade-readiness-solution-to-your-azure-subscription).
+3. [Enroll devices in Windows Analytics](#enroll-devices-in-windows-analytics).
+4. [Use Upgrade Readiness to manage Windows Upgrades](#use-upgrade-readiness-to-manage-windows-upgrades) once your devices are enrolled.
+
+## Data collection and privacy
+
+To enable system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see [Frequently asked questions and troubleshooting Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-FAQ-troubleshooting), which discusses the issues and provides links to still more detailed information.
+
+## Add the Upgrade Readiness solution to your Azure subscription
+
+Upgrade Readiness is offered as a *solution* which you link to a new or existing [Azure Log Analytics](https://azure.microsoft.com/services/log-analytics/) *workspace* within your Azure *subscription*. To configure this, follow these steps:
+
+1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal.
+
+ >[!NOTE]
+ > Upgrade Readiness is included at no additional cost with Windows 10 Professional, Education, and Enterprise editions. An Azure subscription is required for managing and using Upgrade Readiness, but no Azure charges are expected to accrue to the subscription as a result of using Upgrade Readiness.
+
+2. In the Azure portal select **Create a resource**, search for "Upgrade Readiness", and then select **Create** on the **Upgrade Readiness** solution.
+ 
+
+ 
+3. Choose an existing workspace or create a new workspace to host the Upgrade Readiness solution.
+ 
+ - If you are using other Windows Analytics solutions (Device Health or Update Compliance) you should add Upgrade Readiness to the same workspace.
+ - If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started:
+ - Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*.
+ - For the resource group setting select **Create new** and use the same name you chose for your new workspace.
+ - For the location setting, choose the Azure region where you would prefer the data to be stored.
+ - For the pricing tier select **per GB**.
+4. Now that you have selected a workspace, you can go back to the Upgrade Readiness blade and select **Create**.
+ 
+5. Watch for a Notification (in the Azure portal) that "Deployment 'Microsoft.CompatibilityAssessmentOMS' to resource group 'YourResourceGroupName' was successful." and then select **Go to resource** This might take several minutes to appear.
+ 
+ - Suggestion: Choose the **Pin to Dashboard** option to make it easy to navigate to your newly added Upgrade Readiness solution.
+ - Suggestion: If a "resource unavailable" error occurs when navigating to the solution, try again after one hour.
+
+## Enroll devices in Windows Analytics
+
+
+Once you've added Upgrade Readiness to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For full instructions, see [Enrolling devices in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started).
+
+
+
+## Use Upgrade Readiness to manage Windows Upgrades
+
+Now that your devices are enrolled, you can move on to [Use Upgrade Readiness to manage Windows Upgrades](https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades).
diff --git a/windows/deployment/upgrade/upgrade-readiness-identify-apps.md b/windows/deployment/upgrade/upgrade-readiness-identify-apps.md
index 4c4477de3c..61818a5efc 100644
--- a/windows/deployment/upgrade/upgrade-readiness-identify-apps.md
+++ b/windows/deployment/upgrade/upgrade-readiness-identify-apps.md
@@ -1,41 +1,45 @@
----
-title: Upgrade Readiness - Identify important apps (Windows 10)
-ms.reviewer:
-manager: laurawi
-ms.author: greglin
-description: Describes how to prepare your environment so that you can use Upgrade Readiness to manage Windows upgrades.
-ms.prod: w10
-audience: itpro
author: greg-lindsay
-ms.topic: article
-ms.collection: M365-analytics
----
-
-# Upgrade Readiness - Step 1: Identify important apps
-
-This is the first step of the Upgrade Readiness workflow. In this step, applications are listed and grouped by importance level. Setting the importance level enables you to prioritize applications for upgrade.
-
-
-
-
-
-Select **Assign importance** to change an application’s importance level. By default, applications are marked **Not reviewed** or **Low install count** until you assign a different importance level to them.
-
-To change an application’s importance level:
-
-1. Select **Not reviewed** or **Low install count** on the **Prioritize applications** blade to view the list of applications with that importance level.
-2. Select the applications you want to change to a specific importance level and then select the appropriate option from the **Select importance level** list.
-3. Click **Save** when finished.
-
-Importance levels include:
-
-| Importance level | When to use it | Recommendation |
-|--------------------|------------------|------------------|
-| Low install count | We give you a head start by identifying applications that are installed on 2% or less of your total computer inventory. \[Number of computers application is installed on/total number of computers in your inventory.\] Low install count applications are automatically marked as **Ready to upgrade** in the **UpgradeDecision** column unless they have issues that need attention. | Be sure to review low install count applications for any business critical or important applications that are not yet upgrade-ready, despite their low installation rates. For example, payroll apps or tax accounting apps tend to be installed on a relatively small number of machines but are still considered business critical applications. |
-| Not reviewed | Applications that are installed on more than 2% of your total computer inventory are marked not reviewed until you set their importance level. | Once you’ve started to investigate an application to determine its importance level and upgrade readiness, change its status to **Review in progress** in both the **Importance** and **UpgradeDecision** columns. |
-| Business critical | By default, no applications are marked as business critical because only you can make that determination. If you know that an application is critical to your organization’s functioning, mark it **Business critical**. | You may also want to change the application’s status to **Review in progress** in the **UpgradeDecision** column to let other team members know that you’re working on getting this business critical application upgrade-ready. Once you’ve fixed any issues and validated that the application will migrate successfully, change the upgrade decision to **Ready to upgrade**. |
-| Important | By default, no applications are marked as important because only you can make that determination. If the application is important but not critical to your organization’s functioning, mark it **Important**. | You may also want to change the application’s status to **Review in progress** in the **UpgradeDecision** column to let other team members know that you’re working on getting this important application upgrade-ready. Once you’ve fixed any issues and validated that the application will migrate successfully, change the upgrade decision to **Ready to upgrade**. |
-| Ignore | By default, no applications are marked as ignore because only you can make that determination. If the application is not important to your organization’s functioning, such as user-installed applications and games, you may not want to spend time and money validating that these applications will migrate successfully. Mark these applications **Ignore**. | Set the application’s importance level to **Ignore** to let other team members know that it can be left as-is with no further investigation or testing. If you set the importance level to ignore, and this is an app that you are not planning on testing or validating, consider changing the upgrade decision to **Ready to upgrade**. By marking these apps ready to upgrade, you are indicating that you are comfortable upgrading with the app remaining in its current state. |
-| Review in progress | Once you’ve started to investigate an application to determine its importance level and upgrade readiness, change its status to **Review in progress** in both the **Importance** and **UpgradeDecision** columns. | As you learn more about the application’s importance to your organization’s functioning, change the importance level to **Business critical**, **Important**, or **Ignore**. Until you’ve determined that priority applications will migrate successfully, leave the upgrade decision status as **Review in progress**. |
-
+---
+title: Upgrade Readiness - Identify important apps (Windows 10)
+ms.reviewer:
+manager: laurawi
+ms.author: jaimeo
+description: Describes how to prepare your environment so that you can use Upgrade Readiness to manage Windows upgrades.
+ms.prod: w10
+audience: itpro
+author: jaimeo
+ms.topic: article
+ms.collection: M365-analytics
+---
+
+# Upgrade Readiness - Step 1: Identify important apps
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+This is the first step of the Upgrade Readiness workflow. In this step, applications are listed and grouped by importance level. Setting the importance level enables you to prioritize applications for upgrade.
+
+
+
+
+
+Select **Assign importance** to change an application’s importance level. By default, applications are marked **Not reviewed** or **Low install count** until you assign a different importance level to them.
+
+To change an application’s importance level:
+
+1. Select **Not reviewed** or **Low install count** on the **Prioritize applications** blade to view the list of applications with that importance level.
+2. Select the applications you want to change to a specific importance level and then select the appropriate option from the **Select importance level** list.
+3. Click **Save** when finished.
+
+Importance levels include:
+
+| Importance level | When to use it | Recommendation |
+|--------------------|------------------|------------------|
+| Low install count | We give you a head start by identifying applications that are installed on 2% or less of your total computer inventory. \[Number of computers application is installed on/total number of computers in your inventory.\] Low install count applications are automatically marked as **Ready to upgrade** in the **UpgradeDecision** column unless they have issues that need attention. | Be sure to review low install count applications for any business critical or important applications that are not yet upgrade-ready, despite their low installation rates. For example, payroll apps or tax accounting apps tend to be installed on a relatively small number of machines but are still considered business critical applications. |
+| Not reviewed | Applications that are installed on more than 2% of your total computer inventory are marked not reviewed until you set their importance level. | Once you’ve started to investigate an application to determine its importance level and upgrade readiness, change its status to **Review in progress** in both the **Importance** and **UpgradeDecision** columns. |
+| Business critical | By default, no applications are marked as business critical because only you can make that determination. If you know that an application is critical to your organization’s functioning, mark it **Business critical**. | You may also want to change the application’s status to **Review in progress** in the **UpgradeDecision** column to let other team members know that you’re working on getting this business critical application upgrade-ready. Once you’ve fixed any issues and validated that the application will migrate successfully, change the upgrade decision to **Ready to upgrade**. |
+| Important | By default, no applications are marked as important because only you can make that determination. If the application is important but not critical to your organization’s functioning, mark it **Important**. | You may also want to change the application’s status to **Review in progress** in the **UpgradeDecision** column to let other team members know that you’re working on getting this important application upgrade-ready. Once you’ve fixed any issues and validated that the application will migrate successfully, change the upgrade decision to **Ready to upgrade**. |
+| Ignore | By default, no applications are marked as ignore because only you can make that determination. If the application is not important to your organization’s functioning, such as user-installed applications and games, you may not want to spend time and money validating that these applications will migrate successfully. Mark these applications **Ignore**. | Set the application’s importance level to **Ignore** to let other team members know that it can be left as-is with no further investigation or testing. If you set the importance level to ignore, and this is an app that you are not planning on testing or validating, consider changing the upgrade decision to **Ready to upgrade**. By marking these apps ready to upgrade, you are indicating that you are comfortable upgrading with the app remaining in its current state. |
+| Review in progress | Once you’ve started to investigate an application to determine its importance level and upgrade readiness, change its status to **Review in progress** in both the **Importance** and **UpgradeDecision** columns. | As you learn more about the application’s importance to your organization’s functioning, change the importance level to **Business critical**, **Important**, or **Ignore**. Until you’ve determined that priority applications will migrate successfully, leave the upgrade decision status as **Review in progress**. |
+
diff --git a/windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md b/windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md
index 1aee2eb281..7fdb58ffe0 100644
--- a/windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md
+++ b/windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md
@@ -1,51 +1,55 @@
----
-title: Monitor deployment with Upgrade Readiness
-ms.reviewer:
-manager: laurawi
-description: Describes how to use Upgrade Readiness to monitor the deployment after Windows upgrades.
-keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics,
-ms.localizationpriority: medium
-ms.prod: w10
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.topic: article
-ms.collection: M365-analytics
----
-
-# Upgrade Readiness - Step 4: Monitor
-
-Now that you have started deploying an update with Upgrade Readiness, you can use it to monitor important elements.
-
-
-
-
-## Update progress
-
-The **Update progress** blade allows you to monitor the progress and status of your deployment. Any device that has attepted to upgrade in the last 30 days displays the **DeploymentStatus** attribute. You'll be able to see the number of computers that have successfully upgraded, failed to upgrade, are stalled, etc.
-
-
-Selecting this blade allows you to view device-level details about the deployment. For example, select **Failed** to view the original operating system version, the target operating system version, and the reason the update failed for each of the devices that failed to upgrade. In the case of the device illustrated in the following image, an attempt was made to upgrade from Windows 10, version 1703 to 1709, but the operation timed out.
-
-
-
-
-## Driver issues
-
-The **Driver issues** blade allows you to see Device Manager errors for your upgraded devices. We include data for all compatibility-related device errors, such as "driver not found" and "driver not started." The blade summarizes errors by error type, but you can select a particular error type to see device-level details about which device(s) are failing and where to obtain a driver.
-
-
-For example, by selecting error code **28 - driver not installed**, you would see that the device in the following image is missing the driver for a network controller. Upgrade Readiness also notifies that a suitable driver is available online through Windows Update. If this device is configured to automatically receive updates from Windows Update, this issue would likely resolve itself following the device's next Windows Update scan. If this device does not automatically receive updates from Windows Update, you would need to deliver the driver manually.
-
-
-
-## User feedback
-
-The **User Feedback** blade focuses on gathering subjective feedback from your end users. If a user submits feedback through the Feedback Hub app on a device in your workspace, we will make that feedback visible to you in this blade. The Feedback Hub app is built into Windows 10 and can be accessed by typing "Feedback Hub" in the Cortana search bar.
-
-
-We recommend that you encourage your end users to submit any feedback they have through Feedback Hub. Not only will this feedback be sent directly to Microsoft for review, but you'll also be able to see it by using Upgrade Readiness. You should be aware that **feedback submitted through Feedback Hub will be publicly visible**, so it's best to avoid submitting feedback about internal line-of-business applications.
-
-When viewing user feedback in Upgrade Readiness, you'll be able to see the raw "Title" and "Feedback" text from the user's submission in Feedback Hub, as well as the number of upvotes the submission has received. (Since feedback is publicly visible, the number of upvotes is a global value and not specific to your company.) If a Microsoft engineer has responded to the submission in Feedback Hub, we'll pull in the Microsoft response for you to see as well.
-
-
-
+---
+title: Monitor deployment with Upgrade Readiness
+ms.reviewer:
+manager: laurawi
+description: Describes how to use Upgrade Readiness to monitor the deployment after Windows upgrades.
+keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics,
+ms.localizationpriority: medium
+ms.prod: w10
+audience: itpro
+author: jaimeo
+ms.author: jaimeo
+ms.topic: article
+ms.collection: M365-analytics
+---
+
+# Upgrade Readiness - Step 4: Monitor
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+Now that you have started deploying an update with Upgrade Readiness, you can use it to monitor important elements.
+
+
+
+
+## Update progress
+
+The **Update progress** blade allows you to monitor the progress and status of your deployment. Any device that has attempted to upgrade in the last 30 days displays the **DeploymentStatus** attribute. You'll be able to see the number of computers that have successfully upgraded, failed to upgrade, are stalled, etc.
+
+
+Selecting this blade allows you to view device-level details about the deployment. For example, select **Failed** to view the original operating system version, the target operating system version, and the reason the update failed for each of the devices that failed to upgrade. In the case of the device illustrated in the following image, an attempt was made to upgrade from Windows 10, version 1703 to 1709, but the operation timed out.
+
+
+
+
+## Driver issues
+
+The **Driver issues** blade allows you to see Device Manager errors for your upgraded devices. We include data for all compatibility-related device errors, such as "driver not found" and "driver not started." The blade summarizes errors by error type, but you can select a particular error type to see device-level details about which device(s) are failing and where to obtain a driver.
+
+
+For example, by selecting error code **28 - driver not installed**, you would see that the device in the following image is missing the driver for a network controller. Upgrade Readiness also notifies that a suitable driver is available online through Windows Update. If this device is configured to automatically receive updates from Windows Update, this issue would likely resolve itself following the device's next Windows Update scan. If this device does not automatically receive updates from Windows Update, you would need to deliver the driver manually.
+
+
+
+## User feedback
+
+The **User Feedback** blade focuses on gathering subjective feedback from your end users. If a user submits feedback through the Feedback Hub app on a device in your workspace, we will make that feedback visible to you in this blade. The Feedback Hub app is built into Windows 10 and can be accessed by typing "Feedback Hub" in the Cortana search bar.
+
+
+We recommend that you encourage your end users to submit any feedback they have through Feedback Hub. Not only will this feedback be sent directly to Microsoft for review, but you'll also be able to see it by using Upgrade Readiness. You should be aware that **feedback submitted through Feedback Hub will be publicly visible**, so it's best to avoid submitting feedback about internal line-of-business applications.
+
+When viewing user feedback in Upgrade Readiness, you'll be able to see the raw "Title" and "Feedback" text from the user's submission in Feedback Hub, as well as the number of upvotes the submission has received. (Since feedback is publicly visible, the number of upvotes is a global value and not specific to your company.) If a Microsoft engineer has responded to the submission in Feedback Hub, we'll pull in the Microsoft response for you to see as well.
+
+
+
diff --git a/windows/deployment/upgrade/upgrade-readiness-requirements.md b/windows/deployment/upgrade/upgrade-readiness-requirements.md
index 582f5bb732..5de1e052e6 100644
--- a/windows/deployment/upgrade/upgrade-readiness-requirements.md
+++ b/windows/deployment/upgrade/upgrade-readiness-requirements.md
@@ -1,76 +1,80 @@
----
-title: Upgrade Readiness requirements (Windows 10)
-ms.reviewer:
-manager: laurawi
-description: Provides requirements for Upgrade Readiness.
-keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics,
-ms.prod: w10
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.localizationpriority: medium
-ms.topic: article
-ms.collection: M365-analytics
----
-
-# Upgrade Readiness requirements
-
-This article introduces concepts and steps needed to get up and running with Upgrade Readiness. We recommend that you review this list of requirements before getting started as you may need to collect information, such as account credentials, and get approval from internal IT groups, such as your network security group, before you can start using Upgrade Readiness.
-
-## Supported upgrade paths
-
-### Windows 7 and Windows 8.1
-
-To perform an in-place upgrade, user computers must be running the latest version of either Windows 7 SP1 or Windows 8.1. After you enable Windows diagnostic data, Upgrade Readiness performs a full inventory of computers so that you can see which version of Windows is installed on each computer.
-
-The compatibility update that sends diagnostic data from user computers to Microsoft data centers works with Windows 7 SP1 and Windows 8.1 only. Upgrade Readiness cannot evaluate Windows XP or Windows Vista for upgrade eligibility.
-
-
-
-If you need to update user computers to Windows 7 SP1 or Windows 8.1, use Windows Update or download and deploy the applicable package from the Microsoft Download Center.
-
-> [!NOTE]
-> Upgrade Readiness is designed to best support in-place upgrades. In-place upgrades do not support migrations from BIOS to UEFI or from 32-bit to 64-bit architecture. If you need to migrate computers in these scenarios, use the wipe-and-reload method. Upgrade Readiness insights are still valuable in this scenario, however, you can ignore in-place upgrade specific guidance.
-
-See [Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications) for additional information about computer system requirements.
-
-### Windows 10
-
-Keeping Windows 10 up to date involves deploying a feature update, and Upgrade Readiness tools help you prepare and plan for these Windows updates.
-The latest cumulative updates must be installed on Windows 10 computers to make sure that the required compatibility updates are installed. You can find the latest cumulative update on the [Microsoft Update Catalog](https://catalog.update.microsoft.com).
-
-While Upgrade Readiness can be used to assist with updating devices from Windows 10 Long-Term Servicing Channel (LTSC) to Windows 10 Semi-Annual Channel, Upgrade Readiness does not support updates to Windows 10 LTSC. The Long-Term Servicing Channel of Windows 10 is not intended for general deployment, and does not receive feature updates, therefore it is not a supported target with Upgrade Readiness. See [Windows as a service overview](../update/waas-overview.md#long-term-servicing-channel) to understand more about LTSC.
-
-## Operations Management Suite or Azure Log Analytics
-
-Upgrade Readiness is offered as a solution in Azure Portal and Azure Log Analytics, a collection of cloud-based services for managing on premises and cloud computing environments. For more information about Azure Portal, see [Windows Analytics in the Azure Portal](../update/windows-analytics-azure-portal.md) or the Azure [Log Analytics overview](https://azure.microsoft.com/services/log-analytics/).
-
-If you’re already using Azure Portal or Azure Log Analytics, you’ll find Upgrade Readiness in the Solutions Gallery. Click the **Upgrade Readiness** tile in the gallery and then click **Add** on the solution’s details page. Upgrade Readiness is now visible in your workspace.
-
-If you are not using Azure Portal or Azure Log Analytics, go to [Log Analytics](https://azure.microsoft.com/services/log-analytics/) on Microsoft.com and select **Start free** to start the setup process. During the process, you’ll create a workspace and add the Upgrade Readiness solution to it.
-
->[!IMPORTANT]
->You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory, use a Work or School account when you sign in to Azure Portal. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in Azure Portal. You also need an Azure subscription to link to your Azure Portal workspace. The account you used to create the workspace must have administrator permissions on the Azure subscription in order to link the workspace to the Azure account. Once the link has been established, you can revoke the administrator permissions.
-
-## System Center Configuration Manager integration
-
-Upgrade Readiness can be integrated with your installation of Configuration Manager. For more information, see [Integrate Upgrade Readiness with System Center Configuration Manager](https://docs.microsoft.com/sccm/core/clients/manage/upgrade/upgrade-analytics).
-
-
-
-## Important information about this release
-
-Before you get started configuring Upgrade Anatlyics, review the following tips and limitations about this release.
-
-**Upgrade Readiness does not support on-premises Windows deployments.** Upgrade Readiness is built as a cloud service, which allows Upgrade Readiness to provide you with insights based on the data from user computers and other Microsoft compatibility services. Cloud services are easy to get up and running and are cost-effective because there is no requirement to physically implement and maintain services on-premises.
-
-**In-region data storage requirements.** Windows diagnostic data from user computers is encrypted, sent to, and processed at Microsoft-managed secure data centers located in the US. Our analysis of the upgrade readiness-related data is then provided to you through the Upgrade Readiness solution in Azure Portal. Upgrade Readiness is supported in all Azure regions; however, selecting an international Azure region does not prevent diagnostic data from being sent to and processed in Microsoft's secure data centers in the US.
-
-### Tips
-
-- When viewing inventory items in table view, the maximum number of rows that can be viewed and exported is limited to 5,000. If you need to view or export more than 5,000 items, reduce the scope of the query so you can export a list with fewer items.
-
-- Sorting data by clicking a column heading may not sort your complete list of items. For information about how to sort data in Azure Portal, see [Sorting DocumentDB data using Order By](https://azure.microsoft.com/documentation/articles/documentdb-orderby).
-
-## Get started
-
-See [Get started with Upgrade Readiness](upgrade-readiness-get-started.md) for detailed, step-by-step instructions for configuring Upgrade Readiness and getting started on your Windows upgrade project.
+---
+title: Upgrade Readiness requirements (Windows 10)
+ms.reviewer:
+manager: laurawi
+description: Provides requirements for Upgrade Readiness.
+keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics,
+ms.prod: w10
+audience: itpro
+author: jaimeo
+ms.author: jaimeo
+ms.localizationpriority: medium
+ms.topic: article
+ms.collection: M365-analytics
+---
+
+# Upgrade Readiness requirements
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+This article introduces concepts and steps needed to get up and running with Upgrade Readiness. We recommend that you review this list of requirements before getting started as you may need to collect information, such as account credentials, and get approval from internal IT groups, such as your network security group, before you can start using Upgrade Readiness.
+
+## Supported upgrade paths
+
+### Windows 7 and Windows 8.1
+
+To perform an in-place upgrade, user computers must be running the latest version of either Windows 7 SP1 or Windows 8.1. After you enable Windows diagnostic data, Upgrade Readiness performs a full inventory of computers so that you can see which version of Windows is installed on each computer.
+
+The compatibility update that sends diagnostic data from user computers to Microsoft data centers works with Windows 7 SP1 and Windows 8.1 only. Upgrade Readiness cannot evaluate Windows XP or Windows Vista for upgrade eligibility.
+
+
+
+If you need to update user computers to Windows 7 SP1 or Windows 8.1, use Windows Update or download and deploy the applicable package from the Microsoft Download Center.
+
+> [!NOTE]
+> Upgrade Readiness is designed to best support in-place upgrades. In-place upgrades do not support migrations from BIOS to UEFI or from 32-bit to 64-bit architecture. If you need to migrate computers in these scenarios, use the wipe-and-reload method. Upgrade Readiness insights are still valuable in this scenario, however, you can ignore in-place upgrade specific guidance.
+
+See [Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications) for additional information about computer system requirements.
+
+### Windows 10
+
+Keeping Windows 10 up to date involves deploying a feature update, and Upgrade Readiness tools help you prepare and plan for these Windows updates.
+The latest cumulative updates must be installed on Windows 10 computers to make sure that the required compatibility updates are installed. You can find the latest cumulative update on the [Microsoft Update Catalog](https://catalog.update.microsoft.com).
+
+While Upgrade Readiness can be used to assist with updating devices from Windows 10 Long-Term Servicing Channel (LTSC) to Windows 10 Semi-Annual Channel, Upgrade Readiness does not support updates to Windows 10 LTSC. The Long-Term Servicing Channel of Windows 10 is not intended for general deployment, and does not receive feature updates, therefore it is not a supported target with Upgrade Readiness. See [Windows as a service overview](../update/waas-overview.md#long-term-servicing-channel) to understand more about LTSC.
+
+## Operations Management Suite or Azure Log Analytics
+
+Upgrade Readiness is offered as a solution in Azure Portal and Azure Log Analytics, a collection of cloud-based services for managing on premises and cloud computing environments. For more information about Azure Portal, see [Windows Analytics in the Azure Portal](../update/windows-analytics-azure-portal.md) or the Azure [Log Analytics overview](https://azure.microsoft.com/services/log-analytics/).
+
+If you’re already using Azure Portal or Azure Log Analytics, you’ll find Upgrade Readiness in the Solutions Gallery. Click the **Upgrade Readiness** tile in the gallery and then click **Add** on the solution’s details page. Upgrade Readiness is now visible in your workspace.
+
+If you are not using Azure Portal or Azure Log Analytics, go to [Log Analytics](https://azure.microsoft.com/services/log-analytics/) on Microsoft.com and select **Start free** to start the setup process. During the process, you’ll create a workspace and add the Upgrade Readiness solution to it.
+
+>[!IMPORTANT]
+>You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory, use a Work or School account when you sign in to Azure Portal. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in Azure Portal. You also need an Azure subscription to link to your Azure Portal workspace. The account you used to create the workspace must have administrator permissions on the Azure subscription in order to link the workspace to the Azure account. Once the link has been established, you can revoke the administrator permissions.
+
+## System Center Configuration Manager integration
+
+Upgrade Readiness can be integrated with your installation of Configuration Manager. For more information, see [Integrate Upgrade Readiness with System Center Configuration Manager](https://docs.microsoft.com/sccm/core/clients/manage/upgrade/upgrade-analytics).
+
+
+
+## Important information about this release
+
+Before you get started configuring Upgrade Readiness, review the following tips and limitations about this release.
+
+**Upgrade Readiness does not support on-premises Windows deployments.** Upgrade Readiness is built as a cloud service, which allows Upgrade Readiness to provide you with insights based on the data from user computers and other Microsoft compatibility services. Cloud services are easy to get up and running and are cost-effective because there is no requirement to physically implement and maintain services on-premises.
+
+**In-region data storage requirements.** Windows diagnostic data from user computers is encrypted, sent to, and processed at Microsoft-managed secure data centers located in the US. Our analysis of the upgrade readiness-related data is then provided to you through the Upgrade Readiness solution in Azure Portal. Upgrade Readiness is supported in all Azure regions; however, selecting an international Azure region does not prevent diagnostic data from being sent to and processed in Microsoft's secure data centers in the US.
+
+### Tips
+
+- When viewing inventory items in table view, the maximum number of rows that can be viewed and exported is limited to 5,000. If you need to view or export more than 5,000 items, reduce the scope of the query so you can export a list with fewer items.
+
+- Sorting data by clicking a column heading may not sort your complete list of items. For information about how to sort data in Azure Portal, see [Sorting DocumentDB data using Order By](https://azure.microsoft.com/documentation/articles/documentdb-orderby).
+
+## Get started
+
+See [Get started with Upgrade Readiness](upgrade-readiness-get-started.md) for detailed, step-by-step instructions for configuring Upgrade Readiness and getting started on your Windows upgrade project.
diff --git a/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md b/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md
index 6d2a66ecdc..2c58536bd5 100644
--- a/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md
+++ b/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md
@@ -1,216 +1,220 @@
----
-title: Upgrade Readiness - Resolve application and driver issues (Windows 10)
-ms.reviewer:
-manager: laurawi
-description: Describes how to resolve application and driver issues that can occur during an upgrade with Upgrade Readiness.
-keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics,
-ms.prod: w10
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.localizationpriority: medium
-ms.topic: article
-ms.collection: M365-analytics
----
-
-# Upgrade Readiness - Step 2: Resolve app and driver issues
-
-This section of the Upgrade Readiness workflow reports application and driver inventory and shows you which applications have known issues, which applications have no known issues, and which drivers have issues. We identify applications and drivers that need attention and suggest fixes when we know about them.
-
-## In this section
-
-The blades in the **Step 2: Resolve issues** section are:
-
-- [Review applications with known issues](#review-applications-with-known-issues)
-- [Review known driver issues](#review-drivers-with-known-issues)
-- [Review low-risk apps and drivers](#review-low-risk-apps-and-drivers)
-- [Prioritize app and driver testing](#prioritize-app-and-driver-testing)
-
->You can change an application’s upgrade decision and a driver’s upgrade decision from the blades in this section. To change an application’s or a driver’s importance level, select **User changes**. Select the item you want to change and then select the appropriate option from the **Select upgrade decision** list.
-
-Upgrade decisions include:
-
-
-| Upgrade decision | When to use it | Guidance |
-|--------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| Not reviewed | All drivers are marked as Not reviewed by default. Any app that has not been marked **Low install count** will also have an upgrade decision of **Not reviewed** by default. | Apps you have not yet reviewed or are waiting to review later should be marked as **Not reviewed**. When you start to investigate an application or a driver to determine upgrade readiness, change their upgrade decision to **Review in progress**. |
-| Review in progress | When you start to investigate an application or a driver to determine upgrade readiness, change its upgrade decision to **Review in progress**. Until you’ve determined that applications and drivers will migrate successfully or you’ve resolved blocking issues, leave the upgrade decision status as **Review in progress**. | Once you’ve fixed any issues and validated that the application or driver will migrate successfully, change the upgrade decision to **Ready to upgrade**. |
-| Ready to upgrade | Mark applications and drivers **Ready to upgrade** once you’ve resolved all blocking issues and you’re confident that they will upgrade successfully, or if you’ve decided to upgrade them as-is. | Applications with no known issues and with low installation rates are marked **Ready to upgrade** by default. In Step 1, you might have marked some of your apps as **Ignore**. These should be marked as **Ready to upgrade**. Apps with low installation rates are marked as **Ready to upgrade** by default. Be sure to review any low install count applications for any business critical or important applications that are not yet upgrade-ready, despite their low installation rates. |
-| Won’t upgrade | By default, no applications or drivers are marked **Won’t upgrade** because only you can make that determination. Use **Won’t upgrade** for applications and drivers that you do not work on your target operating system, or that you are unable to upgrade. | If, during your investigation into an application or driver, you determine that they should not or cannot be upgraded, mark them **Won’t upgrade**. |
-
-As you review applications with known issues, you can also see ISV support statements or applications using [Ready for Windows](https://www.readyforwindows.com/).
-
-## Review applications with known issues
-
-Applications with issues known to Microsoft are listed, grouped by upgrade assessment into **Attention needed** or **Fix available**.
-
-
-
-
-
-To change an application's upgrade decision:
-
-1. Select **Decide upgrade readiness** to view applications with issues.
-2. In the table view, select an **UpgradeDecision** value.
-3. Select **Decide upgrade readiness** to change the upgrade decision for each application.
-4. Select the applications you want to change to a specific upgrade decision and then select the appropriate option from the **Select upgrade decision** list.
-5. Click **Save** when finished.
-
-IMPORTANT: Ensure that you have the most recent versions of the compatibility update and related KBs installed to get the most up-to-date compatibility information.
-
-For applications assessed as **Attention needed**, review the table below for details about known issues and for guidance about how to resolve them, when possible.
-
-| Upgrade Assessment | Action required prior to upgrade? | Issue | What it means | Guidance |
-|--------------------|-----------------------------------|-----------|-----------------|------------|
-| Attention needed | No | Application is removed during upgrade | Compatibility issues were detected and the application will not migrate to the new operating system. | No action is required for the upgrade to proceed. |
-| Attention needed | Yes | Blocking upgrade | Blocking issues were detected and Upgrade Readiness is not able to remove the application during upgrade. The application may work on the new operating system. | Remove the application before upgrading, and reinstall and test on new operating system. |
-| Attention needed | No | Evaluate application on new OS | The application will migrate, but issues were detected that may impact its performance on the new operating system. | No action is required for the upgrade to proceed, but be sure to test the application on the new operating system. |
-| Attention needed | No | Does not work with new OS, but won’t block upgrade | The application is not compatible with the new operating system, but won’t block the upgrade. | No action is required for the upgrade to proceed, however, you’ll have to install a compatible version of the application on the new operating system. |
-| Attention needed | Yes | Does not work with new OS, and will block upgrade | The application is not compatible with the new operating system and will block the upgrade. | Remove the application before upgrading. A compatible version of the application may be available. |
-| Attention needed | Yes | May block upgrade, test application | Issues were detected that may interfere with the upgrade, but need to be investigated further. | Test the application’s behavior during upgrade. If it blocks the upgrade, remove it before upgrading and reinstall and test it on the new operating system. |
-| Attention needed | Maybe | Multiple | Multiple issues are affecting the application. See detailed view for more information.| When you see Multiple in the query detailed view, click **Query** to see details about what issues were detected with the different versions of the application. |
-
-For applications assessed as **Fix available**, review the table below for details about known issues and ways to fix them that are known to Microsoft.
-
-| Upgrade Assessment | Action required prior to upgrade? | Issue | What it means | Guidance |
-|--------------------|-----------------------------------|----------|-----------------|-------------|
-| Fix available | Yes | Blocking upgrade, update application to newest version | The existing version of the application is not compatible with the new operating system and won’t migrate. A compatible version of the application is available. | Update the application before upgrading. |
-| Fix available | No | Reinstall application after upgrading | The application is compatible with the new operating system, but must be reinstalled after upgrading. The application is removed during the upgrade process. | No action is required for the upgrade to proceed. Reinstall application on the new operating system. |
-| Fix available | Yes | Blocking upgrade, but can be reinstalled after upgrading | The application is compatible with the new operating system, but won’t migrate. | Remove the application before upgrading and reinstall on the new operating system. |
-| Fix available | Yes | Disk encryption blocking upgrade | The application’s encryption features are blocking the upgrade. | Disable the encryption feature before upgrading and enable it again after upgrading. |
-
-### ISV support for applications with Ready for Windows
-
-[Ready for Windows](https://www.readyforwindows.com/) lists software solutions that are supported and in use for Windows 10. This site leverages data about application adoption from commercial Windows 10 installations and helps IT managers upgrade to Windows 10 with confidence. For more information, see [Ready for Windows Frequently Asked Questions](https://developer.microsoft.com/windows/ready-for-windows/#/faq/).
-
-Click **Review Applications With Known Issues** to see the status of applications for Ready for Windows and corresponding guidance. For example:
-
-
-
-If there are known issues with an application, the specific guidance for that known issue takes precedence over the Ready for Windows guidance.
-
-
-
-If you query with RollupLevel="NamePublisher", each version of the application can have a different status for Ready for Windows. In this case, different values appear for Ready for Windows.
-
-
-
-> [!TIP]
-> Within the Upgrade Readiness data model, an object of Type **UAApp** refers to a particular application installed on a specific computer.
->
-> To support dynamic aggregation and summation of data the Upgrade Readiness solution "rolls up" (aggregates) data in preprocessing. Rolling up to the **Granular** level enables display of the **App** level. In Upgrade Readiness terminology, an **App** is a unique combination of: app name, app vendor, app version, and app language. Thus, at the Granular level, you can see attributes such as **total install count**, which is the number of machines with a specific **App** installed.
->
-> Upgrade Readiness also has a roll up level of **NamePublisher**, This level enables you to ignore different app versions within your organization for a particular app. In other words, **NamePublisher** displays statistics about a given app, aggregated across all versions.
-
-The following table lists possible values for **ReadyForWindows** and what they mean. For more information, see [What does the Adoption Status mean?](https://developer.microsoft.com/en-us/windows/ready-for-windows#/faq/?scrollTo=faqStatuses)
-
-| Ready for Windows Status | Query rollup level | What this means | Guidance |
-|-------------------|--------------------------|-----------------|----------|
-|Supported version available | Granular | The software provider has declared support for one or more versions of this application on Windows 10. | The ISV has declared support for a version of this application on Windows 10. |
-| Highly adopted | Granular | This version of this application has been highly adopted within the Windows 10 Enterprise ecosystem. | This application has been installed on at least 100,000 commercial Windows 10 devices. |
-| Adopted | Granular | This version of this application has been adopted within the Windows 10 Enterprise ecosystem. | This application has been installed on at least 10,000 commercial Windows 10 devices. |
-| Insufficient Data | Granular | Too few commercial Windows 10 devices are sharing information about this version of this application for Microsoft to categorize its adoption. | N/A |
-| Contact developer | Granular | There may be compatibility issues with this version of the application, so Microsoft recommends contacting the software provider to learn more. | Check [Ready for Windows](https://www.readyforwindows.com/) for additional information.|
-|Supported version available | NamePublisher | The software provider has declared support for this application on Windows 10. | The ISV has declared support for a version of this application on Windows 10.|
-|Adoption status available | NamePublisher | A Ready for Windows adoption status is available for one or more versions of this application. Please check Ready for Windows to learn more. |Check [Ready for Windows](https://www.readyforwindows.com/) for adoption information for this application.|
-| Unknown | Any | There is no Ready for Windows information available for this version of this application. Information may be available for other versions of the application at [Ready for Windows](https://www.readyforwindows.com/). | N/A |
-
-## Review drivers with known issues
-
-Drivers that won’t migrate to the new operating system are listed, grouped by availability.
-
-
-
-Availability categories are explained in the table below.
-
-| Driver availability | Action required before or after upgrade? | What it means | Guidance |
-|-----------------------|------------------------------------------|----------------|--------------|
-| Available in-box | No, for awareness only | The currently installed version of an application or driver won’t migrate to the new operating system; however, a compatible version is installed with the new operating system. | No action is required for the upgrade to proceed. |
-| Import from Windows Update | Yes | The currently installed version of a driver won’t migrate to the new operating system; however, a compatible version is available from Windows Update. | If the computer automatically receives updates from Windows Update, no action is required. Otherwise, import a new driver from Windows Update after upgrading. |
-| Available in-box and from Windows Update | Yes | The currently installed version of a driver won’t migrate to the new operating system. Although a new driver is installed during upgrade, a newer version is available from Windows Update. | If the computer automatically receives updates from Windows Update, no action is required. Otherwise, import a new driver from Windows Update after upgrading. |
-| Check with vendor | Yes | The driver won’t migrate to the new operating system and we are unable to locate a compatible version. | Check with the independent hardware vendor (IHV) who manufactures the driver for a solution. |
-
-To change a driver’s upgrade decision:
-
-1. Select **Decide upgrade readiness** and then select the group of drivers you want to review. Select **Table** to view the list in a table.
-
-2. Select **User changes** to enable user input.
-
-3. Select the drivers you want to change to a specific upgrade decision and then select the appropriate option from the **Select upgrade decision** list.
-
-4. Click **Save** when finished.
-
-## Review low-risk apps and drivers
-
-Applications and drivers that are meet certain criteria to be considered low risk are displayed on this blade.
-
-
-
-The first row reports the number of your apps that have an official statement of support on Windows 10 from the software vendor, so you can be confident that they will work on your target operating system.
-
-The second row (**Apps that are "Highly adopted"**) shows apps that have a ReadyForWindows status of "Highly adopted". This means that they have been installed on at least 100,000 commercial Windows 10 devices, and that Microsoft has not detected significant issues with the app in diagnostic data. Since these apps are prevalent in the ecosystem at large, you can be confident that they will work in your environment as well.
-
-Each row of the blade uses a different criterion to filter your apps or drivers. You can view a list of applications that meet the criterion by clicking into a row of the blade. For example, if you click the row that says "Apps that are 'Highly adopted'", the result is a list of apps that have a ReadyForWindows status of "Highly adopted". From here, you can bulk-select the results, select **Ready to upgrade**, and then click **Save**. This will mark all apps meeting the "Highly adopted" criterion as "Ready to upgrade"--no further validation is required. Any applications that you have marked as *Mission critical* or *Business critical* are filtered out, as well as any app that has an issue known to Microsoft. This allows you to work with apps in bulk without having to worry about missing a critical app.
-
-You can customize the criteria further by using the Log Search query language. For example, if a ReadyForWindows status of "Adopted" is not sufficient by itself for you to be confident in an app's compatibility, you can add additional filters. To do this, click the row labeled **Apps that are 'Adopted'**. Then, modify the resulting query to fit your company's risk tolerance. If, for example, you prefer that an app must be "Adopted" and have fewer than 1,000 installations, then add *TotalInstalls < 1000* to the end of the Log Search query. Similarly, you can append additional criteria by using other attributes such as monthly active users or app importance.
-
->[!NOTE]
->Apps that you have designated as *Mission critical* or *Business critical* are automatically **excluded** from the counts on this blade. If an app is critical, you should always validate it manually it prior to upgrading.
-
- At the bottom of the blade, the **OTHER APPS AND DRIVERS IN NEED OF REVIEW** section allows you to quickly access apps you have designated as **Mission critical** or **Business critical**, your remaining apps that still need to be reviewed, and your remaining drivers that need to be reviewed.
-
-
-
-## Prioritize app and driver testing
-
-Planning and executing an OS upgrade project can be overwhelming. When you are tasked with evaluating thousands of applications and drivers to ensure a successful upgrade, it can be difficult to decide where to start. The Upgrade Readiness solution provides valuable assistance for you, helping to determine the most important apps and drivers to unblock and enabling you yo create a proposed action plan.
-
-### Proposed action plan
-
-The Upgrade Readiness proposed action plan is an optimally ordered list of apps and drivers that are in need of review. By testing apps and drivers in the order suggested by the proposed action plan, you are able to increase your number of “Ready to upgrade” computers in an efficient manner. The action plan can be a very powerful tool during upgrade planning – but it’s most helpful when it’s used correctly. This topic explains the proposed action plan, describes how to use it, and calls out a few misconceptions and invalid use cases that you should avoid.
-
-The proposed action plan represents the order thath Microsoft recommends you rationalize the upgrade-readiness of your apps and drivers. By validating apps and drivers in the order proposed, you can ensure that you are testing efficiently.
-
-Each item in the proposed action plan represents either an application or a driver that you have not yet marked “Ready to upgrade.”
-
->Since “Low install count” apps are automatically marked “Ready to upgrade”, you will not see any of these apps in the proposed action plan.
-
-Each item in the plan has the following attributes:
-
-| Attribute | Description | Example value |
-|-----------------------|------------------------------------------|----------------|
-| ItemRank | The location of this item in the context of the proposed action plan. For example, the item with ItemRank 7 is the 7th item in the Plan. It is crucial that the Plan is viewed in order by increasing ItemRank. Sorting the Plan in any other way invalidates the insights that the Plan provides. | 7 |
-| ItemType | Whether this item is an app or driver -- possible values are: "App" and "Driver." | App |
-| ItemName | The name of the app or driver that is in need of review. | Microsoft Visual C++ 2005 Redistributable (x64) |
-| ItemVendor | The vendor of the app or driver. | Microsoft Corporation |
-| ItemVersion | The version of the app or driver. | 12.1.0.1 |
-| ItemLanguage | If this item is an application, then this field will be the language of the app. If the item is a driver, then this will say "N/A." | English |
-| ItemHardwareId | If this item is a driver, then this field will be the hardware id of the driver. If the item is an app, then this will say "N/A." | N/A |
-| Upgrade Decision | The upgrade decision you have provided for this app or driver. If you have not defined an upgrade decision, then you will see the default value of “Not reviewed.” | Review in progress |
-| ComputersUnblocked | Assuming you have already marked all previous items in the proposed action plan “Ready to upgrade”, this represents the number of additional computers that will become “Ready to upgrade” by testing this app or driver and giving it an upgrade decision of “Ready to upgrade”. For example, if ComputersUnblocked is 200, then resolving any issues associated with the app/driver in question will make 200 new computers “Ready to upgrade.” | 200 |
-| CumulativeUnblocked | The total number of computers that will become “Ready to upgrade” if you validate and mark this and all prior items in the proposed action plan “Ready to upgrade”. For example, if ItemRank is 7, and CumulativeUnblocked is 950, then fixing items 1 thru 7 in the proposed action plan will cause 950 of your computers to become “Ready to upgrade.” | 950 |
-| CumulativeUnblockedPct | The percentage of your machines that will become “Ready to upgrade” if you make this and all prior items in the proposed action plan “Ready to upgrade.” | 0.24 |
-
-See the following example action plan items (click the image for a full-size view):
-
-
-
-
-In this example, the 3rd item is an application: Microsoft Bing Sports , a modern app, version 4.20.951.0 , published by Microsoft. By validating this app and making its UpgradeDecision “Ready to upgrade”, you can potentially make 1014 computers “Ready to upgrade” – but only after you have already validated items 1 and 2 in the list. By marking items 1, 2, and 3 “Ready to upgrade”, 14779 of your computers will become upgrade-ready. This represents 10.96% of the machines in this workspace.
-
-#### Using the proposed action plan
-
-There are several valid use cases for the proposed action plan. But it’s always important to remember that the information presented in the Plan is only accurate when sorted by increasing Item Rank! Here are three potential cases in which you could use the proposed action plan:
-
-1. Quickly determine how many apps and drivers you’ll need to validate in order to make x% of your computers upgrade-ready. To determine this, simply find the first item in the Plan with a CumulativeUnblockedPct greater than or equal to your desired percentage of upgrade-ready computers. The corresponding ItemRank represents the smallest number of apps and drivers that you can validate in order to reach your upgrade readiness goal. The prior items in the proposed action plan itself represent the most efficient route to reaching your goal.
-
-2. Use the proposed action plan to prepare a small portion of your machines for a pilot of your target Operating System. Let’s say you want to test a new Operating System by upgrading a few hundred computers. You can use the proposed action plan to determine how many apps and drivers you will need to validate before you can be confident that your pilot will be successful.
-
-3. If your project deadline is approaching and you only have time to validate a few more apps and drivers, you can use the proposed action plan to determine which apps and drivers you should focus on to maximize the number of computers that you can confidently upgrade.
-
-#### Misconceptions and things to avoid
-
-The most common misconceptions about the proposed action plan involve the assumption that each item in the plan is independent of those around it. The apps and drivers in the plan must be considered in the correct order to draw valid conclusions. For example, if you choose to validate items 1, 3, 4, and 5 and mark each of them “Ready to upgrade,” the proposed action plan cannot tell you how many computers will become upgrade-ready as a result of your testing. Even the non-cumulative “ComputersUnblocked” count is dependent upon all prior issues having already been resolved.
-
-If an item with ItemRank = 7 has a ComputersUnblocked value of 50, do not assume that 50 of your computers will become upgrade-ready if you test this item. However, if you validate items 1 through 6 in the plan, you can make an additional 50 computers upgrade-ready by validating the 7th item in the plan.
+---
+title: Upgrade Readiness - Resolve application and driver issues (Windows 10)
+ms.reviewer:
+manager: laurawi
+description: Describes how to resolve application and driver issues that can occur during an upgrade with Upgrade Readiness.
+keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics,
+ms.prod: w10
+audience: itpro
+author: jaimeo
+ms.author: jaimeo
+ms.localizationpriority: medium
+ms.topic: article
+ms.collection: M365-analytics
+---
+
+# Upgrade Readiness - Step 2: Resolve app and driver issues
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+This section of the Upgrade Readiness workflow reports application and driver inventory and shows you which applications have known issues, which applications have no known issues, and which drivers have issues. We identify applications and drivers that need attention and suggest fixes when we know about them.
+
+## In this section
+
+The blades in the **Step 2: Resolve issues** section are:
+
+- [Review applications with known issues](#review-applications-with-known-issues)
+- [Review known driver issues](#review-drivers-with-known-issues)
+- [Review low-risk apps and drivers](#review-low-risk-apps-and-drivers)
+- [Prioritize app and driver testing](#prioritize-app-and-driver-testing)
+
+>You can change an application’s upgrade decision and a driver’s upgrade decision from the blades in this section. To change an application’s or a driver’s importance level, select **User changes**. Select the item you want to change and then select the appropriate option from the **Select upgrade decision** list.
+
+Upgrade decisions include:
+
+
+| Upgrade decision | When to use it | Guidance |
+|--------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Not reviewed | All drivers are marked as Not reviewed by default. Any app that has not been marked **Low install count** will also have an upgrade decision of **Not reviewed** by default. | Apps you have not yet reviewed or are waiting to review later should be marked as **Not reviewed**. When you start to investigate an application or a driver to determine upgrade readiness, change their upgrade decision to **Review in progress**. |
+| Review in progress | When you start to investigate an application or a driver to determine upgrade readiness, change its upgrade decision to **Review in progress**. Until you’ve determined that applications and drivers will migrate successfully or you’ve resolved blocking issues, leave the upgrade decision status as **Review in progress**. | Once you’ve fixed any issues and validated that the application or driver will migrate successfully, change the upgrade decision to **Ready to upgrade**. |
+| Ready to upgrade | Mark applications and drivers **Ready to upgrade** once you’ve resolved all blocking issues and you’re confident that they will upgrade successfully, or if you’ve decided to upgrade them as-is. | Applications with no known issues and with low installation rates are marked **Ready to upgrade** by default. In Step 1, you might have marked some of your apps as **Ignore**. These should be marked as **Ready to upgrade**. Apps with low installation rates are marked as **Ready to upgrade** by default. Be sure to review any low install count applications for any business critical or important applications that are not yet upgrade-ready, despite their low installation rates. |
+| Won’t upgrade | By default, no applications or drivers are marked **Won’t upgrade** because only you can make that determination. Use **Won’t upgrade** for applications and drivers that you do not work on your target operating system, or that you are unable to upgrade. | If, during your investigation into an application or driver, you determine that they should not or cannot be upgraded, mark them **Won’t upgrade**. |
+
+As you review applications with known issues, you can also see ISV support statements or applications using [Ready for Windows](https://www.readyforwindows.com/).
+
+## Review applications with known issues
+
+Applications with issues known to Microsoft are listed, grouped by upgrade assessment into **Attention needed** or **Fix available**.
+
+
+
+
+
+To change an application's upgrade decision:
+
+1. Select **Decide upgrade readiness** to view applications with issues.
+2. In the table view, select an **UpgradeDecision** value.
+3. Select **Decide upgrade readiness** to change the upgrade decision for each application.
+4. Select the applications you want to change to a specific upgrade decision and then select the appropriate option from the **Select upgrade decision** list.
+5. Click **Save** when finished.
+
+IMPORTANT: Ensure that you have the most recent versions of the compatibility update and related KBs installed to get the most up-to-date compatibility information.
+
+For applications assessed as **Attention needed**, review the table below for details about known issues and for guidance about how to resolve them, when possible.
+
+| Upgrade Assessment | Action required prior to upgrade? | Issue | What it means | Guidance |
+|--------------------|-----------------------------------|-----------|-----------------|------------|
+| Attention needed | No | Application is removed during upgrade | Compatibility issues were detected and the application will not migrate to the new operating system. | No action is required for the upgrade to proceed. |
+| Attention needed | Yes | Blocking upgrade | Blocking issues were detected and Upgrade Readiness is not able to remove the application during upgrade. The application may work on the new operating system. | Remove the application before upgrading, and reinstall and test on new operating system. |
+| Attention needed | No | Evaluate application on new OS | The application will migrate, but issues were detected that may impact its performance on the new operating system. | No action is required for the upgrade to proceed, but be sure to test the application on the new operating system. |
+| Attention needed | No | Does not work with new OS, but won’t block upgrade | The application is not compatible with the new operating system, but won’t block the upgrade. | No action is required for the upgrade to proceed, however, you’ll have to install a compatible version of the application on the new operating system. |
+| Attention needed | Yes | Does not work with new OS, and will block upgrade | The application is not compatible with the new operating system and will block the upgrade. | Remove the application before upgrading. A compatible version of the application may be available. |
+| Attention needed | Yes | May block upgrade, test application | Issues were detected that may interfere with the upgrade, but need to be investigated further. | Test the application’s behavior during upgrade. If it blocks the upgrade, remove it before upgrading and reinstall and test it on the new operating system. |
+| Attention needed | Maybe | Multiple | Multiple issues are affecting the application. See detailed view for more information.| When you see Multiple in the query detailed view, click **Query** to see details about what issues were detected with the different versions of the application. |
+
+For applications assessed as **Fix available**, review the table below for details about known issues and ways to fix them that are known to Microsoft.
+
+| Upgrade Assessment | Action required prior to upgrade? | Issue | What it means | Guidance |
+|--------------------|-----------------------------------|----------|-----------------|-------------|
+| Fix available | Yes | Blocking upgrade, update application to newest version | The existing version of the application is not compatible with the new operating system and won’t migrate. A compatible version of the application is available. | Update the application before upgrading. |
+| Fix available | No | Reinstall application after upgrading | The application is compatible with the new operating system, but must be reinstalled after upgrading. The application is removed during the upgrade process. | No action is required for the upgrade to proceed. Reinstall application on the new operating system. |
+| Fix available | Yes | Blocking upgrade, but can be reinstalled after upgrading | The application is compatible with the new operating system, but won’t migrate. | Remove the application before upgrading and reinstall on the new operating system. |
+| Fix available | Yes | Disk encryption blocking upgrade | The application’s encryption features are blocking the upgrade. | Disable the encryption feature before upgrading and enable it again after upgrading. |
+
+### ISV support for applications with Ready for Windows
+
+[Ready for Windows](https://www.readyforwindows.com/) lists software solutions that are supported and in use for Windows 10. This site leverages data about application adoption from commercial Windows 10 installations and helps IT managers upgrade to Windows 10 with confidence. For more information, see [Ready for Windows Frequently Asked Questions](https://developer.microsoft.com/windows/ready-for-windows/#/faq/).
+
+Click **Review Applications With Known Issues** to see the status of applications for Ready for Windows and corresponding guidance. For example:
+
+
+
+If there are known issues with an application, the specific guidance for that known issue takes precedence over the Ready for Windows guidance.
+
+
+
+If you query with RollupLevel="NamePublisher", each version of the application can have a different status for Ready for Windows. In this case, different values appear for Ready for Windows.
+
+
+
+> [!TIP]
+> Within the Upgrade Readiness data model, an object of Type **UAApp** refers to a particular application installed on a specific computer.
+>
+> To support dynamic aggregation and summation of data the Upgrade Readiness solution "rolls up" (aggregates) data in preprocessing. Rolling up to the **Granular** level enables display of the **App** level. In Upgrade Readiness terminology, an **App** is a unique combination of: app name, app vendor, app version, and app language. Thus, at the Granular level, you can see attributes such as **total install count**, which is the number of machines with a specific **App** installed.
+>
+> Upgrade Readiness also has a roll up level of **NamePublisher**, This level enables you to ignore different app versions within your organization for a particular app. In other words, **NamePublisher** displays statistics about a given app, aggregated across all versions.
+
+The following table lists possible values for **ReadyForWindows** and what they mean. For more information, see [What does the Adoption Status mean?](https://developer.microsoft.com/en-us/windows/ready-for-windows#/faq/?scrollTo=faqStatuses)
+
+| Ready for Windows Status | Query rollup level | What this means | Guidance |
+|-------------------|--------------------------|-----------------|----------|
+|Supported version available | Granular | The software provider has declared support for one or more versions of this application on Windows 10. | The ISV has declared support for a version of this application on Windows 10. |
+| Highly adopted | Granular | This version of this application has been highly adopted within the Windows 10 Enterprise ecosystem. | This application has been installed on at least 100,000 commercial Windows 10 devices. |
+| Adopted | Granular | This version of this application has been adopted within the Windows 10 Enterprise ecosystem. | This application has been installed on at least 10,000 commercial Windows 10 devices. |
+| Insufficient Data | Granular | Too few commercial Windows 10 devices are sharing information about this version of this application for Microsoft to categorize its adoption. | N/A |
+| Contact developer | Granular | There may be compatibility issues with this version of the application, so Microsoft recommends contacting the software provider to learn more. | Check [Ready for Windows](https://www.readyforwindows.com/) for additional information.|
+|Supported version available | NamePublisher | The software provider has declared support for this application on Windows 10. | The ISV has declared support for a version of this application on Windows 10.|
+|Adoption status available | NamePublisher | A Ready for Windows adoption status is available for one or more versions of this application. Please check Ready for Windows to learn more. |Check [Ready for Windows](https://www.readyforwindows.com/) for adoption information for this application.|
+| Unknown | Any | There is no Ready for Windows information available for this version of this application. Information may be available for other versions of the application at [Ready for Windows](https://www.readyforwindows.com/). | N/A |
+
+## Review drivers with known issues
+
+Drivers that won’t migrate to the new operating system are listed, grouped by availability.
+
+
+
+Availability categories are explained in the table below.
+
+| Driver availability | Action required before or after upgrade? | What it means | Guidance |
+|-----------------------|------------------------------------------|----------------|--------------|
+| Available in-box | No, for awareness only | The currently installed version of an application or driver won’t migrate to the new operating system; however, a compatible version is installed with the new operating system. | No action is required for the upgrade to proceed. |
+| Import from Windows Update | Yes | The currently installed version of a driver won’t migrate to the new operating system; however, a compatible version is available from Windows Update. | If the computer automatically receives updates from Windows Update, no action is required. Otherwise, import a new driver from Windows Update after upgrading. |
+| Available in-box and from Windows Update | Yes | The currently installed version of a driver won’t migrate to the new operating system. Although a new driver is installed during upgrade, a newer version is available from Windows Update. | If the computer automatically receives updates from Windows Update, no action is required. Otherwise, import a new driver from Windows Update after upgrading. |
+| Check with vendor | Yes | The driver won’t migrate to the new operating system and we are unable to locate a compatible version. | Check with the independent hardware vendor (IHV) who manufactures the driver for a solution. |
+
+To change a driver’s upgrade decision:
+
+1. Select **Decide upgrade readiness** and then select the group of drivers you want to review. Select **Table** to view the list in a table.
+
+2. Select **User changes** to enable user input.
+
+3. Select the drivers you want to change to a specific upgrade decision and then select the appropriate option from the **Select upgrade decision** list.
+
+4. Click **Save** when finished.
+
+## Review low-risk apps and drivers
+
+Applications and drivers that are meet certain criteria to be considered low risk are displayed on this blade.
+
+
+
+The first row reports the number of your apps that have an official statement of support on Windows 10 from the software vendor, so you can be confident that they will work on your target operating system.
+
+The second row (**Apps that are "Highly adopted"**) shows apps that have a ReadyForWindows status of "Highly adopted". This means that they have been installed on at least 100,000 commercial Windows 10 devices, and that Microsoft has not detected significant issues with the app in diagnostic data. Since these apps are prevalent in the ecosystem at large, you can be confident that they will work in your environment as well.
+
+Each row of the blade uses a different criterion to filter your apps or drivers. You can view a list of applications that meet the criterion by clicking into a row of the blade. For example, if you click the row that says "Apps that are 'Highly adopted'", the result is a list of apps that have a ReadyForWindows status of "Highly adopted". From here, you can bulk-select the results, select **Ready to upgrade**, and then click **Save**. This will mark all apps meeting the "Highly adopted" criterion as "Ready to upgrade"--no further validation is required. Any applications that you have marked as *Mission critical* or *Business critical* are filtered out, as well as any app that has an issue known to Microsoft. This allows you to work with apps in bulk without having to worry about missing a critical app.
+
+You can customize the criteria further by using the Log Search query language. For example, if a ReadyForWindows status of "Adopted" is not sufficient by itself for you to be confident in an app's compatibility, you can add additional filters. To do this, click the row labeled **Apps that are 'Adopted'**. Then, modify the resulting query to fit your company's risk tolerance. If, for example, you prefer that an app must be "Adopted" and have fewer than 1,000 installations, then add *TotalInstalls < 1000* to the end of the Log Search query. Similarly, you can append additional criteria by using other attributes such as monthly active users or app importance.
+
+>[!NOTE]
+>Apps that you have designated as *Mission critical* or *Business critical* are automatically **excluded** from the counts on this blade. If an app is critical, you should always validate it manually it prior to upgrading.
+
+ At the bottom of the blade, the **OTHER APPS AND DRIVERS IN NEED OF REVIEW** section allows you to quickly access apps you have designated as **Mission critical** or **Business critical**, your remaining apps that still need to be reviewed, and your remaining drivers that need to be reviewed.
+
+
+
+## Prioritize app and driver testing
+
+Planning and executing an OS upgrade project can be overwhelming. When you are tasked with evaluating thousands of applications and drivers to ensure a successful upgrade, it can be difficult to decide where to start. The Upgrade Readiness solution provides valuable assistance for you, helping to determine the most important apps and drivers to unblock and enabling you yo create a proposed action plan.
+
+### Proposed action plan
+
+The Upgrade Readiness proposed action plan is an optimally ordered list of apps and drivers that are in need of review. By testing apps and drivers in the order suggested by the proposed action plan, you are able to increase your number of “Ready to upgrade” computers in an efficient manner. The action plan can be a very powerful tool during upgrade planning – but it’s most helpful when it’s used correctly. This topic explains the proposed action plan, describes how to use it, and calls out a few misconceptions and invalid use cases that you should avoid.
+
+The proposed action plan represents the order thath Microsoft recommends you rationalize the upgrade-readiness of your apps and drivers. By validating apps and drivers in the order proposed, you can ensure that you are testing efficiently.
+
+Each item in the proposed action plan represents either an application or a driver that you have not yet marked “Ready to upgrade.”
+
+>Since “Low install count” apps are automatically marked “Ready to upgrade”, you will not see any of these apps in the proposed action plan.
+
+Each item in the plan has the following attributes:
+
+| Attribute | Description | Example value |
+|-----------------------|------------------------------------------|----------------|
+| ItemRank | The location of this item in the context of the proposed action plan. For example, the item with ItemRank 7 is the 7th item in the Plan. It is crucial that the Plan is viewed in order by increasing ItemRank. Sorting the Plan in any other way invalidates the insights that the Plan provides. | 7 |
+| ItemType | Whether this item is an app or driver -- possible values are: "App" and "Driver." | App |
+| ItemName | The name of the app or driver that is in need of review. | Microsoft Visual C++ 2005 Redistributable (x64) |
+| ItemVendor | The vendor of the app or driver. | Microsoft Corporation |
+| ItemVersion | The version of the app or driver. | 12.1.0.1 |
+| ItemLanguage | If this item is an application, then this field will be the language of the app. If the item is a driver, then this will say "N/A." | English |
+| ItemHardwareId | If this item is a driver, then this field will be the hardware id of the driver. If the item is an app, then this will say "N/A." | N/A |
+| Upgrade Decision | The upgrade decision you have provided for this app or driver. If you have not defined an upgrade decision, then you will see the default value of “Not reviewed.” | Review in progress |
+| ComputersUnblocked | Assuming you have already marked all previous items in the proposed action plan “Ready to upgrade”, this represents the number of additional computers that will become “Ready to upgrade” by testing this app or driver and giving it an upgrade decision of “Ready to upgrade”. For example, if ComputersUnblocked is 200, then resolving any issues associated with the app/driver in question will make 200 new computers “Ready to upgrade.” | 200 |
+| CumulativeUnblocked | The total number of computers that will become “Ready to upgrade” if you validate and mark this and all prior items in the proposed action plan “Ready to upgrade”. For example, if ItemRank is 7, and CumulativeUnblocked is 950, then fixing items 1 thru 7 in the proposed action plan will cause 950 of your computers to become “Ready to upgrade.” | 950 |
+| CumulativeUnblockedPct | The percentage of your machines that will become “Ready to upgrade” if you make this and all prior items in the proposed action plan “Ready to upgrade.” | 0.24 |
+
+See the following example action plan items (click the image for a full-size view):
+
+
+
+
+In this example, the 3rd item is an application: Microsoft Bing Sports , a modern app, version 4.20.951.0 , published by Microsoft. By validating this app and making its UpgradeDecision “Ready to upgrade”, you can potentially make 1014 computers “Ready to upgrade” – but only after you have already validated items 1 and 2 in the list. By marking items 1, 2, and 3 “Ready to upgrade”, 14779 of your computers will become upgrade-ready. This represents 10.96% of the machines in this workspace.
+
+#### Using the proposed action plan
+
+There are several valid use cases for the proposed action plan. But it’s always important to remember that the information presented in the Plan is only accurate when sorted by increasing Item Rank! Here are three potential cases in which you could use the proposed action plan:
+
+1. Quickly determine how many apps and drivers you’ll need to validate in order to make x% of your computers upgrade-ready. To determine this, simply find the first item in the Plan with a CumulativeUnblockedPct greater than or equal to your desired percentage of upgrade-ready computers. The corresponding ItemRank represents the smallest number of apps and drivers that you can validate in order to reach your upgrade readiness goal. The prior items in the proposed action plan itself represent the most efficient route to reaching your goal.
+
+2. Use the proposed action plan to prepare a small portion of your machines for a pilot of your target Operating System. Let’s say you want to test a new Operating System by upgrading a few hundred computers. You can use the proposed action plan to determine how many apps and drivers you will need to validate before you can be confident that your pilot will be successful.
+
+3. If your project deadline is approaching and you only have time to validate a few more apps and drivers, you can use the proposed action plan to determine which apps and drivers you should focus on to maximize the number of computers that you can confidently upgrade.
+
+#### Misconceptions and things to avoid
+
+The most common misconceptions about the proposed action plan involve the assumption that each item in the plan is independent of those around it. The apps and drivers in the plan must be considered in the correct order to draw valid conclusions. For example, if you choose to validate items 1, 3, 4, and 5 and mark each of them “Ready to upgrade,” the proposed action plan cannot tell you how many computers will become upgrade-ready as a result of your testing. Even the non-cumulative “ComputersUnblocked” count is dependent upon all prior issues having already been resolved.
+
+If an item with ItemRank = 7 has a ComputersUnblocked value of 50, do not assume that 50 of your computers will become upgrade-ready if you test this item. However, if you validate items 1 through 6 in the plan, you can make an additional 50 computers upgrade-ready by validating the 7th item in the plan.
diff --git a/windows/deployment/upgrade/upgrade-readiness-target-new-OS.md b/windows/deployment/upgrade/upgrade-readiness-target-new-OS.md
index b4cdb30a40..78c11d1569 100644
--- a/windows/deployment/upgrade/upgrade-readiness-target-new-OS.md
+++ b/windows/deployment/upgrade/upgrade-readiness-target-new-OS.md
@@ -1,61 +1,65 @@
----
-title: Upgrade Readiness - Targeting a new operating system version
-ms.reviewer:
-manager: laurawi
-ms.author: greglin
-description: Explains how to run Upgrade Readiness again to target a different operating system version or bulk-approve all apps from a given vendor
-ms.prod: w10
-audience: itpro
author: greg-lindsay
-ms.topic: article
-ms.collection: M365-analytics
----
-
-# Targeting a new operating system version
-
-After you've used Upgrade Readiness to help deploy a given version of Windows 10, you might want to use it again to help deploy a newer version of Windows 10. When you change the target operating system version (as described in [Use Upgrade Readiness to manage Windows upgrades](use-upgrade-readiness-to-manage-windows-upgrades.md#target-version)), the app states (Importance, AppOwner, UpgradeDecision, TestPlan, and TestResult) are not reset. Follow this guidance to preserve or reset these states as needed:
-
-## TestResults
-
-If you want to preserve the TestResults from the previous operating system version testing, there is nothing you need to do.
-
-If you want to reset them, click any of the rows in the **Prioritize Application** blade (described in [Upgrade Readiness - Step 1: Identify important apps](upgrade-readiness-identify-apps.md)). This will take you to the **Log Search** user experience. Replace the query in that window with the following query:
-
-`search in (UAApp) IsRollup == true and RollupLevel == "Granular" and TestResult <> "Not started"`
-
-After a short period of time, you will see the "user input" perspective render, which will let you bulk-edit the results. Select the check box in the table header, click the **bulk edit** button, and then set the **TestResult** to *Not started*. Leave all other fields as they are.
-
-## UpgradeDecision
-
-If you want to preserve the UpgradeDecision from the previous operating system version testing, there is nothing you need to do.
-
-If you want to reset them, keep these important points in mind:
-
-- Make sure to *not* reset the **Ready to upgrade** decision for the "long tail" of apps that have importance of **Ignore** or **Low install count**. Doing this will make it extremely difficult to complete the Upgrade Readiness workflow.
-- Decide which decisions to reset. For example, one option is just to reset the decisions marked **Ready to upgrade** (in order to retest those), while preserving states of apps marked **Won't upgrade**. Doing this means you won't lose track of this previous marking. Or you can reset everything.
-
-To do this, type the following query in **Log Search**:
-
-`search in (UAApp) IsRollup == true and RollupLevel == "Granular" and Importance <> "Ignore" and Importance <> "Low install count" and UpgradeDecision == "Ready to upgrade"`
-
->[!NOTE]
->If you just want to reset all **UpgradeDecision** values, you can simply remove `'and UpgradeDecision == "Ready to upgrade"` from the query.
-
-After a short period of time, you will see the "user input" perspective render, which will let you bulk-edit the results. Select the check box in the table header, click the **bulk edit** button, and then set the **UpgradeDecision** to *Not reviewed*. Leave all other fields as they are.
-
-
-## Bulk-approving apps from a given vendor
-
-You can bulk-approve all apps from a given vendor (for example, Microsoft) if there are no known compatibility issues. To do this, type the following query in **Log Search**:
-
-`search in (UAApp) IsRollup == true and RollupLevel == "Granular" and AppVendor has "Microsoft" and UpgradeAssessment=="No known issues" and UpgradeDecision<>"Ready to upgrade"`
-
-After a short period of time, you will see the "user input" perspective render, which will let you bulk-edit the results. Select the check box in the table header, click the **bulk edit" button**, and then set the **UpgradeDecision** to *Ready to upgrade*. Leave all other fields as they are.
-
-## Related topics
-
-[Windows Analytics overview](../update/windows-analytics-overview.md)
-
-[Manage Windows upgrades with Upgrade Readiness](manage-windows-upgrades-with-upgrade-readiness.md)
-
-[Get started with Upgrade Readiness](upgrade-readiness-get-started.md)
-
+---
+title: Upgrade Readiness - Targeting a new operating system version
+ms.reviewer:
+manager: laurawi
+ms.author: jaimeo
+description: Explains how to run Upgrade Readiness again to target a different operating system version or bulk-approve all apps from a given vendor
+ms.prod: w10
+audience: itpro
+author: jaimeo
+ms.topic: article
+ms.collection: M365-analytics
+---
+
+# Targeting a new operating system version
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+After you've used Upgrade Readiness to help deploy a given version of Windows 10, you might want to use it again to help deploy a newer version of Windows 10. When you change the target operating system version (as described in [Use Upgrade Readiness to manage Windows upgrades](use-upgrade-readiness-to-manage-windows-upgrades.md#target-version)), the app states (Importance, AppOwner, UpgradeDecision, TestPlan, and TestResult) are not reset. Follow this guidance to preserve or reset these states as needed:
+
+## TestResults
+
+If you want to preserve the TestResults from the previous operating system version testing, there is nothing you need to do.
+
+If you want to reset them, click any of the rows in the **Prioritize Application** blade (described in [Upgrade Readiness - Step 1: Identify important apps](upgrade-readiness-identify-apps.md)). This will take you to the **Log Search** user experience. Replace the query in that window with the following query:
+
+`search in (UAApp) IsRollup == true and RollupLevel == "Granular" and TestResult <> "Not started"`
+
+After a short period of time, you will see the "user input" perspective render, which will let you bulk-edit the results. Select the check box in the table header, click the **bulk edit** button, and then set the **TestResult** to *Not started*. Leave all other fields as they are.
+
+## UpgradeDecision
+
+If you want to preserve the UpgradeDecision from the previous operating system version testing, there is nothing you need to do.
+
+If you want to reset them, keep these important points in mind:
+
+- Make sure to *not* reset the **Ready to upgrade** decision for the "long tail" of apps that have importance of **Ignore** or **Low install count**. Doing this will make it extremely difficult to complete the Upgrade Readiness workflow.
+- Decide which decisions to reset. For example, one option is just to reset the decisions marked **Ready to upgrade** (in order to retest those), while preserving states of apps marked **Won't upgrade**. Doing this means you won't lose track of this previous marking. Or you can reset everything.
+
+To do this, type the following query in **Log Search**:
+
+`search in (UAApp) IsRollup == true and RollupLevel == "Granular" and Importance <> "Ignore" and Importance <> "Low install count" and UpgradeDecision == "Ready to upgrade"`
+
+>[!NOTE]
+>If you just want to reset all **UpgradeDecision** values, you can simply remove `'and UpgradeDecision == "Ready to upgrade"` from the query.
+
+After a short period of time, you will see the "user input" perspective render, which will let you bulk-edit the results. Select the check box in the table header, click the **bulk edit** button, and then set the **UpgradeDecision** to *Not reviewed*. Leave all other fields as they are.
+
+
+## Bulk-approving apps from a given vendor
+
+You can bulk-approve all apps from a given vendor (for example, Microsoft) if there are no known compatibility issues. To do this, type the following query in **Log Search**:
+
+`search in (UAApp) IsRollup == true and RollupLevel == "Granular" and AppVendor has "Microsoft" and UpgradeAssessment=="No known issues" and UpgradeDecision<>"Ready to upgrade"`
+
+After a short period of time, you will see the "user input" perspective render, which will let you bulk-edit the results. Select the check box in the table header, click the **bulk edit" button**, and then set the **UpgradeDecision** to *Ready to upgrade*. Leave all other fields as they are.
+
+## Related topics
+
+[Windows Analytics overview](../update/windows-analytics-overview.md)
+
+[Manage Windows upgrades with Upgrade Readiness](manage-windows-upgrades-with-upgrade-readiness.md)
+
+[Get started with Upgrade Readiness](upgrade-readiness-get-started.md)
+
diff --git a/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md b/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md
index 8bbc0e4a13..78ad55ad25 100644
--- a/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md
+++ b/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md
@@ -1,73 +1,77 @@
----
-title: Upgrade Readiness - Upgrade Overview (Windows 10)
-ms.reviewer:
-manager: laurawi
-ms.author: greglin
-description: Displays the total count of computers sharing data and upgraded.
-ms.prod: w10
-audience: itpro
author: greg-lindsay
-ms.topic: article
-ms.collection: M365-analytics
----
-
-# Upgrade Readiness - Upgrade overview
-
-The first blade in the Upgrade Readiness solution is the upgrade overview blade. This blade displays the total count of computers sharing data with Microsoft, and the count of computers upgraded. As you successfully upgrade computers, the count of computers upgraded increases.
-
-The upgrade overivew blade displays data refresh status, including the date and time of the most recent data update and whether user changes are reflected. The upgrade overview blade also displays the current target OS version. For more information about the target OS version, see [target version](use-upgrade-readiness-to-manage-windows-upgrades.md#target-version).
-
-The following color-coded status changes are reflected on the upgrade overview blade:
-
-- The "Last updated" banner:
- - No delay in processing device inventory data = "Last updated" banner is displayed in green.
- - Delay processing device inventory data = "Last updated" banner is displayed in amber.
-- Computers with incomplete data:
- - Less than 4% = Count is displayed in green.
- - 4% - 10% = Count is displayed in amber.
- - Greater than 10% = Count is displayed in red.
-- Computers with outdated KB:
- - Less than 10% = Count is displayed in green.
- - 10% - 30% = Count is displayed in amber.
- - Greater than 30% = Count is displayed in red.
-- User changes:
- - Pending user changes = User changes count displays "Data refresh pending" in amber.
- - No pending user changes = User changes count displays "Up to date" in green.
-- Target version:
- - If the current value matches the recommended value, the version is displayed in green.
- - If the current value is an older OS version than the recommended value, but not deprecated, the version is displayed in amber.
- - If the current value is a deprecated OS version, the version is displayed in red.
-
-Click a row to drill down and see details about individual computers. If updates are missing, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md) for information on required updates.
-
-In the following example, there is no delay in data processing, more than 10% of computers (6k\8k) have incomplete data, more than 30% of computers (6k/8k) require an update, there are no pending user changes, and the currently selected target OS version is the same as the recommended version:
-
-
-
-
-
-If data processing is delayed, the "Last updated" banner will indicate the date on which data was last updated. You can continue using your workspace as normal. However, any changes or additional information that is added might not be displayed until data is refreshed. When your workspace is in this state, there is no action required; data is typically refreshed and the display will return to normal again within 24 hours.
-
-If there are computers with incomplete data, verify that you have installed the latest compatibilty updates. Install the updates if necessary and then run the most recent [Update Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) from the Microsoft download center. The updated data payload should appear in Upgrade Readiness within 48 hours of a successful run on the deployment script.
-
-Select **Total computers** for a list of computers and details about them, including:
-
-- Computer ID and computer name
-- Computer manufacturer
-- Computer model
-- Operating system version and build
-- Count of system requirement, application, and driver issues per computer
-- Upgrade assessment based on analysis of computer diagnostic data
-- Upgrade decision status
-
-Select **Total applications** for a list of applications discovered on user computers and details about them, including:
-
-- Application vendor
-- Application version
-- Count of computers the application is installed on
-- Count of computers that opened the application at least once in the past 30 days
-- Percentage of computers in your total computer inventory that opened the application in the past 30 days
-- Issues detected, if any
-- Upgrade assessment based on analysis of application data
-- Rollup level
+---
+title: Upgrade Readiness - Upgrade Overview (Windows 10)
+ms.reviewer:
+manager: laurawi
+ms.author: jaimeo
+description: Displays the total count of computers sharing data and upgraded.
+ms.prod: w10
+audience: itpro
+author: jaimeo
+ms.topic: article
+ms.collection: M365-analytics
+---
+
+# Upgrade Readiness - Upgrade overview
+
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+The first blade in the Upgrade Readiness solution is the upgrade overview blade. This blade displays the total count of computers sharing data with Microsoft, and the count of computers upgraded. As you successfully upgrade computers, the count of computers upgraded increases.
+
+The upgrade overview blade displays data refresh status, including the date and time of the most recent data update and whether user changes are reflected. The upgrade overview blade also displays the current target OS version. For more information about the target OS version, see [target version](use-upgrade-readiness-to-manage-windows-upgrades.md#target-version).
+
+The following color-coded status changes are reflected on the upgrade overview blade:
+
+- The "Last updated" banner:
+ - No delay in processing device inventory data = "Last updated" banner is displayed in green.
+ - Delay processing device inventory data = "Last updated" banner is displayed in amber.
+- Computers with incomplete data:
+ - Less than 4% = Count is displayed in green.
+ - 4% - 10% = Count is displayed in amber.
+ - Greater than 10% = Count is displayed in red.
+- Computers with outdated KB:
+ - Less than 10% = Count is displayed in green.
+ - 10% - 30% = Count is displayed in amber.
+ - Greater than 30% = Count is displayed in red.
+- User changes:
+ - Pending user changes = User changes count displays "Data refresh pending" in amber.
+ - No pending user changes = User changes count displays "Up to date" in green.
+- Target version:
+ - If the current value matches the recommended value, the version is displayed in green.
+ - If the current value is an older OS version than the recommended value, but not deprecated, the version is displayed in amber.
+ - If the current value is a deprecated OS version, the version is displayed in red.
+
+Click a row to drill down and see details about individual computers. If updates are missing, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md) for information on required updates.
+
+In the following example, there is no delay in data processing, more than 10% of computers (6k\8k) have incomplete data, more than 30% of computers (6k/8k) require an update, there are no pending user changes, and the currently selected target OS version is the same as the recommended version:
+
+
+
+
+
+If data processing is delayed, the "Last updated" banner will indicate the date on which data was last updated. You can continue using your workspace as normal. However, any changes or additional information that is added might not be displayed until data is refreshed. When your workspace is in this state, there is no action required; data is typically refreshed and the display will return to normal again within 24 hours.
+
+If there are computers with incomplete data, verify that you have installed the latest compatibility updates. Install the updates if necessary and then run the most recent [Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) from the Microsoft download center. The updated data payload should appear in Upgrade Readiness within 48 hours of a successful run on the deployment script.
+
+Select **Total computers** for a list of computers and details about them, including:
+
+- Computer ID and computer name
+- Computer manufacturer
+- Computer model
+- Operating system version and build
+- Count of system requirement, application, and driver issues per computer
+- Upgrade assessment based on analysis of computer diagnostic data
+- Upgrade decision status
+
+Select **Total applications** for a list of applications discovered on user computers and details about them, including:
+
+- Application vendor
+- Application version
+- Count of computers the application is installed on
+- Count of computers that opened the application at least once in the past 30 days
+- Percentage of computers in your total computer inventory that opened the application in the past 30 days
+- Issues detected, if any
+- Upgrade assessment based on analysis of application data
+- Rollup level
diff --git a/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md b/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md
index bb0ea00851..8faa48539f 100644
--- a/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md
+++ b/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md
@@ -14,6 +14,9 @@ ms.topic: article
# Use Upgrade Readiness to manage Windows upgrades
+>[!IMPORTANT]
+>The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Get started with Update Compliance](../update/update-compliance-get-started.md) will continue to be supported. For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
>[!IMPORTANT]
>>**The OMS portal has been deprecated, so you need to switch to the [Azure portal](https://portal.azure.com) now.** The two portals offer the same experience, with some key differences. Learn how to use [Windows Analytics in the Azure Portal](../update/windows-analytics-azure-portal.md). Find out more about the [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition), or jump right in and [Get started with Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started).
diff --git a/windows/deployment/vda-subscription-activation.md b/windows/deployment/vda-subscription-activation.md
index 7ba4d88b2d..a1992d96b8 100644
--- a/windows/deployment/vda-subscription-activation.md
+++ b/windows/deployment/vda-subscription-activation.md
@@ -2,7 +2,8 @@
title: Configure VDA for Windows 10 Subscription Activation
ms.reviewer:
manager: laurawi
-ms.audience: itpro
author: greg-lindsay
+ms.audience: itpro
+author: greg-lindsay
description: How to enable Windows 10 Enterprise E3 and E5 subscriptions for VDA
keywords: upgrade, update, task sequence, deploy
ms.prod: w10
@@ -10,7 +11,8 @@ ms.mktglfcycl: deploy
ms.localizationpriority: medium
ms.sitesec: library
ms.pagetype: mdt
-audience: itpro
author: greg-lindsay
+audience: itpro
+author: greg-lindsay
ms.topic: article
ms.collection: M365-modern-desktop
---
@@ -29,7 +31,7 @@ Deployment instructions are provided for the following scenarios:
- VMs must be running Windows 10 Pro, version 1703 (also known as the Creator's Update) or later.
- VMs must be Active Directory-joined or Azure Active Directory (AAD)-joined.
- VMs must be generation 1.
-- VMs must hosted by a [Qualified Multitenant Hoster](https://www.microsoft.com/CloudandHosting/licensing_sca.aspx) (QMTH).
+- VMs must hosted by a [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH).
## Activation
diff --git a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md
index 2ca4a9039b..893b4f6f7c 100644
--- a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md
+++ b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md
@@ -18,86 +18,103 @@ ms.topic: article
---
# Activate using Active Directory-based activation
-**Applies to**
-- Windows 10
-- Windows 8.1
-- Windows 8
-- Windows Server 2012 R2
-- Windows Server 2012
-- Windows Server 2016
-- Windows Server 2019
+
+> Applies to
+>
+>- Windows 10
+>- Windows 8.1
+>- Windows 8
+>- Windows Server 2012 R2
+>- Windows Server 2012
+>- Windows Server 2016
+>- Windows Server 2019
**Looking for retail activation?**
-- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644)
-Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. Active Directory-based activation requires that the forest schema be updated by adprep.exe on a computer running Windows Server 2012 or Windows Server 2012 R2, but after the schema is updated, older domain controllers can still activate clients.
-Any domain-joined computers running Windows 10, Windows 8.1, Windows 8, Windows Server 2012, or Windows Server 2012 R2 with a GVLK will be activated automatically and transparently. They will stay activated as long as they remain members of the domain and maintain periodic contact with a domain controller. Activation takes place after the Licensing service starts. When this service starts, the computer contacts AD DS automatically, receives the activation object, and is activated without user intervention.
-To allow computers with GVLKs to activate themselves, use the Volume Activation Tools console in Windows Server 2012 R2 or the VAMT in earlier versions of Windows Server to create an object in the AD DS forest. You create this activation object by submitting a KMS host key to Microsoft, as shown in Figure 10.
+- [Get Help Activating Microsoft Windows 7 or Windows 8.1](https://support.microsoft.com/help/15083/windows-activate-windows-7-or-8-1)
+- [Get Help Activating Microsoft Windows 10](https://support.microsoft.com/help/12440/windows-10-activate)
+
+Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. Active Directory-based activation requires that the forest schema be updated using *adprep.exe* on a supported server OS, but after the schema is updated, older domain controllers can still activate clients.
+
+Any domain-joined computers running a supported operating system with a Generic Volume License Key (GVLK) will be activated automatically and transparently. They will stay activated as long as they remain members of the domain and maintain periodic contact with a domain controller. Activation takes place after the Licensing service starts. When this service starts, the computer contacts AD DS automatically, receives the activation object, and is activated without user intervention.
+
+To allow computers with GVLKs to activate themselves, use the Volume Activation Tools console or the [Volume Activation Management Tool (VAMT)](volume-activation-management-tool.md) in earlier versions of Windows Server to create an object in the AD DS forest. You create this activation object by submitting a KMS host key to Microsoft, as shown in Figure 10.
+
The process proceeds as follows:
-1. Perform one of the following tasks:
- - Install the Volume Activation Services server role on a domain controller running Windows Server 2012 R2, and add a KMS host key by using the Volume Activation Tools Wizard.
- - Extend the domain to the Windows Server 2012 R2 schema level, and add a KMS host key by using the VAMT.
-2. Microsoft verifies the KMS host key, and an activation object is created.
-3. Client computers are activated by receiving the activation object from a domain controller during startup.
+
+1. Perform one of the following tasks:
+ - Install the Volume Activation Services server role on a domain controller and add a KMS host key by using the Volume Activation Tools Wizard.
+ - Extend the domain to the Windows Server 2012 R2 or higher schema level, and add a KMS host key by using the VAMT.
+1. Microsoft verifies the KMS host key, and an activation object is created.
+1. Client computers are activated by receiving the activation object from a domain controller during startup.

-
+
**Figure 10**. The Active Directory-based activation flow
-
-For environments in which all computers are running Windows 10, Windows 8.1, Windows 8, Windows Server 2012, or Windows Server 2012 R2, and they are joined to a domain, Active Directory-based activation is the best option for activating all client computers and servers, and you may be able to remove any KMS hosts from your environment.
+
+For environments in which all computers are running an operating system listed under *Applies to*, and they are joined to a domain, Active Directory-based activation is the best option for activating all client computers and servers, and you may be able to remove any KMS hosts from your environment.
+
If an environment will continue to contain earlier volume licensing operating systems and applications or if you have workgroup computers outside the domain, you need to maintain a KMS host to maintain activation status for earlier volume licensing editions of Windows and Office.
+
Clients that are activated with Active Directory-based activation will maintain their activated state for up to 180 days since the last contact with the domain, but they will periodically attempt to reactivate before then and at the end of the 180 day period. By default, this reactivation event occurs every seven days.
-When a reactivation event occurs, the client queries AD DS for the activation object. Client computers examine the activation object and compare it to the local edition as defined by the GVLK. If the object and GVLK match, reactivation occurs. If the AD DS object cannot be retrieved, client computers use KMS activation. If the computer is removed from the domain, when the computer or the Software Protection service is restarted, the operating system will change the status from activated to not activated, and the computer will try to activate with KMS.
+
+When a reactivation event occurs, the client queries AD DS for the activation object. Client computers examine the activation object and compare it to the local edition as defined by the GVLK. If the object and GVLK match, reactivation occurs. If the AD DS object cannot be retrieved, client computers use KMS activation. If the computer is removed from the domain, and the computer or the Software Protection service is restarted, the operating system will change the status from activated to not activated, and the computer will try to activate with KMS.
+
## Step-by-step configuration: Active Directory-based activation
-**Note**
-You must be a member of the local Administrators group on all computers mentioned in these steps. You also need to be a member of the Enterprise Administrators group, because setting up Active Directory-based activation changes forest-wide settings.
-**To configure Active Directory-based activation on Windows Server 2012 R2, complete the following steps:**
-1. Use an account with Domain Administrator and Enterprise Administrator credentials to sign in to a domain controller.
-2. Launch Server Manager.
-3. Add the Volume Activation Services role, as shown in Figure 11.
+
+> [!NOTE]
+> You must be a member of the local Administrators group on all computers mentioned in these steps. You also need to be a member of the Enterprise Administrators group, because setting up Active Directory-based activation changes forest-wide settings.
+
+**To configure Active Directory-based activation on Windows Server 2012 R2 or higher, complete the following steps:**
+
+1. Use an account with Domain Administrator and Enterprise Administrator credentials to sign in to a domain controller.
+1. Launch Server Manager.
+1. Add the Volume Activation Services role, as shown in Figure 11.

-
+
**Figure 11**. Adding the Volume Activation Services role
-
-4. Click the link to launch the Volume Activation Tools (Figure 12).
+
+1. Click the link to launch the Volume Activation Tools (Figure 12).

-
+
**Figure 12**. Launching the Volume Activation Tools
-
-5. Select the **Active Directory-Based Activation** option (Figure 13).
+
+1. Select the **Active Directory-Based Activation** option (Figure 13).

-
+
**Figure 13**. Selecting Active Directory-Based Activation
-
-6. Enter your KMS host key and (optionally) a display name (Figure 14).
+
+1. Enter your KMS host key and (optionally) a display name (Figure 14).

-
+
**Figure 14**. Entering your KMS host key
-
-7. Activate your KMS host key by phone or online (Figure 15).
+
+1. Activate your KMS host key by phone or online (Figure 15).

-
+
**Figure 15**. Choosing how to activate your product
-
-8. After activating the key, click **Commit**, and then click **Close**.
+
+1. After activating the key, click **Commit**, and then click **Close**.
## Verifying the configuration of Active Directory-based activation
To verify your Active Directory-based activation configuration, complete the following steps:
-1. After you configure Active Directory-based activation, start a computer that is running an edition of Windows that is configured by volume licensing.
-2. If the computer has been previously configured with a MAK key, replace the MAK key with the GVLK by running the **slmgr.vbs /ipk** command and specifying the GLVK as the new product key.
-3. If the computer is not joined to your domain, join it to the domain.
-4. Sign in to the computer.
-5. Open Windows Explorer, right-click **Computer**, and then click **Properties**.
-6. Scroll down to the **Windows activation** section, and verify that this client has been activated.
- **Note**
- If you are using both KMS and Active Directory-based activation, it may be difficult to see whether a client has been activated by KMS or by Active Directory-based activation. Consider disabling KMS during the test, or make sure that you are using a client computer that has not already been activated by KMS. The **slmgr.vbs /dlv** command also indicates whether KMS has been used.
-
+1. After you configure Active Directory-based activation, start a computer that is running an edition of Windows that is configured by volume licensing.
+1. If the computer has been previously configured with a MAK key, replace the MAK key with the GVLK by running the **slmgr.vbs /ipk** command and specifying the GLVK as the new product key.
+1. If the computer is not joined to your domain, join it to the domain.
+1. Sign in to the computer.
+1. Open Windows Explorer, right-click **Computer**, and then click **Properties**.
+1. Scroll down to the **Windows activation** section, and verify that this client has been activated.
+
+ > [!NOTE]
+ > If you are using both KMS and Active Directory-based activation, it may be difficult to see whether a client has been activated by KMS or by Active Directory-based activation. Consider disabling KMS during the test, or make sure that you are using a client computer that has not already been activated by KMS. The **slmgr.vbs /dlv** command also indicates whether KMS has been used.
+
## See also
-- [Volume Activation for Windows 10](volume-activation-windows-10.md)
+
+- [Volume Activation for Windows 10](volume-activation-windows-10.md)
diff --git a/windows/deployment/volume-activation/active-directory-based-activation-overview.md b/windows/deployment/volume-activation/active-directory-based-activation-overview.md
index b0c4c10975..581a2a317e 100644
--- a/windows/deployment/volume-activation/active-directory-based-activation-overview.md
+++ b/windows/deployment/volume-activation/active-directory-based-activation-overview.md
@@ -9,7 +9,8 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: activation
-audience: itpro
author: greg-lindsay
+audience: itpro
+author: greg-lindsay
ms.date: 12/07/2018
ms.topic: article
---
@@ -37,7 +38,7 @@ VAMT enables IT Professionals to manage and activate the ADBA object. Activation
## Related topics
-- [How to Activate an Active Directory Forest Online](https://go.microsoft.com/fwlink/p/?LinkId=246565)
-- [How to Proxy Activate an Active Directory Forest](https://go.microsoft.com/fwlink/p/?LinkId=246566)
+- [How to Activate an Active Directory Forest Online](https://docs.microsoft.com/windows/deployment/volume-activation/activate-forest-vamt)
+- [How to Proxy Activate an Active Directory Forest](https://docs.microsoft.com/windows/deployment/volume-activation/activate-forest-by-proxy-vamt)
diff --git a/windows/deployment/windows-10-deployment-posters.md b/windows/deployment/windows-10-deployment-posters.md
new file mode 100644
index 0000000000..f36dea21ef
--- /dev/null
+++ b/windows/deployment/windows-10-deployment-posters.md
@@ -0,0 +1,41 @@
+---
+title: Windows 10 deployment process posters
+description: View and download Windows 10 deployment process flows for System Center Configuration Manager and Windows Autopilot.
+ms.reviewer:
+manager: laurawi
+ms.audience: itpro
+author: greg-lindsay
+ms.author: greglin
+keywords: upgrade, in-place, configuration, deploy
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: medium
+ms.sitesec: library
+audience: itpro
+author: greg-lindsay
+ms.topic: article
+---
+
+# Windows 10 deployment process posters
+
+**Applies to**
+- Windows 10
+
+The following posters step through various options for deploying Windows 10 with Windows Autopilot or System Center Configuration Manager.
+
+## Deploy Windows 10 with Autopilot
+
+The Windows Autopilot poster is two pages in portrait mode (11x17). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10AutopilotFlowchart.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10Autopilotflowchart.vsdx) format.
+
+[](./media/Windows10AutopilotFlowchart.pdf)
+
+## Deploy Windows 10 with System Center Configuration Manager
+
+The Configuration Manager poster is one page in landscape mode (17x11). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.vsdx) format.
+
+[](./media/Windows10DeploymentConfigManager.pdf)
+
+## See also
+
+[Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot)
+[Scenarios to deploy enterprise operating systems with Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems)
\ No newline at end of file
diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md
index 11ef79b654..8ceb4e28f5 100644
--- a/windows/deployment/windows-10-subscription-activation.md
+++ b/windows/deployment/windows-10-subscription-activation.md
@@ -7,7 +7,8 @@ ms.mktglfcycl: deploy
ms.localizationpriority: medium
ms.sitesec: library
ms.pagetype: mdt
-audience: itpro
author: greg-lindsay
+audience: itpro
+author: greg-lindsay
manager: laurawi
ms.collection: M365-modern-desktop
search.appverid:
@@ -167,7 +168,7 @@ The following policies apply to acquisition and renewal of licenses on devices:
- Devices that have been upgraded will attempt to renew licenses about every 30 days, and must be connected to the Internet to successfully acquire or renew a license.
- If a device is disconnected from the Internet until its current subscription expires, the operating system will revert to Windows 10 Pro or Windows 10 Pro Education. As soon as the device is connected to the Internet again, the license will automatically renew.
- Up to five devices can be upgraded for each user license.
-- If a device the meets requirements and a licensed user signs in on that device, it will be upgraded.
+- If a device meets the requirements and a licensed user signs in on that device, it will be upgraded.
Licenses can be reallocated from one user to another user, allowing you to optimize your licensing investment against changing needs.
diff --git a/windows/deployment/windows-autopilot/TOC.md b/windows/deployment/windows-autopilot/TOC.md
index 73b9410bf7..0de74e46b1 100644
--- a/windows/deployment/windows-autopilot/TOC.md
+++ b/windows/deployment/windows-autopilot/TOC.md
@@ -7,6 +7,7 @@
## [Get started](demonstrate-deployment-on-vm.md)
# Deployment scenarios
+## [Deployment processes](deployment-process.md)
## [User-driven mode](user-driven.md)
## [Self-deploying mode](self-deploying.md)
## [Windows Autopilot Reset](windows-autopilot-reset.md)
diff --git a/windows/deployment/windows-autopilot/add-devices.md b/windows/deployment/windows-autopilot/add-devices.md
index 6d2dc8e363..b76cb0ec72 100644
--- a/windows/deployment/windows-autopilot/add-devices.md
+++ b/windows/deployment/windows-autopilot/add-devices.md
@@ -1,162 +1,162 @@
----
-title: Adding devices
-ms.reviewer:
-manager: laurawi
-description: How to add devices to Windows Autopilot
-keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: medium
-ms.sitesec: library
-ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
-ms.author: greglin
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-
-# Adding devices to Windows Autopilot
-
-**Applies to**
-
-- Windows 10
-
-Before deploying a device using Windows Autopilot, the device must be registered with the Windows Autopilot deployment service. Ideally, this would be performed by the OEM, reseller, or distributor from which the devices were purchased, but this can also be done by the organization by collecting the hardware identity and uploading it manually.
-
-## OEM registration
-
-When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers" section of the [Windows Autopilot information page](https://www.microsoft.com/windowsforbusiness/windows-autopilot).
-
-Before an OEM can register devices on behalf of an organization, the organization must grant the OEM permission to do so. This process is initiated by the OEM, with approval granted by an Azure AD global administrator from the organization. See the "Customer Consent" section of the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#oem-authorization).
-
-## Reseller, distributor, or partner registration
-
-Customers may purchase devices from resellers, distributors, or other partners. As long as these resellers, distributors, and partners are part of the [Cloud Solution Partners (CSP) program](https://partner.microsoft.com/en-us/cloud-solution-provider), they too can register devices on behalf of the customer.
-
-As with OEMs, CSP parnters must be granted permission to register devices on behalf of an organization. This follows the process described on the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#csp-authorization). The CSP partner initiates a request to establish a relationship with the organization, with approval granted by a global administrator from the organization. Once approved, CSP partners add devices using [Partner Center](https://partner.microsoft.com/en-us/pcv/dashboard/overview), either directly through the web site or via available APIs that can automate the same tasks.
-
-Windows Autopilot does not require delegated administrator permissions when establishing the relationship between the CSP partner and the organization. As part of the approval process performed by the global administrator, the global administrator can choose to uncheck the "Include delegated administration permissions" checkbox.
-
-## Automatic registration of existing devices
-
-If an existing device is already running Windows 10 version 1703 or later and enrolled in an MDM service such an Intune, that MDM service can ask the device for the hardware ID (also known as a hardware hash). Once it has that, it can automatically register the device with Windows Autopilot.
-
-For instructions on how to do this with Microsoft Intune, see [Create an Autopilot deployment profile](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-deployment-profile) documentation describing the "Convert all targeted devices to Autopilot" setting.
-
-Also note that when using the [Windows Autopilot for existing devices](https://docs.microsoft.com/windows/deployment/windows-autopilot/existing-devices) scenario, it is not necessary to pre-register the devices with Windows Autopilot. Instead, a configuration file (AutopilotConfigurationFile.json) containing all the Windows Autopilot profile settings is used; the device can be registered with Windows Autopilot after the fact using the same "Convert all targeted devices to Autopilot" setting.
-
-## Manual registration
-
-To perform manual registration of a device, you must first capture its hardware ID (also known as a hardware hash). Once this process has completed, the resulting hardware ID can be uploaded to the Windows Autopilot service. Because this process requires booting the device into Windows 10 in order to obtain the hardware ID, this is intended primarily for testing and evaluation scenarios.
-
-## Device identification
-
-To define a device to the Windows Autopilot deployment service, a unique hardware ID for the device needs to be captured and uploaded to the service. While this step is ideally done by the hardware vendor (OEM, reseller, or distributor), automatically associating the device with an organization, it is also possible to do this through a harvesting process that collects the device from within a running Windows 10 version 1703 or later installation.
-
-The hardware ID, also commonly referred to as a hardware hash, contains several details about the device, including its manufacturer, model, device serial number, hard drive serial number, and many other attributes that can be used to uniquely identify that device.
-
-Note that the hardware hash also contains details about when it was generated, so it will change each time it is generated. When the Windows Autopilot deployment service attempts to match a device, it considers changes like that, as well as more substantial changes such as a new hard drive, and is still able to match successfully. But substantial changes to the hardware, such as a motherboard replacement, would not match, so a new hash would need to be generated and uploaded.
-
-### Collecting the hardware ID from existing devices using System Center Configuration Manager
-
-Starting with System Center Configuration Manager current branch version 1802, the hardware hashes for existing Windows 10 version 1703 and higher devices are automatically collected by Configuration Manager. See the [What’s new in version 1802](https://docs.microsoft.com/sccm/core/plan-design/changes/whats-new-in-version-1802#report-on-windows-autopilot-device-information) documentation for more details. The hash information can be extracted from Configuration Manager into a CSV file.
-
-### Collecting the hardware ID from existing devices using PowerShell
-
-The hardware ID, or hardware hash, for an existing device is available through Windows Management Instrumentation (WMI), as long as that device is running Windows 10 version 1703 or later. To help gather this information, as well as the serial number of the device (useful to see at a glance the machine to which it belongs), a PowerShell script called [Get-WindowsAutoPilotInfo.ps1 has been published to the PowerShell Gallery website](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo).
-
-To use this script, you can download it from the PowerShell Gallery and run it on each computer, or you can install it directly from the PowerShell Gallery. To install it directly and capture the hardware hash from the local computer, use the following commands from an elevated Windows PowerShell prompt:
-
-```powershell
-md c:\\HWID
-Set-Location c:\\HWID
-Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted
-Install-Script -Name Get-WindowsAutoPilotInfo
-Get-WindowsAutoPilotInfo.ps1 -OutputFile AutoPilotHWID.csv
-```
-
-The commands can also be run remotely, as long as WMI permissions are in place and WMI is accessible through the Windows Firewall on that remote computer. See the [Get-WindowsAutoPilotInfo](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo) script’s help (using “Get-Help Get-WindowsAutoPilotInfo.ps1”) for more information about running the script.
-
->[!IMPORTANT]
->Do not connect devices to the Internet prior to capturing the hardware ID and creating an Autopilot device profile. This includes collecting the hardware ID, uploading the .CSV into MSfB or Intune, assigning the profile, and confirming the profile assignment. Connecting the device to the Internet before this process is complete will result in the device downloading a blank profile that is stored on the device until it is explicity removed. In Windows 10 version 1809, you can clear the cached profile by restarting OOBE. In previous versions, the only way to clear the stored profile is to re-install the OS, reimage the PC, or run **sysprep /generalize /oobe**.
->After Intune reports the profile ready to go, only then should the device be connected to the Internet.
-
->[!NOTE]
->If OOBE is restarted too many times it can enter a recovery mode and fail to run the Autopilot configuration. You can identify this scenario if OOBE displays multiple configuration options on the same page, including language, region, and keyboard layout. The normal OOBE displays each of these on a separate page. The following value key tracks the count of OOBE retries:
->**HKCU\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\UserOOBE**
->To ensure OOBE has not been restarted too many times, you can change this value to 1.
-
-## Registering devices
-
-
-
-
-Once the hardware IDs have been captured from existing devices, they can be uploaded through a variety of means. See the detailed documentation for each available mechanism.
-
-- [Microsoft Intune](https://docs.microsoft.com/intune/enrollment-autopilot). This is the preferred mechanism for all customers.
-- [Partner Center](https://msdn.microsoft.com/partner-center/autopilot). This is used by CSP partners to register devices on behalf of customers.
-- [Microsoft 365 Business & Office 365 Admin](https://support.office.com/article/Create-and-edit-AutoPilot-profiles-5cf7139e-cfa1-4765-8aad-001af1c74faa). This is typically used by small and medium businesses (SMBs) who manage their devices using Microsoft 365 Business.
-- [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#manage-autopilot-deployment-profiles). You might already be using MSfB to manage your apps and settings.
-
-A summary of each platform's capabilities is provided below.
-
-
-
-Platform/Portal
- Register devices?
- Create/Assign profile
- Acceptable DeviceID
-
-
-
-OEM Direct API
-YES - 1000 at a time max
-NO
-Tuple or PKID
-
-
-
-Partner Center
-YES - 1000 at a time max
-YES
-Tuple or PKID or 4K HH
-
-
-
-Intune
-YES - 500 at a time max\*
-YES\*
-4K HH
-
-
-
-Microsoft Store for Business
-YES - 1000 at a time max
-YES
-4K HH
-
-
-
-Microsoft Business 365
-YES - 1000 at a time max
-YES
-4K HH
-
-
-
-
->* Microsoft recommended platform to use
-
-## Summary
-
-When deploying new devices using Windows Autopilot, the following steps are required:
-
-1. [Register devices](#registering-devices). Ideally, this step is performed by the OEM, reseller, or distributor from which the devices were purchased, but this can also be done by the organization by collecting the hardware identity and uploading it manually.
-2. [Configure device profiles](profiles.md), specifying how the device should be deployed and what user experience should be presented.
-3. Boot the device. When the device is connected to a network with internet access, it will contact the Windows Autopilot deployment service to see if the device is registered, and if it is, it will download profile settings such as the [Enrollment Status page](enrollment-status.md), which are used to customize the end user experience.
-
-## Other configuration settings
-
-- [Bitlocker encryption settings](bitlocker.md): You can configure the BitLocker encryption settings to be applied before automatic encryption is started.
-
+---
+title: Adding devices
+ms.reviewer:
+manager: laurawi
+description: How to add devices to Windows Autopilot
+keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: medium
+ms.sitesec: library
+ms.pagetype: deploy
+audience: itpro
+author: greg-lindsay
+ms.author: greglin
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+
+# Adding devices to Windows Autopilot
+
+**Applies to**
+
+- Windows 10
+
+Before deploying a device using Windows Autopilot, the device must be registered with the Windows Autopilot deployment service. Ideally, this would be performed by the OEM, reseller, or distributor from which the devices were purchased, but this can also be done by the organization by collecting the hardware identity and uploading it manually.
+
+## OEM registration
+
+When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers" section of the [Windows Autopilot information page](https://www.microsoft.com/windowsforbusiness/windows-autopilot).
+
+Before an OEM can register devices on behalf of an organization, the organization must grant the OEM permission to do so. This process is initiated by the OEM, with approval granted by an Azure AD global administrator from the organization. See the "Customer Consent" section of the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#oem-authorization).
+
+## Reseller, distributor, or partner registration
+
+Customers may purchase devices from resellers, distributors, or other partners. As long as these resellers, distributors, and partners are part of the [Cloud Solution Partners (CSP) program](https://partner.microsoft.com/en-us/cloud-solution-provider), they too can register devices on behalf of the customer.
+
+As with OEMs, CSP partners must be granted permission to register devices on behalf of an organization. This follows the process described on the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#csp-authorization). The CSP partner initiates a request to establish a relationship with the organization, with approval granted by a global administrator from the organization. Once approved, CSP partners add devices using [Partner Center](https://partner.microsoft.com/en-us/pcv/dashboard/overview), either directly through the web site or via available APIs that can automate the same tasks.
+
+Windows Autopilot does not require delegated administrator permissions when establishing the relationship between the CSP partner and the organization. As part of the approval process performed by the global administrator, the global administrator can choose to uncheck the "Include delegated administration permissions" checkbox.
+
+## Automatic registration of existing devices
+
+If an existing device is already running Windows 10 version 1703 or later and enrolled in an MDM service such an Intune, that MDM service can ask the device for the hardware ID (also known as a hardware hash). Once it has that, it can automatically register the device with Windows Autopilot.
+
+For instructions on how to do this with Microsoft Intune, see [Create an Autopilot deployment profile](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-deployment-profile) documentation describing the "Convert all targeted devices to Autopilot" setting.
+
+Also note that when using the [Windows Autopilot for existing devices](https://docs.microsoft.com/windows/deployment/windows-autopilot/existing-devices) scenario, it is not necessary to pre-register the devices with Windows Autopilot. Instead, a configuration file (AutopilotConfigurationFile.json) containing all the Windows Autopilot profile settings is used; the device can be registered with Windows Autopilot after the fact using the same "Convert all targeted devices to Autopilot" setting.
+
+## Manual registration
+
+To perform manual registration of a device, you must first capture its hardware ID (also known as a hardware hash). Once this process has completed, the resulting hardware ID can be uploaded to the Windows Autopilot service. Because this process requires booting the device into Windows 10 in order to obtain the hardware ID, this is intended primarily for testing and evaluation scenarios.
+
+## Device identification
+
+To define a device to the Windows Autopilot deployment service, a unique hardware ID for the device needs to be captured and uploaded to the service. While this step is ideally done by the hardware vendor (OEM, reseller, or distributor), automatically associating the device with an organization, it is also possible to do this through a harvesting process that collects the device from within a running Windows 10 version 1703 or later installation.
+
+The hardware ID, also commonly referred to as a hardware hash, contains several details about the device, including its manufacturer, model, device serial number, hard drive serial number, and many other attributes that can be used to uniquely identify that device.
+
+Note that the hardware hash also contains details about when it was generated, so it will change each time it is generated. When the Windows Autopilot deployment service attempts to match a device, it considers changes like that, as well as more substantial changes such as a new hard drive, and is still able to match successfully. But substantial changes to the hardware, such as a motherboard replacement, would not match, so a new hash would need to be generated and uploaded.
+
+### Collecting the hardware ID from existing devices using System Center Configuration Manager
+
+Starting with System Center Configuration Manager current branch version 1802, the hardware hashes for existing Windows 10 version 1703 and higher devices are automatically collected by Configuration Manager. See the [What’s new in version 1802](https://docs.microsoft.com/sccm/core/plan-design/changes/whats-new-in-version-1802#report-on-windows-autopilot-device-information) documentation for more details. The hash information can be extracted from Configuration Manager into a CSV file.
+
+### Collecting the hardware ID from existing devices using PowerShell
+
+The hardware ID, or hardware hash, for an existing device is available through Windows Management Instrumentation (WMI), as long as that device is running Windows 10 version 1703 or later. To help gather this information, as well as the serial number of the device (useful to see at a glance the machine to which it belongs), a PowerShell script called [Get-WindowsAutoPilotInfo.ps1 has been published to the PowerShell Gallery website](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo).
+
+To use this script, you can download it from the PowerShell Gallery and run it on each computer, or you can install it directly from the PowerShell Gallery. To install it directly and capture the hardware hash from the local computer, use the following commands from an elevated Windows PowerShell prompt:
+
+```powershell
+md c:\\HWID
+Set-Location c:\\HWID
+Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted
+Install-Script -Name Get-WindowsAutoPilotInfo
+Get-WindowsAutoPilotInfo.ps1 -OutputFile AutoPilotHWID.csv
+```
+
+The commands can also be run remotely, as long as WMI permissions are in place and WMI is accessible through the Windows Firewall on that remote computer. See the [Get-WindowsAutoPilotInfo](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo) script’s help (using “Get-Help Get-WindowsAutoPilotInfo.ps1”) for more information about running the script.
+
+>[!IMPORTANT]
+>Do not connect devices to the Internet prior to capturing the hardware ID and creating an Autopilot device profile. This includes collecting the hardware ID, uploading the .CSV into MSfB or Intune, assigning the profile, and confirming the profile assignment. Connecting the device to the Internet before this process is complete will result in the device downloading a blank profile that is stored on the device until it is explicity removed. In Windows 10 version 1809, you can clear the cached profile by restarting OOBE. In previous versions, the only way to clear the stored profile is to re-install the OS, reimage the PC, or run **sysprep /generalize /oobe**.
+>After Intune reports the profile ready to go, only then should the device be connected to the Internet.
+
+>[!NOTE]
+>If OOBE is restarted too many times it can enter a recovery mode and fail to run the Autopilot configuration. You can identify this scenario if OOBE displays multiple configuration options on the same page, including language, region, and keyboard layout. The normal OOBE displays each of these on a separate page. The following value key tracks the count of OOBE retries:
+>**HKCU\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\UserOOBE**
+>To ensure OOBE has not been restarted too many times, you can change this value to 1.
+
+## Registering devices
+
+
+
+
+Once the hardware IDs have been captured from existing devices, they can be uploaded through a variety of means. See the detailed documentation for each available mechanism.
+
+- [Microsoft Intune](https://docs.microsoft.com/intune/enrollment-autopilot). This is the preferred mechanism for all customers.
+- [Partner Center](https://msdn.microsoft.com/partner-center/autopilot). This is used by CSP partners to register devices on behalf of customers.
+- [Microsoft 365 Business & Office 365 Admin](https://support.office.com/article/Create-and-edit-AutoPilot-profiles-5cf7139e-cfa1-4765-8aad-001af1c74faa). This is typically used by small and medium businesses (SMBs) who manage their devices using Microsoft 365 Business.
+- [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#manage-autopilot-deployment-profiles). You might already be using MSfB to manage your apps and settings.
+
+A summary of each platform's capabilities is provided below.
+
+
+
+Platform/Portal
+ Register devices?
+ Create/Assign profile
+ Acceptable DeviceID
+
+
+
+OEM Direct API
+YES - 1000 at a time max
+NO
+Tuple or PKID
+
+
+
+Partner Center
+YES - 1000 at a time max
+YES
+Tuple or PKID or 4K HH
+
+
+
+Intune
+YES - 500 at a time max*
+YES*
+4K HH
+
+
+
+Microsoft Store for Business
+YES - 1000 at a time max
+YES
+4K HH
+
+
+
+Microsoft Business 365
+YES - 1000 at a time max
+YES
+4K HH
+
+
+
+
+>* Microsoft recommended platform to use
+
+## Summary
+
+When deploying new devices using Windows Autopilot, the following steps are required:
+
+1. [Register devices](#registering-devices). Ideally, this step is performed by the OEM, reseller, or distributor from which the devices were purchased, but this can also be done by the organization by collecting the hardware identity and uploading it manually.
+2. [Configure device profiles](profiles.md), specifying how the device should be deployed and what user experience should be presented.
+3. Boot the device. When the device is connected to a network with internet access, it will contact the Windows Autopilot deployment service to see if the device is registered, and if it is, it will download profile settings such as the [Enrollment Status page](enrollment-status.md), which are used to customize the end user experience.
+
+## Other configuration settings
+
+- [Bitlocker encryption settings](bitlocker.md): You can configure the BitLocker encryption settings to be applied before automatic encryption is started.
diff --git a/windows/deployment/windows-autopilot/deployment-process.md b/windows/deployment/windows-autopilot/deployment-process.md
new file mode 100644
index 0000000000..3a8781ce86
--- /dev/null
+++ b/windows/deployment/windows-autopilot/deployment-process.md
@@ -0,0 +1,27 @@
+---
+title: Windows 10 deployment process posters
+description: View and download Windows 10 deployment process flows for System Center Configuration Manager and Windows Autopilot.
+ms.reviewer:
+manager: laurawi
+ms.audience: itpro
+author: greg-lindsay
+keywords: upgrade, in-place, configuration, deploy
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: medium
+ms.sitesec: library
+audience: itpro
+author: greg-lindsay
+ms.topic: article
+---
+
+# Windows Autopilot deployment process
+
+**Applies to**
+- Windows 10
+
+Windows Autopilot deployment processes are summarized in the poster below. The poster is two pages in portrait mode (11x17). Click the image below to view a PDF in your browser.
+
+[](../media/Windows10AutopilotFlowchart.pdf)
+
+**Note**: The Windows Autopilot for existing devices process is included in the [System Center Configuration Manager deployment poster](../windows-10-deployment-posters.md#deploy-windows-10-with-system-center-configuration-manager).
\ No newline at end of file
diff --git a/windows/deployment/windows-autopilot/known-issues.md b/windows/deployment/windows-autopilot/known-issues.md
index b2de8f53ee..c1f9331822 100644
--- a/windows/deployment/windows-autopilot/known-issues.md
+++ b/windows/deployment/windows-autopilot/known-issues.md
@@ -31,10 +31,8 @@ This happens because Windows 10, version 1903 deletes the AutopilotConfiguration
To fix this issue: Edit the Configuration Manager task sequence and disable the Prepare Windows for Capture step.
Add a new Run command line step that runs c:\windows\system32\sysprep\sysprep.exe /oobe /reboot .
More information
- The following known issue will be resolved by installing the KB4517211 update, due to be released in late September 2019.
-
-TPM attestation fails on Windows 10 1903 due to missing AKI extension in EK certificate. (An additional validation added in Windows 10 1903 to check that the TPM EK certs had the proper attributes according to the TCG specifications uncovered that a number of them don’t, so that validation will be removed).
- Download and install the KB4517211 update. This update is currently pending release.
+ TPM attestation fails on Windows 10 1903 due to missing AKI extension in EK certificate. (An additional validation added in Windows 10 1903 to check that the TPM EK certs had the proper attributes according to the TCG specifications uncovered that a number of them don’t, so that validation will be removed).
+ Download and install the KB4517211 update .
The following known issues are resolved by installing the August 30, 2019 KB4512941 update (OS Build 18362.329):
- Windows Autopilot for existing devices feature does not properly suppress “Activities” page during OOBE. (Because of this, you’ll see that extra page during OOBE).
@@ -53,7 +51,12 @@ TPM attestation fails on Windows 10 1903 due to missing AKI extension in EK cert
- You are unable to install UWP apps from the Microsoft Store, causing failures during Windows Autopilot. If you are deploying Company Portal as a blocking app during Windows Autopilot ESP, you’ve probably seen this error.
- A user is not granted administrator rights in the Windows Autopilot user-driven Hybrid Azure AD join scenario. This is another non-English OS issue.
Download and install the KB4505903 update . See the section: How to get this update for information on specific release channels you can use to obtain the update.
-
+ Windows Autopilot self-deploying mode fails with an error code:
+
+0x800705B4 This is a general error indicating a timeout. A common cause of this error in self-deploying mode is that the device is not TPM 2.0 capable (ex: a virtual machine). Devices that are not TPM 2.0 capable cannot be used with self-deploying mode.
+ 0x801c03ea This error indicates that TPM attestation failed, causing a failure to join Azure Active Directory with a device token.
+ 0xc1036501 The device cannot do an automatic MDM enrollment because there are multiple MDM configurations in Azure AD. See Inside Windows Autopilot self-deploying mode .
+
White glove gives a red screen and the Microsoft-Windows-User Device Registration/Admin event log displays HResult error code 0x801C03F3 This can happen if Azure AD can’t find an AAD device object for the device that you are trying to deploy. This will occur if you manually delete the object. To fix it, remove the device from AAD, Intune, and Autopilot, then re-register it with Autopilot, which will recreate the AAD device object.
To obtain troubleshooting logs use: Mdmdiagnosticstool.exe -area Autopilot;TPM -cab c:\autopilot.cab
White glove gives a red screen White glove is not supported on a VM.
diff --git a/windows/deployment/windows-autopilot/self-deploying.md b/windows/deployment/windows-autopilot/self-deploying.md
index 939b4ac431..ca49b045ee 100644
--- a/windows/deployment/windows-autopilot/self-deploying.md
+++ b/windows/deployment/windows-autopilot/self-deploying.md
@@ -39,7 +39,7 @@ Self-deploying mode is designed to deploy Windows 10 as a kiosk, digital signage
Because self-deploying mode uses a device’s TPM 2.0 hardware to authenticate the device into an organization’s Azure AD tenant, devices without TPM 2.0 cannot be used with this mode. The devices must also support TPM device attestation. (All newly-manufactured Windows devices should meet these requirements.)
>[!IMPORTANT]
->If you attempt a self-deploying mode deployment on a device that does not have support TPM 2.0 or on a virtual machine, the process will fail when verifying the device with an 0x800705B4 timeout error (Hyper-V virtual TPMs are not supported).. Also note that Window 10, version 1903 or later is required to use self-deploying mode due to issues with TPM device attestation in Windows 10, version 1809. Since Windows 10 Enterprise 2019 LTSC is based on Windows 10 version 1809, self-deploying mode is also not supported on Windows 10 Enterprise 2019 LTSC.
+>If you attempt a self-deploying mode deployment on a device that does not have support TPM 2.0 or on a virtual machine, the process will fail when verifying the device with an 0x800705B4 timeout error (Hyper-V virtual TPMs are not supported). Also note that Window 10, version 1903 or later is required to use self-deploying mode due to issues with TPM device attestation in Windows 10, version 1809. Since Windows 10 Enterprise 2019 LTSC is based on Windows 10 version 1809, self-deploying mode is also not supported on Windows 10 Enterprise 2019 LTSC. See [Windows Autopilot known issues](known-issues.md) to review other known errors and solutions.
In order to display an organization-specific logo and organization name during the Autopilot process, Azure Active Directory Company Branding needs to be configured with the images and text that should be displayed. See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details.
diff --git a/windows/deployment/windows-autopilot/troubleshooting.md b/windows/deployment/windows-autopilot/troubleshooting.md
index 2d857f5388..f2e35ade30 100644
--- a/windows/deployment/windows-autopilot/troubleshooting.md
+++ b/windows/deployment/windows-autopilot/troubleshooting.md
@@ -9,7 +9,8 @@ ms.mktglfcycl: deploy
ms.localizationpriority: medium
ms.sitesec: library
ms.pagetype: deploy
-audience: itpro
author: greg-lindsay
+audience: itpro
+author: greg-lindsay
ms.author: greglin
ms.collection: M365-modern-desktop
ms.topic: article
@@ -47,7 +48,7 @@ If the expected Autopilot behavior does not occur during the out-of-box experien
### Windows 10 version 1803 and above
-To see details related to the Autopilot profile settings and OOBE flow, Windows 10 version 1803 and above adds event log entries. These can be viewed using Event Viewer, navigating to the log at **Application and Services Logs –> Microsoft –> Windows –> Provisioning-Diagnostics-Provider –> AutoPilot**. The following events may be recorded, depending on the scenario and profile configuration.
+To see details related to the Autopilot profile settings and OOBE flow, Windows 10 version 1803 and above adds event log entries. These can be viewed using Event Viewer, navigating to the log at **Application and Services Logs –> Microsoft –> Windows –> Provisioning-Diagnostics-Provider –> AutoPilot** for versions before 1903, or **Application and Services Logs –> Microsoft –> Windows –> ModernDeployment-Diagnostics-Provider –> AutoPilot** for 1903 and above. The following events may be recorded, depending on the scenario and profile configuration.
| Event ID | Type | Description |
|----------|------|-------------|
diff --git a/windows/docfx.json b/windows/docfx.json
index 21cba6820f..1bac183185 100644
--- a/windows/docfx.json
+++ b/windows/docfx.json
@@ -9,7 +9,7 @@
],
"resource": [
{
- "files": ["**/images/**"],
+ "files": ["**/images/**", "**/*.pdf"],
"exclude": ["**/obj/**"]
}
],
diff --git a/windows/privacy/TOC.md b/windows/privacy/TOC.md
index e4021e6946..8e10f74a84 100644
--- a/windows/privacy/TOC.md
+++ b/windows/privacy/TOC.md
@@ -14,7 +14,7 @@
### [Windows 10, version 1709 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
### [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
## Enhanced level Windows diagnostic data events and fields
-### [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)
+### [Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)
## Full level categories
### [Windows 10, version 1709 and newer diagnostic data for the Full level](windows-diagnostic-data.md)
### [Windows 10, version 1703 diagnostic data for the Full level](windows-diagnostic-data-1703.md)
diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
index aed5ac00b0..709a681130 100644
--- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
+++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
@@ -104,27 +104,8 @@ Windows diagnostic data also helps Microsoft better understand how customers use
### Insights into your own organization
-Sharing information with Microsoft helps make Windows and other products better, but it can also help make your internal processes and user experiences better, as well. Microsoft is in the process of developing a set of analytics customized for your internal use. The first of these, called [Upgrade Readiness](/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness).
+Sharing information with Microsoft helps make Windows and other products better, but it can also help make your internal processes and user experiences better. Microsoft provides a set of solutions that leverage information shared by customers to provide insights customized for your internal use. The first of these was [Upgrade Readiness](/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness), followed by [Desktop Analytics](https://aka.ms/DADocs) (coming soon). Both help organizations with [Windows as a Service](/windows/deployment/update/wass-overview) adoption and potential compatibility challenges. For E5 customers, [Microsoft Defender Advanced Threat Protection](/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection), a platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats.
-#### Upgrade Readiness
-
-Upgrading to new operating system versions has traditionally been a challenging, complex, and slow process for many enterprises. Discovering applications and drivers and then testing them for potential compatibility issues have been among the biggest pain points.
-
-To better help customers through this difficult process, Microsoft developed Upgrade Readiness to give enterprises the tools to plan and manage the upgrade process end to end and allowing them to adopt new Windows releases more quickly and on an ongoing basis.
-
-With Windows diagnostic data enabled, Microsoft collects computer, application, and driver compatibility-related information for analysis. We then identify compatibility issues that can block your upgrade and suggest fixes when they are known to Microsoft.
-
-Use Upgrade Readiness to get:
-
-- A visual workflow that guides you from pilot to production
-- Detailed computer, driver, and application inventory
-- Powerful computer level search and drill-downs
-- Guidance and insights into application and driver compatibility issues with suggested fixes
-- Data driven application rationalization tools
-- Application usage information, allowing targeted validation; workflow to track validation progress and decisions
-- Data export to commonly used software deployment tools
-
-The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded.
## How Microsoft handles diagnostic data
@@ -390,20 +371,26 @@ However, before more data is gathered, Microsoft’s privacy governance team, in
> [!NOTE]
> Crash dumps collected at this diagnostic data level may unintentionally contain personal data, such as portions of memory from a documents, a web page, etc.
-## Limit Enhanced diagnostic data to the minimum required by Windows Analytics
+## Limit Enhanced diagnostic data to the minimum required by Desktop Analytics
-Windows Analytics Device Health reports are powered by diagnostic data not included in the **Basic** level, such as crash reports and certain operating system events. In the past, organizations sending **Enhanced** or **Full** level diagnostic data were able to participate in Device Health. However, organizations that required detailed event and field level documentation were unable to move from **Basic** to **Enhanced**.
+> [!IMPORTANT]
+> The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](/windows/deployment/update/update-compliance-get-started) will continue to be supported.
+> For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
-In Windows 10, version 1709, we introduced the **Limit Enhanced diagnostic data to the minimum required by Windows Analytics** feature. When enabled, this feature lets you send only the following subset of **Enhanced** level diagnostic data. For more info about Device Health, see the [Monitor the health of devices with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-monitor) topic.
+Desktop Analytics reports are powered by diagnostic data not included in the **Basic** level, such as crash reports and certain operating system events.
-- **Operating system events.** Limited to a small set required for analytics reports and documented in the [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) topic.
+In Windows 10, version 1709, we introduced the **Limit Enhanced diagnostic data to the minimum required by Windows Analytics** feature. When enabled, this feature lets you send only the following subset of **Enhanced** level diagnostic data.
+
+- **Operating system events.** Limited to a small set required for analytics reports and documented in the [Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) topic.
- **Some crash dump types.** Triage dumps for user mode and mini dumps for kernel mode.
>[!NOTE]
> Triage dumps are a type of [minidumps](https://docs.microsoft.com/windows/desktop/debug/minidump-files) that go through a process of user-sensitive information scrubbing. Some user-sensitive information may be missed in the process, and will therefore be sent with the dump.
-### Enable limiting enhanced diagnostic data to the minimum required by Windows Analytics
+With the retirement of Windows Analytics, this policy will continue to be supported by Desktop Analytics, but will not include Office related diagnostic data.
+
+### Enable limiting enhanced diagnostic data to the minimum required by Desktop Analytics
1. Set the diagnostic data level to **Enhanced**, using either Group Policy or MDM.
diff --git a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md
index 29da582e50..c6e50f98f3 100644
--- a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md
+++ b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md
@@ -1,6 +1,6 @@
---
-description: Use this article to learn more about the enhanced diagnostic data events used by Windows Analytics
-title: Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics (Windows 10)
+description: Use this article to learn more about the limit enhanced diagnostic data events policy used by Desktop Analytics
+title: Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy (Windows 10)
keywords: privacy, diagnostic data
ms.prod: w10
ms.mktglfcycl: manage
@@ -18,19 +18,24 @@ ms.reviewer:
---
-# Windows 10 enhanced diagnostic data events and fields used by Windows Analytics
+# Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy
**Applies to**
- Windows 10, version 1709 and newer
-Windows Analytics Device Health reports are powered by diagnostic data not included in the Basic level. This includes crash reports and certain OS diagnostic data events. Organizations sending Enhanced or Full level diagnostic data were able to participate in Device Health, but some organizations which required detailed event and field level documentation were unable to move from Basic to Enhanced.
+> [!IMPORTANT]
+> The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](/windows/deployment/update/update-compliance-get-started) will continue to be supported.
+> For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
-In Windows 10, version 1709, we introduce a new feature: "Limit Enhanced diagnostic data to the minimum required by Windows Analytics". When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to only those described below. Note that the Enhanced level also includes limited crash reports, which are not described below. For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
+Desktop Analytics reports are powered by diagnostic data not included in the Basic level.
+In Windows 10, version 1709, we introduced a new feature: "Limit Enhanced diagnostic data to the minimum required by Windows Analytics". When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to only those described below. Note that the Enhanced level also includes limited crash reports, which are not described below. For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
+
+With the retirement of Windows Analytics, this policy will continue to be supported by Desktop Analytics, but will not include Office related diagnostic data.
## KernelProcess.AppStateChangeSummary
-This event summarizes application usage and performance characteristics to help Microsoft improve performance and reliability. Organizations can use this event with Windows Analytics to gain insights into application reliability.
+This event summarizes application usage and performance characteristics to help Microsoft improve performance and reliability. Organizations can use this event with Desktop Analytics to gain insights into application reliability.
The following fields are available:
@@ -241,7 +246,7 @@ This event is fired when the office application suspends as per app life-cycle c
- **SuspendType:** Type of suspend
## Microsoft.OSG.OSS.CredProvFramework.ReportResultStop
-This event indicates the result of an attempt to authenticate a user with a credential provider. It helps Microsoft to improve logon reliability. Using this event with Windows Analytics can help organizations monitor and improve logon success for different methods (for example, biometric) on managed devices.
+This event indicates the result of an attempt to authenticate a user with a credential provider. It helps Microsoft to improve logon reliability. Using this event with Desktop Analytics can help organizations monitor and improve logon success for different methods (for example, biometric) on managed devices.
The following fields are available:
@@ -261,7 +266,7 @@ The following fields are available:
- **UserTag:** Count of the number of times a user has selected a provider
## Microsoft.Windows.Kernel.Power.OSStateChange
-This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Windows Analytics, organizations can use this to monitor reliability and performance of managed devices
+This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Desktop Analytics, organizations can use this to monitor reliability and performance of managed devices
The following fields are available:
@@ -322,7 +327,7 @@ The following field is available:
- **ticksSinceBoot:** Duration of boot event (milliseconds)
## Microsoft.Windows.Shell.Desktop.LogonFramework.AllLogonTasks
-This event summarizes the logon procedure to help Microsoft improve performance and reliability. By using this event with Windows Analytics organizations can help identify logon problems on managed devices.
+This event summarizes the logon procedure to help Microsoft improve performance and reliability. By using this event with Desktop Analytics organizations can help identify logon problems on managed devices.
The following fields are available:
@@ -359,7 +364,7 @@ The following fields are available:
- **status:** Indicates whether errors occurred during WIP learning events
## Win32kTraceLogging.AppInteractivitySummary
-Summarizes which app windows are being used (for example, have focus) to help Microsoft improve compatibility and user experience. Also helps organizations (by using Windows Analytics) to understand and improve application reliability on managed devices.
+Summarizes which app windows are being used (for example, have focus) to help Microsoft improve compatibility and user experience. Also helps organizations (by using Desktop Analytics) to understand and improve application reliability on managed devices.
The following fields are available:
@@ -415,8 +420,11 @@ A previous revision of this list stated that a field named PartA_UserSid was a m
### Office events added
In Windows 10, version 1809 (also applies to versions 1709 and 1803 starting with [KB 4462932](https://support.microsoft.com/help/4462932/windows-10-update-kb4462932) and [KB 4462933](https://support.microsoft.com/help/4462933/windows-10-update-kb4462933) respectively), 16 events were added, describing Office app launch and availability. These events were added to improve the precision of Office data in Windows Analytics.
+> [!NOTE]
+> Office data will no longer be provided through this policy in Desktop Analytics.
+
### CertAnalytics events removed
-In Windows 10, version 1809 (also applies to versions 1709 and 1803 starting with [KB 4462932](https://support.microsoft.com/help/4462932/windows-10-update-kb4462932) and [KB 4462933](https://support.microsoft.com/help/4462933/windows-10-update-kb4462933) respectively), 3 "CertAnalytics" events were removed, as they are no longer required for Windows Analytics.
+In Windows 10, version 1809 (also applies to versions 1709 and 1803 starting with [KB 4462932](https://support.microsoft.com/help/4462932/windows-10-update-kb4462932) and [KB 4462933](https://support.microsoft.com/help/4462933/windows-10-update-kb4462933) respectively), 3 "CertAnalytics" events were removed, as they are no longer required for Desktop Analytics.
>[!NOTE]
>You can use the Windows Diagnostic Data Viewer to observe and review events and their fields as described in this topic.
diff --git a/windows/privacy/gdpr-it-guidance.md b/windows/privacy/gdpr-it-guidance.md
index ba1428445d..b268fb53f1 100644
--- a/windows/privacy/gdpr-it-guidance.md
+++ b/windows/privacy/gdpr-it-guidance.md
@@ -26,7 +26,7 @@ Applies to:
- Windows 10 Team Edition, version 1703 for Surface Hub
- Windows Server 2019
- Windows Server 2016
-- Windows Analytics
+- Desktop Analytics
This topic provides IT Decision Makers with a basic understanding of the relationship between users in an organization and Microsoft in the context of the GDPR (General Data Protection Regulation). You will also learn what role an IT organization plays for that relationship.
@@ -112,28 +112,32 @@ Some examples of diagnostic data include:
Diagnostic data is categorized into the levels "Security", "Basic", "Enhanced", and "Full". For a detailed discussion about these diagnostic data levels please see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). To find more about what information is collected and how it is handled, see [Understanding Windows diagnostic data](configure-windows-diagnostic-data-in-your-organization.md#understanding-windows-diagnostic-data).
->[!IMPORTANT]
->Other Microsoft services as well as 3rd party applications and drivers running on Windows devices may implement their own functionality, independently from Windows, to transport their diagnostic data. Please contact the publisher for further guidance on how to control the diagnostic data collection level and transmission of these applications and services.
+> [!IMPORTANT]
+> Other Microsoft services as well as 3rd party applications and drivers running on Windows devices may implement their own functionality, independently from Windows, to transport their diagnostic data. Please contact the publisher for further guidance on how to control the diagnostic data collection level and transmission of these applications and services.
### Windows services where Microsoft is the processor under the GDPR
-Most Windows 10 services are controller services in terms of the GDPR – for both Windows functional data and Windows diagnostic data. But there are a few Windows services where Microsoft is a processor for functional data under the GDPR, such as [Windows Analytics](https://www.microsoft.com/windowsforbusiness/windows-analytics) and [Windows Defender Advanced Threat Protection (ATP)](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp).
+Most Windows 10 services are controller services in terms of the GDPR – for both Windows functional data and Windows diagnostic data. But there are a few Windows services where Microsoft is a processor for functional data under the GDPR, such as [Desktop Analytics](https://aka.ms/dadocs), [Update Compliance](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor) and [Windows Defender Advanced Threat Protection (ATP)](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp).
>[!NOTE]
->Both Windows Analytics and Windows Defender ATP are subscription services for organizations. Some functionality requires a certain license (please see [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare)).
+>Both Desktop Analytics and Windows Defender ATP are subscription services for organizations. Some functionality requires a certain license (please see [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare)).
-#### Windows Analytics
+#### Desktop Analytics
-[Windows Analytics](https://www.microsoft.com/windowsforbusiness/windows-analytics) is a service that provides rich, actionable information for helping organizations to gain deep insights into the operational efficiency and health of the Windows devices in their environment. It uses Windows diagnostic data from devices enrolled by the IT organization of an enterprise into the Windows Analytics service.
+> [!IMPORTANT]
+> The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](/windows/deployment/update/update-compliance-get-started) will continue to be supported.
+> For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
-Windows [transmits Windows diagnostic data](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) to Microsoft datacenters, where that data is analyzed and stored. With Windows Analytics, the IT organization can then view the analyzed data to detect and fix issues or to improve their processes for upgrading to Windows 10.
+[Desktop Analytics](https://aka.ms/dadocs) is a cloud-based service that integrates with Configuration Manager. The service provides insight and intelligence for you to make more informed decisions about the update readiness of Windows Windows devices in their environment. It uses Windows diagnostic data from devices enrolled by the IT organization of an enterprise with data aggregated from millions of devices into the Desktop Analytics service.
-As a result, in terms of the GDPR, the organization that has subscribed to Windows Analytics is acting as the controller, while Microsoft is the processor for Windows Analytics.
->[!NOTE]
->The IT organization must explicitly enable Windows Analytics for a device after the organization subscribes.
+Windows [transmits Windows diagnostic data](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) to Microsoft datacenters, where that data is analyzed and stored. With Desktop Analytics, the IT organization can then view the analyzed data to detect and fix issues or to improve their processes for upgrading to Windows 10.
->[!IMPORTANT]
->Windows Analytics does not collect Windows Diagnostic data by itself. Instead, Windows Analytics only uses a subset of Windows Diagnostic data that is collected by Windows for an enrolled device. The Windows Diagnostic data collection is controlled by the IT department of an organization or the user of a device.
+As a result, in terms of the GDPR, the organization that has subscribed to Desktop Analytics is acting as the controller, while Microsoft is the processor for Desktop Analytics.
+> [!NOTE]
+> The IT organization must explicitly enable Desktop Analytics for a device after the organization subscribes.
+
+> [!IMPORTANT]
+> Desktop Analytics does not collect Windows Diagnostic data by itself. Instead, Desktop Analytics only uses a subset of Windows Diagnostic data that is collected by Windows for an enrolled device. The Windows Diagnostic data collection is controlled by the IT department of an organization or the user of a device. See [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/sccm/desktop-analytics/enable-data-sharing)
#### Windows Defender ATP
@@ -141,8 +145,8 @@ As a result, in terms of the GDPR, the organization that has subscribed to Windo
As a result, in terms of the GDPR, the organization that has subscribed to Windows Defender ATP is acting as the controller, while Microsoft is the processor for Windows Defender ATP.
->[!NOTE]
->The IT organization must explicitly enable Windows Defender ATP for a device after the organization subscribes.
+> [!NOTE]
+> The IT organization must explicitly enable Windows Defender ATP for a device after the organization subscribes.
#### At a glance – Windows 10 services GDPR mode of operations
@@ -152,7 +156,7 @@ The following table lists in what GDPR mode – controller or processor – Wind
| --- | --- |
| Windows Functional data | Controller or Processor* |
| Windows Diagnostic data | Controller |
-| Windows Analytics | Processor |
+| Desktop Analytics | Processor |
| Windows Defender Advanced Threat Detection (ATP) | Processor |
*Table 1: Windows 10 GDPR modes of operations for different Windows 10 services*
@@ -166,7 +170,7 @@ The following table lists in what GDPR mode – controller or processor – Wind
Windows diagnostic data collection level for Windows 10 can be set by a user in Windows (*Start > Settings > Privacy > Diagnostics & feedback*) or by the IT department of an organization, using Group Policy or Mobile Device Management (MDM) techniques.
-* For Windows 10, version 1803 and version 1809, Microsoft recommends setting the Windows diagnostic level to “Enhanced”. This enables organizations to get the full functionality of [Windows Analytics](#windows-analytics).
+* For Windows 10, version 1803 and version 1809, Microsoft recommends setting the Windows diagnostic level to “Enhanced”. This enables organizations to get the full functionality of [Desktop Analytics](#desktop-analytics).
>[!NOTE]
>For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
@@ -174,17 +178,16 @@ Windows diagnostic data collection level for Windows 10 can be set by a user in
* For Windows 10, version 1709, and Windows 10, version 1703, the recommended Windows diagnostic level configuration for EEA and Switzerland commercial users is “Basic”.
>[!NOTE]
->For Windows 7, Microsoft recommends [configuring enterprise devices for Windows Analytics](/windows/deployment/update/windows-analytics-get-started) to facilitate upgrade planning to Windows 10.
+>For Windows 7, Microsoft recommends [using Commercial Data Opt-in setting](/previous-versions/windows/it-pro/windows-7/ee126127(v=ws.10)) to facilitate upgrade planning to Windows 10.
-### Additional information for Windows Analytics
+### Additional information for Desktop Analytics
-Some Windows Analytics solutions and functionality, such as Update Compliance, works with “Basic” as minimum Windows diagnostic level. Other solutions and functionality of Windows Analytics, such as Device Health, require “Enhanced”.
+The basic functionality of Desktop Analytics works at the “Basic” diagnostic data level. Other functionality of Desktop Analytics, such as usage or health data for updated devices, require “Enhanced”.
-Those organizations who wish to share the smallest set of events for Windows Analytics and have set the Windows diagnostic level to “Enhanced” can use the “Limit Enhanced diagnostic data to the minimum required by Windows Analytics” setting. This filtering mechanism was that Microsoft introduced in Windows 10, version 1709. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by Windows Analytics.
+Those organizations who wish to share the smallest set of events for Desktop Analytics and have set the Windows diagnostic level to “Enhanced” can use the [“Limit Enhanced diagnostic data to the minimum required by Desktop Analytics”](/windows/privacy/configure-windows-diagnostic-data-in-your-organization#limit-enhanced-diagnostic-data-to-the-minimum-required-by-desktop-analytics) setting. This filtering mechanism was that Microsoft introduced in Windows 10, version 1709. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by Desktop Analytics.
->[!NOTE]
->Additional information can be found at [Windows Analytics and privacy](/windows/deployment/update/windows-analytics-privacy
-).
+> [!NOTE]
+> Additional information can be found at [Desktop Analytics and privacy](/sccm/desktop-analytics/privacy).
## Controlling Windows 10 data collection and notification about it
@@ -258,8 +261,8 @@ Backups, including live backups and backups that are stored locally within an or
Surface Hub is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to a user. For removing Windows diagnostic data sent to Microsoft for a Surface Hub, Microsoft created the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store.
->[!NOTE]
->Additional apps running on the device, that are not delivered as part of the in-box experience of Surface Hub, may implement their own diagnostic data collection and transmission functionality independently to collect and process personal data. Please contact the app publisher for further guidance on how to control this.
+> [!NOTE]
+> Additional apps running on the device, that are not delivered as part of the in-box experience of Surface Hub, may implement their own diagnostic data collection and transmission functionality independently to collect and process personal data. Please contact the app publisher for further guidance on how to control this.
An IT administrator can configure privacy- related settings, such as setting the Windows diagnostic data level to Basic. Surface Hub does not support group policy for centralized management; however, IT administrators can use MDM to apply these settings to Surface Hub. For more information about Surface Hub and MDM, please see [Manage settings with an MDM provider](https://docs.microsoft.com/surface-hub/manage-settings-with-mdm-for-surface-hub).
@@ -269,8 +272,8 @@ An IT administrator can configure privacy- related settings, such as setting the
Personal data protection is one of the goals of the GDPR. One way of improving personal data protection is to use the modern and advanced security features of Windows 10. An IT organization can learn more at [Mitigate threats by using Windows 10 security features](/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10) and [Standards for a highly secure Windows 10 device](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-highly-secure).
->[!NOTE]
->Some of these features might require a particular Windows hardware, such as a computer with a Trusted Platform Module (TPM) chip, and can depend on a particular Windows product (such as Windows 10 E5).
+> [!NOTE]
+> Some of these features might require a particular Windows hardware, such as a computer with a Trusted Platform Module (TPM) chip, and can depend on a particular Windows product (such as Windows 10 E5).
### Windows Security Baselines
diff --git a/windows/privacy/manage-windows-1809-endpoints.md b/windows/privacy/manage-windows-1809-endpoints.md
index fc2c0ac152..012bc24086 100644
--- a/windows/privacy/manage-windows-1809-endpoints.md
+++ b/windows/privacy/manage-windows-1809-endpoints.md
@@ -261,6 +261,8 @@ If you [turn off traffic for these endpoints](manage-connections-from-windows-op
| Source process | Protocol | Destination |
|----------------|----------|------------|
| | | login.msa.akadns6.net |
+| | | login.live.com |
+| | | account.live.com |
| system32\Auth.Host.exe | HTTPS | auth.gfx.ms |
| | | us.configsvc1.live.com.akadns.net |
diff --git a/windows/release-information/resolved-issues-windows-10-1507.yml b/windows/release-information/resolved-issues-windows-10-1507.yml
index bc005f4a92..50c83837eb 100644
--- a/windows/release-information/resolved-issues-windows-10-1507.yml
+++ b/windows/release-information/resolved-issues-windows-10-1507.yml
@@ -32,10 +32,10 @@ sections:
- type: markdown
text: "
Summary Originating update Status Date resolved
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > OS Build 10240.18334 September 23, 2019KB4522009 ResolvedKB4520011 October 08, 2019 10:00 AM PT
-
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.See details > OS Build 10240.18305 August 13, 2019KB4512497 ResolvedKB4517276 August 17, 2019 02:00 PM PT
-
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.See details > OS Build 10240.18244 June 11, 2019KB4503291 Resolved External August 09, 2019 07:03 PM PT
-
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.See details > OS Build 10240.18244 June 11, 2019KB4503291 ResolvedKB4507458 July 09, 2019 10:00 AM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > OS Build 10240.18334 September 23, 2019KB4522009 ResolvedKB4520011 October 08, 2019 10:00 AM PT
+
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.See details > OS Build 10240.18305 August 13, 2019KB4512497 ResolvedKB4517276 August 17, 2019 02:00 PM PT
+
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.See details > OS Build 10240.18244 June 11, 2019KB4503291 Resolved External August 09, 2019 07:03 PM PT
+
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may see an error or the app may close.See details > OS Build 10240.18244 June 11, 2019KB4503291 ResolvedKB4507458 July 09, 2019 10:00 AM PT
Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessibleSee details > OS Build 10240.18215 May 14, 2019KB4499154 ResolvedKB4505051 May 19, 2019 02:00 PM PT
"
diff --git a/windows/release-information/resolved-issues-windows-10-1607.yml b/windows/release-information/resolved-issues-windows-10-1607.yml
index c781814227..f95b379a56 100644
--- a/windows/release-information/resolved-issues-windows-10-1607.yml
+++ b/windows/release-information/resolved-issues-windows-10-1607.yml
@@ -32,26 +32,25 @@ sections:
- type: markdown
text: "
Summary Originating update Status Date resolved
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > OS Build 14393.3206 September 23, 2019KB4522010 ResolvedKB4519998 October 08, 2019 10:00 AM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > OS Build 14393.3206 September 23, 2019KB4522010 ResolvedKB4519998 October 08, 2019 10:00 AM PT
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.See details > OS Build 14393.3204 September 10, 2019KB4516044 Resolved September 17, 2019 04:47 PM PT
-
Apps and scripts using the NetQueryDisplayInformation API may fail with error Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.See details > OS Build 14393.3053 June 18, 2019KB4503294 ResolvedKB4516044 September 10, 2019 10:00 AM PT
-
Domain connected devices that use MIT Kerberos realms will not start up Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.See details > OS Build 14393.3115 July 16, 2019KB4507459 ResolvedKB4512517 August 13, 2019 10:00 AM PT
-
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > OS Build 14393.3025 June 11, 2019KB4503267 ResolvedKB4512495 August 17, 2019 02:00 PM PT
-
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.See details > OS Build 14393.3144 August 13, 2019KB4512517 ResolvedKB4512495 August 17, 2019 02:00 PM PT
-
Internet Explorer 11 and apps using the WebBrowser control may fail to render JavaScript may fail to render as expected in Internet Explorer 11 and in apps using JavaScript or the WebBrowser control.See details > OS Build 14393.3085 July 09, 2019KB4507460 ResolvedKB4512517 August 13, 2019 10:00 AM PT
-
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.See details > OS Build 14393.3025 June 11, 2019KB4503267 Resolved External August 09, 2019 07:03 PM PT
-
SCVMM cannot enumerate and manage logical switches deployed on the host For hosts managed by System Center Virtual Machine Manager (VMM), VMM cannot enumerate and manage logical switches deployed on the host.See details > OS Build 14393.2639 November 27, 2018KB4467684 ResolvedKB4507459 July 16, 2019 10:00 AM PT
+
Apps and scripts using the NetQueryDisplayInformation API may fail with error Applications and scripts that call NetQueryDisplayInformation may fail to return results after the first page of data.See details > OS Build 14393.3053 June 18, 2019KB4503294 ResolvedKB4516044 September 10, 2019 10:00 AM PT
+
Domain connected devices that use MIT Kerberos realms will not start up Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.See details > OS Build 14393.3115 July 16, 2019KB4507459 ResolvedKB4512517 August 13, 2019 10:00 AM PT
+
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > OS Build 14393.3025 June 11, 2019KB4503267 ResolvedKB4512495 August 17, 2019 02:00 PM PT
+
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.See details > OS Build 14393.3144 August 13, 2019KB4512517 ResolvedKB4512495 August 17, 2019 02:00 PM PT
+
Internet Explorer 11 and apps using the WebBrowser control may fail to render JavaScript may fail to render as expected in IE11 and in apps using JavaScript or the WebBrowser control.See details > OS Build 14393.3085 July 09, 2019KB4507460 ResolvedKB4512517 August 13, 2019 10:00 AM PT
+
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.See details > OS Build 14393.3025 June 11, 2019KB4503267 Resolved External August 09, 2019 07:03 PM PT
+
SCVMM cannot enumerate and manage logical switches deployed on the host System Center Virtual Machine Manager cannot enumerate and manage logical switches deployed on managed hosts.See details > OS Build 14393.2639 November 27, 2018KB4467684 ResolvedKB4507459 July 16, 2019 10:00 AM PT
Some applications may fail to run as expected on clients of AD FS 2016 Some applications may fail to run as expected on clients of Active Directory Federation Services 2016 (AD FS 2016)See details > OS Build 14393.2941 April 25, 2019KB4493473 ResolvedKB4507459 July 16, 2019 10:00 AM PT
Devices with Hyper-V enabled may receive BitLocker error 0xC0210000 Some devices with Hyper-V enabled may start into BitLocker recovery with error 0xC0210000.See details > OS Build 14393.2969 May 14, 2019KB4494440 ResolvedKB4507460 July 09, 2019 10:00 AM PT
Difficulty connecting to some iSCSI-based SANs Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.See details > OS Build 14393.2999 May 23, 2019KB4499177 ResolvedKB4509475 June 27, 2019 02:00 PM PT
-
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.See details > OS Build 14393.3025 June 11, 2019KB4503267 ResolvedKB4503294 June 18, 2019 02:00 PM PT
+
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may see an error or the app may close.See details > OS Build 14393.3025 June 11, 2019KB4503267 ResolvedKB4503294 June 18, 2019 02:00 PM PT
Opening Internet Explorer 11 may fail Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.See details > OS Build 14393.2999 May 23, 2019KB4499177 ResolvedKB4503267 June 11, 2019 10:00 AM PT
-
Issue using PXE to start a device from WDS There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension.See details > OS Build 14393.2848 March 12, 2019KB4489882 ResolvedKB4503267 June 11, 2019 10:00 AM PT
+
Issue using PXE to start a device from WDS There may be issues using PXE to start a device from a WDS server configured to use Variable Window Extension.See details > OS Build 14393.2848 March 12, 2019KB4489882 ResolvedKB4503267 June 11, 2019 10:00 AM PT
Update not showing as applicable through WSUS or SCCM or when manually installed Update not showing as applicable through WSUS or SCCM or when manually installedSee details > OS Build 14393.2969 May 14, 2019KB4494440 ResolvedKB4498947 May 14, 2019 10:00 AM PT
Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessibleSee details > OS Build 14393.2969 May 14, 2019KB4494440 ResolvedKB4505052 May 19, 2019 02:00 PM PT
-
Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > OS Build 14393.2941 April 25, 2019KB4493473 ResolvedKB4494440 May 14, 2019 10:00 AM PT
+
Layout and cell size of Excel sheets may change when using MS UI Gothic When using MS UI Gothic or MS PGothic in Excel, the text, layout, or cell size may become narrower or wider.See details > OS Build 14393.2941 April 25, 2019KB4493473 ResolvedKB4494440 May 14, 2019 10:00 AM PT
Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.See details > OS Build 14393.2941 April 25, 2019KB4493473 ResolvedKB4494440 May 14, 2019 10:00 AM PT
-
Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.See details > OS Build 14393.2848 March 12, 2019KB4489882 ResolvedKB4493473 April 25, 2019 02:00 PM PT
"
@@ -134,7 +133,6 @@ sections:
text: "
Details Originating update Status History
Issue using PXE to start a device from WDS After installing
KB4489882 , there may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension. This may cause the connection to the WDS server to terminate prematurely while downloading the image. This issue does not affect clients or devices that are not using Variable Window Extension.
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1 Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
Resolution: This issue was resolved in
KB4503267 .
Back to top OS Build 14393.2848 March 12, 2019KB4489882 ResolvedKB4503267 Resolved: June 11, 2019 10:00 AM PT Opened: March 12, 2019 10:00 AM PT
-
Custom URI schemes may not start corresponding application After installing
KB4489882 , Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer.
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
Resolution: This issue is resolved in
KB4493473 .
Back to top OS Build 14393.2848 March 12, 2019KB4489882 ResolvedKB4493473 Resolved: April 25, 2019 02:00 PM PT Opened: March 12, 2019 10:00 AM PT
"
diff --git a/windows/release-information/resolved-issues-windows-10-1703.yml b/windows/release-information/resolved-issues-windows-10-1703.yml
index 5416d6e479..5d1e5cf2ba 100644
--- a/windows/release-information/resolved-issues-windows-10-1703.yml
+++ b/windows/release-information/resolved-issues-windows-10-1703.yml
@@ -32,18 +32,17 @@ sections:
- type: markdown
text: "
Summary Originating update Status Date resolved
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > OS Build 15063.2046 September 23, 2019KB4522011 ResolvedKB4520010 October 08, 2019 10:00 AM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > OS Build 15063.2046 September 23, 2019KB4522011 ResolvedKB4520010 October 08, 2019 10:00 AM PT
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.See details > OS Build 15063.2045 September 10, 2019KB4516068 Resolved September 17, 2019 04:47 PM PT
-
Domain connected devices that use MIT Kerberos realms will not start up Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.See details > OS Build 15063.1955 July 16, 2019KB4507467 ResolvedKB4512507 August 13, 2019 10:00 AM PT
-
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.See details > OS Build 15063.1988 August 13, 2019KB4512507 ResolvedKB4512474 August 17, 2019 02:00 PM PT
-
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.See details > OS Build 15063.1868 June 11, 2019KB4503279 Resolved External August 09, 2019 07:03 PM PT
+
Domain connected devices that use MIT Kerberos realms will not start up Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.See details > OS Build 15063.1955 July 16, 2019KB4507467 ResolvedKB4512507 August 13, 2019 10:00 AM PT
+
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.See details > OS Build 15063.1988 August 13, 2019KB4512507 ResolvedKB4512474 August 17, 2019 02:00 PM PT
+
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.See details > OS Build 15063.1868 June 11, 2019KB4503279 Resolved External August 09, 2019 07:03 PM PT
Devices with Hyper-V enabled may receive BitLocker error 0xC0210000 Some devices with Hyper-V enabled may start into BitLocker recovery with error 0xC0210000.See details > OS Build 15063.1805 May 14, 2019KB4499181 ResolvedKB4507450 July 09, 2019 10:00 AM PT
Difficulty connecting to some iSCSI-based SANs Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.See details > OS Build 15063.1839 May 28, 2019KB4499162 ResolvedKB4509476 June 26, 2019 04:00 PM PT
-
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.See details > OS Build 15063.1868 June 11, 2019KB4503279 ResolvedKB4503289 June 18, 2019 02:00 PM PT
+
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may see an error or the app may close.See details > OS Build 15063.1868 June 11, 2019KB4503279 ResolvedKB4503289 June 18, 2019 02:00 PM PT
Opening Internet Explorer 11 may fail Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.See details > OS Build 15063.1839 May 28, 2019KB4499162 ResolvedKB4503279 June 11, 2019 10:00 AM PT
Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessibleSee details > OS Build 15063.1805 May 14, 2019KB4499181 ResolvedKB4505055 May 19, 2019 02:00 PM PT
-
Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > OS Build 15063.1784 April 25, 2019KB4493436 ResolvedKB4499181 May 14, 2019 10:00 AM PT
-
Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.See details > OS Build 15063.1689 March 12, 2019KB4489871 ResolvedKB4493436 April 25, 2019 02:00 PM PT
+
Layout and cell size of Excel sheets may change when using MS UI Gothic When using MS UI Gothic or MS PGothic in Excel, the text, layout, or cell size may become narrower or wider.See details > OS Build 15063.1784 April 25, 2019KB4493436 ResolvedKB4499181 May 14, 2019 10:00 AM PT
"
@@ -105,12 +104,3 @@ sections:
Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. For example, the layout and cell size of Microsoft Excel sheets may change when using MS UI Gothic .
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1 Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
Resolution : This issue has been resolved.
Back to top OS Build 15063.1784 April 25, 2019KB4493436 ResolvedKB4499181 Resolved: May 14, 2019 10:00 AM PT Opened: May 10, 2019 10:35 AM PT
"
-
-- title: March 2019
-- items:
- - type: markdown
- text: "
- Details Originating update Status History
-
Custom URI schemes may not start corresponding application After installing
KB4489871 , custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer.
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
Resolution: This issue is resolved in
KB4493436 .
Back to top OS Build 15063.1689 March 12, 2019KB4489871 ResolvedKB4493436 Resolved: April 25, 2019 02:00 PM PT Opened: March 12, 2019 10:00 AM PT
-
- "
diff --git a/windows/release-information/resolved-issues-windows-10-1709.yml b/windows/release-information/resolved-issues-windows-10-1709.yml
index e0630f77fe..9ec5a0c287 100644
--- a/windows/release-information/resolved-issues-windows-10-1709.yml
+++ b/windows/release-information/resolved-issues-windows-10-1709.yml
@@ -32,19 +32,18 @@ sections:
- type: markdown
text: "
Summary Originating update Status Date resolved
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > OS Build 16299.1392 September 23, 2019KB4522012 ResolvedKB4520004 October 08, 2019 10:00 AM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > OS Build 16299.1392 September 23, 2019KB4522012 ResolvedKB4520004 October 08, 2019 10:00 AM PT
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.See details > OS Build 16299.1387 September 10, 2019KB4516066 Resolved September 19, 2019 04:08 PM PT
-
Domain connected devices that use MIT Kerberos realms will not start up Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.See details > OS Build 16299.1296 July 16, 2019KB4507465 ResolvedKB4512516 August 13, 2019 10:00 AM PT
-
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > OS Build 16299.1217 June 11, 2019KB4503284 ResolvedKB4512494 August 16, 2019 02:00 PM PT
-
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.See details > OS Build 16299.1331 August 13, 2019KB4512516 ResolvedKB4512494 August 16, 2019 02:00 PM PT
-
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.See details > OS Build 16299.1217 June 11, 2019KB4503284 Resolved External August 09, 2019 07:03 PM PT
+
Domain connected devices that use MIT Kerberos realms will not start up Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.See details > OS Build 16299.1296 July 16, 2019KB4507465 ResolvedKB4512516 August 13, 2019 10:00 AM PT
+
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > OS Build 16299.1217 June 11, 2019KB4503284 ResolvedKB4512494 August 16, 2019 02:00 PM PT
+
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.See details > OS Build 16299.1331 August 13, 2019KB4512516 ResolvedKB4512494 August 16, 2019 02:00 PM PT
+
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.See details > OS Build 16299.1217 June 11, 2019KB4503284 Resolved External August 09, 2019 07:03 PM PT
Difficulty connecting to some iSCSI-based SANs Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.See details > OS Build 16299.1182 May 28, 2019KB4499147 ResolvedKB4509477 June 26, 2019 04:00 PM PT
-
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.See details > OS Build 16299.1217 June 11, 2019KB4503284 ResolvedKB4503281 June 18, 2019 02:00 PM PT
+
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may see an error or the app may close.See details > OS Build 16299.1217 June 11, 2019KB4503284 ResolvedKB4503281 June 18, 2019 02:00 PM PT
Opening Internet Explorer 11 may fail Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.See details > OS Build 16299.1182 May 28, 2019KB4499147 ResolvedKB4503284 June 11, 2019 10:00 AM PT
Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessibleSee details > OS Build 16299.1143 May 14, 2019KB4498946 ResolvedKB4505062 May 19, 2019 02:00 PM PT
-
Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > OS Build 16299.1127 April 25, 2019KB4493440 ResolvedKB4499179 May 14, 2019 10:00 AM PT
+
Layout and cell size of Excel sheets may change when using MS UI Gothic When using MS UI Gothic or MS PGothic in Excel, the text, layout, or cell size may become narrower or wider.See details > OS Build 16299.1127 April 25, 2019KB4493440 ResolvedKB4499179 May 14, 2019 10:00 AM PT
Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.See details > OS Build 16299.1127 April 25, 2019KB4493440 ResolvedKB4499179 May 14, 2019 10:00 AM PT
-
Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.See details > OS Build 16299.1029 March 12, 2019KB4489886 ResolvedKB4493440 April 25, 2019 02:00 PM PT
"
@@ -115,12 +114,3 @@ sections:
Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing
KB4493440 .
Affected platforms:
Client: Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016 Server: Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016
Resolution: This issue was resolved in
KB4499179 .
Back to top OS Build 16299.1127 April 25, 2019KB4493440 ResolvedKB4499179 Resolved: May 14, 2019 10:00 AM PT Opened: April 25, 2019 02:00 PM PT
"
-
-- title: March 2019
-- items:
- - type: markdown
- text: "
- Details Originating update Status History
-
Custom URI schemes may not start corresponding application After installing
KB4489886 , custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer.
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
Resolution: This issue is resolved in
KB4493440 .
Back to top OS Build 16299.1029 March 12, 2019KB4489886 ResolvedKB4493440 Resolved: April 25, 2019 02:00 PM PT Opened: March 12, 2019 10:00 AM PT
-
- "
diff --git a/windows/release-information/resolved-issues-windows-10-1803.yml b/windows/release-information/resolved-issues-windows-10-1803.yml
index 5a16aed2a6..9a7946487e 100644
--- a/windows/release-information/resolved-issues-windows-10-1803.yml
+++ b/windows/release-information/resolved-issues-windows-10-1803.yml
@@ -32,20 +32,21 @@ sections:
- type: markdown
text: "
Summary Originating update Status Date resolved
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > OS Build 17134.1009 September 23, 2019KB4522014 ResolvedKB4520008 October 08, 2019 10:00 AM PT
+
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.See details > OS Build 17134.950 August 13, 2019KB4512501 ResolvedKB4519978 October 15, 2019 10:00 AM PT
+
Startup to a black screen after installing updates Your device may startup to a black screen during the first logon after installing updates.See details > OS Build 17134.829 June 11, 2019KB4503286 ResolvedKB4519978 October 15, 2019 10:00 AM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > OS Build 17134.1009 September 23, 2019KB4522014 ResolvedKB4520008 October 08, 2019 10:00 AM PT
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.See details > OS Build 17134.1006 September 10, 2019KB4516058 Resolved September 19, 2019 04:08 PM PT
-
Domain connected devices that use MIT Kerberos realms will not start up Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.See details > OS Build 17134.915 July 16, 2019KB4507466 ResolvedKB4512501 August 13, 2019 10:00 AM PT
+
Domain connected devices that use MIT Kerberos realms will not start up Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.See details > OS Build 17134.915 July 16, 2019KB4507466 ResolvedKB4512501 August 13, 2019 10:00 AM PT
Notification issue: \"Your device is missing important security and quality fixes.\" Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes.\"See details > N/A Resolved September 03, 2019 12:32 PM PT
-
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > OS Build 17134.829 June 11, 2019KB4503286 ResolvedKB4512509 August 19, 2019 02:00 PM PT
-
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.See details > OS Build 17134.950 August 13, 2019KB4512501 ResolvedKB4512509 August 19, 2019 02:00 PM PT
-
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.See details > OS Build 17134.829 June 11, 2019KB4503286 Resolved External August 09, 2019 07:03 PM PT
+
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > OS Build 17134.829 June 11, 2019KB4503286 ResolvedKB4512509 August 19, 2019 02:00 PM PT
+
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.See details > OS Build 17134.950 August 13, 2019KB4512501 ResolvedKB4512509 August 19, 2019 02:00 PM PT
+
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.See details > OS Build 17134.829 June 11, 2019KB4503286 Resolved External August 09, 2019 07:03 PM PT
Difficulty connecting to some iSCSI-based SANs Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.See details > OS Build 17134.799 May 21, 2019KB4499183 ResolvedKB4509478 June 26, 2019 04:00 PM PT
-
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.See details > OS Build 17134.829 June 11, 2019KB4503286 ResolvedKB4503288 June 18, 2019 02:00 PM PT
+
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may see an error or the app may close.See details > OS Build 17134.829 June 11, 2019KB4503286 ResolvedKB4503288 June 18, 2019 02:00 PM PT
Opening Internet Explorer 11 may fail Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.See details > OS Build 17134.799 May 21, 2019KB4499183 ResolvedKB4503286 June 11, 2019 10:00 AM PT
Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessibleSee details > OS Build 17134.765 May 14, 2019KB4499167 ResolvedKB4505064 May 19, 2019 02:00 PM PT
-
Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > OS Build 17134.753 April 25, 2019KB4493437 ResolvedKB4499167 May 14, 2019 10:00 AM PT
+
Layout and cell size of Excel sheets may change when using MS UI Gothic When using MS UI Gothic or MS PGothic in Excel, the text, layout, or cell size may become narrower or wider.See details > OS Build 17134.753 April 25, 2019KB4493437 ResolvedKB4499167 May 14, 2019 10:00 AM PT
Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.See details > OS Build 17134.753 April 25, 2019KB4493437 ResolvedKB4499167 May 14, 2019 10:00 AM PT
-
Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.See details > OS Build 17134.648 March 12, 2019KB4489868 ResolvedKB4493437 April 25, 2019 02:00 PM PT
"
@@ -61,6 +62,7 @@ sections:
- type: markdown
text: "
Details Originating update Status History
+
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code After installing
KB4512501 , Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.
Affected platforms:
Client: Windows 10, version 1809; Windows 10, version 1803
Resolution: This issue was resolved in
KB4519978 .
Back to top OS Build 17134.950 August 13, 2019KB4512501 ResolvedKB4519978 Resolved: October 15, 2019 10:00 AM PT Opened: September 11, 2019 05:32 PM PT
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver. The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in
KB4520008 .
Back to top OS Build 17134.1009 September 23, 2019KB4522014 ResolvedKB4520008 Resolved: October 08, 2019 10:00 AM PT Opened: September 30, 2019 06:26 PM PT
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: Due to security related changes in
KB4516058 , this issue may occur when
Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of
Manual . To resolve the issue, perform the following steps:
Select the Start button and type Services . Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties . Locate Startup type: and change it to Manual Select Ok The TabletInputService service is now in the default configuration and IME should work as expected. Back to top OS Build 17134.1006 September 10, 2019KB4516058 Resolved Resolved: September 19, 2019 04:08 PM PT Opened: September 13, 2019 05:25 PM PT
Notification issue: \"Your device is missing important security and quality fixes.\" Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes\" in the Windows Update dialog and a red \"!\" in the task tray on the Windows Update tray icon. This notification is intended for devices that are 90 days or more out of date, but some users with installed updates released in June or July also saw this notification.
Affected platforms:
Client: Windows 10, version 1803 Server: Windows Server, version 1803
Resolution: This issue was resolved on the server side on August 30, 2019. Only devices that are out of date by 90 days or more should now see the notification. No action is required by the user to resolve this issue. If you are still seeing the \"Your device is missing important security and quality fixes\" notification, we recommend selecting
Check for Updates in the
Windows Update dialog. For instructions, see
Update Windows 10 . Microsoft always recommends trying to keep your devices up to date, as the monthly updates contain important security fixes.
Back to top N/A Resolved Resolved: September 03, 2019 12:32 PM PT Opened: September 03, 2019 12:32 PM PT
@@ -93,6 +95,7 @@ sections:
- type: markdown
text: "
Details Originating update Status History
+
Startup to a black screen after installing updates We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803 Server: Windows Server 2019
Resolution: This issue was resolved in
KB4519978 .
Back to top OS Build 17134.829 June 11, 2019KB4503286 ResolvedKB4519978 Resolved: October 15, 2019 10:00 AM PT Opened: June 14, 2019 04:41 PM PT
Difficulty connecting to some iSCSI-based SANs Devices may have issues connecting to some Storage Area Network (SAN) devices using Internet Small Computer System Interface (iSCSI) after installing
KB4499183 . You may also receive an error in the
System log section of
Event Viewer with Event ID 43 from iScsiPrt and a description of “Target failed to respond in time for a login request.”
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016 Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in
KB4509478 .
Back to top OS Build 17134.799 May 21, 2019KB4499183 ResolvedKB4509478 Resolved: June 26, 2019 04:00 PM PT Opened: June 20, 2019 04:46 PM PT
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in
KB4503288 .
Back to top OS Build 17134.829 June 11, 2019KB4503286 ResolvedKB4503288 Resolved: June 18, 2019 02:00 PM PT Opened: June 12, 2019 11:11 AM PT
Opening Internet Explorer 11 may fail Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607 Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in
KB4503286 .
Back to top OS Build 17134.799 May 21, 2019KB4499183 ResolvedKB4503286 Resolved: June 11, 2019 10:00 AM PT Opened: June 05, 2019 05:49 PM PT
@@ -117,12 +120,3 @@ sections:
Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail after installing
KB4493437 .
Affected platforms:
Client: Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016 Server: Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016
Resolution: This issue was resolved in
KB4499167 .
Back to top OS Build 17134.753 April 25, 2019KB4493437 ResolvedKB4499167 Resolved: May 14, 2019 10:00 AM PT Opened: April 25, 2019 02:00 PM PT
"
-
-- title: March 2019
-- items:
- - type: markdown
- text: "
- Details Originating update Status History
-
Custom URI schemes may not start corresponding application After installing
KB4489868 , custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites security zones on Internet Explorer.
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
Resolution: This issue is resolved in
KB4493437 .
Back to top OS Build 17134.648 March 12, 2019KB4489868 ResolvedKB4493437 Resolved: April 25, 2019 02:00 PM PT Opened: March 12, 2019 10:00 AM PT
-
- "
diff --git a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml
index 31f2522277..d8ce5f8d4a 100644
--- a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml
+++ b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml
@@ -32,27 +32,29 @@ sections:
- type: markdown
text: "
Summary Originating update Status Date resolved
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > OS Build 17763.740 September 23, 2019KB4522015 ResolvedKB4519338 October 08, 2019 10:00 AM PT
-
Apps and scripts using the NetQueryDisplayInformation API may fail with error Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.See details > OS Build 17763.55 October 09, 2018KB4464330 ResolvedKB4516077 September 24, 2019 10:00 AM PT
+
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.See details > OS Build 17763.678 August 13, 2019KB4511553 ResolvedKB4520062 October 15, 2019 10:00 AM PT
+
Startup to a black screen after installing updates Your device may startup to a black screen during the first logon after installing updates.See details > OS Build 17763.557 June 11, 2019KB4503327 ResolvedKB4520062 October 15, 2019 10:00 AM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > OS Build 17763.740 September 23, 2019KB4522015 ResolvedKB4519338 October 08, 2019 10:00 AM PT
+
Apps and scripts using the NetQueryDisplayInformation API may fail with error Applications and scripts that call NetQueryDisplayInformation may fail to return results after the first page of data.See details > OS Build 17763.55 October 09, 2018KB4464330 ResolvedKB4516077 September 24, 2019 10:00 AM PT
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.See details > OS Build 17763.737 September 10, 2019KB4512578 Resolved September 19, 2019 04:08 PM PT
-
Domain connected devices that use MIT Kerberos realms will not start up Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.See details > OS Build 17763.652 July 22, 2019KB4505658 ResolvedKB4511553 August 13, 2019 10:00 AM PT
-
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > OS Build 17763.557 June 11, 2019KB4503327 ResolvedKB4512534 August 17, 2019 02:00 PM PT
-
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.See details > OS Build 17763.678 August 13, 2019KB4511553 ResolvedKB4512534 August 17, 2019 02:00 PM PT
-
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.See details > OS Build 17763.557 June 11, 2019KB4503327 Resolved External August 09, 2019 07:03 PM PT
+
Domain connected devices that use MIT Kerberos realms will not start up Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.See details > OS Build 17763.652 July 22, 2019KB4505658 ResolvedKB4511553 August 13, 2019 10:00 AM PT
+
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > OS Build 17763.557 June 11, 2019KB4503327 ResolvedKB4512534 August 17, 2019 02:00 PM PT
+
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.See details > OS Build 17763.678 August 13, 2019KB4511553 ResolvedKB4512534 August 17, 2019 02:00 PM PT
+
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.See details > OS Build 17763.557 June 11, 2019KB4503327 Resolved External August 09, 2019 07:03 PM PT
Difficulty connecting to some iSCSI-based SANs Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.See details > OS Build 17763.529 May 21, 2019KB4497934 ResolvedKB4509479 June 26, 2019 04:00 PM PT
-
Devices with Realtek Bluetooth radios drivers may not pair or connect as expected Devices with some Realtek Bluetooth radios drivers, in some circumstances, may have issues pairing or connecting to devices.See details > OS Build 17763.503 May 14, 2019KB4494441 ResolvedKB4501371 June 18, 2019 02:00 PM PT
-
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.See details > OS Build 17763.557 June 11, 2019KB4503327 ResolvedKB4501371 June 18, 2019 02:00 PM PT
+
Devices with Realtek Bluetooth radios drivers may not pair or connect as expected Devices with some Realtek Bluetooth radios drivers may have issues pairing or connecting to devices.See details > OS Build 17763.503 May 14, 2019KB4494441 ResolvedKB4501371 June 18, 2019 02:00 PM PT
+
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may see an error or the app may close.See details > OS Build 17763.557 June 11, 2019KB4503327 ResolvedKB4501371 June 18, 2019 02:00 PM PT
Printing from Microsoft Edge or other UWP apps may result in the error 0x80070007 Attempting to print from Microsoft Edge or other Universal Windows Platform (UWP) apps, you may receive an error.See details > OS Build 17763.379 March 12, 2019KB4489899 ResolvedKB4501371 June 18, 2019 02:00 PM PT
Opening Internet Explorer 11 may fail Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.See details > OS Build 17763.529 May 21, 2019KB4497934 ResolvedKB4503327 June 11, 2019 10:00 AM PT
-
Issue using PXE to start a device from WDS Using PXE to start a device from a WDS server configured to use Variable Window Extension may cause the connection to the WDS server to terminate prematurely.See details > OS Build 17763.379 March 12, 2019KB4489899 ResolvedKB4503327 June 11, 2019 10:00 AM PT
-
Audio not working on monitors or TV connected to a PC via HDMI, USB, or DisplayPort Upgrade block: Microsoft has identified issues with certain new Intel display drivers, which accidentally turn on unsupported features in Windows.See details > OS Build 17763.134 November 13, 2018KB4467708 Resolved May 21, 2019 07:42 AM PT
+
Issue using PXE to start a device from WDS Using PXE to start a device from a WDS server configured to use Variable Window Extension may terminate the connection.See details > OS Build 17763.379 March 12, 2019KB4489899 ResolvedKB4503327 June 11, 2019 10:00 AM PT
+
Audio not working on monitors or TV connected to a PC via HDMI, USB, or DisplayPort Upgrade block: Certain new Intel display drivers may accidentally turn on unsupported features in Windows.See details > OS Build 17763.134 November 13, 2018KB4467708 Resolved May 21, 2019 07:42 AM PT
Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessibleSee details > OS Build 17763.503 May 14, 2019KB4494441 ResolvedKB4505056 May 19, 2019 02:00 PM PT
-
Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > OS Build 17763.475 May 03, 2019KB4495667 ResolvedKB4494441 May 14, 2019 10:00 AM PT
+
Layout and cell size of Excel sheets may change when using MS UI Gothic When using MS UI Gothic or MS PGothic in Excel, the text, layout, or cell size may become narrower or wider.See details > OS Build 17763.475 May 03, 2019KB4495667 ResolvedKB4494441 May 14, 2019 10:00 AM PT
Windows 10, version 1809 update history may show an update installed twice Some customers are reporting that KB4494441 installed twice on their deviceSee details > OS Build 17763.503 May 14, 2019KB4494441 Resolved May 16, 2019 02:37 PM PT
Zone transfers over TCP may fail Zone transfers between primary and secondary DNS servers over the Transmission Control Protocol (TCP) may fail.See details > OS Build 17763.475 May 03, 2019KB4495667 ResolvedKB4494441 May 14, 2019 10:00 AM PT
Latest cumulative update (KB 4495667) installs automatically Reports that the optional cumulative update (KB 4495667) installs automatically.See details > OS Build 17763.475 May 03, 2019KB4495667 Resolved May 08, 2019 03:37 PM PT
System may be unresponsive after restart if ArcaBit antivirus software installed After further investigation ArcaBit has confirmed this issue is not applicable to Windows 10, version 1809See details > OS Build 17763.437 April 09, 2019KB4493509 Resolved May 08, 2019 03:30 PM PT
-
Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.See details > OS Build 17763.379 March 12, 2019KB4489899 ResolvedKB4495667 May 03, 2019 10:00 AM PT
+
Custom URI schemes may not start corresponding application Custom URI schemes for application protocol handlers may not start the corresponding application.See details > OS Build 17763.379 March 12, 2019KB4489899 ResolvedKB4495667 May 03, 2019 10:00 AM PT
"
@@ -68,6 +70,7 @@ sections:
- type: markdown
text: "
Details Originating update Status History
+
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code After installing
KB4511553 , Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.
Affected platforms:
Client: Windows 10, version 1809; Windows 10, version 1803
Resolution: This issue was resolved in
KB4520062 .
Back to top OS Build 17763.678 August 13, 2019KB4511553 ResolvedKB4520062 Resolved: October 15, 2019 10:00 AM PT Opened: September 11, 2019 05:32 PM PT
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver. The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in
KB4519338 .
Back to top OS Build 17763.740 September 23, 2019KB4522015 ResolvedKB4519338 Resolved: October 08, 2019 10:00 AM PT Opened: September 30, 2019 06:26 PM PT
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: Due to security related changes in
KB4512578 , this issue may occur when
Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of
Manual . To resolve the issue, perform the following steps:
Select the Start button and type Services . Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties . Locate Startup type: and change it to Manual Select Ok The TabletInputService service is now in the default configuration and IME should work as expected. Back to top OS Build 17763.737 September 10, 2019KB4512578 Resolved Resolved: September 19, 2019 04:08 PM PT Opened: September 13, 2019 05:25 PM PT
@@ -100,6 +103,7 @@ sections:
- type: markdown
text: "
Details Originating update Status History
+
Startup to a black screen after installing updates We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803 Server: Windows Server 2019
Resolution: This issue was resolved in
KB4520062 .
Back to top OS Build 17763.557 June 11, 2019KB4503327 ResolvedKB4520062 Resolved: October 15, 2019 10:00 AM PT Opened: June 14, 2019 04:41 PM PT
Difficulty connecting to some iSCSI-based SANs Devices may have issues connecting to some Storage Area Network (SAN) devices using Internet Small Computer System Interface (iSCSI) after installing
KB4497934 . You may also receive an error in the
System log section of
Event Viewer with Event ID 43 from iScsiPrt and a description of “Target failed to respond in time for a login request.”
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016 Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in
KB4509479 .
Back to top OS Build 17763.529 May 21, 2019KB4497934 ResolvedKB4509479 Resolved: June 26, 2019 04:00 PM PT Opened: June 20, 2019 04:46 PM PT
Devices with Realtek Bluetooth radios drivers may not pair or connect as expected In some circumstances, devices with Realtek Bluetooth radios may have issues pairing or connecting to Bluetooth devices due to a driver issue.
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019 Server: Windows Server 2019
Resolution: This issue was resolved in
KB4501371 .
Back to top OS Build 17763.503 May 14, 2019KB4494441 ResolvedKB4501371 Resolved: June 18, 2019 02:00 PM PT Opened: June 14, 2019 05:45 PM PT
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in
KB4501371 .
Back to top OS Build 17763.557 June 11, 2019KB4503327 ResolvedKB4501371 Resolved: June 18, 2019 02:00 PM PT Opened: June 12, 2019 11:11 AM PT
diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml
index b8113225b2..9226fbbd4e 100644
--- a/windows/release-information/resolved-issues-windows-10-1903.yml
+++ b/windows/release-information/resolved-issues-windows-10-1903.yml
@@ -32,29 +32,32 @@ sections:
- type: markdown
text: "
Summary Originating update Status Date resolved
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > OS Build 18362.357 September 23, 2019KB4522016 ResolvedKB4517389 October 08, 2019 10:00 AM PT
+
Unable to discover or connect to Bluetooth devices using some Qualcomm adapters Microsoft has identified compatibility issues with some versions of Qualcomm Bluetooth radio drivers.See details > OS Build 18362.116 May 20, 2019KB4505057 ResolvedKB4517389 October 08, 2019 10:00 AM PT
+
Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters Some devices with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards may experience compatibility issues.See details > N/A ResolvedKB4522355 October 24, 2019 10:00 AM PT
+
dGPU occasionally disappear from device manager on Surface Book 2 Some apps or games may close or fail to open on Surface Book 2 devices with Nvidia dGPU.See details > OS Build 18362.145 May 29, 2019KB4497935 Resolved October 18, 2019 04:33 PM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > OS Build 18362.357 September 23, 2019KB4522016 ResolvedKB4517389 October 08, 2019 10:00 AM PT
Audio in games is quiet or different than expected Microsoft has received reports that audio in certain games is quieter or different than expected.See details > OS Build 18362.356 September 10, 2019KB4515384 ResolvedKB4517211 September 26, 2019 02:00 PM PT
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.See details > OS Build 18362.356 September 10, 2019KB4515384 Resolved September 19, 2019 04:08 PM PT
-
Some users report issues related to the Start menu and Windows Desktop Search Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.See details > OS Build 18362.356 September 10, 2019KB4515384 Resolved September 19, 2019 04:58 PM PT
+
Some users report issues related to the Start menu and Windows Desktop Search A small number of users have reported issues related to the Start menu and Windows Desktop Search.See details > OS Build 18362.356 September 10, 2019KB4515384 Resolved September 19, 2019 04:58 PM PT
Screenshots and Snips have an unnatural orange tint Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installedSee details > OS Build 18362.356 September 10, 2019KB4516115 Resolved External September 11, 2019 08:54 PM PT
Windows Desktop Search may not return any results and may have high CPU usage Windows Desktop Search may not return any results and SearchUI.exe may have high CPU usage after installing KB4512941.See details > OS Build 18362.329 August 30, 2019KB4512941 ResolvedKB4515384 September 10, 2019 10:00 AM PT
-
Domain connected devices that use MIT Kerberos realms will not start up Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.See details > OS Build 18362.145 May 29, 2019KB4497935 ResolvedKB4512941 August 30, 2019 10:00 AM PT
-
Issues updating when certain versions of Intel storage drivers are installed Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.See details > OS Build 18362.145 May 29, 2019KB4497935 ResolvedKB4512941 August 30, 2019 10:00 AM PT
-
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.See details > OS Build 18362.295 August 13, 2019KB4512508 ResolvedKB4512941 August 30, 2019 10:00 AM PT
+
Domain connected devices that use MIT Kerberos realms will not start up Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.See details > OS Build 18362.145 May 29, 2019KB4497935 ResolvedKB4512941 August 30, 2019 10:00 AM PT
+
Issues updating when certain versions of Intel storage drivers are installed Windows 10, version 1903 update may fail with certain versions of Intel Rapid Storage Technology (Intel RST) drivers.See details > OS Build 18362.145 May 29, 2019KB4497935 ResolvedKB4512941 August 30, 2019 10:00 AM PT
+
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.See details > OS Build 18362.295 August 13, 2019KB4512508 ResolvedKB4512941 August 30, 2019 10:00 AM PT
Initiating a Remote Desktop connection may result in black screen When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.See details > OS Build 18362.145 May 29, 2019KB4497935 ResolvedKB4512941 August 30, 2019 10:00 AM PT
-
Windows Sandbox may fail to start with error code “0x80070002” Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language was changed between updatesSee details > OS Build 18362.116 May 20, 2019KB4505057 ResolvedKB4512941 August 30, 2019 10:00 AM PT
-
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > OS Build 18362.175 June 11, 2019KB4503293 ResolvedKB4512941 August 30, 2019 10:00 AM PT
-
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.See details > OS Build 18362.175 June 11, 2019KB4503293 Resolved External August 09, 2019 07:03 PM PT
-
Display brightness may not respond to adjustments Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers.See details > OS Build 18362.116 May 21, 2019KB4505057 ResolvedKB4505903 July 26, 2019 02:00 PM PT
-
RASMAN service may stop working and result in the error “0xc0000005” The Remote Access Connection Manager (RASMAN) service may stop working and result in the error “0xc0000005” with VPN profiles configured as an Always On VPN connection.See details > OS Build 18362.145 May 29, 2019KB4497935 ResolvedKB4505903 July 26, 2019 02:00 PM PT
-
Loss of functionality in Dynabook Smartphone Link app After updating to Windows 10, version 1903, you may experience a loss of functionality when using the Dynabook Smartphone Link application.See details > OS Build 18362.116 May 20, 2019KB4505057 Resolved July 11, 2019 01:54 PM PT
+
Windows Sandbox may fail to start with error code “0x80070002” Windows Sandbox may fail to start on devices in which the operating system language was changed between updates.See details > OS Build 18362.116 May 20, 2019KB4505057 ResolvedKB4512941 August 30, 2019 10:00 AM PT
+
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > OS Build 18362.175 June 11, 2019KB4503293 ResolvedKB4512941 August 30, 2019 10:00 AM PT
+
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.See details > OS Build 18362.175 June 11, 2019KB4503293 Resolved External August 09, 2019 07:03 PM PT
+
Display brightness may not respond to adjustments Devices configured with certain Intel display drivers may experience a driver compatibility issue.See details > OS Build 18362.116 May 21, 2019KB4505057 ResolvedKB4505903 July 26, 2019 02:00 PM PT
+
RASMAN service may stop working and result in the error “0xc0000005” The RASMAN service may stop working with VPN profiles configured as an Always On VPN connection.See details > OS Build 18362.145 May 29, 2019KB4497935 ResolvedKB4505903 July 26, 2019 02:00 PM PT
+
Loss of functionality in Dynabook Smartphone Link app Users who update to Windows 10, version 1903 may experience a loss of functionality with Dynabook Smartphone Link.See details > OS Build 18362.116 May 20, 2019KB4505057 Resolved July 11, 2019 01:54 PM PT
Error attempting to update with external USB device or memory card attached PCs with an external USB device or SD memory card attached may get error: \"This PC can't be upgraded to Windows 10.\"See details > OS Build 18362.116 May 21, 2019KB4505057 Resolved July 11, 2019 01:53 PM PT
Audio not working with Dolby Atmos headphones and home theater Users may experience audio loss with Dolby Atmos headphones or Dolby Atmos home theater.See details > OS Build 18362.116 May 21, 2019KB4505057 Resolved July 11, 2019 01:53 PM PT
-
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.See details > OS Build 18362.175 June 11, 2019KB4503293 ResolvedKB4501375 June 27, 2019 10:00 AM PT
-
Duplicate folders and documents showing in user profile directory If known folders (e.g. Desktop, Documents, or Pictures folders) are redirected, an empty folder with that same name may be created.See details > OS Build 18362.116 May 21, 2019KB4505057 ResolvedKB4497935 May 29, 2019 02:00 PM PT
-
Older versions of BattlEye anti-cheat software incompatible Microsoft and BattlEye have identified a compatibility issue with some games that use older versions of BattlEye anti-cheat software.See details > OS Build 18362.116 May 21, 2019KB4505057 Resolved June 07, 2019 04:26 PM PT
+
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may see an error or the app may close.See details > OS Build 18362.175 June 11, 2019KB4503293 ResolvedKB4501375 June 27, 2019 10:00 AM PT
+
Duplicate folders and documents showing in user profile directory An empty folder with the same name may be created if known folders (e.g. Desktop, Documents) are redirected.See details > OS Build 18362.116 May 21, 2019KB4505057 ResolvedKB4497935 May 29, 2019 02:00 PM PT
+
Older versions of BattlEye anti-cheat software incompatible Users may experience a compatibility issue with some games that use older versions of BattlEye anti-cheat software.See details > OS Build 18362.116 May 21, 2019KB4505057 Resolved June 07, 2019 04:26 PM PT
D3D applications and games may fail to enter full-screen mode on rotated displays Some Direct3D (D3D) applications and games may fail to enter full-screen mode on rotated displays.See details > OS Build 18362.116 May 21, 2019KB4505057 ResolvedKB4497935 May 29, 2019 02:00 PM PT
-
AMD RAID driver incompatibility Installation process may stop when trying to install Windows 10, version 1903 update on computers that run certain versions of AMD RAID drivers.See details > OS Build 18362.116 May 21, 2019KB4505057 Resolved June 06, 2019 11:06 AM PT
+
AMD RAID driver incompatibility Devices running certain AMD RAID drivers may have difficulty installing the Windows 10, version 1903 update.See details > OS Build 18362.116 May 21, 2019KB4505057 Resolved June 06, 2019 11:06 AM PT
"
@@ -65,11 +68,21 @@ sections:
"
+- title: October 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History
+
Unable to discover or connect to Bluetooth devices using some Qualcomm adapters Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Qualcomm. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Qualcomm Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.
Affected platforms:
Client: Windows 10, version 1903 Server: Windows Server, version 1903
Resolution: This issue was resolved in
KB4517389 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.
Back to top OS Build 18362.116 May 20, 2019KB4505057 ResolvedKB4517389 Resolved: October 08, 2019 10:00 AM PT Opened: October 25, 2019 04:21 PM PT
+
+ "
+
- title: September 2019
- items:
- type: markdown
text: "
Details Originating update Status History
+
Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters Microsoft and NEC have found incompatibility issues with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903 on specific models of NEC devices. If these devices are updated to Windows 10, version 1903, they will no longer be able to use any Wi-Fi connections. The Wi-Fi driver may have a yellow exclamation point in device manager. The task tray icon for networking may show the icon for no internet and Network & Internet settings may not show any Wi-Fi networks.
To safeguard your update experience, we have applied a compatibility hold on the affected devices from being offered Windows 10, version 1903.
Affected platforms:
Client: Windows 10, version 1903
Resolution: This issue was resolved in
KB4522355 . The safeguard hold is estimated to be removed in mid-November.
Back to top N/A ResolvedKB4522355 Resolved: October 24, 2019 10:00 AM PT Opened: September 13, 2019 05:25 PM PT
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver. The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in
KB4517389 .
Back to top OS Build 18362.357 September 23, 2019KB4522016 ResolvedKB4517389 Resolved: October 08, 2019 10:00 AM PT Opened: September 30, 2019 06:26 PM PT
Audio in games is quiet or different than expected Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.
Affected platforms:
Client: Windows 10, version 1903
Resolution: This issue was resolved in
KB4517211 .
Back to top OS Build 18362.356 September 10, 2019KB4515384 ResolvedKB4517211 Resolved: September 26, 2019 02:00 PM PT Opened: September 13, 2019 05:25 PM PT
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: Due to security related changes in
KB4515384 , this issue may occur when
Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of
Manual . To resolve the issue, perform the following steps:
Select the Start button and type Services . Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties . Locate Startup type: and change it to Manual Select Ok The TabletInputService service is now in the default configuration and IME should work as expected. Back to top OS Build 18362.356 September 10, 2019KB4515384 Resolved Resolved: September 19, 2019 04:08 PM PT Opened: September 13, 2019 05:25 PM PT
@@ -94,6 +107,7 @@ sections:
- type: markdown
text: "
Details Originating update Status History
+
dGPU occasionally disappear from device manager on Surface Book 2 Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing units (dGPUs). After updating to Windows 10, version 1903 (the May 2019 Update), some apps or games that needs to perform graphics intensive operations may close or fail to open.
To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPU from being offered Windows 10, version 1903 until this issue is resolved.
Affected platforms:
Client: Windows 10, version 1903
Resolved: To resolve this issue, you will need to update the firmware of your Surface Book 2 device. Please see the
Surface Book 2 update history page for instructions on how to install the October 2019 updates on your device. There is no update for Windows needed for this issue.
The safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903.
Back to top OS Build 18362.145 May 29, 2019KB4497935 Resolved Resolved: October 18, 2019 04:33 PM PT Opened: July 12, 2019 04:20 PM PT
Domain connected devices that use MIT Kerberos realms will not start up Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of
KB4497935 . Devices that are domain controllers or domain members are both affected.
To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.
Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: This issue was resolved in
KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.
Back to top OS Build 18362.145 May 29, 2019KB4497935 ResolvedKB4512941 Resolved: August 30, 2019 10:00 AM PT Opened: July 25, 2019 06:10 PM PT
Issues updating when certain versions of Intel storage drivers are installed Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).
To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.
Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.8.1050 .
Affected platforms:
Client: Windows 10, version 1903 Server: Windows Server, version 1903
Resolution: This issue was resolved in
KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.
Back to top OS Build 18362.145 May 29, 2019KB4497935 ResolvedKB4512941 Resolved: August 30, 2019 10:00 AM PT Opened: July 25, 2019 06:10 PM PT
diff --git a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml
index 76c9d8cf03..8b2b541e7e 100644
--- a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml
+++ b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml
@@ -32,21 +32,20 @@ sections:
- type: markdown
text: "
Summary Originating update Status Date resolved
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > September 24, 2019KB4516048 ResolvedKB4519976 October 08, 2019 10:00 AM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > September 24, 2019KB4516048 ResolvedKB4519976 October 08, 2019 10:00 AM PT
You may receive an error when opening or using the Toshiba Qosmio AV Center Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.See details > August 13, 2019KB4512506 ResolvedKB4516048 September 24, 2019 10:00 AM PT
Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV Windows updates that are SHA-2 signed are not available with Symantec or Norton antivirus program installedSee details > August 13, 2019KB4512506 Resolved External August 27, 2019 02:29 PM PT
-
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > June 11, 2019KB4503292 ResolvedKB4512514 August 17, 2019 02:00 PM PT
-
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.See details > August 13, 2019KB4512506 ResolvedKB4517297 August 16, 2019 02:00 PM PT
-
System may be unresponsive after restart with certain McAfee antivirus products Devices with McAfee Endpoint Security Threat Prevention 10.x, Host Intrusion Prevention 8.0, or VirusScan Enterprise 8.8 may be slow or unresponsive at startup.See details > April 09, 2019KB4493472 Resolved External August 13, 2019 06:59 PM PT
-
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.See details > June 11, 2019KB4503292 Resolved External August 09, 2019 07:03 PM PT
+
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > June 11, 2019KB4503292 ResolvedKB4512514 August 17, 2019 02:00 PM PT
+
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.See details > August 13, 2019KB4512506 ResolvedKB4517297 August 16, 2019 02:00 PM PT
+
System may be unresponsive after restart with certain McAfee antivirus products Devices running certain McAfee Endpoint security applications may be slow or unresponsive at startup.See details > April 09, 2019KB4493472 Resolved External August 13, 2019 06:59 PM PT
+
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.See details > June 11, 2019KB4503292 Resolved External August 09, 2019 07:03 PM PT
IE11 may stop working when loading or interacting with Power BI reports Power BI reports that contain line charts with markers may cause Internet Explorer 11 to stop working.See details > May 14, 2019KB4499164 ResolvedKB4503277 June 20, 2019 02:00 PM PT
-
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.See details > June 11, 2019KB4503292 ResolvedKB4503277 June 20, 2019 02:00 PM PT
+
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may see an error or the app may close.See details > June 11, 2019KB4503292 ResolvedKB4503277 June 20, 2019 02:00 PM PT
Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessibleSee details > May 14, 2019KB4499164 ResolvedKB4505050 May 18, 2019 02:00 PM PT
System may be unresponsive after restart if ArcaBit antivirus software installed Devices with ArcaBit antivirus software installed may become unresponsive upon restart.See details > April 09, 2019KB4493472 Resolved May 14, 2019 01:23 PM PT
-
System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.See details > April 09, 2019KB4493472 Resolved May 14, 2019 01:22 PM PT
+
System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection, managed by Sophos Central or Sophos Enterprise Console, may be unresponsive.See details > April 09, 2019KB4493472 Resolved May 14, 2019 01:22 PM PT
System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart.See details > April 09, 2019KB4493472 Resolved May 14, 2019 01:21 PM PT
Authentication may fail for services after the Kerberos ticket expires Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires.See details > March 12, 2019KB4489878 ResolvedKB4499164 May 14, 2019 10:00 AM PT
-
Devices may not respond at login or Welcome screen if running certain Avast software Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart.See details > April 09, 2019KB4493472 Resolved April 25, 2019 02:00 PM PT
"
@@ -115,7 +114,6 @@ sections:
System may be unresponsive after restart if ArcaBit antivirus software installed Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart after installing
KB4493472 .
Affected platforms:
Client: Windows 8.1; Windows 7 SP1 Server: Windows Server 2012 R2; Windows Server 2008 R2 SP1
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. ArcaBit has released an update to address this issue. For more information, see the
Arcabit support article .
Back to top April 09, 2019KB4493472 Resolved Resolved: May 14, 2019 01:23 PM PT Opened: April 09, 2019 10:00 AM PT
System unresponsive after restart if Sophos Endpoint Protection installed Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing
KB4493472 .
Affected platforms:
Client: Windows 8.1; Windows 7 SP1 Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the
Sophos support article .
Back to top April 09, 2019KB4493472 Resolved Resolved: May 14, 2019 01:22 PM PT Opened: April 09, 2019 10:00 AM PT
System may be unresponsive after restart if Avira antivirus software installed Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing
KB4493472 .
Affected platforms:
Client: Windows 8.1; Windows 7 SP1 Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the
Avira support article .
Back to top April 09, 2019KB4493472 Resolved Resolved: May 14, 2019 01:21 PM PT Opened: April 09, 2019 10:00 AM PT
-
Devices may not respond at login or Welcome screen if running certain Avast software Microsoft and Avast have identified an issue on devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software after you install
KB4493472 and restart. Devices may become unresponsive at the login or Welcome screen. Additionally, you may be unable to log in or log in after an extended period of time.
Affected platforms:
Client: Windows 8.1; Windows 7 SP1 Server: Windows Server 2012 R2; Windows Server 2008 R2 SP1
Resolution: Avast has released emergency updates to address this issue. For more information and AV update schedule, see the
Avast support KB article .
Back to top April 09, 2019KB4493472 Resolved Resolved: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT
"
diff --git a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml
index c59da3e253..dd4aae95a7 100644
--- a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml
+++ b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml
@@ -32,21 +32,20 @@ sections:
- type: markdown
text: "
Summary Originating update Status Date resolved
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > September 24, 2019KB4516041 ResolvedKB4520005 October 08, 2019 10:00 AM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > September 24, 2019KB4516041 ResolvedKB4520005 October 08, 2019 10:00 AM PT
Windows RT 8.1 devices may have issues opening Internet Explorer 11 On Windows RT 8.1 devices, Internet Explorer 11 may not open and you may receive an error.See details > September 10, 2019KB4516067 ResolvedKB4516041 September 24, 2019 10:00 AM PT
-
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > June 11, 2019KB4503276 ResolvedKB4512478 August 17, 2019 02:00 PM PT
-
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.See details > August 13, 2019KB4512488 ResolvedKB4517298 August 16, 2019 02:00 PM PT
-
System may be unresponsive after restart with certain McAfee antivirus products Devices with McAfee Endpoint Security Threat Prevention 10.x, Host Intrusion Prevention 8.0, or VirusScan Enterprise 8.8 may be slow or unresponsive at startup.See details > April 09, 2019KB4493446 Resolved External August 13, 2019 06:59 PM PT
-
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.See details > June 11, 2019KB4503276 Resolved External August 09, 2019 07:03 PM PT
+
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > June 11, 2019KB4503276 ResolvedKB4512478 August 17, 2019 02:00 PM PT
+
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.See details > August 13, 2019KB4512488 ResolvedKB4517298 August 16, 2019 02:00 PM PT
+
System may be unresponsive after restart with certain McAfee antivirus products Devices running certain McAfee Endpoint security applications may be slow or unresponsive at startup.See details > April 09, 2019KB4493446 Resolved External August 13, 2019 06:59 PM PT
+
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.See details > June 11, 2019KB4503276 Resolved External August 09, 2019 07:03 PM PT
IE11 may stop working when loading or interacting with Power BI reports Power BI reports that contain line charts with markers may cause Internet Explorer 11 to stop working.See details > May 14, 2019KB4499151 ResolvedKB4503283 June 20, 2019 02:00 PM PT
-
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.See details > June 11, 2019KB4503276 ResolvedKB4503283 June 20, 2019 02:00 PM PT
-
Issue using PXE to start a device from WDS There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension.See details > March 12, 2019KB4489881 ResolvedKB4503276 June 11, 2019 10:00 AM PT
+
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may see an error or the app may close.See details > June 11, 2019KB4503276 ResolvedKB4503283 June 20, 2019 02:00 PM PT
+
Issue using PXE to start a device from WDS There may be issues using PXE to start a device from a WDS server configured to use Variable Window Extension.See details > March 12, 2019KB4489881 ResolvedKB4503276 June 11, 2019 10:00 AM PT
Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessibleSee details > May 14, 2019KB4499151 ResolvedKB4505050 May 18, 2019 02:00 PM PT
-
Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > April 25, 2019KB4493443 ResolvedKB4499151 May 14, 2019 10:00 AM PT
+
Layout and cell size of Excel sheets may change when using MS UI Gothic When using MS UI Gothic or MS PGothic in Excel, the text, layout, or cell size may become narrower or wider.See details > April 25, 2019KB4493443 ResolvedKB4499151 May 14, 2019 10:00 AM PT
System may be unresponsive after restart if ArcaBit antivirus software installed Devices with ArcaBit antivirus software installed may become unresponsive upon restart.See details > April 09, 2019KB4493446 Resolved May 14, 2019 01:22 PM PT
-
System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.See details > April 09, 2019KB4493446 Resolved May 14, 2019 01:22 PM PT
+
System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection, managed by Sophos Central or Sophos Enterprise Console, may be unresponsive.See details > April 09, 2019KB4493446 Resolved May 14, 2019 01:22 PM PT
System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart.See details > April 09, 2019KB4493446 Resolved May 14, 2019 01:21 PM PT
-
Devices may not respond at login or Welcome screen if running certain Avast software Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart.See details > April 09, 2019KB4493446 Resolved April 25, 2019 02:00 PM PT
"
@@ -115,7 +114,6 @@ sections:
System may be unresponsive after restart if ArcaBit antivirus software installed Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart after installing
KB4493446 .
Affected platforms:
Client: Windows 8.1; Windows 7 SP1 Server: Windows Server 2012 R2; Windows Server 2008 R2 SP1
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. ArcaBit has released an update to address this issue. For more information, see the
Arcabit support article .
Back to top April 09, 2019KB4493446 Resolved Resolved: May 14, 2019 01:22 PM PT Opened: April 09, 2019 10:00 AM PT
System unresponsive after restart if Sophos Endpoint Protection installed Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing
KB4493446 .
Affected platforms:
Client: Windows 8.1; Windows 7 SP1 Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the
Sophos support article .
Back to top April 09, 2019KB4493446 Resolved Resolved: May 14, 2019 01:22 PM PT Opened: April 09, 2019 10:00 AM PT
System may be unresponsive after restart if Avira antivirus software installed Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing
KB4493446 .
Affected platforms:
Client: Windows 8.1; Windows 7 SP1 Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the
Avira support article .
Back to top April 09, 2019KB4493446 Resolved Resolved: May 14, 2019 01:21 PM PT Opened: April 09, 2019 10:00 AM PT
-
Devices may not respond at login or Welcome screen if running certain Avast software Microsoft and Avast have identified an issue on devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software after you install
KB4493446 and restart. Devices may become unresponsive at the login or Welcome screen. Additionally, you may be unable to log in or log in after an extended period of time.
Affected platforms:
Client: Windows 8.1; Windows 7 SP1 Server: Windows Server 2012 R2; Windows Server 2008 R2 SP1
Resolution : Avast has released emergency updates to address this issue. For more information and AV update schedule, see the
Avast support KB article .
Back to top April 09, 2019KB4493446 Resolved Resolved: April 25, 2019 02:00 PM PT Opened: April 09, 2019 10:00 AM PT
"
diff --git a/windows/release-information/resolved-issues-windows-server-2008-sp2.yml b/windows/release-information/resolved-issues-windows-server-2008-sp2.yml
index 56156479e8..535126c94e 100644
--- a/windows/release-information/resolved-issues-windows-server-2008-sp2.yml
+++ b/windows/release-information/resolved-issues-windows-server-2008-sp2.yml
@@ -32,12 +32,13 @@ sections:
- type: markdown
text: "
Summary Originating update Status Date resolved
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > September 24, 2019KB4516030 ResolvedKB4520002 October 08, 2019 10:00 AM PT
-
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > June 11, 2019KB4503273 ResolvedKB4512499 August 17, 2019 02:00 PM PT
-
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.See details > August 13, 2019KB4512476 ResolvedKB4517301 August 16, 2019 02:00 PM PT
-
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.See details > June 11, 2019KB4503273 Resolved External August 09, 2019 07:03 PM PT
-
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.See details > June 11, 2019KB4503273 ResolvedKB4503271 June 20, 2019 02:00 PM PT
-
System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.See details > April 09, 2019KB4493471 Resolved May 14, 2019 01:21 PM PT
+
Issues manually installing updates by double-clicking the .msu file You may encounter issues manually installing updates by double-clicking the .msu file and may receive an error.See details > September 10, 2019KB4474419 ResolvedKB4474419 September 23, 2019 10:00 AM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > September 24, 2019KB4516030 ResolvedKB4520002 October 08, 2019 10:00 AM PT
+
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > June 11, 2019KB4503273 ResolvedKB4512499 August 17, 2019 02:00 PM PT
+
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.See details > August 13, 2019KB4512476 ResolvedKB4517301 August 16, 2019 02:00 PM PT
+
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.See details > June 11, 2019KB4503273 Resolved External August 09, 2019 07:03 PM PT
+
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may see an error or the app may close.See details > June 11, 2019KB4503273 ResolvedKB4503271 June 20, 2019 02:00 PM PT
+
System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection, managed by Sophos Central or Sophos Enterprise Console, may be unresponsive.See details > April 09, 2019KB4493471 Resolved May 14, 2019 01:21 PM PT
System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart.See details > April 09, 2019KB4493471 Resolved May 14, 2019 01:19 PM PT
Authentication may fail for services after the Kerberos ticket expires Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires.See details > March 12, 2019KB4489880 ResolvedKB4499149 May 14, 2019 10:00 AM PT
@@ -55,6 +56,7 @@ sections:
- type: markdown
text: "
Details Originating update Status History
+
Issues manually installing updates by double-clicking the .msu file After installing the SHA-2 update (
KB4474419 ) released on September 10, 2019, you may encounter issues manually installing updates by double-clicking on the .msu file and may receive the error, \"Installer encountered an error: 0x80073afc. The resource loader failed to find MUI file.\"
Affected platforms:
Server: Windows Server 2008 SP2
Workaround: Open a command prompt and use the following command (replacing <msu location> with the actual location and filename of the update): wusa.exe <msu location> /quiet
Resolution: This issue is resolved in
KB4474419 released October 8, 2019. It will install automatically from Windows Update and Windows Server Update Services (WSUS). If you need to install this update manually, you will need to use the workaround above.
Note If you previously installed
KB4474419 released September 23, 2019, then you already have the latest version of this update and do not need to reinstall.
Back to top September 10, 2019KB4474419 ResolvedKB4474419 Resolved: September 23, 2019 10:00 AM PT Opened: September 20, 2019 04:57 PM PT
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver. The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Note This issue also affects the Internet Explorer Cumulative Update
KB4522007 , release September 23, 2019.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in
KB4520002 . If you are using Security Only updates, see
KB4519974 for resolving KB for your platform.
Back to top September 24, 2019KB4516030 ResolvedKB4520002 Resolved: October 08, 2019 10:00 AM PT Opened: September 30, 2019 06:26 PM PT
"
diff --git a/windows/release-information/resolved-issues-windows-server-2012.yml b/windows/release-information/resolved-issues-windows-server-2012.yml
index 36c006c7b9..660872c996 100644
--- a/windows/release-information/resolved-issues-windows-server-2012.yml
+++ b/windows/release-information/resolved-issues-windows-server-2012.yml
@@ -32,17 +32,17 @@ sections:
- type: markdown
text: "
Summary Originating update Status Date resolved
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > September 24, 2019KB4516069 ResolvedKB4520007 October 08, 2019 10:00 AM PT
-
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > June 11, 2019KB4503285 ResolvedKB4512512 August 17, 2019 02:00 PM PT
-
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.See details > August 13, 2019KB4512518 ResolvedKB4517302 August 16, 2019 02:00 PM PT
-
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.See details > June 11, 2019KB4503285 Resolved External August 09, 2019 07:03 PM PT
-
Some devices and generation 2 Hyper-V VMs may have issues installing updates Some devices and generation 2 Hyper-V virtual machines (VMs) may have issues installing some updates when Secure Boot is enabled.See details > June 11, 2019KB4503285 ResolvedKB4503295 June 21, 2019 02:00 PM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > September 24, 2019KB4516069 ResolvedKB4520007 October 08, 2019 10:00 AM PT
+
Devices starting using PXE from a WDS or SCCM servers may fail to start Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"See details > June 11, 2019KB4503285 ResolvedKB4512512 August 17, 2019 02:00 PM PT
+
Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.See details > August 13, 2019KB4512518 ResolvedKB4517302 August 16, 2019 02:00 PM PT
+
MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.See details > June 11, 2019KB4503285 Resolved External August 09, 2019 07:03 PM PT
+
Some devices and generation 2 Hyper-V VMs may have issues installing updates Some devices and generation 2 Hyper-V VMs may have issues installing some updates when Secure Boot is enabled.See details > June 11, 2019KB4503285 ResolvedKB4503295 June 21, 2019 02:00 PM PT
IE11 may stop working when loading or interacting with Power BI reports Power BI reports that contain line charts with markers may cause Internet Explorer 11 to stop working.See details > May 14, 2019KB4499171 ResolvedKB4503295 June 21, 2019 02:00 PM PT
-
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.See details > June 11, 2019KB4503285 ResolvedKB4503295 June 20, 2019 02:00 PM PT
-
Issue using PXE to start a device from WDS There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension.See details > March 12, 2019KB4489891 ResolvedKB4503285 June 11, 2019 10:00 AM PT
+
Event Viewer may close or you may receive an error when using Custom Views When trying to expand, view, or create Custom Views in Event Viewer, you may see an error or the app may close.See details > June 11, 2019KB4503285 ResolvedKB4503295 June 20, 2019 02:00 PM PT
+
Issue using PXE to start a device from WDS There may be issues using PXE to start a device from a WDS server configured to use Variable Window Extension.See details > March 12, 2019KB4489891 ResolvedKB4503285 June 11, 2019 10:00 AM PT
Unable to access some gov.uk websites gov.uk websites that don’t support “HSTS” may not be accessibleSee details > May 14, 2019KB4499171 ResolvedKB4505050 May 18, 2019 02:00 PM PT
-
Layout and cell size of Excel sheets may change when using MS UI Gothic When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel. See details > April 25, 2019KB4493462 ResolvedKB4499171 May 14, 2019 10:00 AM PT
-
System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.See details > April 09, 2019KB4493451 Resolved May 14, 2019 01:21 PM PT
+
Layout and cell size of Excel sheets may change when using MS UI Gothic When using MS UI Gothic or MS PGothic in Excel, the text, layout, or cell size may become narrower or wider.See details > April 25, 2019KB4493462 ResolvedKB4499171 May 14, 2019 10:00 AM PT
+
System unresponsive after restart if Sophos Endpoint Protection installed Devices with Sophos Endpoint Protection, managed by Sophos Central or Sophos Enterprise Console, may be unresponsive.See details > April 09, 2019KB4493451 Resolved May 14, 2019 01:21 PM PT
System may be unresponsive after restart if Avira antivirus software installed Devices with Avira antivirus software installed may become unresponsive upon restart.See details > April 09, 2019KB4493451 Resolved May 14, 2019 01:19 PM PT
"
diff --git a/windows/release-information/status-windows-10-1507.yml b/windows/release-information/status-windows-10-1507.yml
index ca4bc3e9f8..be4512cee7 100644
--- a/windows/release-information/status-windows-10-1507.yml
+++ b/windows/release-information/status-windows-10-1507.yml
@@ -60,8 +60,8 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary Originating update Status Last updated
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > OS Build 10240.18334 September 23, 2019KB4522009 ResolvedKB4520011 October 08, 2019 10:00 AM PT
-
Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".See details > OS Build 10240.18094 January 08, 2019KB4480962 Mitigated April 25, 2019 02:00 PM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > OS Build 10240.18334 September 23, 2019KB4522009 ResolvedKB4520011 October 08, 2019 10:00 AM PT
+
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).See details > OS Build 10240.18094 January 08, 2019KB4480962 Mitigated April 25, 2019 02:00 PM PT
"
diff --git a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml
index 8ae7ab2eb4..c75ec5b5a9 100644
--- a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml
+++ b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml
@@ -60,12 +60,10 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary Originating update Status Last updated
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > OS Build 14393.3206 September 23, 2019KB4522010 ResolvedKB4519998 October 08, 2019 10:00 AM PT
-
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.See details > OS Build 14393.3204 September 10, 2019KB4516044 Resolved September 17, 2019 04:47 PM PT
-
Apps and scripts using the NetQueryDisplayInformation API may fail with error Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.See details > OS Build 14393.3053 June 18, 2019KB4503294 ResolvedKB4516044 September 10, 2019 10:00 AM PT
-
Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".See details > OS Build 14393.2724 January 08, 2019KB4480961 Mitigated April 25, 2019 02:00 PM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > OS Build 14393.3206 September 23, 2019KB4522010 ResolvedKB4519998 October 08, 2019 10:00 AM PT
+
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).See details > OS Build 14393.2724 January 08, 2019KB4480961 Mitigated April 25, 2019 02:00 PM PT
Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.See details > OS Build 14393.2608 November 13, 2018KB4467691 Mitigated February 19, 2019 10:00 AM PT
-
Cluster service may fail if the minimum password length is set to greater than 14 The cluster service may fail to start with the error “2245 (NERR_PasswordTooShort)” if the Group Policy “Minimum Password Length” is configured with greater than 14 characters.See details > OS Build 14393.2639 November 27, 2018KB4467684 Mitigated April 25, 2019 02:00 PM PT
+
Cluster service may fail if the minimum password length is set to greater than 14 The cluster service may fail to start if “Minimum Password Length” is configured with greater than 14 characters.See details > OS Build 14393.2639 November 27, 2018KB4467684 Mitigated April 25, 2019 02:00 PM PT
"
@@ -82,16 +80,6 @@ sections:
text: "
Details Originating update Status History
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver. The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in
KB4519998 .
Back to top OS Build 14393.3206 September 23, 2019KB4522010 ResolvedKB4519998 Resolved: October 08, 2019 10:00 AM PT Opened: September 30, 2019 06:26 PM PT
-
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: After investigation, we have found that this issue does not affect this version of Windows.
Back to top OS Build 14393.3204 September 10, 2019KB4516044 Resolved Resolved: September 17, 2019 04:47 PM PT Opened: September 13, 2019 05:25 PM PT
-
- "
-
-- title: August 2019
-- items:
- - type: markdown
- text: "
- Details Originating update Status History
-
Apps and scripts using the NetQueryDisplayInformation API may fail with error Applications and scripts that call the
NetQueryDisplayInformation API or the
WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”
Affected platforms:
Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in
KB4516044 .
Back to top OS Build 14393.3053 June 18, 2019KB4503294 ResolvedKB4516044 Resolved: September 10, 2019 10:00 AM PT Opened: August 01, 2019 05:00 PM PT
"
diff --git a/windows/release-information/status-windows-10-1703.yml b/windows/release-information/status-windows-10-1703.yml
index 69a1b1cd91..5ad1df7093 100644
--- a/windows/release-information/status-windows-10-1703.yml
+++ b/windows/release-information/status-windows-10-1703.yml
@@ -21,7 +21,7 @@ sections:
Find information on known issues for Windows 10, version 1703. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
-Windows 10, version 1703 has reached end of service
Consumer and commercial editions of Windows 10, version 1703 have reached end of service. As devices running these editions are no longer receiving monthly security and quality updates containing protections from the latest security threats, we recommend that you update these devices to the latest version of Windows 10 immediately. For more information on end of service dates currently supported versions of Windows 10, see the
Windows lifecycle fact sheet .
+Windows 10, version 1703 has reached end of service
Consumer and commercial editions of Windows 10, version 1703 have reached end of service. Devices running these editions are no longer receiving monthly security and quality updates containing protections from the latest security threats. We recommend that you update these devices to the latest version of Windows 10 immediately. For more information on end of service dates currently supported versions of Windows 10, see the
Windows lifecycle fact sheet .
Note This page will be retired on Tuesday, November 12, 2019.
"
@@ -64,9 +64,8 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary Originating update Status Last updated
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > OS Build 15063.2046 September 23, 2019KB4522011 ResolvedKB4520010 October 08, 2019 10:00 AM PT
-
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.See details > OS Build 15063.2045 September 10, 2019KB4516068 Resolved September 17, 2019 04:47 PM PT
-
Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".See details > OS Build 15063.1563 January 08, 2019KB4480973 Mitigated April 25, 2019 02:00 PM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > OS Build 15063.2046 September 23, 2019KB4522011 ResolvedKB4520010 October 08, 2019 10:00 AM PT
+
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).See details > OS Build 15063.1563 January 08, 2019KB4480973 Mitigated April 25, 2019 02:00 PM PT
"
@@ -83,7 +82,6 @@ sections:
text: "
Details Originating update Status History
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver. The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in
KB4520010 .
Back to top OS Build 15063.2046 September 23, 2019KB4522011 ResolvedKB4520010 Resolved: October 08, 2019 10:00 AM PT Opened: September 30, 2019 06:26 PM PT
-
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: After investigation, we have found that this issue does not affect this version of Windows.
Back to top OS Build 15063.2045 September 10, 2019KB4516068 Resolved Resolved: September 17, 2019 04:47 PM PT Opened: September 13, 2019 05:25 PM PT
"
diff --git a/windows/release-information/status-windows-10-1709.yml b/windows/release-information/status-windows-10-1709.yml
index 5c261a20d3..217b281dbc 100644
--- a/windows/release-information/status-windows-10-1709.yml
+++ b/windows/release-information/status-windows-10-1709.yml
@@ -60,9 +60,8 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary Originating update Status Last updated
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > OS Build 16299.1392 September 23, 2019KB4522012 ResolvedKB4520004 October 08, 2019 10:00 AM PT
-
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.See details > OS Build 16299.1387 September 10, 2019KB4516066 Resolved September 19, 2019 04:08 PM PT
-
Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".See details > OS Build 16299.904 January 08, 2019KB4480978 Mitigated April 25, 2019 02:00 PM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > OS Build 16299.1392 September 23, 2019KB4522012 ResolvedKB4520004 October 08, 2019 10:00 AM PT
+
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).See details > OS Build 16299.904 January 08, 2019KB4480978 Mitigated April 25, 2019 02:00 PM PT
"
@@ -79,7 +78,6 @@ sections:
text: "
Details Originating update Status History
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver. The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in
KB4520004 .
Back to top OS Build 16299.1392 September 23, 2019KB4522012 ResolvedKB4520004 Resolved: October 08, 2019 10:00 AM PT Opened: September 30, 2019 06:26 PM PT
-
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: Due to security related changes in
KB4516066 , this issue may occur when
Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of
Manual . To resolve the issue, perform the following steps:
Select the Start button and type Services . Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties . Locate Startup type: and change it to Manual Select Ok The TabletInputService service is now in the default configuration and IME should work as expected. Back to top OS Build 16299.1387 September 10, 2019KB4516066 Resolved Resolved: September 19, 2019 04:08 PM PT Opened: September 13, 2019 05:25 PM PT
"
diff --git a/windows/release-information/status-windows-10-1803.yml b/windows/release-information/status-windows-10-1803.yml
index 20747f2e00..9480e53e4d 100644
--- a/windows/release-information/status-windows-10-1803.yml
+++ b/windows/release-information/status-windows-10-1803.yml
@@ -64,11 +64,10 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary Originating update Status Last updated
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > OS Build 17134.1009 September 23, 2019KB4522014 ResolvedKB4520008 October 08, 2019 10:00 AM PT
-
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.See details > OS Build 17134.1006 September 10, 2019KB4516058 Resolved September 19, 2019 04:08 PM PT
-
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not respond to \"wake up\" from sleep.See details > OS Build 17134.950 August 13, 2019KB4512501 Mitigated September 11, 2019 05:32 PM PT
-
Startup to a black screen after installing updates Your device may startup to a black screen during the first logon after installing updates.See details > OS Build 17134.829 June 11, 2019KB4503286 Mitigated June 14, 2019 04:41 PM PT
-
Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".See details > OS Build 17134.523 January 08, 2019KB4480966 Mitigated April 25, 2019 02:00 PM PT
+
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.See details > OS Build 17134.950 August 13, 2019KB4512501 ResolvedKB4519978 October 15, 2019 10:00 AM PT
+
Startup to a black screen after installing updates Your device may startup to a black screen during the first logon after installing updates.See details > OS Build 17134.829 June 11, 2019KB4503286 ResolvedKB4519978 October 15, 2019 10:00 AM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > OS Build 17134.1009 September 23, 2019KB4522014 ResolvedKB4520008 October 08, 2019 10:00 AM PT
+
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).See details > OS Build 17134.523 January 08, 2019KB4480966 Mitigated April 25, 2019 02:00 PM PT
"
@@ -84,9 +83,8 @@ sections:
- type: markdown
text: "
Details Originating update Status History
+
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code After installing
KB4512501 , Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.
Affected platforms:
Client: Windows 10, version 1809; Windows 10, version 1803
Resolution: This issue was resolved in
KB4519978 .
Back to top OS Build 17134.950 August 13, 2019KB4512501 ResolvedKB4519978 Resolved: October 15, 2019 10:00 AM PT Opened: September 11, 2019 05:32 PM PT
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver. The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in
KB4520008 .
Back to top OS Build 17134.1009 September 23, 2019KB4522014 ResolvedKB4520008 Resolved: October 08, 2019 10:00 AM PT Opened: September 30, 2019 06:26 PM PT
-
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: Due to security related changes in
KB4516058 , this issue may occur when
Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of
Manual . To resolve the issue, perform the following steps:
Select the Start button and type Services . Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties . Locate Startup type: and change it to Manual Select Ok The TabletInputService service is now in the default configuration and IME should work as expected. Back to top OS Build 17134.1006 September 10, 2019KB4516058 Resolved Resolved: September 19, 2019 04:08 PM PT Opened: September 13, 2019 05:25 PM PT
-
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code After installing
KB4512501 , Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.
Affected platforms:
Client: Windows 10, version 1809; Windows 10, version 1803
Workaround: To mitigate the issue, use the following steps:
Close the Windows Mixed Reality Portal, if it is running. Open Task Manager by selecting the Start button and typing Task Manager . In Task Manager under the Processes tab, right click or long press on “Windows Explorer ” and select restart. You can now open the Windows Mixed Reality Portal.
Next steps: We are working on a resolution and will provide an update in an upcoming release.
Back to top OS Build 17134.950 August 13, 2019KB4512501 Mitigated Last updated: September 11, 2019 05:32 PM PT Opened: September 11, 2019 05:32 PM PT
"
@@ -95,7 +93,7 @@ sections:
- type: markdown
text: "
Details Originating update Status History
-
Startup to a black screen after installing updates We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803 Server: Windows Server 2019
Workaround: To mitigate this issue, press Ctrl+Alt+Delete, then select the Power button in the lower right corner of the screen and select Restart . Your device should now restart normally.
Next steps: We are working on a resolution and will provide an update in an upcoming release.
Back to top OS Build 17134.829 June 11, 2019KB4503286 Mitigated Last updated: June 14, 2019 04:41 PM PT Opened: June 14, 2019 04:41 PM PT
+
Startup to a black screen after installing updates We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803 Server: Windows Server 2019
Resolution: This issue was resolved in
KB4519978 .
Back to top OS Build 17134.829 June 11, 2019KB4503286 ResolvedKB4519978 Resolved: October 15, 2019 10:00 AM PT Opened: June 14, 2019 04:41 PM PT
"
diff --git a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml
index 62622b2f60..101cc52d36 100644
--- a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml
+++ b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml
@@ -64,13 +64,12 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary Originating update Status Last updated
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > OS Build 17763.740 September 23, 2019KB4522015 ResolvedKB4519338 October 08, 2019 10:00 AM PT
-
Apps and scripts using the NetQueryDisplayInformation API may fail with error Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.See details > OS Build 17763.55 October 09, 2018KB4464330 ResolvedKB4516077 September 24, 2019 10:00 AM PT
-
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.See details > OS Build 17763.737 September 10, 2019KB4512578 Resolved September 19, 2019 04:08 PM PT
-
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not respond to \"wake up\" from sleep.See details > OS Build 17763.678 August 13, 2019KB4511553 Mitigated September 11, 2019 05:32 PM PT
-
Startup to a black screen after installing updates Your device may startup to a black screen during the first logon after installing updates.See details > OS Build 17763.557 June 11, 2019KB4503327 Mitigated June 14, 2019 04:41 PM PT
-
Devices with some Asian language packs installed may receive an error After installing the KB4493509 devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FSee details > OS Build 17763.437 April 09, 2019KB4493509 Mitigated May 03, 2019 10:59 AM PT
-
Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".See details > OS Build 17763.253 January 08, 2019KB4480116 Mitigated April 09, 2019 10:00 AM PT
+
Microsoft Defender Advanced Threat Protection might stop running The Microsoft Defender ATP service might stop running and might fail to send reporting data.See details > OS Build 17763.832 October 15, 2019KB4520062 Investigating October 18, 2019 04:23 PM PT
+
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.See details > OS Build 17763.678 August 13, 2019KB4511553 ResolvedKB4520062 October 15, 2019 10:00 AM PT
+
Startup to a black screen after installing updates Your device may startup to a black screen during the first logon after installing updates.See details > OS Build 17763.557 June 11, 2019KB4503327 ResolvedKB4520062 October 15, 2019 10:00 AM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > OS Build 17763.740 September 23, 2019KB4522015 ResolvedKB4519338 October 08, 2019 10:00 AM PT
+
Devices with some Asian language packs installed may receive an error Devices with Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FOUND.\"See details > OS Build 17763.437 April 09, 2019KB4493509 Mitigated May 03, 2019 10:59 AM PT
+
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).See details > OS Build 17763.253 January 08, 2019KB4480116 Mitigated April 09, 2019 10:00 AM PT
"
@@ -81,23 +80,22 @@ sections:
"
+- title: October 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History
+
Microsoft Defender Advanced Threat Protection might stop running After installing the optional non-security update (
KB4520062 ), the Microsoft Defender Advanced Threat Protection (ATP) service might stop running and might fail to send reporting data. You might also receive a 0xc0000409 error in
Event Viewer on MsSense.exe.
Note Microsoft Windows Defender Antivirus is not affected by this issue.
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019 Server: Windows Server, version 1809; Windows Server 2019
Next steps: At this time, we suggest that devices in an affected environment do not install the optional non-security update,
KB4520062 . We are working on a resolution and estimate a solution will be available in mid-November.
Back to top OS Build 17763.832 October 15, 2019KB4520062 Investigating Last updated: October 18, 2019 04:23 PM PT Opened: October 17, 2019 05:14 PM PT
+
+ "
+
- title: September 2019
- items:
- type: markdown
text: "
Details Originating update Status History
+
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code After installing
KB4511553 , Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.
Affected platforms:
Client: Windows 10, version 1809; Windows 10, version 1803
Resolution: This issue was resolved in
KB4520062 .
Back to top OS Build 17763.678 August 13, 2019KB4511553 ResolvedKB4520062 Resolved: October 15, 2019 10:00 AM PT Opened: September 11, 2019 05:32 PM PT
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver. The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in
KB4519338 .
Back to top OS Build 17763.740 September 23, 2019KB4522015 ResolvedKB4519338 Resolved: October 08, 2019 10:00 AM PT Opened: September 30, 2019 06:26 PM PT
-
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: Due to security related changes in
KB4512578 , this issue may occur when
Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of
Manual . To resolve the issue, perform the following steps:
Select the Start button and type Services . Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties . Locate Startup type: and change it to Manual Select Ok The TabletInputService service is now in the default configuration and IME should work as expected. Back to top OS Build 17763.737 September 10, 2019KB4512578 Resolved Resolved: September 19, 2019 04:08 PM PT Opened: September 13, 2019 05:25 PM PT
-
Windows Mixed Reality Portal users may intermittently receive a 15-5 error code After installing
KB4511553 , Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.
Affected platforms:
Client: Windows 10, version 1809; Windows 10, version 1803
Workaround: To mitigate the issue, use the following steps:
Close the Windows Mixed Reality Portal, if it is running. Open Task Manager by selecting the Start button and typing Task Manager . In Task Manager under the Processes tab, right click or long press on “Windows Explorer ” and select restart. You can now open the Windows Mixed Reality Portal.
Next steps: We are working on a resolution and will provide an update in an upcoming release.
Back to top OS Build 17763.678 August 13, 2019KB4511553 Mitigated Last updated: September 11, 2019 05:32 PM PT Opened: September 11, 2019 05:32 PM PT
-
- "
-
-- title: August 2019
-- items:
- - type: markdown
- text: "
- Details Originating update Status History
-
Apps and scripts using the NetQueryDisplayInformation API may fail with error Applications and scripts that call the
NetQueryDisplayInformation API or the
WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”
Affected platforms:
Server: Windows Server 2019; Windows Server 2016
Resolution: This issue was resolved in
KB4516077 .
Back to top OS Build 17763.55 October 09, 2018KB4464330 ResolvedKB4516077 Resolved: September 24, 2019 10:00 AM PT Opened: August 01, 2019 05:00 PM PT
"
@@ -106,7 +104,7 @@ sections:
- type: markdown
text: "
Details Originating update Status History
-
Startup to a black screen after installing updates We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803 Server: Windows Server 2019
Workaround: To mitigate this issue, press Ctrl+Alt+Delete, then select the Power button in the lower right corner of the screen and select Restart . Your device should now restart normally.
Next steps: We are working on a resolution and will provide an update in an upcoming release.
Back to top OS Build 17763.557 June 11, 2019KB4503327 Mitigated Last updated: June 14, 2019 04:41 PM PT Opened: June 14, 2019 04:41 PM PT
+
Startup to a black screen after installing updates We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.
Affected platforms:
Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803 Server: Windows Server 2019
Resolution: This issue was resolved in
KB4520062 .
Back to top OS Build 17763.557 June 11, 2019KB4503327 ResolvedKB4520062 Resolved: October 15, 2019 10:00 AM PT Opened: June 14, 2019 04:41 PM PT
"
diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml
index fab48103a1..ba1a2faffc 100644
--- a/windows/release-information/status-windows-10-1903.yml
+++ b/windows/release-information/status-windows-10-1903.yml
@@ -64,19 +64,15 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary Originating update Status Last updated
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > OS Build 18362.357 September 23, 2019KB4522016 ResolvedKB4517389 October 08, 2019 10:00 AM PT
-
Audio in games is quiet or different than expected Microsoft has received reports that audio in certain games is quieter or different than expected.See details > OS Build 18362.356 September 10, 2019KB4515384 ResolvedKB4517211 September 26, 2019 02:00 PM PT
-
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.See details > OS Build 18362.356 September 10, 2019KB4515384 Resolved September 19, 2019 04:08 PM PT
-
Some users report issues related to the Start menu and Windows Desktop Search Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.See details > OS Build 18362.356 September 10, 2019KB4515384 Resolved September 19, 2019 04:58 PM PT
-
Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters Microsoft and NEC have found incompatibility issues with some devices with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903.See details > N/A Mitigated September 13, 2019 05:25 PM PT
-
Screenshots and Snips have an unnatural orange tint Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installedSee details > OS Build 18362.356 September 10, 2019KB4516115 Resolved External September 11, 2019 08:54 PM PT
-
Windows Desktop Search may not return any results and may have high CPU usage Windows Desktop Search may not return any results and SearchUI.exe may have high CPU usage after installing KB4512941.See details > OS Build 18362.329 August 30, 2019KB4512941 ResolvedKB4515384 September 10, 2019 10:00 AM PT
-
Updates may fail to install and you may receive Error 0x80073701 Installation of updates may fail and you may receive an error, \"Updates Failed, There were problems installing some updates, but we'll try again later\" and \"Error 0x80073701.\"See details > OS Build 18362.145 May 29, 2019KB4497935 Investigating August 16, 2019 04:28 PM PT
+
Unable to discover or connect to Bluetooth devices using some Qualcomm adapters Microsoft has identified compatibility issues with some versions of Qualcomm Bluetooth radio drivers.See details > OS Build 18362.116 May 20, 2019KB4505057 ResolvedKB4517389 October 08, 2019 10:00 AM PT
+
Unable to discover or connect to Bluetooth devices using some Realtek adapters Microsoft has identified compatibility issues with some versions of Realtek Bluetooth radio drivers.See details > OS Build 18362.116 May 21, 2019KB4505057 Mitigated October 25, 2019 04:21 PM PT
+
Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters Some devices with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards may experience compatibility issues.See details > N/A ResolvedKB4522355 October 24, 2019 10:00 AM PT
+
dGPU occasionally disappear from device manager on Surface Book 2 Some apps or games may close or fail to open on Surface Book 2 devices with Nvidia dGPU.See details > OS Build 18362.145 May 29, 2019KB4497935 Resolved October 18, 2019 04:33 PM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > OS Build 18362.357 September 23, 2019KB4522016 ResolvedKB4517389 October 08, 2019 10:00 AM PT
+
Updates may fail to install and you may receive Error 0x80073701 Installation of updates may fail and you may receive error code 0x80073701.See details > OS Build 18362.145 May 29, 2019KB4497935 Investigating August 16, 2019 04:28 PM PT
Intermittent loss of Wi-Fi connectivity Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. See details > OS Build 18362.116 May 21, 2019KB4505057 Mitigated External August 01, 2019 08:44 PM PT
Gamma ramps, color profiles, and night light settings do not apply in some cases Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.See details > OS Build 18362.116 May 21, 2019KB4505057 Mitigated August 01, 2019 06:27 PM PT
-
The dGPU may occasionally disappear from device manager on Surface Book 2 with dGPU Some apps or games that needs to perform graphics intensive operations may close or fail to open on Surface Book 2 devices with Nvidia dGPU.See details > OS Build 18362.145 May 29, 2019KB4497935 Investigating July 16, 2019 09:04 AM PT
-
Unable to discover or connect to Bluetooth devices Microsoft has identified compatibility issues with some versions of Realtek and Qualcomm Bluetooth radio drivers.See details > OS Build 18362.116 May 21, 2019KB4505057 Mitigated May 21, 2019 04:48 PM PT
-
Intel Audio displays an intcdaud.sys notification Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in battery drain. See details > OS Build 18362.116 May 21, 2019KB4505057 Mitigated May 21, 2019 04:47 PM PT
+
Intel Audio displays an intcdaud.sys notification Devices with a range of Intel Display Audio device drivers may experience battery drain.See details > OS Build 18362.116 May 21, 2019KB4505057 Mitigated May 21, 2019 04:47 PM PT
Cannot launch Camera app Microsoft and Intel have identified an issue affecting Intel RealSense SR300 or Intel RealSense S200 camera apps.See details > OS Build 18362.116 May 21, 2019KB4505057 Mitigated May 21, 2019 04:47 PM PT
"
@@ -88,18 +84,22 @@ sections:
"
+- title: October 2019
+- items:
+ - type: markdown
+ text: "
+ Details Originating update Status History
+
Unable to discover or connect to Bluetooth devices using some Qualcomm adapters Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Qualcomm. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Qualcomm Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.
Affected platforms:
Client: Windows 10, version 1903 Server: Windows Server, version 1903
Resolution: This issue was resolved in
KB4517389 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.
Back to top OS Build 18362.116 May 20, 2019KB4505057 ResolvedKB4517389 Resolved: October 08, 2019 10:00 AM PT Opened: October 25, 2019 04:21 PM PT
+
+ "
+
- title: September 2019
- items:
- type: markdown
text: "
Details Originating update Status History
+
Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters Microsoft and NEC have found incompatibility issues with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903 on specific models of NEC devices. If these devices are updated to Windows 10, version 1903, they will no longer be able to use any Wi-Fi connections. The Wi-Fi driver may have a yellow exclamation point in device manager. The task tray icon for networking may show the icon for no internet and Network & Internet settings may not show any Wi-Fi networks.
To safeguard your update experience, we have applied a compatibility hold on the affected devices from being offered Windows 10, version 1903.
Affected platforms:
Client: Windows 10, version 1903
Resolution: This issue was resolved in
KB4522355 . The safeguard hold is estimated to be removed in mid-November.
Back to top N/A ResolvedKB4522355 Resolved: October 24, 2019 10:00 AM PT Opened: September 13, 2019 05:25 PM PT
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver. The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in
KB4517389 .
Back to top OS Build 18362.357 September 23, 2019KB4522016 ResolvedKB4517389 Resolved: October 08, 2019 10:00 AM PT Opened: September 30, 2019 06:26 PM PT
-
Audio in games is quiet or different than expected Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.
Affected platforms:
Client: Windows 10, version 1903
Resolution: This issue was resolved in
KB4517211 .
Back to top OS Build 18362.356 September 10, 2019KB4515384 ResolvedKB4517211 Resolved: September 26, 2019 02:00 PM PT Opened: September 13, 2019 05:25 PM PT
-
IME may become unresponsive or have High CPU usage Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
Resolution: Due to security related changes in
KB4515384 , this issue may occur when
Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of
Manual . To resolve the issue, perform the following steps:
Select the Start button and type Services . Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties . Locate Startup type: and change it to Manual Select Ok The TabletInputService service is now in the default configuration and IME should work as expected. Back to top OS Build 18362.356 September 10, 2019KB4515384 Resolved Resolved: September 19, 2019 04:08 PM PT Opened: September 13, 2019 05:25 PM PT
-
Some users report issues related to the Start menu and Windows Desktop Search Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.
Affected platforms:
Client: Windows 10, version 1903
Resolution: At this time, Microsoft has not found a
Search or
Start issue significantly impacting users originating from
KB4515384 . We will continue monitoring to ensure users have a high-quality experience when interacting with these areas. If you are currently having issues, we recommend you to take a moment to report it in via the Feedback Hub
(Windows + F) then try the Windows 10 Troubleshoot settings (found in
Settings ). If you are having an issue with search, see
Fix problems in Windows Search .
Back to top OS Build 18362.356 September 10, 2019KB4515384 Resolved Resolved: September 19, 2019 04:58 PM PT Opened: September 11, 2019 05:18 PM PT
-
Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters Microsoft and NEC have found incompatibility issues with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903 on specific models of NEC devices. If these devices are updated to Windows 10, version 1903, they will no longer be able to use any Wi-Fi connections. The Wi-Fi driver may have a yellow exclamation point in device manager. The task tray icon for networking may show the icon for no internet and Network & Internet settings may not show any Wi-Fi networks.
To safeguard your update experience, we have applied a compatibility hold on the affected devices from being offered Windows 10, version 1903.
Affected platforms:
Client: Windows 10, version 1903
Workaround: If you are using an affected device and you have already installed Windows 10, version 1903, you can mitigate the issue disabling then re-enabling the Wi-Fi adapter in Device Manager. You should now be able to use Wi-Fi until your next reboot.
Next steps: Microsoft and NEC are working on a resolution and will provide an update in an upcoming release.
Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.
Back to top N/A Mitigated Last updated: September 13, 2019 05:25 PM PT Opened: September 13, 2019 05:25 PM PT
-
Screenshots and Snips have an unnatural orange tint When creating screenshots or using similar tools (such as Snipping Tool or Snip & Sketch), the resulting images may have an unnatural orange tint. This issue is caused by the Eye Care mode feature of Lenovo Vantage. This issue started on or around September 5, 2019.
Affected platforms:
Client: Windows 10, version 1903 Server: None
Back to top OS Build 18362.356 September 10, 2019KB4516115 Resolved External Last updated: September 11, 2019 08:54 PM PT Opened: September 11, 2019 08:54 PM PT
-
Windows Desktop Search may not return any results and may have high CPU usage Microsoft is getting reports that a small number of users may not receive results when using Windows Desktop Search and may see high CPU usage from SearchUI.exe when searching after installing
KB4512941 . This issue is only encountered on devices in which searching the web from Windows Desktop Search has been disabled.
Affected platforms:
Client: Windows 10, version 1903
Resolution: This issue was resolved in
KB4515384 .
Back to top OS Build 18362.329 August 30, 2019KB4512941 ResolvedKB4515384 Resolved: September 10, 2019 10:00 AM PT Opened: September 04, 2019 02:25 PM PT
"
@@ -117,7 +117,7 @@ sections:
- type: markdown
text: "
Details Originating update Status History
-
The dGPU may occasionally disappear from device manager on Surface Book 2 with dGPU Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing unit (dGPU). After updating to Windows 10, version 1903 (May 2019 Feature Update), some apps or games that needs to perform graphics intensive operations may close or fail to open.
To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPUs from being offered Windows 10, version 1903, until this issue is resolved.
Affected platforms:
Client: Windows 10, version 1903
Workaround: To mitigate the issue if you are already on Windows 10, version 1903, you can restart the device or select the Scan for hardware changes button in the Action menu or on the toolbar in Device Manager.
Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.
Next steps: We are working on a resolution and will provide an update in an upcoming release.
Back to top OS Build 18362.145 May 29, 2019KB4497935 Investigating Last updated: July 16, 2019 09:04 AM PT Opened: July 12, 2019 04:20 PM PT
+
dGPU occasionally disappear from device manager on Surface Book 2 Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing units (dGPUs). After updating to Windows 10, version 1903 (the May 2019 Update), some apps or games that needs to perform graphics intensive operations may close or fail to open.
To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPU from being offered Windows 10, version 1903 until this issue is resolved.
Affected platforms:
Client: Windows 10, version 1903
Resolved: To resolve this issue, you will need to update the firmware of your Surface Book 2 device. Please see the
Surface Book 2 update history page for instructions on how to install the October 2019 updates on your device. There is no update for Windows needed for this issue.
The safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903.
Back to top OS Build 18362.145 May 29, 2019KB4497935 Resolved Resolved: October 18, 2019 04:33 PM PT Opened: July 12, 2019 04:20 PM PT
"
@@ -126,9 +126,9 @@ sections:
- type: markdown
text: "
Details Originating update Status History
+
Unable to discover or connect to Bluetooth devices using some Realtek adapters Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Realtek. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Realtek Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.
Affected platforms:
Client: Windows 10, version 1903 Server: Windows Server, version 1903
Workaround: Check with your device manufacturer (OEM) to see if an updated driver is available and install it. You will need to install a Realtek driver version greater than 1.5.1011.0.
Note Until an updated driver has been installed, we recommend you do not attempt to manually update using the Update now button or the Media Creation Tool.
Next steps: Microsoft is working with Realtek to release new drivers for all affected system via Windows Update.
October 25, 2019 note This issue was previously grouped with the Qualcomm radio issue, which is now resolved. There is no change to this issue except to remove reference to Qualcomm.
Back to top OS Build 18362.116 May 21, 2019KB4505057 Mitigated Last updated: October 25, 2019 04:21 PM PT Opened: May 21, 2019 07:29 AM PT
Intermittent loss of Wi-Fi connectivity Some older computers may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. An updated Wi-Fi driver should be available from your device manufacturer (OEM).
To safeguard your upgrade experience, we have applied a hold on devices with this Qualcomm driver from being offered Windows 10, version 1903, until the updated driver is installed.
Affected platforms:
Client: Windows 10, version 1903
Workaround: Before updating to Windows 10, version 1903, you will need to download and install an updated Wi-Fi driver from your device manufacturer (OEM).
Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.
Back to top OS Build 18362.116 May 21, 2019KB4505057 Mitigated External Last updated: August 01, 2019 08:44 PM PT Opened: May 21, 2019 07:13 AM PT
Gamma ramps, color profiles, and night light settings do not apply in some cases Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.
Microsoft has identified some scenarios in which these features may have issues or stop working, for example:
Connecting to (or disconnecting from) an external monitor, dock, or projector Rotating the screen Updating display drivers or making other display mode changes Closing full screen applications Applying custom color profiles Running applications that rely on custom gamma ramps
Affected platforms:
Client: Windows 10, version 1903
Workaround: If you find that your night light has stopped working, try turning the night light off and on, or restarting your computer. For other color setting issues, restart your computer to correct the issue.
Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.
Next steps: We are working on a resolution and will provide an update in an upcoming release.
Back to top OS Build 18362.116 May 21, 2019KB4505057 Mitigated Last updated: August 01, 2019 06:27 PM PT Opened: May 21, 2019 07:28 AM PT
-
Unable to discover or connect to Bluetooth devices Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Realtek and Qualcomm. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Realtek or Qualcomm Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.
Affected platforms:
Client: Windows 10, version 1903 Server: Windows Server, version 1903
Workaround: Check with your device manufacturer (OEM) to see if an updated driver is available and install it.
For Qualcomm drivers, you will need to install a driver version greater than 10.0.1.11. For Realtek drivers, you will need to install a driver version greater than 1.5.1011.0.
Note Until an updated driver has been installed, we recommend you do not attempt to manually update using the Update now button or the Media Creation Tool.
Next steps: Microsoft is working with Realtek and Qualcomm to release new drivers for all affected system via Windows Update.
Back to top OS Build 18362.116 May 21, 2019KB4505057 Mitigated Last updated: May 21, 2019 04:48 PM PT Opened: May 21, 2019 07:29 AM PT
Intel Audio displays an intcdaud.sys notification Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in higher than normal battery drain. If you see an intcdaud.sys notification or “What needs your attention” notification when trying to update to Windows 10, version 1903, you have an affected Intel Audio Display device driver installed on your machine (intcdaud.sys, versions 10.25.0.3 through 10.25.0.8).
To safeguard your update experience, we have applied a compatibility hold on devices with drivers from being offered Windows 10, version 1903 until updated device drivers have been installed.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809
Workaround:
On the “What needs your attention\" notification, click the Back button to remain on your current version of Windows 10. (Do not click Confirm as this will proceed with the update and you may experience compatibility issues.) Affected devices will automatically revert to the previous working configuration.
Note We recommend you do not attempt to update your devices until newer device drivers are installed.
Next steps: You can opt to wait for newer drivers to be installed automatically through Windows Update or check with the computer manufacturer for the latest device driver software availability and installation procedures.
Back to top OS Build 18362.116 May 21, 2019KB4505057 Mitigated Last updated: May 21, 2019 04:47 PM PT Opened: May 21, 2019 07:22 AM PT
Cannot launch Camera app Microsoft and Intel have identified an issue affecting Intel RealSense SR300 and Intel RealSense S200 cameras when using the Camera app. After updating to the Windows 10 May 2019 Update and launching the Camera app, you may get an error message stating:
\"Close other apps, error code: 0XA00F4243.”
To safeguard your update experience, we have applied a protective hold on machines with Intel RealSense SR300 or Intel RealSense S200 cameras installed from being offered Windows 10, version 1903, until this issue is resolved.
Affected platforms:
Client: Windows 10, version 1903
Workaround: To temporarily resolve this issue, perform one of the following:
Unplug your camera and plug it back in. or
Disable and re-enable the driver in Device Manager. In the Search box, type \"Device Manager\" and press Enter . In the Device Manager dialog box, expand Cameras , then right-click on any RealSense driver listed and select Disable device . Right click on the driver again and select Enable device . or
Restart the RealSense service. In the Search box, type \"Task Manager\" and hit Enter . In the Task Manager dialog box, click on the Services tab, right-click on RealSense , and select Restart .
Note This workaround will only resolve the issue until your next system restart.
Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.
Next steps: We are working on a resolution and will provide an update in an upcoming release.
Back to top OS Build 18362.116 May 21, 2019KB4505057 Mitigated Last updated: May 21, 2019 04:47 PM PT Opened: May 21, 2019 07:20 AM PT
diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml
index 3d71ca817a..e1dbec18dc 100644
--- a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml
+++ b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml
@@ -60,8 +60,7 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary Originating update Status Last updated
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > September 24, 2019KB4516048 ResolvedKB4519976 October 08, 2019 10:00 AM PT
-
You may receive an error when opening or using the Toshiba Qosmio AV Center Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.See details > August 13, 2019KB4512506 ResolvedKB4516048 September 24, 2019 10:00 AM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > September 24, 2019KB4516048 ResolvedKB4519976 October 08, 2019 10:00 AM PT
IA64 and x64 devices may fail to start after installing updates After installing updates released on or after August 13, 2019, IA64 and x64 devices using EFI Boot may fail to start.See details > August 13, 2019KB4512506 Mitigated August 17, 2019 12:59 PM PT
"
@@ -79,7 +78,6 @@ sections:
text: "
Details Originating update Status History
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver. The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Note This issue also affects the Internet Explorer Cumulative Update
KB4522007 , release September 23, 2019.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in
KB4519976 . If you are using Security Only updates, see
KB4519974 for resolving KB for your platform.
Back to top September 24, 2019KB4516048 ResolvedKB4519976 Resolved: October 08, 2019 10:00 AM PT Opened: September 30, 2019 06:26 PM PT
-
You may receive an error when opening or using the Toshiba Qosmio AV Center After installing
KB4512506 , you may receive an error when opening or using the Toshiba
Qosmio AV Center . You may also receive an error in
Event Log related to cryptnet.dll.
Affected platforms:
Resolution: This issue was resolved in
KB4516048 .
Back to top August 13, 2019KB4512506 ResolvedKB4516048 Resolved: September 24, 2019 10:00 AM PT Opened: September 10, 2019 09:48 AM PT
"
diff --git a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml
index a95d9775c6..6b30adb9b0 100644
--- a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml
+++ b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml
@@ -60,10 +60,9 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary Originating update Status Last updated
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > September 24, 2019KB4516041 ResolvedKB4520005 October 08, 2019 10:00 AM PT
-
Windows RT 8.1 devices may have issues opening Internet Explorer 11 On Windows RT 8.1 devices, Internet Explorer 11 may not open and you may receive an error.See details > September 10, 2019KB4516067 ResolvedKB4516041 September 24, 2019 10:00 AM PT
-
Japanese IME doesn't show the new Japanese Era name as a text input option If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.See details > April 25, 2019KB4493443 Mitigated May 15, 2019 05:53 PM PT
-
Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.See details > January 08, 2019KB4480963 Mitigated April 25, 2019 02:00 PM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > September 24, 2019KB4516041 ResolvedKB4520005 October 08, 2019 10:00 AM PT
+
Japanese IME doesn't show the new Japanese Era name as a text input option With previous dictionary updates installed, the Japanese IME doesn't show the new Japanese Era name as an input option.See details > April 25, 2019KB4493443 Mitigated May 15, 2019 05:53 PM PT
+
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).See details > January 08, 2019KB4480963 Mitigated April 25, 2019 02:00 PM PT
"
@@ -80,7 +79,6 @@ sections:
text: "
Details Originating update Status History
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver. The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Note This issue also affects the Internet Explorer Cumulative Update
KB4522007 , release September 23, 2019.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in
KB4520005 . If you are using Security Only updates, see
KB4519974 for resolving KB for your platform.
Back to top September 24, 2019KB4516041 ResolvedKB4520005 Resolved: October 08, 2019 10:00 AM PT Opened: September 30, 2019 06:26 PM PT
-
Windows RT 8.1 devices may have issues opening Internet Explorer 11 On Windows 8.1 RT devices, Internet Explorer 11 may not open and you may receive the error, \"C:\\Program Files\\Internet Explorer\\iexplore.exe: A certificate was explicitly revoked by its issuer.\"
Affected platforms:
Resolution: This issue was resolved in
KB4516041 .
Back to top September 10, 2019KB4516067 ResolvedKB4516041 Resolved: September 24, 2019 10:00 AM PT Opened: September 13, 2019 05:25 PM PT
"
diff --git a/windows/release-information/status-windows-server-2008-sp2.yml b/windows/release-information/status-windows-server-2008-sp2.yml
index fda671a495..0df1e85294 100644
--- a/windows/release-information/status-windows-server-2008-sp2.yml
+++ b/windows/release-information/status-windows-server-2008-sp2.yml
@@ -60,8 +60,8 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary Originating update Status Last updated
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > September 24, 2019KB4516030 ResolvedKB4520002 October 08, 2019 10:00 AM PT
-
Issues manually installing updates by double-clicking the .msu file You may encounter issues manually installing updates by double-clicking the .msu file and may receive an error.See details > September 10, 2019KB4474419 MitigatedKB4474419 September 24, 2019 08:17 AM PT
+
Issues manually installing updates by double-clicking the .msu file You may encounter issues manually installing updates by double-clicking the .msu file and may receive an error.See details > September 10, 2019KB4474419 ResolvedKB4474419 September 23, 2019 10:00 AM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > September 24, 2019KB4516030 ResolvedKB4520002 October 08, 2019 10:00 AM PT
"
@@ -77,7 +77,7 @@ sections:
- type: markdown
text: "
Details Originating update Status History
+
Issues manually installing updates by double-clicking the .msu file After installing the SHA-2 update (
KB4474419 ) released on September 10, 2019, you may encounter issues manually installing updates by double-clicking on the .msu file and may receive the error, \"Installer encountered an error: 0x80073afc. The resource loader failed to find MUI file.\"
Affected platforms:
Server: Windows Server 2008 SP2
Workaround: Open a command prompt and use the following command (replacing <msu location> with the actual location and filename of the update): wusa.exe <msu location> /quiet
Resolution: This issue is resolved in
KB4474419 released October 8, 2019. It will install automatically from Windows Update and Windows Server Update Services (WSUS). If you need to install this update manually, you will need to use the workaround above.
Note If you previously installed
KB4474419 released September 23, 2019, then you already have the latest version of this update and do not need to reinstall.
Back to top September 10, 2019KB4474419 ResolvedKB4474419 Resolved: September 23, 2019 10:00 AM PT Opened: September 20, 2019 04:57 PM PT
Intermittent issues when printing Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver. The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
Note This issue also affects the Internet Explorer Cumulative Update
KB4522007 , release September 23, 2019.
Affected platforms:
Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1 Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
Resolution: This issue was resolved in
KB4520002 . If you are using Security Only updates, see
KB4519974 for resolving KB for your platform.
Back to top September 24, 2019KB4516030 ResolvedKB4520002 Resolved: October 08, 2019 10:00 AM PT Opened: September 30, 2019 06:26 PM PT
-
Issues manually installing updates by double-clicking the .msu file After installing the SHA-2 update (
KB4474419 ) released on September 10, 2019, you may encounter issues manually installing updates by double-clicking on the .msu file and may receive the error, \"Installer encountered an error: 0x80073afc. The resource loader failed to find MUI file.\"
Affected platforms:
Server: Windows Server 2008 SP2
Workaround: Open a command prompt and use the following command (replacing <msu location> with the actual location and filename of the update): wusa.exe <msu location> /quiet
Resolution: This issue is resolved in
KB4474419 released September 23, 2019. Currently, this version is only available from the
Microsoft Update Catalog . To resolve this issue, you will need to manually download the package and use the workaround above to install it.
Next steps: We estimate a solution will be available in mid-October on Windows Update and Windows Server Update Services (WSUS).
Back to top September 10, 2019KB4474419 MitigatedKB4474419 Last updated: September 24, 2019 08:17 AM PT Opened: September 20, 2019 04:57 PM PT
"
diff --git a/windows/release-information/status-windows-server-2012.yml b/windows/release-information/status-windows-server-2012.yml
index f472c2357e..e05f9d92b9 100644
--- a/windows/release-information/status-windows-server-2012.yml
+++ b/windows/release-information/status-windows-server-2012.yml
@@ -60,9 +60,9 @@ sections:
- type: markdown
text: "This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.
Summary Originating update Status Last updated
-
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and may result in a print job being canceled or failing.See details > September 24, 2019KB4516069 ResolvedKB4520007 October 08, 2019 10:00 AM PT
-
Japanese IME doesn't show the new Japanese Era name as a text input option If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.See details > April 25, 2019KB4493462 Mitigated May 15, 2019 05:53 PM PT
-
Certain operations performed on a Cluster Shared Volume may fail Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.See details > January 08, 2019KB4480975 Mitigated April 25, 2019 02:00 PM PT
+
Intermittent issues when printing The print spooler service may intermittently have issues completing a print job and results print job failure.See details > September 24, 2019KB4516069 ResolvedKB4520007 October 08, 2019 10:00 AM PT
+
Japanese IME doesn't show the new Japanese Era name as a text input option With previous dictionary updates installed, the Japanese IME doesn't show the new Japanese Era name as an input option.See details > April 25, 2019KB4493462 Mitigated May 15, 2019 05:53 PM PT
+
Certain operations performed on a Cluster Shared Volume may fail Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).See details > January 08, 2019KB4480975 Mitigated April 25, 2019 02:00 PM PT
"
diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml
index c6fa6957a7..a158f15e9b 100644
--- a/windows/release-information/windows-message-center.yml
+++ b/windows/release-information/windows-message-center.yml
@@ -50,6 +50,8 @@ sections:
text: "
Message Date
+ October 2019 Windows 10, version 1903 \"D\" optional release is available. The October 2019 optional monthly “D” release for Windows 10, version 1903 is now available. For more information on the different types of monthly quality updates, see our
Windows 10 update servicing cadence primer . Follow
@WindowsUpdate for the latest on the availability of this release.
October 24, 2019 08:00 AM PT
+ October 2019 Windows \"C\" optional release is available. The October 2019
optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our
Windows 10 update servicing cadence primer . Follow
@WindowsUpdate for the latest on the availability of this release.
October 15, 2019 09:59 AM PT
Windows 10, version 1703 has reached end of service Consumer and commercial editions of Windows 10, version 1703 have reached end of service. As devices running these editions are no longer receiving monthly security and quality updates containing protections from the latest security threats, we recommend that you update these devices to the latest version of Windows 10 immediately. For more information on end of service dates currently supported versions of Windows 10, see the
Windows lifecycle fact sheet .
October 09, 2019 12:00 PM PT
Take Action: October 2019 security update available for all supported versions of Windows The October 2019 security update release, referred to as our “B” release, is now available for Windows 10, version 1903 and all supported versions of Windows. We recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our
Windows 10 update servicing cadence primer . To be informed about the latest updates and releases, follow us on Twitter
@WindowsUpdate .
October 08, 2019 08:00 AM PT
Take action: Security update available for all supported versions of Windows On October 3, 2019, Microsoft expanded delivery of the out-of-band
Internet Explorer scripting engine security vulnerability (CVE-2019-1367) update released on September 23, 2019 to Windows Update and Windows Server Update Services (WSUS). This is now a required security update for all supported versions of Windows as it includes the Internet Explorer scripting engine vulnerability mitigation and
corrects a recent printing issue some users have experienced. All customers using Windows Update or WSUS will be offered this update automatically. We recommend that you install this update as soon as a possible, then restart your PC to fully apply the mitigations and help secure your devices. As with all cumulative updates, this update supersedes any preceding update.
Note : This update does not replace the standard October 2019 monthly security update release, which is scheduled for October 8, 2019.
October 03, 2019 08:00 AM PT
diff --git a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md
index fb9a2e4abd..9197e2d07d 100644
--- a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md
+++ b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md
@@ -16,103 +16,97 @@ localizationpriority: medium
ms.date: 08/20/2018
ms.reviewer:
---
-# Planning an adequate number of Windows Server 2019 Domain Controllers for Windows Hello for Business deployments
+# Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments
**Applies to**
-- Windows 10, version 1703 or later
-- Windows Server, versions 2016 and 2019
-- Hybrid or On-Premises deployment
-- Key trust
+
+- Windows 10, version 1703 or later
+- Windows Server, versions 2016 or later
+- Hybrid or On-Premises deployment
+- Key trust
> [!NOTE]
>There was an issue with key trust on Windows Server 2019. To fix it, refer to [KB4487044](https://support.microsoft.com/en-us/help/4487044/windows-10-update-kb4487044).
## How many is adequate
-
-How can you find out how many domain controllers are needed? You can use performance monitoring on your domain controllers to determine existing authentication traffic. Windows Server 2016 and above includes the KDC AS Requests performance counter. You can use this counter to determine how much of a domain controller's load is due to initial Kerberos authentication. It's important to remember that authentication for a Windows Hello for Business key trust deployment does not affect Kerberos authentication - it remains unchanged.
+How can you find out how many domain controllers are needed? You can use performance monitoring on your domain controllers to determine existing authentication traffic. Windows Server 2016 and above includes the KDC AS Requests performance counter. You can use this counter to determine how much of a domain controller's load is due to initial Kerberos authentication. It's important to remember that authentication for a Windows Hello for Business key trust deployment does not affect Kerberos authentication - it remains unchanged.
-
-Windows 10 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2016 and above domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers. Therefore, users in a key trust deployment must authenticate to a Windows Server 2016 and above domain controller.
+Windows 10 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2016 or later domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers and above. Therefore, users in a key trust deployment must authenticate to a Windows Server 2016 and above domain controller.
-
-Determining an adequate number of Windows Server domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding the most current version of a domain controller (in this case Windows Server 2019) to a deployment of existing domain controllers (Windows Server 2008R2, Windows Server 2012R2 or Windows Server 2016) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as "piling on". To illustrate the "piling on" concept, consider the following scenario:
+Determining an adequate number of Windows Server domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding a domain controller that supports public key mapping (in this case Windows Server 2016 or later) to a deployment of existing domain controllers which do not support public key mapping (Windows Server 2008R2, Windows Server 2012R2) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as "piling on". To illustrate the "piling on" concept, consider the following scenario:
-
-Consider a controlled environment where there are 1000 client computers and the authentication load of these 1000 client computers is evenly distributed across 10 domain controllers in the environment. The Kerberos AS requests load would look something like the following:
+Consider a controlled environment where there are 1000 client computers and the authentication load of these 1000 client computers is evenly distributed across 10 domain controllers in the environment. The Kerberos AS requests load would look something like the following:

-
-The environment changes. The first change includes DC1 upgraded to Windows Server 2019 to support Windows Hello for Business key-trust authentication. Next, 100 clients enroll for Windows Hello for Business using the public key trust deployment. Given all other factors stay constant, the authentication would now look like the following:
+The environment changes. The first change includes DC1 upgraded to Windows Server 2016 or later to support Windows Hello for Business key-trust authentication. Next, 100 clients enroll for Windows Hello for Business using the public key trust deployment. Given all other factors stay constant, the authentication would now look like the following:

-The Windows Server 2019 domain controller is handling 100 percent of all public key trust authentication. However, it is also handling 10 percent of the password authentication. Why? This behavior occurs because domain controllers 2 - 10 only support password and certificate trust authentication; only a Windows Server 2019 domain controller supports public key trust authentication. The Windows Server 2019 domain controller understands how to authenticate password and certificate trust authentication and will continue to share the load of authenticating those clients. Because DC1 can handle all forms of authentication, it will bear more of the authentication load, and easily become overloaded. What if another Windows Server 2019 domain controller is added, but without deploying Windows Hello for Business to any more clients?
-
+The Windows Server 2016 or later domain controller is handling 100 percent of all public key trust authentication. However, it is also handling 10 percent of password authentication. Why? This behavior occurs because domain controllers 2 - 10 only support password and certificate trust authentication; only a Windows Server 2016 and above domain controller supports public key trust authentication. The Windows Server 2016 and above domain controller still understands how to authenticate password and certificate trust authentication and will continue to share the load of authenticating those clients. Because DC1 can handle all forms of authentication, it will bear more of the authentication load, and easily become overloaded. What if another Windows Server 2016 or later domain controller is added, but without deploying Windows Hello for Business to any more clients?

-Upgrading another Windows Server 2019 domain controller distributes the public key trust authentication across two domain controllers - each supporting 50 percent of the load. But it doesn't change the distribution of password and certificate trust authentication. Both Windows Server 2019 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2019, but the number of WHFB clients remains the same.
+Upgrading another domain controller to Windows Server 2016 or later distributes the public key trust authentication across two domain controllers - each supporting 50 percent of the load. But it doesn't change the distribution of password and certificate trust authentication. Both Windows Server 2019 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2016 or later, but the number of WHFB clients remains the same.

-Domain controllers 1 through 5 now share the public key trust authentication load where each domain controller handles 20 percent of the public key trust load but they each still handle 10 percent of the password and certificate trust authentication. These domain controllers still have a heavier load than domain controllers 6 through 10; however, the load is adequately distributed. Now look the scenario when half of the client computers are upgraded to Windows Hello for Business using a key-trust deployment.
+Domain controllers 1 through 5 now share the public key trust authentication load where each domain controller handles 20 percent of the public key trust load but they each still handle 10 percent of the password and certificate trust authentication. These domain controllers still have a heavier load than domain controllers 6 through 10; however, the load is adequately distributed. Now look the scenario when half of the client computers are upgraded to Windows Hello for Business using a key-trust deployment.

-You'll notice the distribution did not change. Each Windows Server 2019 domain controller handles 20 percent of the public key trust authentication. However, increasing the volume of authentication (by increasing the number of clients) increases the amount of work that is represented by the same 20 percent. In the previous example, 20 percent of public key trust authentication equated to a volume of 20 authentications per domain controller capable of public key trust authentication. However, with upgraded clients, that same 20 percent represents a volume of 100 public key trust authentications per public key trust capable domain controller. Also, the distribution of non-public key trust authentication remained at 10 percent, but the volume of password and certificate trust authentications decreased across the older domain controllers.
+You'll notice the distribution did not change. Each Windows Server 2016 or later domain controller handles 20 percent of the public key trust authentication. However, increasing the volume of authentication (by increasing the number of clients) increases the amount of work that is represented by the same 20 percent. In the previous example, 20 percent of public key trust authentication equated to a volume of 20 authentications per domain controller capable of public key trust authentication. However, with upgraded clients, that same 20 percent represents a volume of 100 public key trust authentications per public key trust capable domain controller. Also, the distribution of non-public key trust authentication remained at 10 percent, but the volume of password and certificate trust authentications decreased across the older domain controllers.
-There are several conclusions here:
-* Upgrading domain controllers changes the distribution of new authentication, but doesn't change the distribution of older authentication.
-* Upgrading domain controllers does not affect the distribution of password and certificate trust authentication because newer domain controllers can support password and certificate trust authentication.
-* Upgraded domain controllers typically carry a heavier authentication load than down-level domain controllers because they support more forms of authentication.
-* Upgrading clients to Windows Hello for Business, increases the volume of public key trust authentication distributed across domain controllers which support it and, reduces the volume of password and certificate trust authentication across all domain controllers
-* Upgrading clients to Windows Hello for Business but does not affect the distribution of authentication; only the volume of authentication.
-
-The preceding was an example to show why it's unrealistic to have a "one-size-fits-all" number to describe what "an adequate amount" means. In the real world, authentication is not evenly distributed across domain controllers.
+There are several conclusions here:
+- Upgrading domain controllers changes the distribution of new authentication, but doesn't change the distribution of older authentication.
+- Upgrading domain controllers does not affect the distribution of password and certificate trust authentication because newer domain controllers can support password and certificate trust authentication.
+- Upgraded domain controllers typically carry a heavier authentication load than down-level domain controllers because they support more forms of authentication.
+- Upgrading clients to Windows Hello for Business, increases the volume of public key trust authentication distributed across domain controllers which support it and, reduces the volume of password and certificate trust authentication across all domain controllers
+- Upgrading clients to Windows Hello for Business but does not affect the distribution of authentication; only the volume of authentication.
+The preceding was an example to show why it's unrealistic to have a "one-size-fits-all" number to describe what "an adequate amount" means. In the real world, authentication is not evenly distributed across domain controllers.
## Determining total AS Request load
Each organization needs to have a baseline of the AS request load that occurs in their environment. Windows Server provides the KDC AS Requests performance counter that helps you determine this.
-Pick a site where you plan to upgrade the clients to Windows Hello for Business public key trust. Pick a time when authentication traffic is most significant--Monday morning is great time as everyone is returning to the office. Enable the performance counter on *all* the domain controllers in that site. Collect KDC AS Requests performance counters for two hours:
-* A half-hour before you expect initial authentication (sign-ins and unlocks) to be significant
-* The hour you believe initial authentication to be significant
-* And a half-hour after you expect initial authentication to be significant
+Pick a site where you plan to upgrade the clients to Windows Hello for Business public key trust. Pick a time when authentication traffic is most significant--Monday morning is great time as everyone is returning to the office. Enable the performance counter on *all* the domain controllers in that site. Collect KDC AS Requests performance counters for two hours:
-For example, if employees are scheduled to come into the office at 9:00am. Your performance capture should begin at 8:30am and end at 10:30am. Ensure your performance logs do not wrap the data. You want to see authentication trend upward, peak, and trend downward.
+- A half-hour before you expect initial authentication (sign-ins and unlocks) to be significant
+- The hour you believe initial authentication to be significant
+- And a half-hour after you expect initial authentication to be significant
+
+For example, if employees are scheduled to come into the office at 9:00am. Your performance capture should begin at 8:30am and end at 10:30am. Ensure your performance logs do not wrap the data. You want to see authentication trend upward, peak, and trend downward.
> [!NOTE]
> To capture all the authentication traffic. Ensure that all computers are powered down to get the most accurate authentication information (computers and services authenticate at first power up--you need to consider this authentication in your evaluation).
-Aggregate the performance data of all domain controllers. Look for the maximum KDC AS Requests for each domain controller. Find the median time when the maximum number of requests occurred for the site, this should represent when the site is experiencing the highest amount of authentication.
-
-Add the number of authentications for each domain controller for the median time. You now have the total authentication for the site during a peak time. Using this metric, you can determine the distribution of authentication across the domain controllers in the site by dividing the domain controller's authentication number for the median time by the total authentication. Multiply the quotient by 10 to convert the distribution to a percentage. To validate your math, all the distributions should equal 100 percent.
+Aggregate the performance data of all domain controllers. Look for the maximum KDC AS Requests for each domain controller. Find the median time when the maximum number of requests occurred for the site, this should represent when the site is experiencing the highest amount of authentication.
-Review the distribution of authentication. Hopefully, none of these are above 70 percent. It's always good to reserve some capacity for the unexpected. Also, the primary purposes of a domain controller are to provide authentication and handle Active Directory operations. Identify domain controllers with lower distributions of authentication as potential candidates for the initial domain controller upgrades in conjunction with a reasonable distribution of clients provisioned for Windows Hello for Business.
+Add the number of authentications for each domain controller for the median time. You now have the total authentication for the site during a peak time. Using this metric, you can determine the distribution of authentication across the domain controllers in the site by dividing the domain controller's authentication number for the median time by the total authentication. Multiply the quotient by 10 to convert the distribution to a percentage. To validate your math, all the distributions should equal 100 percent.
+
+Review the distribution of authentication. Hopefully, none of these are above 70 percent. It's always good to reserve some capacity for the unexpected. Also, the primary purposes of a domain controller are to provide authentication and handle Active Directory operations. Identify domain controllers with lower distributions of authentication as potential candidates for the initial domain controller upgrades in conjunction with a reasonable distribution of clients provisioned for Windows Hello for Business.
## Monitoring Authentication
-Using the same methods described above, monitor the Kerberos authentication after upgrading a domain controller and your first phase of Windows Hello for Business deployments. Make note of the delta of authentication before and after upgrading the domain controller to Windows Server 2019. This delta is representative of authentication resulting from the first phase of your Windows Hello for Business clients. It gives you a baseline for your environment to where you can form a statement such as:
-
+Using the same methods described above, monitor the Kerberos authentication after upgrading a domain controller and your first phase of Windows Hello for Business deployments. Make note of the delta of authentication before and after upgrading the domain controller to Windows Server 2016 or newer. This delta is representative of authentication resulting from the first phase of your Windows Hello for Business clients. It gives you a baseline for your environment to where you can form a statement such as:
```"Every n Windows Hello for Business clients results in x percentage of key-trust authentication."```
-Where _n_ equals the number of clients you switched to Windows Hello for Business and _x_ equals the increased percentage of authentication from the upgraded domain controller. Armed with this information, you can apply the observations of upgrading domain controllers and increasing Windows Hello for Business client count to appropriately phase your deployment.
+Where _n_ equals the number of clients you switched to Windows Hello for Business and _x_ equals the increased percentage of authentication from the upgraded domain controller. Armed with this information, you can apply the observations of upgrading domain controllers and increasing Windows Hello for Business client count to appropriately phase your deployment.
-Remember, increasing the number of clients changes the volume of authentication distributed across the Windows Server 2019 domain controllers. If there is only one Windows Server 2019 domain controller, there's no distribution and you are simply increasing the volume of authentication for which THAT domain controller is responsible.
+Remember, increasing the number of clients changes the volume of authentication distributed across the Windows Server 2016 or newer domain controllers. If there is only one Windows Server 2016 or newer domain controller, there's no distribution and you are simply increasing the volume of authentication for which THAT domain controller is responsible.
Increasing the number of domain controllers distributes the volume of authentication, but doesn't change it. Therefore, as you add more domain controllers, the burden of authentication, for which each domain controller is responsible, decreases. Upgrading two domain controller changes the distribution to 50 percent. Upgrading three domain controllers changes the distribution to 33 percent, and so on.
## Strategy
+
The simplest strategy you can employ is to upgrade one domain controller and monitor the single domain controller as you continue to phase in new Windows Hello for Business key-trust clients until it reaches a 70 or 80 percent threshold.
-Then, upgrade a second domain controller. Monitor the authentication on both domain controllers to determine how the authentication distributes between the two domain controllers. Introduce more Windows Hello for Business clients while monitoring the authentication on the two upgraded domain controllers. Once those reach your environment's designated capacity, you can upgrade another domain controller.
+Then, upgrade a second domain controller. Monitor the authentication on both domain controllers to determine how the authentication distributes between the two domain controllers. Introduce more Windows Hello for Business clients while monitoring the authentication on the two upgraded domain controllers. Once those reach your environment's designated capacity, you can upgrade another domain controller.
-Repeat until your deployment for that site is complete. Now, monitor authentication across all your domain controllers like you did the very first time. Determine the distribution of authentication for each domain controller. Identify the percentage of distribution for which it is responsible. If a single domain controller is responsible for 70 percent of more of the authentication, you may want to consider adding a domain controller to reduce the distribution of authentication volume.
+Repeat until your deployment for that site is complete. Now, monitor authentication across all your domain controllers like you did the very first time. Determine the distribution of authentication for each domain controller. Identify the percentage of distribution for which it is responsible. If a single domain controller is responsible for 70 percent of more of the authentication, you may want to consider adding a domain controller to reduce the distribution of authentication volume.
However, before considering this, ensure the high load of authentication is not a result of applications and services where their configuration has a statically-configured domain controller. Adding domain controllers will not resolve the additional authentication load problem in this scenario. Instead, manually distribute the authentication to different domain controllers among all the services or applications. Alternatively, try simply using the domain name rather than a specific domain controller. Each domain controller has an A record registered in DNS for the domain name, which DNS will round robin with each DNS query. It's not the best load balancer, however, it is a better alternative to static domain controller configurations, provided the configuration is compatible with your service or application.
-
diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md
index 723a2e1e54..bb57bd6b57 100644
--- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md
+++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md
@@ -1,5 +1,5 @@
---
-title: How Windows Hello for Business works - Techincal Deep Dive
+title: How Windows Hello for Business works - Technical Deep Dive
description: Explains registration, authentication, key material, and infrastructure for Windows Hello for Business.
keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust, works
ms.prod: w10
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md
index 5136ececee..1bb87570ff 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md
@@ -580,7 +580,7 @@ Sign-in the NDES server with access equivalent to _domain administrator_.
3. Click **Sign-in**. Type credentials for your Intune administrator, or tenant administrator that has the **Global Administrator** directory role.

> [!IMPORTANT]
- > The user account must have a valid Intune licenese asssigned. If the user account does not have a valid Intune license, the sign-in fails.
+ > The user account must have a valid Intune licenese assigned. If the user account does not have a valid Intune license, the sign-in fails.
4. Optionally, you can configure the NDES Connector for certificate revocation. If you want to do this, continue to the next task. Otherwise, Click **Close**, restart the **Intune Connector Service** and the **World Wide Web Publishing Service**, and skip the next task.
diff --git a/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md b/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md
index c1b6366ec7..77709b6ef2 100644
--- a/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md
+++ b/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md
index 7bb74bdb71..4ce0666579 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md
index 10924772a5..406d096165 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md
index 0177ea0901..ab57ef7b30 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md
index 78092912cd..b0c94843ad 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md
index b9b8646bf0..e4fb0170b4 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md
@@ -6,7 +6,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
@@ -22,7 +22,6 @@ ms.reviewer:
- Windows 10
This topic explains how BitLocker Device Encryption can help protect data on devices running Windows 10.
-For an architectural overview about how BitLocker Device Encryption works with Secure Boot, see [Secure boot and BitLocker Device Encryption overview](https://docs.microsoft.com/windows-hardware/drivers/bringup/secure-boot-and-device-encryption-overview).
For a general overview and list of topics about BitLocker, see [BitLocker](bitlocker-overview.md).
When users travel, their organization’s confidential data goes with them. Wherever confidential data is stored, it must be protected against unauthorized access. Windows has a long history of providing at-rest data-protection solutions that guard against nefarious attackers, beginning with the Encrypting File System in the Windows 2000 operating system. More recently, BitLocker has provided encryption for full drives and portable drives. Windows consistently improves data protection by improving existing options and by providing new strategies.
diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md
index fce071badf..f4f3028fcb 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md
index 2d9a9c0ce6..09d6973301 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md
index 3a17290bcd..121b0d3e49 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md
index 23276f3144..e91f6d7db8 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md
index 6aa957697c..5ab13673ea 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md
index caee851596..08e059935f 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md
@@ -6,7 +6,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
@@ -136,10 +136,7 @@ PS C:\> Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpace
-
-
-
-# **PowerShell**
+**Powershell**
[BitLocker cmdlets for Windows PowerShell](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md#bitlocker-cmdlets-for-windows-powershell)
diff --git a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md
index 79f29f59ec..9e8a4b17a5 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md
@@ -6,7 +6,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md
index 000e35587d..aca61b7f1d 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
@@ -41,7 +41,7 @@ Yes, BitLocker supports multifactor authentication for operating system drives.
For requirements, see [System requirements](bitlocker-overview.md#system-requirements).
> [!NOTE]
-> Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it is cannot be protected by BitLocker.
+> Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it cannot be protected by BitLocker.
## Why are two partitions required? Why does the system drive have to be so large?
@@ -78,4 +78,4 @@ To turn on, turn off, or change configurations of BitLocker on operating system
## What is the recommended boot order for computers that are going to be BitLocker-protected?
-You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such ach as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.
+You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.
diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md
index b57d24fd11..5ce2ab05e6 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-overview.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md
@@ -9,7 +9,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md
index 16272b6213..26a7658ef1 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md
index 6bb6a48e28..211775fd9d 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md
index f5de0c1816..6cc8628157 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md
@@ -9,7 +9,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
diff --git a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md
index 3ec8b9d7db..ddefee9d0c 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md
@@ -6,7 +6,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md
index bb6cc83966..e4e1a3ffcd 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md
index 56534228b9..9f41146f0d 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md
index a093ef4773..5d1da751a8 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md
index 1105a1bf99..72436ef74d 100644
--- a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md
+++ b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
@@ -20,41 +20,31 @@ ms.date: 04/24/2019
# Prepare your organization for BitLocker: Planning and policies
**Applies to**
-- Windows 10
+
+- Windows 10
This topic for the IT professional explains how can you plan your BitLocker deployment.
When you design your BitLocker deployment strategy, define the appropriate policies and configuration requirements based on the business requirements of your organization. The following topics will help you collect information that you can use to frame your decision-making process about deploying and managing BitLocker systems.
-- [Audit your environment](#bkmk-audit)
-- [Encryption keys and authentication](#bkk-encrypt)
-- [TPM hardware configurations](#bkmk-tpmconfigurations)
-- [Non-TPM hardware configurations](#bkmk-nontpm)
-- [Disk configuration considerations](#bkmk-disk)
-- [BitLocker provisioning](#bkmk-prov)
-- [Used Disk Space Only encryption](#bkk-used)
-- [Active Directory Domain Services considerations](#bkmk-addscons)
-- [FIPS support for recovery password protector](#bkmk-fipssupport)
-- [BitLocker Group Policy settings](bitlocker-group-policy-settings.md)
-
-## Audit your environment
+## Audit your environment
To plan your enterprise deployment of BitLocker, you must first understand your current environment. Conduct an informal audit to define your current policies, procedures, and hardware environment. Begin by reviewing your existing corporate security policies as they relate to disk encryption software. If your organization is not currently using disk encryption software, none of these policies will exist. If you are using disk encryption software, then you might need to modify your organization's policies to address the capabilities of BitLocker.
Use the following questions to help you document your organization's current disk encryption security policies:
-1. Are there policies to address which computers will use BitLocker and which computers will not use BitLocker?
-2. What policies exist to control recovery password and recovery key storage?
-3. What are the policies for validating the identity of users that need to perform BitLocker recovery?
-4. What policies exist to control who in the organization has access to recovery data?
-5. What policies exist to control computer decommissioning or retirement?
+1. Are there policies to address which computers will use BitLocker and which computers will not use BitLocker?
+2. What policies exist to control recovery password and recovery key storage?
+3. What are the policies for validating the identity of users that need to perform BitLocker recovery?
+4. What policies exist to control who in the organization has access to recovery data?
+5. What policies exist to control computer decommissioning or retirement?
-## Encryption keys and authentication
+## Encryption keys and authentication
BitLocker helps prevent unauthorized access to data on lost or stolen computers by:
-- Encrypting the entire Windows operating system volume on the hard disk.
-- Verifying the boot process integrity.
+- Encrypting the entire Windows operating system volume on the hard disk.
+- Verifying the boot process integrity.
The trusted platform module (TPM) is a hardware component installed in many newer computers by the computer manufacturers. It works with BitLocker to help protect user data and to ensure that a computer has not been tampered with while the system was offline.
@@ -72,7 +62,7 @@ On computers that do not have a TPM version 1.2 or higher, you can still use Bi
| Startup key | An encryption key that can be stored on most removable media. This key protector can be used alone on non-TPM computers, or in conjunction with a TPM for added security.|
| Recovery password | A 48-digit number used to unlock a volume when it is in recovery mode. Numbers can often be typed on a regular keyboard, if the numbers on the normal keyboard are not responding you can always use the function keys (F1-F10) to input the numbers.|
| Recovery key| An encryption key stored on removable media that can be used for recovering data encrypted on a BitLocker volume.|
-
+
### BitLocker authentication methods
| Authentication method | Requires user interaction | Description |
@@ -82,7 +72,7 @@ On computers that do not have a TPM version 1.2 or higher, you can still use Bi
| TPM + Network key | No | The TPM successfully validates early boot components, and a valid encrypted network key has been provided from the WDS server. This authentication method provides automatic unlock of operating system volumes at system reboot while still maintaining multifactor authentication. |
| TPM + startup key| Yes| The TPM successfully validates early boot components, and a USB flash drive containing the startup key has been inserted.|
| Startup key only | Yes| The user is prompted to insert the USB flash drive that holds the recovery key and/or startup key and reboot the computer.|
-
+
**Will you support computers without TPM version 1.2 or higher?**
Determine whether you will support computers that do not have a TPM version 1.2 or higher in your environment. If you choose to support BitLocker on this type of computer, a user must use a USB startup key to boot the system. This requires additional support processes similar to multifactor authentication.
@@ -101,7 +91,7 @@ If there are areas of your organization where data residing on user computers is
The protection differences provided by multifactor authentication methods cannot be easily quantified. Consider each authentication method's impact on Helpdesk support, user education, user productivity, and automated systems management processes.
-## TPM hardware configurations
+## TPM hardware configurations
In your deployment plan, identify what TPM-based hardware platforms will be supported. Document the hardware models from an OEM of your choice, so that their configurations can be tested and supported. TPM hardware requires special consideration during all aspects of planning and deployment.
@@ -117,24 +107,24 @@ An endorsement key can be created at various points in the TPM’s lifecycle, bu
For more information about the TPM and the TCG, see the Trusted Computing Group: Trusted Platform Module (TPM) Specifications ().
-## Non-TPM hardware configurations
+## Non-TPM hardware configurations
Devices that do not include a TPM can still be protected by drive encryption. Windows To Go workspaces can be BitLocker protected using a startup password and PCs without a TPM can use a startup key.
Use the following questions to identify issues that might affect your deployment in a non-TPM configuration:
-- Are password complexity rules in place?
-- Do you have budget for USB flash drives for each of these computers?
-- Do your existing non-TPM devices support USB devices at boot time?
+- Are password complexity rules in place?
+- Do you have budget for USB flash drives for each of these computers?
+- Do your existing non-TPM devices support USB devices at boot time?
Test your individual hardware platforms with the BitLocker system check option while you are enabling BitLocker. The system check will ensure that BitLocker can read the recovery information from a USB device and encryption keys correctly before it encrypts the volume. CD and DVD drives cannot act as a block storage device and cannot be used to store the BitLocker recovery material.
-## Disk configuration considerations
+## Disk configuration considerations
To function correctly, BitLocker requires a specific disk configuration. BitLocker requires two partitions that meet the following requirements:
-- The operating system partition contains the operating system and its support files; it must be formatted with the NTFS file system
-- The system partition (or boot partition) contains the files that are needed to load Windows after the BIOS or UEFI firware has prepared the system hardware. BitLocker is not enabled on this partition. For BitLocker to work, the system partition must not be encrypted and must be on a different partition than the operating system. On UEFI platforms the system partition must be formatted with the FAT 32 file system. On BIOS platforms the system partition must be formatted with the NTFS file system. It should be at least 350 MB in size
+- The operating system partition contains the operating system and its support files; it must be formatted with the NTFS file system
+- The system partition (or boot partition) contains the files that are needed to load Windows after the BIOS or UEFI firware has prepared the system hardware. BitLocker is not enabled on this partition. For BitLocker to work, the system partition must not be encrypted and must be on a different partition than the operating system. On UEFI platforms the system partition must be formatted with the FAT 32 file system. On BIOS platforms the system partition must be formatted with the NTFS file system. It should be at least 350 MB in size
Windows setup will automatically configure the disk drives of your computer to support BitLocker encryption.
@@ -142,7 +132,7 @@ Windows Recovery Environment (Windows RE) is an extensible recovery platform tha
Windows RE can also be used from boot media other than the local hard disk. If you choose not to install Windows RE on the local hard disk of BitLocker-enabled computers, you can use alternate boot methods, such as Windows Deployment Services, CD-ROM, or USB flash drive, for recovery.
-## BitLocker provisioning
+## BitLocker provisioning
In Windows Vista and Windows 7, BitLocker was provisioned post installation for system and data volumes through either the manage-bde command line interface or the Control Panel user interface. With newer operating systems, BitLocker can be easily provisioned before the operating system is installed. Preprovisioning requires that the computer have a TPM.
@@ -152,7 +142,7 @@ When using the control panel options, administrators can choose to **Turn on Bit
Administrators can enable BitLocker prior to operating system deployment from the Windows Pre-installation Environment (WinPE). This is done with a randomly generated clear key protector applied to the formatted volume and encrypting the volume prior to running the Windows setup process. If the encryption uses the Used Disk Space Only option this step takes only a few seconds and so incorporates well into regular deployment processes.
-## Used Disk Space Only encryption
+## Used Disk Space Only encryption
The BitLocker Setup wizard provides administrators the ability to choose the Used Disk Space Only or Full encryption method when enabling BitLocker for a volume. Administrators can use the new BitLocker Group Policy setting to enforce either Used Disk Space Only or Full disk encryption.
@@ -162,7 +152,7 @@ Used Disk Space Only means that only the portion of the drive that contains data
Full drive encryption means that the entire drive will be encrypted, regardless of whether data is stored on it or not. This is useful for drives that have been repurposed and may contain data remnants from their previous use.
-## Active Directory Domain Services considerations
+## Active Directory Domain Services considerations
BitLocker integrates with Active Directory Domain Services (AD DS) to provide centralized key management. By default, no recovery information is backed up to Active Directory. Administrators can configure the following Group Policy setting for each drive type to enable backup of BitLocker recovery information:
@@ -172,29 +162,30 @@ By default, only Domain Admins have access to BitLocker recovery information, bu
The following recovery data is saved for each computer object:
-- **Recovery password**
+- **Recovery password**
A 48-digit recovery password used to recover a BitLocker-protected volume. Users enter this password to unlock a volume when BitLocker enters recovery mode.
-- **Key package data**
+- **Key package data**
With this key package and the recovery password, you will be able decrypt portions of a BitLocker-protected volume if the disk is severely damaged. Each key package will only work with the volume it was created on, which can be identified by the corresponding volume ID.
-## FIPS support for recovery password protector
+## FIPS support for recovery password protector
Functionality introduced in Windows Server 2012 R2 and Windows 8.1, allows BitLocker to be fully functional in FIPS mode.
->**Note:** The United States Federal Information Processing Standard (FIPS) defines security and interoperability requirements for computer systems that are used by the U.S. federal government. The FIPS 140 standard defines approved cryptographic algorithms. The FIPS 140 standard also sets forth requirements for key generation and for key management. The National Institute of Standards and Technology (NIST) uses the Cryptographic Module Validation Program (CMVP) to determine whether a particular implementation of a cryptographic algorithm is compliant with the FIPS 140 standard. An implementation of a cryptographic algorithm is considered FIPS 140-compliant only if it has been submitted for and has passed NIST validation. An algorithm that has not been submitted cannot be considered FIPS-compliant even if the implementation produces identical data as a validated implementation of the same algorithm.
-
+> [!NOTE]
+> The United States Federal Information Processing Standard (FIPS) defines security and interoperability requirements for computer systems that are used by the U.S. federal government. The FIPS 140 standard defines approved cryptographic algorithms. The FIPS 140 standard also sets forth requirements for key generation and for key management. The National Institute of Standards and Technology (NIST) uses the Cryptographic Module Validation Program (CMVP) to determine whether a particular implementation of a cryptographic algorithm is compliant with the FIPS 140 standard. An implementation of a cryptographic algorithm is considered FIPS 140-compliant only if it has been submitted for and has passed NIST validation. An algorithm that has not been submitted cannot be considered FIPS-compliant even if the implementation produces identical data as a validated implementation of the same algorithm.
+
Prior to these supported versions of Windows, when Windows was in FIPS mode, BitLocker prevented the creation or use of recovery passwords and instead forced the user to use recovery keys. For more information about these issues, see the support article [kb947249](https://support.microsoft.com/kb/947249).
But on computers running these supported systems with BitLocker enabled:
-- FIPS-compliant recovery password protectors can be created when Windows is in FIPS mode. These protectors use the FIPS 140 NIST SP800-132 algorithm.
-- Recovery passwords created in FIPS mode on Windows 8.1 can be distinguished from recovery passwords created on other systems.
-- Recovery unlock using the FIPS-compliant algorithm based recovery password protector work in all cases that currently work for recovery passwords.
-- When FIPS-compliant recovery passwords unlock volumes, the volume is unlocked to allow read/write access even while in FIPS mode.
-- FIPS-compliant recovery password protectors can be exported and stored in AD a while in FIPS mode.
+- FIPS-compliant recovery password protectors can be created when Windows is in FIPS mode. These protectors use the FIPS 140 NIST SP800-132 algorithm.
+- Recovery passwords created in FIPS mode on Windows 8.1 can be distinguished from recovery passwords created on other systems.
+- Recovery unlock using the FIPS-compliant algorithm based recovery password protector work in all cases that currently work for recovery passwords.
+- When FIPS-compliant recovery passwords unlock volumes, the volume is unlocked to allow read/write access even while in FIPS mode.
+- FIPS-compliant recovery password protectors can be exported and stored in AD a while in FIPS mode.
The BitLocker Group Policy settings for recovery passwords work the same for all Windows versions that support BitLocker, whether in FIPs mode or not.
diff --git a/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md b/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md
index c0e83393a2..1473dadc79 100644
--- a/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md
+++ b/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md
@@ -8,7 +8,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dulcemontemayor
+author: dansimp
ms.author: dansimp
manager: dansimp
audience: ITPro
diff --git a/windows/security/information-protection/index.md b/windows/security/information-protection/index.md
index e17bd5c51b..c2050be90b 100644
--- a/windows/security/information-protection/index.md
+++ b/windows/security/information-protection/index.md
@@ -5,7 +5,8 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
-author: justinha
+author: dansimp
+ms.author: dansimp
manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
diff --git a/windows/security/information-protection/tpm/tpm-recommendations.md b/windows/security/information-protection/tpm/tpm-recommendations.md
index bd96309c30..4ab3d8f320 100644
--- a/windows/security/information-protection/tpm/tpm-recommendations.md
+++ b/windows/security/information-protection/tpm/tpm-recommendations.md
@@ -123,7 +123,7 @@ The following table defines which Windows features require TPM support.
TPM Platform Crypto Provider Key Storage Provider| Yes | Yes | Yes
Virtual Smart Card | Yes | Yes | Yes
Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM.
- Autopilot | Yes | No | Yes | TPM 2.0 and UEFI firmware is required.
+ Autopilot | Yes | No | Yes | TPM 2.0 and UEFI firmware is required for white glove and self-deploying scenarios.
SecureBIO | Yes | No | Yes | TPM 2.0 and UEFI firmware is required.
DRTM | Yes | No | Yes | TPM 2.0 and UEFI firmware is required.
diff --git a/windows/security/threat-protection/auditing/event-5156.md b/windows/security/threat-protection/auditing/event-5156.md
index 613f28d976..cdfc758875 100644
--- a/windows/security/threat-protection/auditing/event-5156.md
+++ b/windows/security/threat-protection/auditing/event-5156.md
@@ -102,7 +102,7 @@ This event generates when [Windows Filtering Platform](https://msdn.microsoft.co
- Outbound – for unbound connections.
-- **Source Address** \[Type = UnicodeString\]**:** local IP address on which application received the connection.
+- **Source Address** \[Type = UnicodeString\]**:** IP address from which the connection was initiated.
- IPv4 Address
@@ -114,9 +114,9 @@ This event generates when [Windows Filtering Platform](https://msdn.microsoft.co
- 127.0.0.1 , ::1 - localhost
-- **Source Port** \[Type = UnicodeString\]**:** port number on which application received the connection.
+- **Source Port** \[Type = UnicodeString\]**:** port number from which the connection was initiated.
-- **Destination Address** \[Type = UnicodeString\]**:** IP address ***from*** which connection was received or initiated.
+- **Destination Address** \[Type = UnicodeString\]**:** IP address where the connection was received.
- IPv4 Address
@@ -128,7 +128,7 @@ This event generates when [Windows Filtering Platform](https://msdn.microsoft.co
- 127.0.0.1 , ::1 - localhost
-- **Destination Port** \[Type = UnicodeString\]**:** port number which was used from remote machine to initiate connection.
+- **Destination Port** \[Type = UnicodeString\]**:** port number where the connection was received.
- **Protocol** \[Type = UInt32\]: number of protocol which was used.
@@ -184,7 +184,7 @@ For 5156(S): The Windows Filtering Platform has permitted a connection.
- If you need to monitor all inbound connections to a specific local port, monitor for [5156](event-5156.md) events with that “**Source Port**.**”**
-- Monitor for all connections with a “**Protocol Number”** that is not typical for this device or compter, for example, anything other than 1, 6, or 17.
+- Monitor for all connections with a “**Protocol Number”** that is not typical for this device or computer, for example, anything other than 1, 6, or 17.
- If the computer’s communication with “**Destination Address”** should always use a specific “**Destination Port**,**”** monitor for any other “**Destination Port**.”
diff --git a/windows/security/threat-protection/intelligence/virus-initiative-criteria.md b/windows/security/threat-protection/intelligence/virus-initiative-criteria.md
index adfe6b2035..1723f5ee27 100644
--- a/windows/security/threat-protection/intelligence/virus-initiative-criteria.md
+++ b/windows/security/threat-protection/intelligence/virus-initiative-criteria.md
@@ -19,18 +19,11 @@ ms.topic: article
The Microsoft Virus Initiative (MVI) helps organizations to get their products working and integrated with Windows.
-MVI members will receive access to Windows APIs (such as those used by Windows Defender Antivirus), and other technologies including IOAV, AMSI and Cloud Files, malware telemetry and samples, and invitations to security related events and conferences.
+MVI members receive access to Windows APIs and other technologies including IOAV, AMSI and Cloud files. Members also get malware telemetry and samples and invitations to security related events and conferences.
-MVI requires members to develop and own antimalware technology and to be present in the antimalware industry community.
+## Become a member
-## Join MVI
-
-A request for membership is made by an individual as a representative of an organization that develops and produces antimalware or antivirus technology.
-
-
-### Initial selection criteria
-
-Your organization must meet the following eligibility requirements to qualify for the MVI program:
+A request for membership is made by an individual as a representative of an organization that develops and produces antimalware or antivirus technology. Your organization must meet the following eligibility requirements to qualify for the MVI program:
1. Offer an antimalware or antivirus product that is one of the following:
@@ -39,10 +32,9 @@ Your organization must meet the following eligibility requirements to qualify fo
2. Have your own malware research team unless you build a product based on an SDK.
-3. Be active and have a positive reputation in the antimalware industry. Your organization is:
+3. Be active and have a positive reputation in the antimalware industry.
- * Certified through independent testing by an industry standard organization such as [ICSA Labs](https://www.icsalabs.com/), [West Coast Labs](http://www.westcoastlabs.com/), [PCSL IT Consulting Institute](https://www.pitci.net/), or [SKD Labs](http://www.skdlabs.com/html/english/).
- * Be active in the antimalware industry. For example, participate in industry conferences, be reviewed in an industry standard report such as AV Comparatives, OPSWAT or Gartner.
+ * Activity can include participation in industry conferences or being reviewed in an industry standard report such as AV Comparatives, OPSWAT or Gartner.
4. Be willing to sign a non-disclosure agreement (NDA) with Microsoft.
@@ -52,6 +44,19 @@ Your organization must meet the following eligibility requirements to qualify fo
7. Submit your app to Microsoft for periodic performance testing.
-### Apply now
+8. Certified through independent testing by at least one industry standard organization.
+
+Test Provider | Lab Test Type | Minimum Level / Score
+------------- |---------------|----------------------
+AV-Comparatives | Real-World Protection Test https://www.av-comparatives.org/testmethod/real-world-protection-tests/ |“Approved” rating from AV Comparatives
+AV-Test | Must pass tests for Windows. Certifications for Mac and Linux are not accepted https://www.av-test.org/en/about-the-institute/certification/ | Achieve "AV-TEST Certified" (for home users) or "AV-TEST Approved” (for corporate users)
+ICSA Labs | Endpoint Anti-Malware Detection https://www.icsalabs.com/technology-program/anti-virus/criteria |PASS/Certified
+NSS Labs | Advanced Endpoint Protection AEP 3.0, which covers automatic threat prevention and threat event reporting capabilities https://www.nsslabs.com/tested-technologies/advanced-endpoint-protection/ |“Neutral” rating from NSS
+SKD Labs | Certification Requirements Product: Anti-virus or Antimalware http://www.skdlabs.com/html/english/ http://www.skdlabs.com/cert/ |SKD Labs Star Check Certification Requirements Pass >= 98.5 % with On Demand, On Access and Total Detection tests
+SE Labs | Protection A rating or Small Business EP A rating or Enterprise EP Protection A rating https://selabs.uk/en/reports/consumers |Home or Enterprise “A” rating
+VB 100 | VB100 Certification Test V1.1 https://www.virusbulletin.com/testing/vb100/vb100-methodology/vb100-methodology-ver1-1/ | VB100 Certification
+West Coast Labs | Checkmark Certified http://www.checkmarkcertified.com/sme/ | “A” Rating on Product Security Performance
+
+## Apply now
If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry).
diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md
index 10961a9499..bb1e594c49 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md
@@ -26,7 +26,7 @@ ms.date: 10/08/2019
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-bestpractices-abovefoldlink)
## Optimize query performance
-Apply the recommendations to get results faster and avoid timeouts while running complex queries:
+Apply these recommendations to get results faster and avoid timeouts while running complex queries.
- When trying new queries, always use `limit` to avoid extremely large result sets. You can also initially assess the size of the result set using `count`.
- Use time filters first. Ideally, limit your queries to seven days.
- Put filters that are expected to remove most of the data in the beginning of the query, right after the time filter.
@@ -63,7 +63,7 @@ To create more durable queries using command lines, apply the following practice
- Identify the known processes (such as *net.exe* or *psexec.exe*) by matching on the filename fields, instead of filtering on the command-line field.
- When querying for command-line arguments, don't look for an exact match on multiple unrelated arguments in a certain order. Instead, use regular expressions or use multiple separate contains operators.
-- Use case insensitive matches. For example, use `=~`, `in~`, `contains` instead of `==`, `in` or `contains_cs`
+- Use case insensitive matches. For example, use `=~`, `in~`, and `contains` instead of `==`, `in` and `contains_cs`
- To mitigate DOS command-line obfuscation techniques, consider removing quotes, replacing commas with spaces, and replacing multiple consecutive spaces with a single space. Note that there are more complex DOS obfuscation techniques that require other approaches, but these can help address the most common ones.
The following examples show various ways to construct a query that looks for the file *net.exe* to stop the Windows Defender Firewall service:
diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md
index 89e50cf072..d342f2228f 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md
@@ -131,13 +131,13 @@ The **Get started** section provides a few simple queries using commonly used op
>[!NOTE]
>Apart from the basic query samples, you can also access [shared queries](advanced-hunting-shared-queries.md) for specific threat hunting scenarios. Explore the shared queries on the left side of the page or the GitHub query repository.
-## Access query language documentation
+## Access comprehensive query language reference
-For more information on Kusto query language and supported operators, see [Query Language](https://docs.microsoft.com/azure/kusto/query/).
-
->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-belowfoldlink)
+For detailed information about the query language, see [Kusto query language documentation](https://docs.microsoft.com/azure/kusto/query/).
## Related topics
- [Advanced hunting overview](advanced-hunting-overview.md)
- [Understand the schema](advanced-hunting-schema-reference.md)
-- [Apply query best practices](advanced-hunting-best-practices.md)
\ No newline at end of file
+- [Apply query best practices](advanced-hunting-best-practices.md)
+
+>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-belowfoldlink)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md
index 8841cd7785..e269b25de8 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md
@@ -25,10 +25,10 @@ ms.date: 10/08/2019
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
-## Schema tables
-
The [Advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about machines and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the Advanced hunting schema.
+## Schema tables
+
The following reference lists all the tables in the Advanced hunting schema. Each table name links to a page describing the column names for that table.
Table and column names are also listed within the Microsoft Defender Security Center, in the schema representation on the Advanced hunting screen.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md b/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md
index 010fb7a43b..7558960aa6 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md
@@ -22,8 +22,6 @@ ms.topic: conceptual
**Applies to:**
- [Microsoft Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-[!include[Prerelease information](prerelease.md)]
-
The Microsoft Defender ATP API Explorer is a tool that helps you explore various Microsoft Defender ATP APIs interactively.
The API Explorer makes it easy to construct and perform API queries, test and send requests for any available Microsoft Defender ATP API endpoint. You can also use the API Explorer to perform actions or find data that might not yet be available through the user interface.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md
index 584f376ee3..01c3049bde 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md
@@ -23,8 +23,6 @@ ms.topic: article
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-[!include[Prerelease information](prerelease.md)]
-
## Before you begin
Ensure that you have Microsoft Defender ATP deployed in your environment with machines enrolled, and not just on a laboratory set-up.
@@ -63,9 +61,6 @@ You'll start receiving targeted attack notification from Microsoft Threat Expert
## Consult a Microsoft threat expert about suspicious cybersecurity activities in your organization
->[!NOTE]
->The Microsoft Threat Experts' experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved.
-
You can partner with Microsoft Threat Experts who can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised machine, or a threat intelligence context that you see on your portal dashboard.
>[!NOTE]
@@ -77,10 +72,12 @@ You can partner with Microsoft Threat Experts who can be engaged directly from w
>
->A flyout screen opens.
-
+>A flyout screen opens. The following screen shows when you are on a trial subscription.
>
+> The following screen shows when you are on a full Microsoft Threat Experts - Experts on Demand subscription.
+>
+
>The **Inquiry topic** field is pre-populated with the link to the relevant page for your investigation request. For example, a link to the incident, alert, or machine details page that you were at when you made the request.
3. In the next field, provide enough information to give the Microsoft Threat Experts enough context to start the investigation.
@@ -120,7 +117,7 @@ Response from Microsoft Threat Experts varies according to your inquiry. They wi
- Investigation requires more time
- Initial information was enough to conclude the investigation
-It is crucial to respond in a timely manner to keep the investigation moving. See the Premier customer service and support service level agreement for details.
+It is crucial to respond in a timely manner to keep the investigation moving.
## Related topic
- [Microsoft Threat Experts overview](microsoft-threat-experts.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md
index 5830eaa9af..8c0c0aa43c 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md
@@ -109,10 +109,10 @@ If a proxy or firewall is blocking all traffic by default and allowing only spec
Service location | Microsoft.com DNS record
-|-
-Common URLs for all locations | ```*.blob.core.windows.net``` ```crl.microsoft.com``` ```ctldl.windowsupdate.com``` ```events.data.microsoft.com``` ```notify.windows.com``` ```settings-win.data.microsoft.com ```
-European Union | ```eu.vortex-win.data.microsoft.com``` ```eu-v20.events.data.microsoft.com``` ```winatp-gw-neu.microsoft.com``` ```winatp-gw-weu.microsoft.com```
-United Kingdom | ```uk.vortex-win.data.microsoft.com``` ```uk-v20.events.data.microsoft.com``` ```winatp-gw-uks.microsoft.com``` ```winatp-gw-ukw.microsoft.com```
-United States | ```us.vortex-win.data.microsoft.com``` ```us-v20.events.data.microsoft.com``` ```winatp-gw-cus.microsoft.com``` ```winatp-gw-eus.microsoft.com```
+Common URLs for all locations | ```crl.microsoft.com``` ```ctldl.windowsupdate.com``` ```events.data.microsoft.com``` ```notify.windows.com``` ```settings-win.data.microsoft.com```
+European Union | ```eu.vortex-win.data.microsoft.com``` ```eu-v20.events.data.microsoft.com``` ```usseu1northprod.blob.core.windows.net``` ```usseu1westprod.blob.core.windows.net``` ```winatp-gw-neu.microsoft.com``` ```winatp-gw-weu.microsoft.com``` ```wseu1northprod.blob.core.windows.net``` ```wseu1westprod.blob.core.windows.net```
+United Kingdom | ```uk.vortex-win.data.microsoft.com``` ```uk-v20.events.data.microsoft.com``` ```ussuk1southprod. blob.core.windows.net``` ```ussuk1westprod. blob.core.windows.net``` ```winatp-gw-uks.microsoft.com``` ```winatp-gw-ukw.microsoft.com``` ```wsuk1southprod. blob.core.windows.net``` ```wsuk1westprod. blob.core.windows.net```
+United States | ```us.vortex-win.data.microsoft.com``` ```ussus1eastprod.blob.core.windows.net``` ```ussus1westprod.blob.core.windows.net``` ```ussus2eastprod.blob.core.windows.net``` ```ussus2westprod.blob.core.windows.net``` ```ussus3eastprod.blob.core.windows.net``` ```ussus3westprod.blob.core.windows.net``` ```ussus4eastprod.blob.core.windows.net``` ```ussus4westprod.blob.core.windows.net``` ```us-v20.events.data.microsoft.com``` ```winatp-gw-cus.microsoft.com``` ```winatp-gw-eus.microsoft.com``` ```wsus1eastprod.blob.core.windows.net``` ```wsus1westprod.blob.core.windows.net``` ```wsus2eastprod.blob.core.windows.net``` ```wsus2westprod.blob.core.windows.net```
If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the previously listed URLs.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md b/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md
index 97adf97d65..20a35409f5 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md
@@ -22,7 +22,6 @@ ms.topic: conceptual
**Applies to:**
- [Microsoft Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-[!include[Prerelease information](prerelease.md)]
Connected applications integrates with the Microsoft Defender ATP platform using APIs.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md
index 97a6409ed0..7f23be0e27 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md
@@ -83,8 +83,8 @@ You can use the following procedure to enable network protection on domain-joine
You can confirm network protection is enabled on a local computer by using Registry editor:
1. Click **Start** and type **regedit** to open **Registry Editor**.
-1. Navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection
-1. Click **EnableNetworkProtection** and confirm the value:
+2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection
+3. Click **EnableNetworkProtection** and confirm the value:
* 0=Off
* 1=On
* 2=Audit
diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-secure-score.md b/windows/security/threat-protection/microsoft-defender-atp/enable-secure-score.md
index 7d87930ea5..8829cf492a 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/enable-secure-score.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/enable-secure-score.md
@@ -15,7 +15,6 @@ manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
ms.topic: article
-ms.date: 04/24/2018
---
# Enable Secure Score security controls
@@ -27,7 +26,7 @@ ms.date: 04/24/2018
-Set the baselines for calculating the score of Windows Defender security controls on the Secure Score dashboard. If you use third-party solutions, consider excluding the corresponding controls from the calculations.
+Set the baselines for calculating the score of security controls on the Secure Score dashboard. If you use third-party solutions, consider excluding the corresponding controls from the calculations.
>[!NOTE]
>Changes might take up to a few hours to reflect on the dashboard.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md
index 4d70c50373..d0ad0448da 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md
@@ -1,7 +1,7 @@
---
title: See how exploit protection works in a demo
description: See how exploit protection can prevent suspicious behaviors from occurring on specific apps.
-keywords: Exploit protection, exploits, kernel, events, evaluate, demo, try, mitigiation
+keywords: Exploit protection, exploits, kernel, events, evaluate, demo, try, mitigation
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
ms.prod: w10
@@ -10,9 +10,9 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
audience: ITPro
-author: levinec
-ms.author: ellevin
-ms.date: 04/02/2019
+author: denisebmsft
+ms.author: deniseb
+ms.date: 10/21/2019
ms.reviewer:
manager: dansimp
---
@@ -23,21 +23,16 @@ manager: dansimp
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-[Exploit protection](exploit-protection.md) helps protect devices from malware that uses exploits to spread and infect other devices.
-It consists of a number of mitigations that can be applied to either the operating system or an individual app.
-Many of the features that were part of the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/security/jj653751) are included in exploit protection.
+[Exploit protection](exploit-protection.md) helps protect devices from malware that uses exploits to spread and infect other devices. Mitigation can be applied to either the operating system or to an individual app. Many of the features that were part of the [Enhanced Mitigation Experience Toolkit (EMET)](emet-exploit-protection.md) are included in exploit protection.
-This topic helps you enable exploit protection in audit mode and review related events in Event Viewer.
-You can enable audit mode for certain app-level mitigations to see how they will work in a test environment.
-This lets you see a record of what *would* have happened if you had enabled the mitigation in production.
-You can make sure it doesn't affect your line-of-business apps, and see which suspicious or malicious events occur.
+This article helps you enable exploit protection in audit mode and review related events in Event Viewer. You can enable audit mode to see how mitigation works for certain apps in a test environment. By auditing exploit protection, you can see what *would* have happened if you had enabled exploit protection in your production environment. This way, you can help ensure exploit protection doesn't adversely affect your line-of-business apps, and you can see which suspicious or malicious events occur.
> [!TIP]
> You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to see how exploit protection works.
## Enable exploit protection in audit mode
-You can set mitigations in audit mode for specific programs either by using the Windows Security app or PowerShell.
+You can set mitigation in audit mode for specific programs either by using the Windows Security app or Windows PowerShell.
### Windows Security app
@@ -45,12 +40,12 @@ You can set mitigations in audit mode for specific programs either by using the
2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**.
-3. Go to **Program settings** and choose the app you want to apply mitigations to:
+3. Go to **Program settings** and choose the app you want to apply protection to:
1. If the app you want to configure is already listed, click it and then click **Edit**
- 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app:
- * Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
- * Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
+ 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app.
+ - Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
+ - Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows.
@@ -76,14 +71,14 @@ Where:
* \:
* The mitigation's cmdlet as defined in the following table. Each mitigation is separated with a comma.
- Mitigation | Audit mode cmdlet
--|-
- Arbitrary code guard (ACG) | AuditDynamicCode
- Block low integrity images | AuditImageLoad
- Block untrusted fonts | AuditFont, FontAuditOnly
- Code integrity guard | AuditMicrosoftSigned, AuditStoreSigned
- Disable Win32k system calls | AuditSystemCall
- Do not allow child processes | AuditChildProcess
+ |Mitigation | Audit mode cmdlet |
+|---|---|
+ |Arbitrary code guard (ACG) | AuditDynamicCode |
+ |Block low integrity images | AuditImageLoad
+ |Block untrusted fonts | AuditFont, FontAuditOnly |
+ |Code integrity guard | AuditMicrosoftSigned, AuditStoreSigned |
+ |Disable Win32k system calls | AuditSystemCall |
+ |Do not allow child processes | AuditChildProcess |
For example, to enable Arbitrary Code Guard (ACG) in audit mode for an app named *testing.exe*, run the following command:
@@ -97,14 +92,14 @@ You can disable audit mode by replacing `-Enable` with `-Disable`.
To review which apps would have been blocked, open Event Viewer and filter for the following events in the Security-Mitigations log.
-Feature | Provider/source | Event ID | Description
--|-|-|-
- Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 1 | ACG audit
- Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 3 | Do not allow child processes audit
- Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 5 | Block low integrity images audit
- Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 7 | Block remote images audit
- Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 9 | Disable win32k system calls audit
- Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 11 | Code integrity guard audit
+|Feature | Provider/source | Event ID | Description |
+|---|---|--|---|
+ |Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 1 | ACG audit |
+ |Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 3 | Do not allow child processes audit |
+ |Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 5 | Block low integrity images audit |
+ |Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 7 | Block remote images audit |
+ |Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 9 | Disable win32k system calls audit |
+ |Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 11 | Code integrity guard audit |
## Related topics
diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md
index b657e78ae2..c7ae3aac79 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md
@@ -1,7 +1,7 @@
---
title: Microsoft Defender ATP evaluation lab
description: Learn about Microsoft Defender ATP capabilities, run attack simulations, and see how it prevents, detects, and remediates threats.
-keywords:
+keywords: evaluate mdatp, evaluation, lab, simulation, windows 10, windows server 2019, evaluation lab
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
@@ -26,12 +26,18 @@ Conducting a comprehensive security product evaluation can be a complex process
The Microsoft Defender ATP evaluation lab is designed to eliminate the complexities of machine and environment configuration so that you can
focus on evaluating the capabilities of the platform, running simulations, and seeing the prevention, detection, and remediation features in action.
-When you get started with the lab, you'll be guided through a simple set-up process where your tenant will be provisioned with test machines. These test machines will come pre-configured to have the latest and greatest Windows 10 version with the right security components in place and Office 2019 Standard installed.
+When you get started with the lab, you'll be guided through a simple set-up process where you can specify the type of configuration that best suits your needs.
+
+After the lab setup process is complete, you can add Windows 10 or Windows Server 2019 machines. These test machines come pre-configured to have the latest and greatest OS versions with the right security components in place and Office 2019 Standard installed.
With the simplified set-up experience, you can focus on running your own test scenarios and the pre-made simulations to see how Microsoft Defender ATP performs.
You'll have full access to all the powerful capabilities of the platform such as automated investigations, advanced hunting, and threat analytics, allowing you to test the comprehensive protection stack that Microsoft Defender ATP offers.
+## Before you begin
+You'll need to fulfill the [licensing requirements](minimum-requirements.md#licensing-requirements) or have trial access to Microsoft Defender ATP to access the evaluation lab.
+
+Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-main-abovefoldlink)
## Get started with the lab
You can access the lab from the menu. In the navigation menu, select **Evaluation and tutorials > Evaluation lab**.
@@ -43,15 +49,28 @@ When you access the evaluation lab for the first time, you'll find an introducti
It's a good idea to read the guide before starting the evaluation process so that you can conduct a thorough assessment of the platform.
>[!NOTE]
->- Each environment is provisioned with only three test machines.
->- Each machine will be available for only three days from the day of activation.
->- When you've used up these three machines, no new machines are provided.
-Deleting a machine does not refresh the available test machine count.
+>- Each environment is provisioned with a limited set of test machines.
+>- Depending the type of environment structure you select, machines will be available for the specified number of hours from the day of activation.
+>- When you've used up the provisioned machines, no new machines are provided. A deleted machine does not refresh the available test machine count.
>- Given the limited resources, it’s advisable to use the machines carefully.
-## Evaluation setup
-When you add a machine to your environment, Microsoft Defender ATP sets up a well-configured machine with connection details. The machine will be configured with the most up to date version of Windows 10 and Office 2019 Standard as well as other apps such as Java, Python, and SysIntenals.
+## Setup the evaluation lab
+
+1. In the navigation pane, select **Evaluation and tutorials > Evaluation lab**, then select **Setup lab**.
+
+ 
+
+2. Depending on your evaluation needs, you can choose to setup an environment with fewer machines for a longer period or more machines for a shorter period. Select your preferred lab configuration then select **Create lab**.
+
+ 
+
+When the environment completes the setup process, you're ready to add machines.
+
+## Add machines
+When you add a machine to your environment, Microsoft Defender ATP sets up a well-configured machine with connection details. You can add Windows 10 or Windows Server 2019 machines.
+
+The machine will be configured with the most up-to-date version of the OS and Office 2019 Standard as well as other apps such as Java, Python, and SysIntenals.
The machine will automatically be onboarded to your tenant with the recommended Windows security components turned on and in audit mode - with no effort on your side.
@@ -74,33 +93,27 @@ Automated investigation settings will be dependent on tenant settings. It will b
>[!NOTE]
>The connection to the test machines is done using RDP. Make sure that your firewall settings allow RDP connections.
+1. From the dashboard, select **Add machine**.
-1. In the navigation pane, select **Evaluation and tutorials > Evaluation lab**.
+ 
-2. Select **Prepare lab**.
- 
+2. Choose the type of machine to add. You can choose to add Windows 10 or Windows Server 2019.
-3. Select **Add machine**.
+ 
- >[!WARNING]
- >- Each environment is provisioned with only three test machines.
- >- Each machine will be available for only three days from the day of activation.
- >- When you've used up these three machines, no new machines are provided.
- Deleting a machine does not refresh the available test machine count.
- >- Given the limited resources, it’s advisable to use the machines carefully.
-
- 
>[!NOTE]
>If something goes wrong with the machine creation process, you'll be notified and you'll need to submit a new request. If the machine creation fails, it will not be counted against the overall allowed quota.
-4. The connection details are displayed. Select **Copy** to save the password for the machine.
+3. The connection details are displayed. Select **Copy** to save the password for the machine.
>[!NOTE]
>The password is only displayed once. Be sure to save it for later use.
-5. Machine set up begins. This can take up to approximately 30 minutes.
+ 
+
+4. Machine set up begins. This can take up to approximately 30 minutes.
The environment will reflect your test machine status through the evaluation - including risk score, exposure score, and alerts created through the simulation.
@@ -165,5 +178,5 @@ Your feedback helps us get better in protecting your environment from advanced a
Let us know what you think, by selecting **Provide feedback**.
-
+
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/add-machine-eval-lab.png b/windows/security/threat-protection/microsoft-defender-atp/images/add-machine-eval-lab.png
new file mode 100644
index 0000000000..2b5b014a6b
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/add-machine-eval-lab.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/add-machine-evaluation-lab.png b/windows/security/threat-protection/microsoft-defender-atp/images/add-machine-evaluation-lab.png
new file mode 100644
index 0000000000..2187629052
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/add-machine-evaluation-lab.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/add-machine-options.png b/windows/security/threat-protection/microsoft-defender-atp/images/add-machine-options.png
new file mode 100644
index 0000000000..1e9dc0b534
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/add-machine-options.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/evaluation-lab-setup.png b/windows/security/threat-protection/microsoft-defender-atp/images/evaluation-lab-setup.png
new file mode 100644
index 0000000000..fda12c1b95
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/evaluation-lab-setup.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/lab-creation-page.png b/windows/security/threat-protection/microsoft-defender-atp/images/lab-creation-page.png
new file mode 100644
index 0000000000..5f76ba9386
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/lab-creation-page.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/lab-setup-page.png b/windows/security/threat-protection/microsoft-defender-atp/images/lab-setup-page.png
new file mode 100644
index 0000000000..b67a8198a8
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/lab-setup-page.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/machine-added-evaluation-lab.png b/windows/security/threat-protection/microsoft-defender-atp/images/machine-added-evaluation-lab.png
new file mode 100644
index 0000000000..81d97b7fed
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/machine-added-evaluation-lab.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-fullsubscription.png b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-fullsubscription.png
new file mode 100644
index 0000000000..aecffb5789
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-fullsubscription.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/send-us-feedback-eval-lab.png b/windows/security/threat-protection/microsoft-defender-atp/images/send-us-feedback-eval-lab.png
new file mode 100644
index 0000000000..8b37ac8a3a
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/send-us-feedback-eval-lab.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md b/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md
index 08ab2a0d71..3d3a959ecb 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md
@@ -49,6 +49,9 @@ To add machine tags using API, see [Add or remove machine tags API](add-or-remov
Tags are added to the machine view and will also be reflected on the **Machines list** view. You can then use the **Tags** filter to see the relevant list of machines.
+>[!NOTE]
+> Filtering might not work on tag names that contain parenthesis.
+
You can also delete tags from this view.

diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md b/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md
index 56e0d4eeb2..249d6de806 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md
@@ -15,7 +15,7 @@ manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
ms.topic: article
-ms.date: 010/08/2018
+ms.date: 10/08/2018
---
# Manage Microsoft Defender ATP incidents
diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md
index 71b44a53e7..e17508a0f9 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md
@@ -22,8 +22,6 @@ ms.topic: conceptual
**Applies to:**
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-[!include[Prerelease information](prerelease.md)]
-
Microsoft Threat Experts is a managed detection and response (MDR) service that provides Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in their unique environments don’t get missed.
This new capability provides expert-driven insights and data through targeted attack notification and access to experts on demand.
@@ -36,9 +34,6 @@ Microsoft Threat Experts provides proactive hunting for the most important threa
- Scope of compromise and as much context as can be quickly delivered to enable fast SOC response.
## Collaborate with experts, on demand
->[!NOTE]
->The Microsoft Threat Experts' experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved.
-
Customers can engage our security experts directly from within Microsoft Defender Security Center for timely and accurate response. Experts provide insights needed to better understand the complex threats affecting your organization, from alert inquiries, potentially compromised machines, root cause of a suspicious network connection, to additional threat intelligence regarding ongoing advanced persistent threat campaigns. With this capability, you can:
- Get additional clarification on alerts including root cause or scope of the incident
diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md
index 692f8cc37b..ce93c62494 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/preview.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md
@@ -42,12 +42,6 @@ Turn on the preview experience setting to be among the first to try upcoming fea
## Preview features
The following features are included in the preview release:
-- [Connected Azure AD applications](connected-applications.md) The Connected applications page provides information about the Azure AD applications connected to Microsoft Defender ATP in your organization.
-
-- [API Explorer](api-explorer.md) The API explorer makes it easy to construct and perform API queries, test and send requests for any available Microsoft Defender ATP API endpoint.
-
-- [Microsoft Threat Experts - Experts on Demand](microsoft-threat-experts.md) You now have the option to consult with Microsoft Threat Experts from several places in the portal to help you in the context of your investigation.
-
- [Indicators for IP addresses, URLs/Domains](manage-indicators.md) You can now allow or block URLs/domains using your own threat intelligence.
- [Microsoft Defender ATP for Mac](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac) Microsoft Defender ATP for Mac brings the next-generation protection, and endpoint detection and response coverage to Mac devices. Core components of the unified endpoint security platform will now be available for Mac devices.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md b/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md
index 3395bce7c7..e52e94be42 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md
@@ -178,10 +178,11 @@ Here is an example return value:
The following code example demonstrates how to obtain an access token and call the Microsoft Defender ATP API.
```csharp
-AuthenticationContext context = new AuthenticationContext(string.Format("https://login.windows.net/{0}/oauth2", tenantId));
+AuthenticationContext context = new AuthenticationContext(string.Format("https://login.windows.net/{0}", tenantId));
ClientCredential clientCredentials = new ClientCredential(clientId, clientSecret);
-AuthenticationResult authenticationResult = context.AcquireToken(resource, clientCredentials);
+AuthenticationResult authenticationResult = context.AcquireTokenAsync(detectionsResource, clientCredentials).GetAwaiter().GetResult();
```
+
### Use token to connect to the detections endpoint
```
diff --git a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md
index 3d9ca8313a..3b08db0a4f 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md
@@ -28,7 +28,8 @@ Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://w
## Before you begin:
1. Create a [Storage account](https://docs.microsoft.com/azure/storage/common/storage-account-overview) in your tenant.
-2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to **Microsoft.insights****.
+2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to Microsoft.insights**.
+3. Go to **Settings > Advanced Features > Preview features** and turn Preview features **On**.
## Enable raw data streaming:
diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md
index bf3d381bd3..53233130eb 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md
@@ -72,7 +72,7 @@ Event ID | Error Type | Resolution steps
5 | Offboarding data was found but couldn't be deleted | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.
10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat```. Verify that the script was ran as an administrator.
15 | Failed to start SENSE service |Check the service health (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights). If the machine is running Windows 10, version 1607 and running the command `sc query sense` returns `START_PENDING`, reboot the machine. If rebooting the machine doesn't address the issue, upgrade to KB4015217 and try onboarding again.
-15 | Failed to start SENSE service | If the message of the error is: System error 577 has occurred. You need to enable the Windows Defender Antivirus ELAM driver, see [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy) for instructions.
+15 | Failed to start SENSE service | If the message of the error is: System error 577 or error 1058 has occurred. You need to enable the Windows Defender Antivirus ELAM driver, see [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy) for instructions.
30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md).
35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location ```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```. The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md).
40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md).
@@ -180,7 +180,7 @@ There are additional components on the machine that the Microsoft Defender ATP a
### Ensure the diagnostic data service is enabled
-If the machines aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the machine. The service might have been disabled by other programs or user configuration changes.
+If the machines aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the machine. The service might have been disabled by other programs or user configuration changes.
First, you should check that the service is set to start automatically when Windows starts, then you should check that the service is currently running (and start it if it isn't).
@@ -248,7 +248,7 @@ If the verification fails and your environment is using a proxy to connect to th
### Ensure that Windows Defender Antivirus is not disabled by a policy
**Problem**: The Microsoft Defender ATP service does not start after onboarding.
-**Symptom**: Onboarding successfully completes, but you see error 577 when trying to start the service.
+**Symptom**: Onboarding successfully completes, but you see error 577 or error 1058 when trying to start the service.
**Solution**: If your machines are running a third-party antimalware client, the Microsoft Defender ATP agent needs the Windows Defender Early Launch Antimalware (ELAM) driver to be enabled. You must ensure that it's not disabled in system policy.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md
index be3d95c1f3..158ff257d6 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md
@@ -28,6 +28,15 @@ The following features are generally available (GA) in the latest release of Mic
For more information preview features, see [Preview features](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection).
+## October 2019
+
+- [Microsoft Threat Experts - Experts on Demand](microsoft-threat-experts.md) You now have the option to consult with Microsoft Threat Experts from several places in the portal to help you in the context of your investigation.
+
+- [Connected Azure AD applications](connected-applications.md) The Connected applications page provides information about the Azure AD applications connected to Microsoft Defender ATP in your organization.
+
+- [API Explorer](api-explorer.md) The API explorer makes it easy to construct and perform API queries, test and send requests for any available Microsoft Defender ATP API endpoint.
+
+
## September 2019
- [Tamper Protection settings using Intune](../windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md#turn-tamper-protection-on-or-off-for-your-organization-using-intune) You can now turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management portal (Intune).
diff --git a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md
index 56c8938d8f..5f46ca3685 100644
--- a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md
+++ b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md
@@ -37,6 +37,9 @@ This means that if you have a mix of computers, such as member servers that run
This topic also covers related events, and how to enable audit mode before constraining the security principals that are allowed to remotely enumerate users and groups so that your environment remains secure without impacting application compatibility.
+> [!NOTE]
+> Implementation of this policy [could affect offline address book generation](https://support.microsoft.com/help/4055652/access-checks-fail-because-of-authz-access-denied-error-in-windows-ser) on servers running Microsoft Exchange 2016 or Microsoft Exchange 2013.
+
## Reference
The SAMRPC protocol makes it possible for a low privileged user to query a machine on a network for data.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md
index 31bb4fd4b9..499df8dfac 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md
@@ -80,7 +80,7 @@ You can disable this setting to ensure that only globally-defined lists (such as
3. Expand the tree to **Windows components > Windows Defender Antivirus**.
-4. Double-click **Configure local administrator merge behavior for lists** and set the option to **Enabled**. Click **OK**.
+4. Double-click **Configure local administrator merge behavior for lists** and set the option to **Disabled**. Click **OK**.
> [!NOTE]
> If you disable local list merging, it will override controlled folder access settings. It also overrides any protected folders or allowed apps set by the local administrator. For more information about controlled folder access settings, see [Enable controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard).
diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md
index 10cc42c9f3..f76c49cd91 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md
@@ -9,83 +9,83 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.author: dansimp
-ms.date: 09/03/2018
+author: denisebmsft
+ms.author: deniseb
+ms.date: 10/18/2019
ms.reviewer:
manager: dansimp
+ms.custom: nextgen
---
# Manage the sources for Windows Defender Antivirus protection updates
**Applies to:**
-- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
+- [Microsoft Defender Advanced Threat Protection](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-There are two components to managing protection updates - where the updates are downloaded from, and when updates are downloaded and applied.
+Keeping your antivirus protection up to date is critical. There are two components to managing protection updates for Windows Defender Antivirus:
+- *Where* the updates are downloaded from; and
+- *When* updates are downloaded and applied.
-This topic describes where you can specify the updates should be downloaded from, also known as the fallback order.
+This article describes the *where* - how to specify where updates should be downloaded from (this is also known as the fallback order). See [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) topic for an overview on how updates work, and how to configure other aspects of updates (such as scheduling updates).
+
+> [!IMPORTANT]
+> Microsoft Defender Antivirus Security intelligence updates are delivered through Windows Update and starting Monday, October 21, 2019, all security intelligence updates will be SHA-2 signed exclusively. Your devices must be updated to support SHA-2 in order to update your security intelligence. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus).
-See [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) topic for an overview on how updates work, and how to configure other aspects of updates (such as scheduling updates).
-There are five locations where you can specify where an endpoint should obtain updates. Typically, you would configure endpoints to individually download the updates from a primary source, followed by the other sources in order of priority based on your network configuration.
+## Fallback order
-Updates will be obtained from the sources in the order you specify. If a source is not available, the next source in the list will be used.
+Typically, you configure endpoints to individually download updates from a primary source, followed by other sources in order of priority, based on your network configuration. Updates are obtained from sources in the order you specify. If a source is not available, the next source in the list is used.
-You can use the following sources:
+When updates are published, some logic is applied to minimize the size of the update. In most cases, only the differences between the latest update and the update that is currently installed (this is referred to as the delta) on the device is downloaded and applied. However, the size of the delta depends on two main factors:
+- The age of the last update on the device; and
+- The source used to download and apply updates.
+The older the updates on an endpoint, the larger the download will be. However, you must also consider download frequency as well. A more frequent update schedule can result in more network usage, whereas a less-frequent schedule can result in larger file sizes per download.
-- Microsoft Update
-- [Windows Server Update Service (WSUS)](https://technet.microsoft.com/windowsserver/bb332157.aspx)
-- System Center Configuration Manager
-- A network file share
-- The [Microsoft Malware Protection Center Security intelligence page (MMPC)](https://www.microsoft.com/security/portal/definitions/adl.aspx)
+There are five locations where you can specify where an endpoint should obtain updates:
+- [Microsoft Update](https://support.microsoft.com/help/12373/windows-update-faq)
+- [Windows Server Update Service](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus)
+- [System Center Configuration Manager](https://docs.microsoft.com/sccm/core/servers/manage/updates)
+- [Network file share](https://docs.microsoft.com/windows-server/storage/nfs/nfs-overview)
+- [Security intelligence updates for Windows Defender Antivirus and other Microsoft antimalware](https://www.microsoft.com/en-us/wdsi/defenderupdates) (Your policy and registry might have this listed as Microsoft Malware Protection Center (MMPC) security intelligence, its former name.)
-When updates are published, some logic will be applied to minimize the size of the update. In most cases, only the "delta" (or the differences between the latest update and the update that is currently installed on the endpoint) will be downloaded and applied. However, the size of the delta depends on:
-
-- How old the current update on the endpoint is
-- Which source you use
-
-
-The older the updates on an endpoint, the larger the download. However, you must also consider frequency versus size - a more frequent update schedule may result in more ad hoc network usage, while a less-frequent schedule may result in larger file sizes.
-
-Microsoft Update allows for rapid releases, which means it will download small deltas on a frequent basis. This ensures the best protection, but may increase network bandwidth.
-
-The WSUS, Configuration Manager, and MMPC sources will deliver less frequent updates. The size of the updates may be slightly larger than the frequent release from Microsoft Update (as the delta, or differences between the latest version and what is on the endpoint will be larger). This ensures consistent protection without increasing ad hoc network usage (although the amount of data may be the same or increased as the updates will be fewer, but may be slightly larger).
+To ensure the best level of protection, Microsoft Update allows for rapid releases, which means smaller downloads on a frequent basis. The Windows Server Update Service, System Center Configuration Manager, and Microsoft security intelligence updates sources deliver less frequent updates. Thus, the delta can be larger, resulting in larger downloads.
> [!IMPORTANT]
-> If you have set MMPC as a fallback source after WSUS or Microsoft Update, updates will only be downloaded from MMPC when the current update is considered to be out-of-date (by default, this is 14 consecutive days of not being able to apply updates from the WSUS or Microsoft Update services).
-> You can, however, [set the number of days before protection is reported as out-of-date](https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).
+> If you have set [Microsoft Malware Protection Center Security intelligence page](https://www.microsoft.com/security/portal/definitions/adl.aspx) (MMPC) updates as a fallback source after Windows Server Update Service or Microsoft Update, updates are only downloaded from security intelligence updates when the current update is considered out-of-date. (By default, this is 14 consecutive days of not being able to apply updates from the Windows Server Update Service or Microsoft Update services).
+> You can, however, [set the number of days before protection is reported as out-of-date](https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).
+> Starting Monday, October 21, 2019, security intelligence updates will be SHA-2 signed exclusively. Devices must be updated to support SHA-2 in order to get the latest security intelligence updates. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus).
Each source has typical scenarios that depend on how your network is configured, in addition to how often they publish updates, as described in the following table:
-Location | Sample scenario
----|---
-WSUS | You are using WSUS to manage updates for your network.
-Microsoft Update | You want your endpoints to connect directly to Microsoft Update. This can be useful for endpoints that irregularly connect to your enterprise network, or if you do not use WSUS to manage your updates.
-File share | You have non-Internet-connected devices (such as VMs). You can use your Internet-connected VM host to download the updates to a network share, from which the VMs can obtain the updates. See the [VDI deployment guide](deployment-vdi-windows-defender-antivirus.md) for how file shares can be used in virtual desktop infrastructure (VDI) environments.
-Configuration Manager | You are using System Center Configuration Manager to update your endpoints.
-MMPC | You need to download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-windows-defender-antivirus.md). This option should generally be used only as a final fallback source, and not the primary source. It will only be used if updates cannot be downloaded from WSUS or Microsoft Update for [a specified number of days](https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).
+|Location | Sample scenario |
+|---|---|
+|Windows Server Update Service | You are using Windows Server Update Service to manage updates for your network.|
+|Microsoft Update | You want your endpoints to connect directly to Microsoft Update. This can be useful for endpoints that irregularly connect to your enterprise network, or if you do not use Windows Server Update Service to manage your updates.|
+|File share | You have non-Internet-connected devices (such as VMs). You can use your Internet-connected VM host to download the updates to a network share, from which the VMs can obtain the updates. See the [VDI deployment guide](deployment-vdi-windows-defender-antivirus.md) for how file shares can be used in virtual desktop infrastructure (VDI) environments.|
+|System Center Configuration Manager | You are using System Center Configuration Manager to update your endpoints.|
+|Security intelligence updates for Windows Defender Antivirus and other Microsoft antimalware (formerly referred to as MMPC) |[Make sure your devices are updated to support SHA-2](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). Microsoft Defender Antivirus Security intelligence updates are delivered through Windows Update, and starting Monday October 21, 2019 security intelligence updates will be SHA-2 signed exclusively. Download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-windows-defender-antivirus.md). This option should generally be used only as a final fallback source, and not the primary source. It will only be used if updates cannot be downloaded from Windows Server Update Service or Microsoft Update for [a specified number of days](https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).|
You can manage the order in which update sources are used with Group Policy, System Center Configuration Manager, PowerShell cmdlets, and WMI.
> [!IMPORTANT]
-> If you set WSUS as a download location, you must approve the updates - regardless of what management tool you use to specify the location. You can set up an automatic approval rule with WSUS, which may be useful as updates arrive at least once a day. See [To synchronize endpoint protection updates in standalone WSUS](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) for more details.
+> If you set Windows Server Update Service as a download location, you must approve the updates, regardless of the management tool you use to specify the location. You can set up an automatic approval rule with Windows Server Update Service, which might be useful as updates arrive at least once a day. To learn more, see [synchronize endpoint protection updates in standalone Windows Server Update Service](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus).
The procedures in this article first describe how to set the order, and then how to set up the **File share** option if you have enabled it.
-**Use Group Policy to manage the update location:**
+## Use Group Policy to manage the update location
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**.
2. In the **Group Policy Management Editor** go to **Computer configuration**.
@@ -103,7 +103,7 @@ The procedures in this article first describe how to set the order, and then how
4. Double-click the **Define file shares for downloading security intelligence updates** setting and set the option to **Enabled**.
- 5. Enter the file share source. If you have multiple sources, enter each source in the order they should be used, separated by a single pipe. Use [standard UNC notation](https://msdn.microsoft.com/library/gg465305.aspx) for denoting the path, for example: `\\host-name1\share-name\object-name|\\host-name2\share-name\object-name`. If you do not enter any paths then this source will be skipped when the VM downloads updates.
+ 5. Enter the file share source. If you have multiple sources, enter each source in the order they should be used, separated by a single pipe. Use [standard UNC notation](https://docs.microsoft.com/openspecs/windows_protocols/ms-dtyp/62e862f4-2a51-452e-8eeb-dc4ff5ee33cc) for denoting the path, for example: `\\host-name1\share-name\object-name|\\host-name2\share-name\object-name`. If you do not enter any paths then this source will be skipped when the VM downloads updates.
6. Click **OK**. This will set the order of file shares when that source is referenced in the **Define the order of sources...** group policy setting.
@@ -111,12 +111,12 @@ The procedures in this article first describe how to set the order, and then how
> For Windows 10, versions 1703 up to and including 1809, the policy path is **Windows Components > Windows Defender Antivirus > Signature Updates**
> For Windows 10, version 1903, the policy path is **Windows Components > Windows Defender Antivirus > Security Intelligence Updates**
-**Use Configuration Manager to manage the update location:**
+## Use Configuration Manager to manage the update location
See [Configure Security intelligence Updates for Endpoint Protection](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-definition-updates) for details on configuring System Center Configuration Manager (current branch).
-**Use PowerShell cmdlets to manage the update location:**
+## Use PowerShell cmdlets to manage the update location
Use the following PowerShell cmdlets to set the update order.
@@ -125,14 +125,14 @@ Set-MpPreference -SignatureFallbackOrder {LOCATION|LOCATION|LOCATION|LOCATION}
Set-MpPreference -SignatureDefinitionUpdateFileSharesSource {\\UNC SHARE PATH|\\UNC SHARE PATH}
```
See the following for more information:
-- [Set-MpPreference -SignatureFallbackOrder](https://technet.microsoft.com/itpro/powershell/windows/defender/set-mppreference#-signaturefallbackorder)
+- [Set-MpPreference -SignatureFallbackOrder](https://docs.microsoft.com/powershell/module/defender/set-mppreference)
- [Set-MpPreference -SignatureDefinitionUpdateFileSharesSource](https://technet.microsoft.com/itpro/powershell/windows/defender/set-mppreference#-signaturedefinitionupdatefilesharessources)
- [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md)
-- [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx)
+- [Defender cmdlets](https://docs.microsoft.com/powershell/module/defender/index)
-**Use Windows Management Instruction (WMI) to manage the update location:**
+## Use Windows Management Instruction (WMI) to manage the update location
-Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties:
+Use the [**Set** method of the **MSFT_MpPreference**](https://docs.microsoft.com/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties:
```WMI
SignatureFallbackOrder
@@ -140,21 +140,14 @@ SignatureDefinitionUpdateFileSharesSource
```
See the following for more information:
-- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx)
+- [Windows Defender WMIv2 APIs](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal)
-**Use Mobile Device Management (MDM) to manage the update location:**
+## Use Mobile Device Management (MDM) to manage the update location
See [Policy CSP - Defender/SignatureUpdateFallbackOrder](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-signatureupdatefallbackorder) for details on configuring MDM.
-
-
-
-
-
-
-
-## Related topics
+## Related articles
- [Deploy Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md)
- [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md
index 7a0f0c27d6..84e9cb78dd 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md
@@ -188,7 +188,102 @@ You may now enroll more devices. You can also enroll them later, after you have
```
-9. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**.
+9. To whitelist Defender and Auto Update for displaying notifications in UI on macOS 10.15 (Catalina), import the following .mobileconfig as a custom payload:
+
+ ```xml
+
+
+
+
+ PayloadContent
+
+
+ NotificationSettings
+
+
+ AlertType
+ 2
+ BadgesEnabled
+
+ BundleIdentifier
+ com.microsoft.autoupdate2
+ CriticalAlertEnabled
+
+ GroupingType
+ 0
+ NotificationsEnabled
+
+ ShowInLockScreen
+
+ ShowInNotificationCenter
+
+ SoundsEnabled
+
+
+
+ AlertType
+ 2
+ BadgesEnabled
+
+ BundleIdentifier
+ com.microsoft.wdavtray
+ CriticalAlertEnabled
+
+ GroupingType
+ 0
+ NotificationsEnabled
+
+ ShowInLockScreen
+
+ ShowInNotificationCenter
+
+ SoundsEnabled
+
+
+
+ PayloadDescription
+
+ PayloadDisplayName
+ notifications
+ PayloadEnabled
+
+ PayloadIdentifier
+ BB977315-E4CB-4915-90C7-8334C75A7C64
+ PayloadOrganization
+ Microsoft
+ PayloadType
+ com.apple.notificationsettings
+ PayloadUUID
+ BB977315-E4CB-4915-90C7-8334C75A7C64
+ PayloadVersion
+ 1
+
+
+ PayloadDescription
+
+ PayloadDisplayName
+ mdatp - allow notifications
+ PayloadEnabled
+
+ PayloadIdentifier
+ 85F6805B-0106-4D23-9101-7F1DFD5EA6D6
+ PayloadOrganization
+ Microsoft
+ PayloadRemovalDisallowed
+
+ PayloadScope
+ System
+ PayloadType
+ Configuration
+ PayloadUUID
+ 85F6805B-0106-4D23-9101-7F1DFD5EA6D6
+ PayloadVersion
+ 1
+
+
+ ```
+
+10. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**.
Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**:
diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md
index 84088ccd42..99a5b6cc89 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md
@@ -118,6 +118,16 @@ Save the **Configuration Profile**.
Use the **Logs** tab to monitor deployment status for each enrolled device.
+### Notification settings
+
+Starting in macOS 10.15 (Catalina) a user must manually allow to display notifications in UI. To auto-enable notifications from Defender and Auto Update, you can import the .mobileconfig below into a separate configuration profile and assign it to all machines with Defender:
+
+ ```xml
+
+
+ PayloadContent NotificationSettings AlertType 2 BadgesEnabled BundleIdentifier com.microsoft.autoupdate2 CriticalAlertEnabled GroupingType 0 NotificationsEnabled ShowInLockScreen ShowInNotificationCenter SoundsEnabled AlertType 2 BadgesEnabled BundleIdentifier com.microsoft.wdavtray CriticalAlertEnabled GroupingType 0 NotificationsEnabled ShowInLockScreen ShowInNotificationCenter SoundsEnabled PayloadDescription PayloadDisplayName notifications PayloadEnabled PayloadIdentifier BB977315-E4CB-4915-90C7-8334C75A7C64 PayloadOrganization Microsoft PayloadType com.apple.notificationsettings PayloadUUID BB977315-E4CB-4915-90C7-8334C75A7C64 PayloadVersion 1 PayloadDescription PayloadDisplayName mdatp - allow notifications PayloadEnabled PayloadIdentifier 85F6805B-0106-4D23-9101-7F1DFD5EA6D6 PayloadOrganization Microsoft PayloadRemovalDisallowed PayloadScope System PayloadType Configuration PayloadUUID 85F6805B-0106-4D23-9101-7F1DFD5EA6D6 PayloadVersion 1
+ ```
+
### Package
1. Create a package in **Settings > Computer Management > Packages**.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md
index 2f67653ec0..f37fa94b99 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md
@@ -72,7 +72,7 @@ There are several ways to uninstall Microsoft Defender ATP for Mac. Please note
### From the command line
-- ```sudo rm -rf '/Applications/Microsoft Defender ATP'```
+- ```sudo rm -rf '/Applications/Microsoft Defender ATP.app'```
## Configuring from the command line
@@ -116,3 +116,6 @@ In the Microsoft Defender ATP portal, you'll see two categories of information:
- Computer model
- Processor architecture
- Whether the device is a virtual machine
+
+ > [!NOTE]
+ > Certain device information might be subject to upcoming releases. To send us feedback, use the Microsoft Defender ATP for Mac app and select **Help** > **Send feedback** on your device. Optionally, use the **Feedback** button in the Microsoft Defender Security Center.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md
index 8324650680..acfa9717f3 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md
@@ -36,7 +36,7 @@ With Tamper Protection, malicious apps are prevented from taking actions like th
## How it works
- Tamper Protection essentially locks Microsoft Defender and prevents your security settings from being changed through apps and methods like these:
+ Tamper Protection essentially locks Windows Defender Antivirus and prevents your security settings from being changed through apps and methods like these:
- Configuring settings in Registry Editor on your Windows machine
- Changing settings through PowerShell cmdlets
- Editing or removing security settings through group policies
@@ -70,16 +70,16 @@ If you are a home user, or you are not subject to settings managed by a security
## Turn Tamper Protection on (or off) for your organization using Intune
-If you are part of your organization's security team, you can turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management portal (Intune). (This feature is rolling out now; if you don't have it yet, you should very soon, assuming your organization has [Microsoft Defender ATP](../microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) and that you meet the prerequisites listed below.)
+If you are part of your organization's security team, you can turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management portal (Intune). (This feature is rolling out now; if you don't have it yet, you should very soon, assuming your organization has [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) (Microsoft Defender ATP) and that you meet the prerequisites listed below.)
You must have appropriate [permissions](../microsoft-defender-atp/assign-portal-access.md), such as global admin, security admin, or security operations, to perform the following task.
1. Make sure your organization meets the following requirements:
- - Your organization must have [Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) (this is included in Microsoft 365 E5. See [Microsoft 365 Enterprise overview](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview) for more details.)
+ - Your organization must have [Microsoft Defender ATP E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) (this is included in Microsoft 365 E5. See [Microsoft 365 Enterprise overview](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview) for more details.)
- Your organization's devices must be managed by [Intune](https://docs.microsoft.com/intune/device-management-capabilities).
- Your Windows machines must be running [Windows OS 1903](https://docs.microsoft.com/windows/release-information/status-windows-10-1903) or later.
- - You must be using Windows security and update [security intelligence](https://www.microsoft.com/wdsi/definitions) to version 1.287.60.0 (or above)
+ - You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above)
- Your machines must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version 1.1.15500.X (or above). (See [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md).)
2. Go to the Microsoft 365 Device Management portal ([https://devicemanagement.microsoft.com](https://devicemanagement.microsoft.com)) and sign in with your work or school account.
@@ -108,7 +108,7 @@ No
No, third-party antivirus will continue to register with the Windows Security application.
-### What happens if Microsoft Defender is not active on a device?
+### What happens if Microsoft Defender Antivirus is not active on a device?
Tamper Protection will not have any impact on such devices.
@@ -116,14 +116,14 @@ Tamper Protection will not have any impact on such devices.
If you are a home user, see [Turn Tamper Protection on (or off) for an individual machine](#turn-tamper-protection-on-or-off-for-an-individual-machine).
-If you are an organization using [Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp), you should be able to manage Tamper Protection in Intune similar to how you manage other endpoint protection features. See [Turn Tamper Protection on (or off) for your organization using Intune](#turn-tamper-protection-on-or-off-for-your-organization-using-intune).
+If you are an organization using [Microsoft Defender ATP E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp), you should be able to manage Tamper Protection in Intune similar to how you manage other endpoint protection features. See [Turn Tamper Protection on (or off) for your organization using Intune](#turn-tamper-protection-on-or-off-for-your-organization-using-intune).
-### How does configuring Tamper Protection in Intune affect how I manage Windows Defender through my group policy?
+### How does configuring Tamper Protection in Intune affect how I manage Windows Defender Antivirus through my group policy?
-Your regular group policy doesn’t apply to Tamper Protection, and changes to Windows Defender settings will be ignored when Tamper Protection is on.
+Your regular group policy doesn’t apply to Tamper Protection, and changes to Windows Defender Antivirus settings will be ignored when Tamper Protection is on.
-### For Microsoft Defender Advanced Threat Protection E5, is configuring Tamper Protection in Intune targeted to the entire organization only?
+### For Microsoft Defender ATP E5, is configuring Tamper Protection in Intune targeted to the entire organization only?
Configuring Tamper Protection in Intune can be targeted to your entire organization as well as to devices and user groups with Intune.
@@ -135,7 +135,7 @@ Currently we do not have support to manage Tamper Protection through System Cent
Currently, configuring Tamper Protection in Intune is only available for customers who have [Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp).
-### What happens if I try to change Microsoft Defender settings in Intune, System Center Configuration Manager, and Windows Management Instrumentation when Tamper Protection is enabled on a device?
+### What happens if I try to change Microsoft Defender ATP settings in Intune, System Center Configuration Manager, and Windows Management Instrumentation when Tamper Protection is enabled on a device?
You won’t be able to change the features that are protected by Tamper Protection; those change requests are ignored.
@@ -143,13 +143,13 @@ You won’t be able to change the features that are protected by Tamper Protecti
No. Local admins cannot change or modify Tamper Protection settings.
-### What happens if my device is onboarded with Microsoft Defender Advanced Threat Protection and then goes into an off-boarded state?
+### What happens if my device is onboarded with Microsoft Defender ATP and then goes into an off-boarded state?
In this case, Tamper Protection status changes, and this feature is no longer applied.
-### Will there be an alert about Tamper Protection status changing in the Microsoft Defender Advanced Threat Protection portal?
+### Will there be an alert about Tamper Protection status changing in the Microsoft Defender Security Center?
-Yes. The alert is shown in [https://securitycenter.microsoft.com](https://microsoft.securitycenter.com) under **Alerts**.
+Yes. The alert is shown in [https://securitycenter.microsoft.com](https://securitycenter.microsoft.com) under **Alerts**.
In addition, your security operations team can use hunting queries, such as the following:
@@ -167,4 +167,4 @@ No.
[Microsoft 365 Enterprise overview (at a glance)](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview#at-a-glance)
-[Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp)
+[Microsoft Defender ATP E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md
index 33c3ad51b5..4c62952e60 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md
@@ -42,7 +42,7 @@ A full scan can be useful on endpoints that have encountered a malware threat to
See [Antimalware and firewall tasks: How to perform an on-demand scan](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-firewall#how-to-perform-an-on-demand-scan-of-computers) for details on using System Center Configuration Manager (current branch) to run a scan.
-**Use the mpcmdrum.exe command-line utility to run a scan:**
+**Use the mpcmdrun.exe command-line utility to run a scan:**
Use the following `-scan` parameter:
diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md
index f4224a60a4..6327898e26 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md
@@ -1,5 +1,5 @@
---
-title: Windows Defender Antivirus
+title: Next-generation protection in Windows 10 and Windows Server 2016
description: Learn how to manage, configure, and use Windows Defender AV, the built-in antimalware and antivirus product available in Windows 10 and Windows Server 2016
keywords: windows defender antivirus, windows defender, antimalware, scep, system center endpoint protection, system center configuration manager, virus, malware, threat, detection, protection, security
search.product: eADQiWindows 10XVcnh
@@ -9,50 +9,44 @@ ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.author: dansimp
-ms.date: 06/11/2019
+author: denisebmsft
+ms.author: deniseb
+ms.date: 10/14/2019
ms.reviewer:
manager: dansimp
---
-# Next Generation Protection in Windows 10 and Windows Server 2016
+# Next-generation protection in Windows 10 and Windows Server 2016
**Applies to:**
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-Next-gen protection provides enhanced safety, alongside more traditional security measures. Next-gen services use machine learning and the cloud to keep all devices on your enterprise network safe.
-
-Next-gen protection services include:
+Next-generation protection includes services that use machine learning together with the cloud to protect devices in your enterprise organization. Next-generation protection services include:
- [Always-on scanning](configure-real-time-protection-windows-defender-antivirus.md), also known as "real-time protection", for advanced file and process behavior monitoring
- [Cloud-based delivery](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) for near-instant detection and blocking of new and emerging threats
- [Dedicated protection updates](manage-updates-baselines-windows-defender-antivirus.md) powered by machine-learning, big-data analysis, and in-depth threat resistance research
>[!TIP]
->You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work:
->
->- Cloud-delivered protection
->- Fast learning (including Block at first sight)
->- Potentially unwanted application blocking
+>Visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to see how the following features work:
+>- [Cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md)
+>- Fast learning (including [block at first sight](configure-block-at-first-sight-windows-defender-antivirus.md))
+>- [Potentially unwanted application blocking](detect-block-potentially-unwanted-apps-windows-defender-antivirus.md)
> [!NOTE]
> For more information regarding what's new in each Windows version, please refer to [What's new in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp).
-
## Minimum system requirements
-Windows Defender Antivirus is our main vehicle for next-gen protection.
+Windows Defender Antivirus is your main vehicle for next-generation protection, and it has the same hardware requirements as Windows 10. For more information, see:
-It has the same hardware requirements as Windows 10. For more information, see:
+- [Minimum hardware requirements](https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview)
+- [Hardware component guidelines](https://docs.microsoft.com/windows-hardware/design/component-guidelines/components)
-- [Minimum hardware requirements](https://msdn.microsoft.com/library/windows/hardware/dn915086.aspx)
-- [Hardware component guidelines](https://msdn.microsoft.com/library/windows/hardware/dn915049.aspx)
+## Configuring Next-generation services
-## Configuring next-gen services
-
-You can use the following to configure and manage next-gen services in Windows 10, while running Windows Defender Antivirus:
+You can use the following to configure and manage next-generation services in Windows 10 while running Windows Defender Antivirus:
- System Center Configuration Manager (as System Center Endpoint Protection, or SCEP)
- Microsoft Intune
@@ -60,13 +54,7 @@ You can use the following to configure and manage next-gen services in Windows 1
- Windows Management Instrumentation (WMI)
- Group Policy
-Configuration and management is largely the same in Windows Server 2016, while running Windows Defender Antivirus; however, [there are some differences](windows-defender-antivirus-on-windows-server-2016.md).
-
->[!TIP]
->You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work:
->- Cloud-delivered protection
->- Fast learning (including Block at first sight)
->- Potentially unwanted application blocking
+Configuration and management is largely the same in Windows Server 2016, while running Windows Defender Antivirus; however, there are some differences. To learn more, see [Windows Defender Antivirus on Windows Server 2016](windows-defender-antivirus-on-windows-server-2016.md).
## Related topics
diff --git a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md
index c0e0200d21..039a888196 100644
--- a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md
@@ -1,13 +1,19 @@
---
title: Allow COM object registration in a Windows Defender Application Control policy (Windows 10)
description: You can allow COM object registration in a Windows Defender Application Control policy.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: mdsakibMSFT
-ms.author: mdsakib
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/21/2019
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md
index c2c55cccf6..488a8cc411 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md
@@ -37,7 +37,7 @@ The Application Identity service determines and verifies the identity of an app.
4. In the details pane, double-click **Application Identity**.
5. In **Application Identity Properties**, configure the service to start automatically.
-Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure.
+Membership in the local **Administrators** group, or equivalent, is the minimum access required to complete this procedure.
**To start the Application Identity service manually**
@@ -47,7 +47,7 @@ Membership in the local **Administrators** group, or equivalent, is the minimum
Starting with Windows 10, the Application Identity service is now a protected process. Because of this, you can no longer manually set the service **Startup type** to **Automatic** by using the Sevices snap-in. Try either of these methods instead:
-- Open an elevated commnad prompt or PowerShell session and type:
+- Open an elevated command prompt or PowerShell session and type:
```powershell
sc.exe config appidsvc start= auto
diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md
index aed91aa7a0..a866996a6f 100644
--- a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md
@@ -1,16 +1,19 @@
---
title: Audit Windows Defender Application Control (WDAC) policies (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
@@ -21,7 +24,7 @@ ms.date: 05/03/2018
- Windows 10
- Windows Server 2016
-Running Appication Control in audit mode allows administrators to discover any applications that were missed during an initial policy scan and to identify any new applications that have been installed and run since the original policy was created. While a WDAC policy is running in audit mode, any binary that runs and would have been denied had the policy been enforced is logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log. When these logged binaries have been validated, they can easily be added to a new WDAC policy. When the new exception policy is created, you can merge it with your existing WDAC policies.
+Running **Application Control** in audit mode allows administrators to discover any applications that were missed during an initial policy scan and to identify any new applications that have been installed and run since the original policy was created. While a WDAC policy is running in audit mode, any binary that runs and would have been denied had the policy been enforced is logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log. When these logged binaries have been validated, they can easily be added to a new WDAC policy. When the new exception policy is created, you can merge it with your existing WDAC policies.
Before you begin this process, you need to create a WDAC policy binary file. If you have not already done so, see [Create an initial Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md).
@@ -96,5 +99,5 @@ Use the following procedure after you have been running a computer with a WDAC p
You can now use this file to update the existing WDAC policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing WDAC policy, see the next section, [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md).
-> [!NOTE]
-> You may have noticed that you did not generate a binary version of this policy as you did in [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md). This is because WDAC policies created from an audit log are not intended to run as stand-alone policies but rather to update existing WDAC policies.
+> [!Note]
+> You may have noticed that you did not generate a binary version of this policy as you did in [Create a Windows Defender Application Control policy from a reference computer](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy). This is because WDAC policies created from an audit log are not intended to run as stand-alone policies but rather to update existing WDAC policies.
diff --git a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md
index 92c3c3aa47..9d7b5e5f7c 100644
--- a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md
@@ -1,6 +1,7 @@
---
title: Create a code signing cert for Windows Defender Application Control (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.reviewer:
manager: dansimp
@@ -10,7 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 02/28/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md
index 67c1e0ccef..041c14d524 100644
--- a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md
@@ -1,6 +1,7 @@
---
title: Create an initial default policy (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.reviewer:
manager: dansimp
@@ -10,7 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md b/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md
index 44a9846b76..4ac0c9fa6e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md
@@ -1,13 +1,19 @@
---
title: Windows Defender Application Control path-based rules (Windows 10)
description: Beginning with Windows 10 version 1903, Windows Defender Application Control (WDAC) policies can contain path-based rules.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: mdsakibMSFT
-ms.author: mdsakib
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/17/2019
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md b/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md
index d7f2a132fb..fe6ff0d10e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md
+++ b/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md
@@ -1,19 +1,19 @@
---
title: Create your Windows Defender Application Control (WDAC) planning document (Windows 10)
description: This planning topic for the IT professional summarizes the information you need to research and include in your WDAC planning document.
-ms.assetid: 41e49644-baf4-4514-b089-88adae2d624e
-ms.reviewer:
-ms.author: dansimp
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
-ms.topic: conceptual
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md
index 13fa578687..586cf70292 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md
@@ -1,16 +1,19 @@
---
title: Deploy catalog files to support Windows Defender Application Control (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 02/28/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md
index 97eea2439c..6505f27774 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md
@@ -1,13 +1,19 @@
---
title: Deploy multiple Windows Defender Application Control Policies (Windows 10)
description: Windows Defender Application Control supports multiple code integrity policies for one device.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: mdsakibMSFT
-ms.author: mdsakib
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/17/2019
---
@@ -44,16 +50,16 @@ Note that multiple policies will not work on pre-1903 systems.
### Allow Multiple Policies
-In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in New-CIPolicy results in 1) random GUIDs being generated for the policy ID and 2) the policy type being specified as base.
+In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy?view=win10-ps) results in 1) random GUIDs being generated for the policy ID and 2) the policy type being specified as base. The below is an example of creating a new policy in the multiple policy format.
```powershell
-New-CIPolicy -MultiplePolicyFormat -foo –bar
+New-CIPolicy -MultiplePolicyFormat -ScanPath '.\temp\' -UserPEs -FilePath ".\policy.xml" -Level Publisher -Fallback Hash
```
Optionally, you can choose to make the new base policy supplementable (allow supplemental policies).
```powershell
-Set-RuleOption -FilePath Enabled:Allow Supplemental Policies
+Set-RuleOption -FilePath -Option 17
```
For signed base policies that are being made supplementable, you need to ensure that supplemental signers are defined. Use the "Supplemental" switch in Add-SignerRule to provide supplemental signers.
diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md
index e4c776c47e..7bbbc5f8e5 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md
@@ -1,16 +1,19 @@
---
title: Deploy Windows Defender Application Control (WDAC) policies by using Group Policy (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 02/28/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md
index 61a3e06b58..8a2a80de85 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md
@@ -1,16 +1,19 @@
---
title: Deploy Windows Defender Application Control (WDAC) policies by using Microsoft Intune (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/17/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md
index 79cdfd3512..59112ea46a 100644
--- a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md
@@ -1,16 +1,19 @@
---
title: Disable Windows Defender Application Control policies (Windows 10)
description: This topic covers how to disable unsigned or signed WDAC policies.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md b/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md
index f29188cd79..59b632cbb8 100644
--- a/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md
+++ b/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md
@@ -1,18 +1,19 @@
---
title: Document your application control management processes (Windows 10)
description: This planning topic describes the WDAC policy maintenance information to record for your design document.
-ms.assetid: 6397f789-0e36-4933-9f86-f3f6489cf1fb
-ms.reviewer:
-ms.author: dansimp
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.topic: conceptual
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md
index 13a60fe360..7d5a20d2d6 100644
--- a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md
@@ -1,16 +1,19 @@
---
title: Enforce Windows Defender Application Control (WDAC) policies (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md
index fbad450704..e6b57b9722 100644
--- a/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md
@@ -1,16 +1,19 @@
---
title: Manage packaged apps with Windows Defender Application Control (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/14/2019
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md
index 4d04e9f6fa..01d8f1abb4 100644
--- a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md
@@ -1,16 +1,19 @@
---
title: Merge Windows Defender Application Control (WDAC) policies (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
index 387ba074e2..a9250a0e9e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
@@ -1,16 +1,20 @@
---
title: Microsoft recommended block rules (Windows 10)
description: To help you plan and begin the initial test stages of a deployment of Microsoft Windows Defender Application Control, this article outlines how to gather information, create a plan, and begin to create and test initial code integrity policies.
-keywords: virtualization, security, malware
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
audience: ITPro
-ms.date: 04/09/2019
-ms.reviewer:
-manager: dansimp
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 04/09/2019
---
# Microsoft recommended block rules
diff --git a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md
index be74ddf1f0..546d20fa52 100644
--- a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md
+++ b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md
@@ -1,16 +1,20 @@
---
title: Plan for Windows Defender Application Control policy management (Windows 10)
description: Plan for Windows Defender Application Control policy management.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.date: 02/21/2018
-ms.reviewer:
-manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 02/21/2018
---
# Plan for Windows Defender Application Control policy management
diff --git a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md
index fa2f7af6ec..183701e0a9 100644
--- a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md
+++ b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md
@@ -1,16 +1,20 @@
---
title: Querying Application Control events centrally using Advanced hunting (Windows 10)
description: Learn about Windows Defender Application Guard and how it helps to combat malicious content and malware out on the Internet.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
-ms.mktglfcycl: manage
+ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
-ms.date: 12/06/2018
-ms.reviewer:
manager: dansimp
+ms.date: 12/06/2018
---
# Querying Application Control events centrally using Advanced hunting
diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
index db654141a9..783157d1c5 100644
--- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
+++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md
@@ -1,16 +1,20 @@
---
title: Select the types of rules to create (Windows 10)
description: Select the types of rules to create.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.date: 04/20/2018
-ms.reviewer:
-manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 04/20/2018
---
# Deploy Windows Defender Application Control policy rules and file rules
@@ -64,13 +68,15 @@ You can set several rule options within a WDAC policy. Table 2 describes each ru
| **8 Required:EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All future Windows 10 and later drivers will meet this requirement. |
| **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. |
| **10 Enabled:Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. |
-| **11 Disabled:Script Enforcement** | This option is not currently supported. |
+| **11 Disabled:Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to Restricted Language Mode. NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. |
| **12 Required:Enforce Store Applications** | If this rule option is enabled, WDAC policies will also apply to Universal Windows applications. |
| **13 Enabled:Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as System Center Configuration Manager, that has been defined as a managed installer. |
| **14 Enabled:Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). |
| **15 Enabled:Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically re-validate the reputation for files that were authorized by the ISG.|
| **16 Enabled:Update Policy No Reboot** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot. |
-| **17 Enabled:Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically-loaded libraries. |
+| **17 Enabled:Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. |
+| **18 Disabled:Runtime FilePath Rule Protection** | Disable default FilePath rule protection of enforcing user-writeability and only allowing admin-writeable locations. |
+| **19 Enabled:Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically-loaded libraries. |
## Windows Defender Application Control file rule levels
@@ -84,6 +90,12 @@ Table 3. Windows Defender Application Control policy - file rule levels
|----------- | ----------- |
| **Hash** | Specifies individual hash values for each discovered binary. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. |
| **FileName** | Specifies individual binary file names. Although the hash values for an application are modified when updated, the file names are typically not. This offers less specific security than the hash level but does not typically require a policy update when any binary is modified. |
+| **FilePath** | Beginning with Windows 10 version 1903, this specifies rules that allow execution of binaries contained in paths that are admin-writeable only. By default, WDAC performs a user-writeability check at runtime which ensures that the current permissions on the specified filepath and its parent directories (recursively) do not allow standard users write access. Note that filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. Filepath rules are best suited for environments where most users are running as standard rather than admin. IT Pros should take care while crafting path rules to allow paths that they know are likely to remain to be admin-writeable only and deny execution from sub-directories where standard users can modify ACLs on the folder. There is a defined list of SIDs which are recognized as admins (below). If a file has write permissions for a SID not in this list, the file will be flagged as user writeable. S-1-3-0; S-1-5-18; S-1-5-19; S-1-5-20; S-1-5-32-544; S-1-5-32-549; S-1-5-32-550; S-1-5-32-551; S-1-5-32-577; S-1-5-32-559; S-1-5-32-568; S-1-15-2-1430448594-2639229838-973813799-439329657-1197984847-4069167804-1277922394; S-1-15-2-95739096-486727260-2033287795-3853587803-1685597119-444378811-2746676523. Wildcards can be used at the beginning or end of a path rule: only one wildcard is allowed per path rule. Wildcards placed at the end of a path authorize all files in that path and its subdirectories recursively (ex. C:\\* would include C:\foo\\* ). Wildcards placed at the beginning of a path scan all directories for files with a specific name (ex. \*\bar.exe would allow C:\bar.exe and C:\foo\bar.exe). Wildcards in the middle of a path are not supported (ex. C:\\*\foo.exe). Without a wildcard, the rule will allow only a specific file (ex. C:\foo\bar.exe). Supported macros: %WINDIR%, %SYSTEM32%, %OSDRIVE%.|
+> [!NOTE]
+> Due to an existing bug, you can not combine Path-based ALLOW rules with any DENY rules in a single policy. Instead, either separate DENY rules into a separate Base policy or move the Path-based ALLOW rules into a supplemental policy as described in [Deploy multiple WDAC policies.](deploy-multiple-windows-defender-application-control-policies.md)
+
+| Rule level | Description |
+|----------- | ----------- |
| **SignedVersion** | This combines the publisher rule with a version number. This option allows anything from the specified publisher, with a version at or above the specified version number, to run. |
| **Publisher** | This is a combination of the PcaCertificate level (typically one certificate below the root) and the common name (CN) of the leaf certificate. This rule level allows organizations to trust a certificate from a major CA (such as Symantec), but only if the leaf certificate is from a specific company (such as Intel, for device drivers). |
| **FilePublisher** | This is a combination of the “FileName” attribute of the signed file, plus “Publisher” (PCA certificate with CN of leaf), plus a minimum version number. This option trusts specific files from the specified publisher, with a version at or above the specified version number. |
@@ -107,51 +119,3 @@ As part of normal operations, they will eventually install software updates, or
They could also choose to create a catalog that captures information about the unsigned internal application, then sign and distribute the catalog. Then the internal application could be handled by WDAC policies in the same way as any other signed application. An update to the internal application would only require that the catalog be regenerated, signed, and distributed (no restarts would be required).
-## Create path-based rules
-
-Beginning with Windows 10 version 1903, Windows Defender Application Control (WDAC) policies can contain path-based rules.
-> [!NOTE]
-> Due to an existing bug, you can not combine Path-based ALLOW rules with any DENY rules in a single policy. Instead, either separate DENY rules into a separate Base policy or move the Path-based ALLOW rules into a supplemental policy as described in [Deploy multiple WDAC policies.](deploy-multiple-windows-defender-application-control-policies.md)
-
-- New-CIPolicy parameter
- - FilePath: create path rules under path \ for anything not user-writeable (at the individual file level)
-
- ```powershell
- New-CIPolicy -FilePath .\mypolicy.xml -Level FileName -ScanPath -UserPEs
- ```
-
- Optionally, add -UserWriteablePaths to ignore user writeability
-
-- New-CIPolicyRule parameter
- - FilePathRule: create a rule where filepath string is directly set to value of \
-
- ```powershell
- New-CIPolicyRule -FilePathRule
- ```
-
- Useful for wildcards like C:\foo\\*
-
-- Usage follows the same flow as per-app rules:
-
- ```powershell
- $rules = New-CIPolicyRule …
- $rules += New-CIPolicyRule …
- …
- New-CIPolicy -FilePath .\mypolicy.xml -Rules $rules -UserPEs
- ```
-
-- Wildcards supported
- - Suffix (ex. C:\foo\\*) OR Prefix (ex. *\foo\bar.exe)
- - One or the other, not both at the same time
- - Does not support wildcard in the middle (ex. C:\\*\foo.exe)
- - Examples:
- - %WINDIR%\\...
- - %SYSTEM32%\\...
- - %OSDRIVE%\\...
-
-- Disable default FilePath rule protection of enforcing user-writeability. For example, to add “Disabled:Runtime FilePath Rule Protection” to the policy:
-
- ```powershell
- Set-RuleOption -Option 18 .\policy.xml
- ```
-
diff --git a/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md b/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md
index 7f2c0b16d3..4d6bb94c8f 100644
--- a/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md
+++ b/windows/security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md
@@ -1,16 +1,20 @@
---
title: Signing Windows Defender Application Control policies with SignTool.exe (Windows 10)
description: SSigned WDAC policies give organizations the highest level of malware protection available in Windows 10.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.date: 02/21/2018
-ms.reviewer:
-manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 02/21/2018
---
# Signing Windows Defender Application Control policies with SignTool.exe
diff --git a/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md b/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md
index aacc7afb09..6a955009ea 100644
--- a/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md
+++ b/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md
@@ -1,18 +1,20 @@
---
-title: types of devices (Windows 10)
+title: Types of devices (Windows 10)
description: Typically, deployment of Windows Defender Application Control happens best in phases, rather than being a feature that you simply “turn on.” The choice and sequence of phases depends on the way various computers and other devices are used in your organization, and to what degree IT manages those devices.
-keywords: virtualization, security, malware
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
-ms.topic: conceptual
-ms.date: 03/01/2018
-ms.reviewer:
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 03/01/2018
---
# Windows Defender Application Control deployment in different scenarios: types of devices
diff --git a/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md
index 5f6b6c7849..7992bb5142 100644
--- a/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md
+++ b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md
@@ -1,6 +1,7 @@
---
title: Understand Windows Defender Application Control policy design decisions (Windows 10)
description: Understand Windows Defender Application Control policy design decisions.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.reviewer:
manager: dansimp
@@ -10,7 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 02/08/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md
index 597df3c8b3..e35f247793 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md
@@ -1,6 +1,7 @@
---
title: Use code signing to simplify application control for classic Windows applications (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.reviewer:
manager: dansimp
@@ -10,7 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md
index 567c3db270..bb2b9834f3 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md
@@ -1,6 +1,7 @@
---
title: Use the Device Guard Signing Portal in the Microsoft Store for Business (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.reviewer:
manager: dansimp
@@ -10,7 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 02/19/2019
---
@@ -30,11 +36,11 @@ Before you get started, be sure to review these best practices:
**Best practices**
- Test your code integrity policies on a pilot group of devices before deploying them to production.
-- Use rule options 9 and 10 during testing. For more information, see the section Code integrity policy rules in the [Deploy Windows Defender Application Control policy rules and file rules](hhttps://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create).
+- Use rule options 9 and 10 during testing. For more information, see the section Code integrity policy rules in the [Deploy Windows Defender Application Control policy rules and file rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create).
**To sign a code integrity policy**
-1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
+1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
2. Click **Manage**, click **Store settings**, and then click **Device Guard**.
3. Click **Upload** to upload your code integrity policy.
4. After the files are uploaded, click **Sign** to sign the code integrity policy.
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md
index 7cca116982..edbac5d2b9 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md
@@ -1,6 +1,7 @@
---
title: Use signed policies to protect Windows Defender Application Control against tampering (Windows 10)
description: Signed WDAC policies give organizations the highest level of malware protection available in Windows 10.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.reviewer:
manager: dansimp
@@ -10,7 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md
index 8919d6d670..2151bc0de5 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md
@@ -1,6 +1,7 @@
---
title: Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.reviewer:
manager: dansimp
@@ -10,7 +11,12 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 05/03/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md
index 8d7885f549..90585fe7cb 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md
@@ -1,16 +1,19 @@
---
title: Windows Defender Application Control and .NET Hardening (Windows 10)
description: Dynamic Code Security is an application control feature that can verify code loaded by .NET at runtime.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 08/20/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md
index 91eec3f5c5..62085ad482 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md
@@ -1,14 +1,20 @@
---
title: Deploy Windows Defender Application Control with Intelligent Security Graph (ISG) (Windows 10)
description: Automatically authorize applications that Microsoft’s ISG recognizes as having known good reputation.
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.date: 06/14/2018
-ms.reviewer:
-manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 06/14/2018
---
# Use Windows Defender Application Control (WDAC) with the Microsoft Intelligent Security Graph
diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md
index 1c2b670b16..aac3df82fc 100644
--- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md
+++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md
@@ -1,15 +1,20 @@
---
title: Deploy Managed Installer for Windows Defender Device Guard (Windows 10)
description: Explains how you can use a managed installer to automatically authorize applications deployed and installed by a designated software distribution solution, such as System Center Configuration Manager.
-keywords: virtualization, security, malware
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.date: 06/13/2018
-ms.reviewer:
-manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 06/13/2018
---
# Deploy Managed Installer for Windows Defender Application Control
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md
index 38cfd605db..80ddc17590 100644
--- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md
@@ -1,15 +1,20 @@
---
title: Planning and getting started on the Windows Defender Application Control deployment process (Windows 10)
description: To help you plan and begin the initial test stages of a deployment of Microsoft Windows Defender Application Control, this article outlines how to gather information, create a plan, and begin to create and test initial code integrity policies.
-keywords: virtualization, security, malware
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.date: 05/16/2018
-ms.reviewer:
-manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 05/16/2018
---
# Planning and getting started on the Windows Defender Application Control deployment process
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md
index e9719fd4e4..37a8decfb5 100644
--- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md
@@ -1,18 +1,21 @@
---
title: Windows Defender Application Control design guide (Windows 10)
description: Microsoft Windows Defender Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security.
-keywords: virtualization, security, malware
+keywords: whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.topic: conceptual
ms.date: 02/20/2018
-ms.reviewer:
-ms.author: dansimp
---
# Windows Defender Application Control design guide
@@ -34,4 +37,3 @@ This guide covers design and planning for Windows Defender Application Control (
| [Create your WDAC planning document](create-your-windows-defender-application-control-planning-document.md) | This planning topic summarizes the information you need to research and include in your planning document. |
After planning is complete, the next step is to deploy WDAC. The [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md) covers the creation and testing of policies, deploying the enforcement setting, and managing and maintaining the policies.
-
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
index 3605322e2c..06f7a63a13 100644
--- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md
@@ -1,16 +1,19 @@
---
title: Windows Defender Application Control (WDAC) (Windows 10)
description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core.
+keywords: whitelisting, security, malware
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
+ms.author: dansimp
+manager: dansimp
ms.date: 01/08/2019
---
@@ -18,7 +21,7 @@ ms.date: 01/08/2019
**Applies to:**
-- Windows 10 Enterprise
+- Windows 10
- Windows Server 2016
- Windows Server 2019
@@ -41,7 +44,7 @@ WDAC policies also block unsigned scripts and MSIs, and Windows PowerShell runs
## WDAC System Requirements
WDAC policies can only be created on computers beginning with Windows 10 Enterprise or Windows Server 2016 and above.
-They can be applied to computers running Windows 10 Enterprise or Windows Server 2016 and above and optionally managed via Mobile Device Management (MDM), such as Microsoft Intune.
+They can be applied to computers running any edition of Windows 10 or Windows Server 2016 and optionally managed via Mobile Device Management (MDM), such as Microsoft Intune.
Group Policy or Intune can be used to distribute WDAC policies.
## New and changed functionality
diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md
index bc80b871c8..3935248ada 100644
--- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md
@@ -1,15 +1,20 @@
---
title: Windows Defender Device Guard and AppLocker (Windows 10)
description: Explains how
-keywords: virtualization, security, malware
+keywords: virtualization, whitelisting, security, malware
+ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
ms.prod: w10
ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
ms.localizationpriority: medium
-author: dansimp
-ms.date: 05/03/2018
-ms.reviewer:
-manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+author: jsuther1974
+ms.reviewer: isbrahm
ms.author: dansimp
+manager: dansimp
+ms.date: 05/03/2018
---
# Windows Defender Device Guard with AppLocker
diff --git a/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md
index ae7c4a20a4..c2b8dc832a 100644
--- a/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md
+++ b/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md
@@ -67,8 +67,8 @@ Answering frequently asked questions about Windows Defender Application Guard (A
| | |
|--------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| **Q:** | How do I configure WDAG to work with my network proxy (IP-Literal Addresses)? |
-| **A:** | WDAG requires proxies to have a symbolic name, not just an IP address. IP-Literal proxy settings such as “192.168.1.4:81” can be annotated as “itproxy:81” or using a record such as “P19216810010” for a proxy with an IP address of 192.168.100.10. This applies to Windows 10 Enterprise edition, 1709 or higher. These would be for the proxy policies under Network Isolation in Group Policy or Intune. |
+| **Q:** | How do I configure Windows Defender Application Guard to work with my network proxy (IP-Literal Addresses)? |
+| **A:** | Windows Defender Application Guard requires proxies to have a symbolic name, not just an IP address. IP-Literal proxy settings such as “192.168.1.4:81” can be annotated as “itproxy:81” or using a record such as “P19216810010” for a proxy with an IP address of 192.168.100.10. This applies to Windows 10 Enterprise edition, 1709 or higher. These would be for the proxy policies under Network Isolation in Group Policy or Intune. |
@@ -76,7 +76,7 @@ Answering frequently asked questions about Windows Defender Application Guard (A
| | |
|--------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Q:** | Which Input Method Editors (IME) in 19H1 are not supported? |
-| **A:** | The following Input Method Editors (IME) introduced in Windows 10, version 1903 are currently not supported in WDAG. Vietnam Telex keyboard Vietnam number key-based keyboard Hindi phonetic keyboard Bangla phonetic keyboard Marathi phonetic keyboard Telugu phonetic keyboard Tamil phonetic keyboard Kannada phonetic keyboard Malayalam phonetic keyboard Gujarati phonetic keyboard Odia phonetic keyboard Punjabi phonetic keyboard |
+| **A:** | The following Input Method Editors (IME) introduced in Windows 10, version 1903 are currently not supported in Windows Defender Application Guard. Vietnam Telex keyboard Vietnam number key-based keyboard Hindi phonetic keyboard Bangla phonetic keyboard Marathi phonetic keyboard Telugu phonetic keyboard Tamil phonetic keyboard Kannada phonetic keyboard Malayalam phonetic keyboard Gujarati phonetic keyboard Odia phonetic keyboard Punjabi phonetic keyboard |
@@ -111,3 +111,17 @@ Answering frequently asked questions about Windows Defender Application Guard (A
+| | |
+|--------|-----------------------------------------------------------------------------------------------|
+| **Q:** | Is there a size limit to the domain lists that I need to configure? |
+| **A:** | Yes, both the Enterprise Resource domains hosted in the cloud and the Domains categorized as both work and personal have a 16383B limit.|
+
+
+
+| | |
+|--------|-----------------------------------------------------------------------------------------------|
+| **Q:** | Why does my encryption driver break Windows Defender Application Guard? |
+| **A:** | Windows Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, WDAG will not work. |
+
+
+