diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json
index 70220d84b0..0c87377631 100644
--- a/.openpublishing.redirection.json
+++ b/.openpublishing.redirection.json
@@ -6,6 +6,21 @@
"redirect_document_id": true
},
{
+"source_path": "windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks.md",
+"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-countermeasures",
+"redirect_document_id": true
+},
+{
+"source_path": "windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys.md",
+"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-countermeasures",
+"redirect_document_id": false
+},
+{
+"source_path": "windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure.md",
+"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-countermeasures",
+"redirect_document_id": false
+},
+{
"source_path": "windows/security/threat-protection/intelligence/transparency-report.md",
"redirect_url": "/windows/security/threat-protection/intelligence/av-tests",
"redirect_document_id": true
@@ -21,6 +36,11 @@
"redirect_document_id": true
},
{
+"source_path": "windows/security/identity-protection/how-hardware-based-containers-help-protect-windows.md",
+"redirect_url": "/windows/security/threat-protection/windows-defender-atp/how-hardware-based-containers-help-protect-windows",
+"redirect_document_id": true
+},
+{
"source_path": "windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows.md",
"redirect_url": "/windows/security/identity-protection/how-hardware-based-containers-help-protect-windows",
"redirect_document_id": true
diff --git a/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md b/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md
index 010a44e44b..352bb35dff 100644
--- a/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md
+++ b/browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md
@@ -52,7 +52,7 @@ IE11 offers enterprises additional security, manageability, performance, backwar
## Related topics
- [Total Economic Impact of Microsoft Edge: Infographic](https://www.microsoft.com/download/details.aspx?id=53892)
- [Web Application Compatibility Lab Kit for Internet Explorer 11](https://technet.microsoft.com/browser/mt612809.aspx)
-- [Download Internet Explorer 11](http://windows.microsoft.com/internet-explorer/download-ie)
+- [Download Internet Explorer 11](https://windows.microsoft.com/internet-explorer/download-ie)
- [Microsoft Edge - Deployment Guide for IT Pros](https://technet.microsoft.com/itpro/microsoft-edge/index)
- [Internet Explorer 11 - Deployment Guide for IT Pros](https://technet.microsoft.com/itpro/internet-explorer/ie11-deploy-guide/index)
- [IEAK 11 - Internet Explorer Administration Kit 11 Users Guide](https://technet.microsoft.com/itpro/internet-explorer/ie11-ieak/index)
diff --git a/browsers/edge/group-policies/extensions-management-gp.md b/browsers/edge/group-policies/extensions-management-gp.md
index 4f12302469..5f85feab3f 100644
--- a/browsers/edge/group-policies/extensions-management-gp.md
+++ b/browsers/edge/group-policies/extensions-management-gp.md
@@ -5,7 +5,7 @@ services:
keywords: Don’t add or edit keywords without consulting your SEO champ.
author: shortpatti
ms.author: pashort
-ms.date: 07/25/2018
+ms.date: 09/05/2018
ms.topic: article
ms.prod: edge
ms.mktglfcycl: explore
diff --git a/browsers/edge/includes/do-not-sync-browser-settings-include.md b/browsers/edge/includes/do-not-sync-browser-settings-include.md
index 9673414962..2424c7de85 100644
--- a/browsers/edge/includes/do-not-sync-browser-settings-include.md
+++ b/browsers/edge/includes/do-not-sync-browser-settings-include.md
@@ -1,5 +1,5 @@
-
->*Supported versions: Microsoft Edge on Windows 10*
+
+>*Supported versions: Microsoft Edge on Windows 10*
>*Default setting: Disabled or not configured (Allowed/turned on)*
[!INCLUDE [do-not-sync-browser-settings-shortdesc](../shortdesc/do-not-sync-browser-settings-shortdesc.md)]
@@ -33,7 +33,7 @@ For more details about configuring the browser syncing options, see [Sync browse
#### Registry settings
- **Path:** HKLM\\Software\Policies\Microsoft\Windows\SettingSync
- **Value name:** DisableWebBrowserSettingSyncUserOverride
-- **Value
+- **Value
### Related policies
@@ -43,6 +43,6 @@ For more details about configuring the browser syncing options, see [Sync browse
### Related topics
-[About sync setting on Microsoft Edge on Windows 10 devices](http://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices)
+[About sync setting on Microsoft Edge on Windows 10 devices](https://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices)
diff --git a/browsers/edge/includes/do-not-sync-include.md b/browsers/edge/includes/do-not-sync-include.md
index 91cfd76c74..8a8b4770f2 100644
--- a/browsers/edge/includes/do-not-sync-include.md
+++ b/browsers/edge/includes/do-not-sync-include.md
@@ -30,8 +30,8 @@
- **Value name:** DisableSettingSyn
- **Value type:** REG_DWORD
-### Related topics
-[About sync setting on Microsoft Edge on Windows 10 devices](http://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices): Learn about what settings are sync'ed.
+### Related topics
+[About sync setting on Microsoft Edge on Windows 10 devices](https://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices): Learn about what settings are sync'ed.
\ No newline at end of file
diff --git a/browsers/edge/includes/prevent-users-to-turn-on-browser-syncing-include.md b/browsers/edge/includes/prevent-users-to-turn-on-browser-syncing-include.md
index a46095d9bd..215ccfad37 100644
--- a/browsers/edge/includes/prevent-users-to-turn-on-browser-syncing-include.md
+++ b/browsers/edge/includes/prevent-users-to-turn-on-browser-syncing-include.md
@@ -1,5 +1,5 @@
-
->*Supported versions: Microsoft Edge on Windows 10, next major update to Windows*
+
+>*Supported versions: Microsoft Edge on Windows 10, next major update to Windows*
>*Default setting: Enabled or not configured (Prevented/turned off)*
[!INCLUDE [prevent-users-to-turn-on-browser-syncing-shortdesc](../shortdesc/prevent-users-to-turn-on-browser-syncing-shortdesc.md)]
@@ -7,8 +7,8 @@
### Supported values
|Group Policy |MDM |Registry |Description |
|---|:---:|:---:|---|
-|Disabled |0 |0 |Allowed/turned on. Users can sync the browser settings. |
-|Enabled or not configured **(default)** |1 |1 |Prevented/turned off. |
+|Disabled |0 |0 |Allowed/turned on. Users can sync the browser settings. |
+|Enabled or not configured **(default)** |1 |1 |Prevented/turned off. |
---
### Configuration options
@@ -26,7 +26,7 @@ For more details about configuring the browser syncing options, see [Sync browse
#### MDM settings
- **MDM name:** Experience/[PreventUsersFromTurningOnBrowserSyncing](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#experience-preventusersfromturningonbrowsersyncing)
- **Supported devices:** Desktop
-- **URI full path:** ./Vendor/MSFT/Policy/Config/Experience/PreventUsersFromTurningOnBrowserSyncing
+- **URI full path:** ./Vendor/MSFT/Policy/Config/Experience/PreventUsersFromTurningOnBrowserSyncing
- **Data type:** String
@@ -34,7 +34,7 @@ For more details about configuring the browser syncing options, see [Sync browse
[Do not sync browser settings](../available-policies.md#do-not-sync-browser-settings): [!INCLUDE [do-not-sync-browser-settings-shortdesc](../shortdesc/do-not-sync-browser-settings-shortdesc.md)].
### Related topics
-[About sync setting on Microsoft Edge on Windows 10 devices](http://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices)
+[About sync setting on Microsoft Edge on Windows 10 devices](https://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices)
\ No newline at end of file
diff --git a/browsers/edge/security-enhancements-microsoft-edge.md b/browsers/edge/security-enhancements-microsoft-edge.md
index 8f16464105..ae5d5916d8 100644
--- a/browsers/edge/security-enhancements-microsoft-edge.md
+++ b/browsers/edge/security-enhancements-microsoft-edge.md
@@ -40,7 +40,7 @@ Microsoft Edge is the first browser to natively support Windows Hello as a more
Microsoft SmartScreen, used in Windows 10 and both Internet Explorer 11 and Microsoft Edge, helps to defend against phishing by performing reputation checks on visited sites and blocking any sites that are thought to be phishing sites. SmartScreen also helps to defend people against being tricked into installing malicious [socially-engineered software downloads](http://operationstech.about.com/od/glossary/g/Socially-Engineered-Malware.htm and against [drive-by attacks](https://blogs.windows.com/msedgedev/2015/12/16/smartscreen-drive-by-improvements/). Drive-by attacks are malicious web-based attacks that compromise your system by targeting security vulnerabilities in commonly used software, and may be hosted on trusted sites.
#### Certificate Reputation system
-While people trust sites that have encrypted web traffic, that trust can be undermined by malicious sites using improperly obtained or fake certificates to impersonate legitimate sites. To help address this problem, we introduced the [Certificate Reputation system](http://blogs.msdn.com/b/ie/archive/2014/03/10/certificate-reputation-a-novel-approach-for-protecting-users-from-fraudulent-certificates.aspx) last year. This year, we’ve extended the system to let web developers use the [Bing Webmaster Tools](http://www.bing.com/toolbox/webmaster) to report directly to Microsoft to let us know about fake certificates.
+While people trust sites that have encrypted web traffic, that trust can be undermined by malicious sites using improperly obtained or fake certificates to impersonate legitimate sites. To help address this problem, we introduced the [Certificate Reputation system](https://blogs.msdn.com/b/ie/archive/2014/03/10/certificate-reputation-a-novel-approach-for-protecting-users-from-fraudulent-certificates.aspx) last year. This year, we’ve extended the system to let web developers use the [Bing Webmaster Tools](http://www.bing.com/toolbox/webmaster) to report directly to Microsoft to let us know about fake certificates.
### Help against hacking
While Microsoft Edge has done much to help defend against trickery, the browser’s “engine” has also been overhauled to resist hacking (attempts to corrupt the browser itself) including a major overhaul of the DOM representation in the browser’s memory, and the security mitigations described here.
@@ -58,14 +58,14 @@ The Microsoft EdgeHTML engine also helps to defend against hacking through these
>Both Microsoft Edge and Internet Explorer 11 support HSTS.
#### All web content runs in an app container sandbox
-Internet Explorer 7 on Windows Vista was the first web browser to provide a browsing sandbox, called [Protected Mode](http://windows.microsoft.com/windows-vista/What-does-Internet-Explorer-protected-mode-do). Protected Mode forced the part of the browser that rendered web content to run with less privilege than the browser controls or the user, providing a level of isolation and protection should a malicious website attempt to exploit a bug in the browser or one of its plug-ins.
+Internet Explorer 7 on Windows Vista was the first web browser to provide a browsing sandbox, called [Protected Mode](https://windows.microsoft.com/windows-vista/What-does-Internet-Explorer-protected-mode-do). Protected Mode forced the part of the browser that rendered web content to run with less privilege than the browser controls or the user, providing a level of isolation and protection should a malicious website attempt to exploit a bug in the browser or one of its plug-ins.
Internet Explorer 10 introduced Enhanced Protected Mode (EPM), based on the Windows 8 app container technology, providing a stronger sandbox by adding deny-by-default and no-read-up semantics. EPM was turned on by default in the Windows 8 and Windows 8.1 immersive browser, but was optional on the Internet Explorer 10 and Internet Explorer 11 desktop versions.
-Microsoft Edge takes the sandbox even farther, running its content processes in app containers not just by default, but all of the time. Because Microsoft Edge doesn’t support 3rd party binary extensions, there’s no reason for it to run outside of the containers, ensuring that Microsoft Edge is more secure.
+Microsoft Edge takes the sandbox even farther, running its content processes in app containers not just by default, but all of the time. Because Microsoft Edge doesn’t support 3rd party binary extensions, there’s no reason for it to run outside of the containers, ensuring that Microsoft Edge is more secure.
#### Microsoft Edge is now a 64-bit app
-The largest security change to Microsoft Edge is that it's designed like a Universal Windows app. By changing the browser to an app, it fundamentally changes the process model so that both the outer manager process and the assorted content processes all live within app container sandboxes; helping to provide the user and the platform with the [confidence](http://blogs.msdn.com/b/b8/archive/2012/05/17/delivering-reliable-and-trustworthy-metro-style-apps.aspx) provided by other Microsoft Store apps.
+The largest security change to Microsoft Edge is that it's designed like a Universal Windows app. By changing the browser to an app, it fundamentally changes the process model so that both the outer manager process and the assorted content processes all live within app container sandboxes; helping to provide the user and the platform with the [confidence](https://blogs.msdn.com/b/b8/archive/2012/05/17/delivering-reliable-and-trustworthy-metro-style-apps.aspx) provided by other Microsoft Store apps.
##### 64-bit processes and Address Space Layout Randomization (ASLR)
Microsoft Edge runs in 64-bit not just by default, but anytime it’s running on a 64-bit operating system. Because Microsoft Edge doesn’t support legacy ActiveX controls or 3rd-party binary extensions, there’s no longer a reason to run 32-bit processes on a 64-bit system.
@@ -104,7 +104,7 @@ We’ve devoted more than 670 machine-years to fuzz testing Microsoft Edge and I
##### Code Review & Penetration Testing
Over 70 end-to-end security engagements reviewed all key features, helping to address security implementation and design issues before shipping.
-
+
##### Windows REDTEAM
The Windows REDTEAM emulates the techniques and expertise of skilled, real-world attackers. Exploited Microsoft Edge vulnerabilities discovered through penetration testing can be addressed before public discovery and real-world exploits.
diff --git a/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md b/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md
index 70a66c3670..ac73cc7854 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md
@@ -18,8 +18,8 @@ ms.sitesec: library
ActiveX controls are small apps that let websites provide content, like videos and games, and let you interact with content, like toolbars. Unfortunately, because many ActiveX controls aren't automatically updated, they can become outdated as new versions are released. It's very important that you keep your ActiveX controls up to date because malicious software (or malware) can target security flaws in outdated controls, damaging your computer by collecting info from it, installing unwanted software, or by letting someone else control it remotely. To help avoid this situation, Internet Explorer includes a security feature called _out-of-date ActiveX control blocking_.
-We'll periodically update this page with new ActiveX controls blocked by this feature. We'll typically provide one month's advance notice before adding new controls to the list.
-
+We'll periodically update this page with new ActiveX controls blocked by this feature. We'll typically provide one month's advance notice before adding new controls to the list.
+
You will receive a notification if a webpage tries to load one of the following of ActiveX control versions:
**Java**
@@ -37,4 +37,4 @@ You will receive a notification if a webpage tries to load one of the following
| Everything below (but not including) Silverlight 5.1.50907.0 |
|--------------------------------------------------------------|
-For more information, see [Out-of-date ActiveX control blocking](out-of-date-activex-control-blocking.md) and [Internet Explorer begins blocking out-of-date ActiveX controls](http://blogs.msdn.com/b/ie/archive/2014/08/06/internet-explorer-begins-blocking-out-of-date-activex-controls.aspx). You can also view Microsoft's complete list of out-of-date ActiveX controls in the XML-based [version list](http://go.microsoft.com/fwlink/?LinkId=403864).
\ No newline at end of file
+For more information, see [Out-of-date ActiveX control blocking](out-of-date-activex-control-blocking.md) and [Internet Explorer begins blocking out-of-date ActiveX controls](https://blogs.msdn.com/b/ie/archive/2014/08/06/internet-explorer-begins-blocking-out-of-date-activex-controls.aspx). You can also view Microsoft's complete list of out-of-date ActiveX controls in the XML-based [version list](https://go.microsoft.com/fwlink/?LinkId=403864).
\ No newline at end of file
diff --git a/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md b/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md
index ad0704e0c4..5d13b1b04f 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md
@@ -2,12 +2,12 @@
ms.localizationpriority: medium
ms.mktglfcycl: support
ms.pagetype: security
-description:
+description:
author: shortpatti
ms.author: pashort
ms.manager: elizapo
ms.prod: ie11
-ms.assetid:
+ms.assetid:
title: Internet Explorer 11 delivery through automatic updates
ms.sitesec: library
ms.date: 05/22/2018
@@ -30,17 +30,17 @@ Internet Explorer 11 makes browsing the web faster, easier, safer, and more reli
Internet Explorer 11 only downloads and installs if it’s available for delivery through Automatic Updates; and Automatic Updates only offer Internet Explorer 11
to users with local administrator accounts. User’s without local administrator accounts won’t be prompted to install the update and will continue using their
-current version of Internet Explorer.
+current version of Internet Explorer.
Internet Explorer 11 replaces Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10. If you decide you don’t want Internet Explorer 11, and you’re running Windows 7 SP1 or Windows Server 2008 R2 with SP1, you can uninstall it from the **View installed updates** section of the **Uninstall an update** page of the Control Panel.
>[!Note]
->If a user installs Internet Explorer 11 and then removes it, it won’t be re-offered to that computer through Automatic Updates. Instead, the user will have to manually re-install the app.
+>If a user installs Internet Explorer 11 and then removes it, it won’t be re-offered to that computer through Automatic Updates. Instead, the user will have to manually re-install the app.
## Internet Explorer 11 automatic upgrades
-Internet Explorer 11 is offered through Automatic Updates and Windows Update as an Important update. Users running Windows 7 SP1, who have chosen to download and install updates automatically through Windows Update, are automatically upgraded to Internet Explorer 11.
-
+Internet Explorer 11 is offered through Automatic Updates and Windows Update as an Important update. Users running Windows 7 SP1, who have chosen to download and install updates automatically through Windows Update, are automatically upgraded to Internet Explorer 11.
+
Users who were automatically upgraded to Internet Explorer 11 can decide to uninstall Internet Explorer 11. However, Internet Explorer 11 will still appear as an optional update through Windows Update.
## Options for blocking automatic delivery
@@ -50,13 +50,13 @@ If you use Automatic Updates in your company, but want to stop your users from a
- **Download and use the Internet Explorer 11 Blocker Toolkit.** Includes a Group Policy template and a script that permanently blocks Internet Explorer 11 from being offered by Windows Update or Microsoft Update as a high-priority update. You can download this kit from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722).
>[!Note]
- >The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](../ie11-faq/faq-ie11-blocker-toolkit.md).
+ >The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](../ie11-faq/faq-ie11-blocker-toolkit.md).
-- **Use an update management solution to control update deployment.**
- If you already use an update management solution, like [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [System Center 2012 Configuration Manager](http://go.microsoft.com/fwlink/?LinkID=276664), you should use that instead of the Internet Explorer Blocker Toolkit.
+- **Use an update management solution to control update deployment.**
+ If you already use an update management solution, like [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [System Center 2012 Configuration Manager](https://go.microsoft.com/fwlink/?LinkID=276664), you should use that instead of the Internet Explorer Blocker Toolkit.
>[!Note]
- >If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company. This scenario is discussed in detail in the Knowledge Base article [here](http://support.microsoft.com/kb/946202).
+ >If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company. This scenario is discussed in detail in the Knowledge Base article [here](https://support.microsoft.com/kb/946202).
Additional information on Internet Explorer 11, including a Readiness Toolkit, technical overview, in-depth feature summary, and Internet Explorer 11 download is available on the [Internet Explorer 11 page of the Microsoft Edge IT Center](https://technet.microsoft.com/microsoft-edge/dn262703.aspx).
@@ -76,12 +76,12 @@ Internet Explorer 11 will be released to WSUS as an Update Rollup package. There
3. Click **Automatic Approvals**.
4. Click the rule that automatically approves an update that is classified as
- Update Rollup, and then click **Edit.**
-
- >[!Note]
- >If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else.
+ Update Rollup, and then click **Edit.**
-5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section.
+ >[!Note]
+ >If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else.
+
+5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section.
>[!Note]
>The properties for this rule will resemble the following:
When an update is in Update Rollups
Approve the update for all computers
@@ -101,9 +101,9 @@ Internet Explorer 11 will be released to WSUS as an Update Rollup package. There
12. Choose **Unapproved** in the **Approval**drop down box.
13. Check to make sure that Microsoft Internet Explorer 11 is listed as an unapproved update.
-
+
>[!Note]
- >There may be multiple updates, depending on the imported language and operating system updates.
+ >There may be multiple updates, depending on the imported language and operating system updates.
**Optional**
@@ -121,7 +121,7 @@ If you need to reset your Update Rollups packages to auto-approve, do this:
6. Check the **Update Rollups** check box, and then click **OK**.
-7. Click **OK** to close the **Automatic Approvals** dialog box.
+7. Click **OK** to close the **Automatic Approvals** dialog box.
>[!Note]
>Because auto-approval rules are only evaluated when an update is first imported into WSUS, turning this rule back on after the Internet Explorer 11 update has been imported and synchronized to the server won’t cause this update to be auto-approved.
diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md
index cd31220caa..896d0512a7 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md
@@ -17,7 +17,7 @@ You can use the Group Policy setting, **Set a default associations configuration
**To set the default browser as Internet Explorer 11**
-1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** setting.
+1. Open your Group Policy editor and go to the **Computer Configuration\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** setting.
Turning this setting on also requires you to create and store a default associations configuration file, locally or on a network share. For more information about creating this file, see [Export or Import Default Application Associations]( https://go.microsoft.com/fwlink/p/?LinkId=618268).
diff --git a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md b/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md
index 9809598bf3..ae241bde6a 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md
@@ -46,7 +46,7 @@ Wait for the message, **Blocking deployment of IE11 on the local machine. The op
For answers to frequently asked questions, see [Internet Explorer 11 Blocker Toolkit: Frequently Asked Questions](https://go.microsoft.com/fwlink/p/?LinkId=314063).
-## Automatic updates
+## Automatic updates
Internet Explorer 11 makes browsing the web faster, easier, safer, and more reliable than ever. To help customers become more secure and up-to-date, Microsoft will distribute Internet Explorer 11 through Automatic Updates and the Windows Update and Microsoft Update sites. Internet Explorer 11 will be available for users of the 32-bit and 64-bit versions of Windows 7 Service Pack 1 (SP1), and 64-bit version of Windows Server 2008 R2 SP1. This article provides an overview of the delivery process and options available for IT administrators to control how and when Internet Explorer 11 is deployed to their organization through Automatic Updates.
### Automatic delivery process
@@ -56,8 +56,8 @@ Internet Explorer 11 replaces Internet Explorer 8, Internet Explorer 9, or Inter
### Internet Explorer 11 automatic upgrades
-Internet Explorer 11 is offered through Automatic Updates and Windows Update as an Important update. Users running Windows 7 SP1, who have chosen to download and install updates automatically through Windows Update, are automatically upgraded to Internet Explorer 11.
-
+Internet Explorer 11 is offered through Automatic Updates and Windows Update as an Important update. Users running Windows 7 SP1, who have chosen to download and install updates automatically through Windows Update, are automatically upgraded to Internet Explorer 11.
+
Users who were automatically upgraded to Internet Explorer 11 can decide to uninstall Internet Explorer 11. However, Internet Explorer 11 will still appear as an optional update through Windows Update.
### Options for blocking automatic delivery
@@ -65,15 +65,15 @@ Users who were automatically upgraded to Internet Explorer 11 can decide to unin
If you use Automatic Updates in your company, but want to stop your users from automatically getting Internet Explorer 11, do one of the following:
- **Download and use the Internet Explorer 11 Blocker Toolkit.** Includes a Group Policy template and a script that permanently blocks Internet Explorer 11 from being offered by Windows Update or Microsoft Update as a high-priority update. You can download this kit from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722).
-
- >[!NOTE]
- >The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](#faq).
-
-- **Use an update management solution to control update deployment.** If you already use an update management solution, like [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [System Center 2012 Configuration Manager](http://go.microsoft.com/fwlink/?LinkID=276664), you should use that instead of the Internet Explorer Blocker Toolkit.
->[!NOTE]
->If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company.
-
+ >[!NOTE]
+ >The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](#faq).
+
+- **Use an update management solution to control update deployment.** If you already use an update management solution, like [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [System Center 2012 Configuration Manager](https://go.microsoft.com/fwlink/?LinkID=276664), you should use that instead of the Internet Explorer Blocker Toolkit.
+
+>[!NOTE]
+>If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company.
+
### Prevent automatic installation of Internet Explorer 11 with WSUS
@@ -88,7 +88,7 @@ Internet Explorer 11 will be released to WSUS as an Update Rollup package. There
4. Click the rule that automatically approves an update that is classified as Update Rollup, and then click **Edit.**
>[!NOTE]
- >If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else.
+ >If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else.
5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section.
diff --git a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md
index 4d0aae1968..304aac3c88 100644
--- a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md
+++ b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md
@@ -145,14 +145,14 @@ Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of
IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. Select a language below and download IEAK 11 from the download center:
| | | |
|---------|---------|---------|
-|[English](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) |
-|[Arabic](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[Chinese (Simplified)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Chinese(Traditional)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) |
-|[Czech](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Danish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Dutch](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) |
-|[Finnish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[German](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Greek](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) |
-|[Hebrew](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Hungarian](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Italian](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) |
-|[Japanese](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Korean](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Polish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) |
-|[Portuguese (Brazil)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |[Portuguese (Portugal)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |[Russian](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) |
-|[Spanish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |[Swedish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |[Turkish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) |
+|[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) |
+|[Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Chinese(Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) |
+|[Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) |
+|[Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) |
+|[Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) |
+|[Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) |
+|[Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |[Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |[Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) |
+|[Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |[Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |[Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) |
diff --git a/browsers/internet-explorer/ie11-faq/faq-ieak11.md b/browsers/internet-explorer/ie11-faq/faq-ieak11.md
index 3798a051af..59d6f5be4a 100644
--- a/browsers/internet-explorer/ie11-faq/faq-ieak11.md
+++ b/browsers/internet-explorer/ie11-faq/faq-ieak11.md
@@ -7,7 +7,7 @@ author: shortpatti
ms.author: pashort
ms.manager: elizapo
ms.prod: ie11
-ms.assetid:
+ms.assetid:
title: IEAK 11 - Frequently Asked Questions
ms.sitesec: library
ms.date: 05/10/2018
@@ -31,21 +31,21 @@ You can customize and install IEAK 11 on the following supported operating syste
- Windows 7 Service Pack 1 (SP1)
-- Windows Server 2008 R2 Service Pack 1 (SP1)
-
+- Windows Server 2008 R2 Service Pack 1 (SP1)
+
>[!Note]
>IEAK 11 does not support building custom packages for Windows RT.
**What can I customize with IEAK 11?**
-The IEAK 11 enables you to customize branding and settings for Internet Explorer 11. For PCs running Windows 7, the custom package also includes the Internet Explorer executable.
+The IEAK 11 enables you to customize branding and settings for Internet Explorer 11. For PCs running Windows 7, the custom package also includes the Internet Explorer executable.
>[!Note]
>Internet Explorer 11 is preinstalled on PCs running Windows 8. Therefore, the executable is not included in the customized package.
**Can IEAK 11 build custom Internet Explorer 11 packages in languages other than the language of the in-use IEAK 11 version?**
-Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard.
+Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard.
>[!Note]
>IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. To download IEAK 11, see [Internet Explorer Administration Kit (IEAK) information and downloads](../ie11-ieak/ieak-information-and-downloads.md).
@@ -99,19 +99,19 @@ Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of
IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. Select a language below and download IEAK 11 from the download center:
| | | |
|---------|---------|---------|
-|[English](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) |
-|[Arabic](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[Chinese (Simplified)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Chinese(Traditional)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) |
-|[Czech](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Danish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Dutch](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) |
-|[Finnish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[German](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Greek](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) |
-|[Hebrew](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Hungarian](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Italian](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) |
-|[Japanese](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Korean](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Polish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) |
-|[Portuguese (Brazil)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |[Portuguese (Portugal)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |[Russian](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) |
-|[Spanish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |[Swedish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |[Turkish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) |
+|[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) |
+|[Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Chinese(Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) |
+|[Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) |
+|[Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) |
+|[Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) |
+|[Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) |
+|[Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |[Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |[Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) |
+|[Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |[Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |[Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) |
## Additional resources
[Download IEAK 11](https://technet.microsoft.com/microsoft-edge/bb219517)
-[IEAK 11 overview](https://technet.microsoft.com/microsoft-edge/dn532244)
+[IEAK 11 overview](https://technet.microsoft.com/microsoft-edge/dn532244)
[IEAK 11 product documentation](https://docs.microsoft.com/internet-explorer/ie11-ieak/index)
[IEAK 11 licensing guidelines](../ie11-ieak/licensing-version-and-features-ieak11.md)
diff --git a/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md b/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md
index 21b4aa46b2..e6c5587108 100644
--- a/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md
+++ b/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md
@@ -7,7 +7,7 @@ author: shortpatti
ms.author: pashort
ms.manager: elizapo
ms.prod: ie11
-ms.assetid:
+ms.assetid:
title: Internet Explorer Administration Kit (IEAK) information and downloads
ms.sitesec: library
ms.date: 05/10/2018
@@ -34,13 +34,13 @@ To download, choose to **Open** the download or **Save** it to your hard drive f
| | | |
|---------|---------|---------|
-|[English](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) |
-|[Arabic](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[German](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Polish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) |
-|[Chinese (Simplified)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Greek](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) |[Portuguese (Brazil)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |
-|[Chinese (Traditional)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) |[Hebrew](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Portuguese (Portugal)](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |
-|[Czech](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Hungarian](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Russian](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) |
-|[Danish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Italian](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) |[Spanish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |
-|[Dutch](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) |[Japanese](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Swedish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |
-|[Finnish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[Korean](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Turkish](http://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) |
+|[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi) |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi) |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi) |
+|[Arabic](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ar-sa/ieak.msi) |[German](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/de-de/ieak.msi) |[Polish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pl-pl/ieak.msi) |
+|[Chinese (Simplified)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-cn/ieak.msi) |[Greek](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/el-gr/ieak.msi) |[Portuguese (Brazil)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-br/ieak.msi) |
+|[Chinese (Traditional)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/zh-tw/ieak.msi) |[Hebrew](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/he-il/ieak.msi) |[Portuguese (Portugal)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/pt-pt/ieak.msi) |
+|[Czech](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/cs-cz/ieak.msi) |[Hungarian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/hu-hu/ieak.msi) |[Russian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ru-ru/ieak.msi) |
+|[Danish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/da-dk/ieak.msi) |[Italian](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/it-it/ieak.msi) |[Spanish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/es-es/ieak.msi) |
+|[Dutch](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nl-nl/ieak.msi) |[Japanese](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ja-jp/ieak.msi) |[Swedish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/sv-se/ieak.msi) |
+|[Finnish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fi-fi/ieak.msi) |[Korean](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/ko-kr/ieak.msi) |[Turkish](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/tr-tr/ieak.msi) |
diff --git a/devices/hololens/hololens-install-apps.md b/devices/hololens/hololens-install-apps.md
index 3de34452cf..f21afb8e8a 100644
--- a/devices/hololens/hololens-install-apps.md
+++ b/devices/hololens/hololens-install-apps.md
@@ -79,13 +79,15 @@ Using Intune, you can also [monitor your app deployment](https://docs.microsoft.
>[!TIP]
>If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate).
-4. In the Windows Device Portal, click **Apps**.
+4. In the Windows Device Portal, click **Views** and select **Apps**.
-5. In **Install app**, select an **app package** from a folder on your computer or network. If the app package requires additional software, click **Add dependency**.
+5. Click **Add** to open the **Deploy or Install Application dialog**.
-6. In **Deploy**, click **Go** to deploy the app package and added dependencies to the connected HoloLens.
+6. Select an **app package** from a folder on your computer or network. If the app package requires additional software or framework packages, click **I want to specify framework packages**.
+
+7. Click **Next** to deploy the app package and added dependencies to the connected HoloLens.
diff --git a/devices/hololens/images/apps.png b/devices/hololens/images/apps.png
index 5cb3b7ec8f..4e00aa96fc 100644
Binary files a/devices/hololens/images/apps.png and b/devices/hololens/images/apps.png differ
diff --git a/devices/hololens/images/windows-device-portal-home-page.png b/devices/hololens/images/windows-device-portal-home-page.png
index 9604161bcd..55e4b0eaad 100644
Binary files a/devices/hololens/images/windows-device-portal-home-page.png and b/devices/hololens/images/windows-device-portal-home-page.png differ
diff --git a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md
index ae2a7ce2e0..f037f97ecb 100644
--- a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md
+++ b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md
@@ -33,9 +33,9 @@ PowerShell scripts to help set up and manage your Microsoft Surface Hub.
To successfully execute these PowerShell scripts, you will need to install the following prerequisites:
-- [Microsoft Online Services Sign-in Assistant for IT Professionals RTW](https://www.microsoft.com/download/details.aspx?id=41950)
-- [Microsoft Azure Active Directory Module for Windows PowerShell (64-bit version)](http://connect.microsoft.com/site1164/Downloads/DownloadDetails.aspx?DownloadID=59185)
-- [Windows PowerShell Module for Skype for Business Online](https://www.microsoft.com/download/details.aspx?id=39366)
+- [Microsoft Online Services Sign-in Assistant for IT Professionals RTW](https://www.microsoft.com/download/details.aspx?id=41950)
+- [Microsoft Azure Active Directory Module for Windows PowerShell (64-bit version)](https://www.powershellgallery.com/packages/MSOnline/1.1.183.17)
+- [Windows PowerShell Module for Skype for Business Online](https://www.microsoft.com/download/details.aspx?id=39366)
## PowerShell scripts for Surface Hub administrators
@@ -280,7 +280,7 @@ if ([System.String]::IsNullOrEmpty($strLyncFQDN))
PrintAction "Connecting to remote sessions. This can occasionally take a while - please do not enter input..."
-try
+try
{
$sessExchange = New-PSSession -ConfigurationName microsoft.exchange -Credential $credExchange -AllowRedirection -Authentication Kerberos -ConnectionUri "http://$strExchangeServer/powershell" -WarningAction SilentlyContinue
}
@@ -305,7 +305,7 @@ Import-PSSession $sessExchange -AllowClobber -WarningAction SilentlyContinue
Import-PSSession $sessLync -AllowClobber -WarningAction SilentlyContinue
## Create the Exchange mailbox ##
-# Note: These exchange commandlets do not always throw their errors as exceptions
+# Note: These exchange commandlets do not always throw their errors as exceptions
# Because Get-Mailbox will throw an error if the mailbox is not found
$Error.Clear()
@@ -333,7 +333,7 @@ $easpolicy = $null
try {
$easpolicy = Get-MobileDeviceMailboxPolicy $strPolicy
}
-catch {}
+catch {}
if ($easpolicy)
{
@@ -355,7 +355,7 @@ else
$easpolicy = New-MobileDeviceMailboxPolicy -Name $strPolicy -PasswordEnabled $false -AllowNonProvisionableDevices $true
if ($easpolicy)
{
- PrintSuccess "A new device policy has been created; you can use this same policy for all future Surface Hub device accounts."
+ PrintSuccess "A new device policy has been created; you can use this same policy for all future Surface Hub device accounts."
}
else
{
@@ -388,7 +388,7 @@ if ($easpolicy)
if (!((Get-Mailbox $credNewAccount.UserName).ResourceType))
{
$Error.Clear()
- # Set policy for account
+ # Set policy for account
Set-CASMailbox $credNewAccount.UserName -ActiveSyncMailboxPolicy $strPolicy
if (!$Error)
{
@@ -399,9 +399,9 @@ if ($easpolicy)
$status["ActiveSync Policy"] = "Failed to apply the EAS policy to the account."
}
$Error.Clear()
-
+
# Convert back to room mailbox
- Set-Mailbox $credNewAccount.UserName -Type Room
+ Set-Mailbox $credNewAccount.UserName -Type Room
# Loop until resource type goes back to room
for ($i = 0; ($i -lt 5) -And ((Get-Mailbox $credNewAccount.UserName).ResourceType -ne "Room"); $i++)
{
@@ -409,12 +409,12 @@ if ($easpolicy)
}
if ((Get-Mailbox $credNewAccount.UserName).ResourceType -ne "Room")
{
- # A failure to convert the mailbox back to a room is unfortunate but means the mailbox is unusable.
+ # A failure to convert the mailbox back to a room is unfortunate but means the mailbox is unusable.
$status["Mailbox Setup"] = "A mailbox was created but we could not set it to a room resource type."
}
else
{
- try
+ try
{
Set-Mailbox $credNewAccount.UserName -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true
} catch { }
@@ -424,7 +424,7 @@ if ($easpolicy)
}
$Error.Clear()
}
-
+
}
}
}
@@ -464,13 +464,13 @@ $Error.Clear()
## Configure the Account to not expire ##
PrintAction "Configuring password not to expire..."
Start-Sleep -s 20
-try
+try
{
Set-AdUser $mailbox.UserPrincipalName -PasswordNeverExpires $true -Enabled $true
}
catch
{
-
+
}
if ($Error)
@@ -503,7 +503,7 @@ $Error.Clear()
try {
Enable-CsMeetingRoom -Identity $credNewAccount.UserName -RegistrarPool $strRegPool -SipAddressType EmailAddress
}
-catch { }
+catch { }
if ($Error)
{
@@ -524,14 +524,14 @@ $strUsr = $credNewAccount.UserName
PrintAction "Summary for creation of $strUsr ($strDisplay)"
if ($status.Count -gt 0)
{
- ForEach($k in $status.Keys)
+ ForEach($k in $status.Keys)
{
$v = $status[$k]
$color = "yellow"
if ($v[0] -eq "S") { $color = "green" }
- elseif ($v[0] -eq "F")
+ elseif ($v[0] -eq "F")
{
- $color = "red"
+ $color = "red"
$v += " Go to http://aka.ms/shubtshoot"
}
@@ -611,11 +611,11 @@ function ExitIfError($strMsg)
try {
Import-Module LyncOnlineConnector
Import-Module MSOnline
-}
+}
catch
{
PrintError "Some dependencies are missing"
- PrintError "Please install the Windows PowerShell Module for Lync Online. For more information go to http://www.microsoft.com/download/details.aspx?id=39366"
+ PrintError "Please install the Windows PowerShell Module for Lync Online. For more information go to http://www.microsoft.com/download/details.aspx?id=39366"
PrintError "Please install the Azure Active Directory module for PowerShell from https://go.microsoft.com/fwlink/p/?linkid=236297"
CleanupAndFail
}
@@ -638,10 +638,10 @@ $credAdmin = $null
$credAdmin=Get-Credential -Message "Enter credentials of an Exchange and Skype for Business admin"
if (!$credadmin)
{
- CleanupAndFail "Valid admin credentials are required to create and prepare the account."
+ CleanupAndFail "Valid admin credentials are required to create and prepare the account."
}
PrintAction "Connecting to remote sessions. This can occasionally take a while - please do not enter input..."
-try
+try
{
$sessExchange = New-PSSession -ConfigurationName microsoft.exchange -Credential $credAdmin -AllowRedirection -Authentication basic -ConnectionUri "https://outlook.office365.com/powershell-liveid/" -WarningAction SilentlyContinue
}
@@ -661,7 +661,7 @@ catch
try
{
- Connect-MsolService -Credential $credAdmin
+ Connect-MsolService -Credential $credAdmin
}
catch
{
@@ -672,7 +672,7 @@ Import-PSSession $sessExchange -AllowClobber -WarningAction SilentlyContinue
Import-PSSession $sessCS -AllowClobber -WarningAction SilentlyContinue
## Create the Exchange mailbox ##
-# Note: These exchange commandlets do not always throw their errors as exceptions
+# Note: These exchange commandlets do not always throw their errors as exceptions
# Because Get-Mailbox will throw an error if the mailbox is not found
$Error.Clear()
@@ -700,7 +700,7 @@ $easpolicy = $null
try {
$easpolicy = Get-MobileDeviceMailboxPolicy $strPolicy
}
-catch {}
+catch {}
if ($easpolicy)
{
@@ -722,7 +722,7 @@ else
$easpolicy = New-MobileDeviceMailboxPolicy -Name $strPolicy -PasswordEnabled $false -AllowNonProvisionableDevices $true
if ($easpolicy)
{
- PrintSuccess "A new device policy has been created; you can use this same policy for all future Surface Hub device accounts."
+ PrintSuccess "A new device policy has been created; you can use this same policy for all future Surface Hub device accounts."
}
else
{
@@ -756,7 +756,7 @@ if ($easpolicy)
if (!((Get-Mailbox $credNewAccount.UserName).ResourceType))
{
$Error.Clear()
- # Set policy for account
+ # Set policy for account
Set-CASMailbox $credNewAccount.UserName -ActiveSyncMailboxPolicy $strPolicy
if (!$Error)
{
@@ -768,9 +768,9 @@ if ($easpolicy)
PrintError "Failed to apply policy"
}
$Error.Clear()
-
+
# Convert back to room mailbox
- Set-Mailbox $credNewAccount.UserName -Type Room
+ Set-Mailbox $credNewAccount.UserName -Type Room
# Loop until resource type goes back to room
for ($i = 0; ($i -lt 5) -And ((Get-Mailbox $credNewAccount.UserName).ResourceType -ne "Room"); $i++)
{
@@ -778,7 +778,7 @@ if ($easpolicy)
}
if ((Get-Mailbox $credNewAccount.UserName).ResourceType -ne "Room")
{
- # A failure to convert the mailbox back to a room is unfortunate but means the mailbox is unusable.
+ # A failure to convert the mailbox back to a room is unfortunate but means the mailbox is unusable.
$status["Mailbox Setup"] = "A mailbox was created but we could not set it to a room resource type."
}
else
@@ -790,7 +790,7 @@ if ($easpolicy)
}
$Error.Clear()
}
-
+
}
}
}
@@ -834,13 +834,13 @@ else
$Error.Clear()
## Configure the Account to not expire ##
PrintAction "Configuring password not to expire..."
-try
+try
{
Set-MsolUser -UserPrincipalName $credNewAccount.UserName -PasswordNeverExpires $true
}
catch
{
-
+
}
if ($Error)
@@ -883,7 +883,7 @@ $Error.Clear()
try {
Enable-CsMeetingRoom -Identity $credNewAccount.UserName -RegistrarPool $strRegPool -SipAddressType EmailAddress
}
-catch { }
+catch { }
if ($Error)
{
@@ -933,14 +933,14 @@ else
if (![System.String]::IsNullOrEmpty($strLicenses))
{
- try
+ try
{
$Error.Clear()
Set-MsolUserLicense -UserPrincipalName $credNewAccount.UserName -AddLicenses $strLicenses
}
catch
{
-
+
}
if ($Error)
{
@@ -959,7 +959,7 @@ else
}
-Write-Host
+Write-Host
## Cleanup and print results ##
Cleanup
@@ -968,14 +968,14 @@ $strUsr = $credNewAccount.UserName
PrintAction "Summary for creation of $strUsr ($strDisplay)"
if ($status.Count -gt 0)
{
- ForEach($k in $status.Keys)
+ ForEach($k in $status.Keys)
{
$v = $status[$k]
$color = "yellow"
if ($v[0] -eq "S") { $color = "green" }
- elseif ($v[0] -eq "F")
+ elseif ($v[0] -eq "F")
{
- $color = "red"
+ $color = "red"
$v += " Go to http://aka.ms/shubtshoot for help"
}
@@ -1100,7 +1100,7 @@ if ($fSfbIsOnline)
try {
Import-Module LyncOnlineConnector
}
- catch
+ catch
{
CleanupAndFail "To verify Skype for Business in online tenants you need the Lync Online Connector module from http://www.microsoft.com/download/details.aspx?id=39366"
}
@@ -1116,7 +1116,7 @@ if ($fHasOnline)
try {
Import-Module MSOnline
}
- catch
+ catch
{
CleanupAndFail "To verify accounts in online tenants you need the Azure Active Directory module for PowerShell from https://go.microsoft.com/fwlink/p/?linkid=236297"
}
@@ -1128,7 +1128,7 @@ if ($fExIsOnline)
{
$authType = [System.Management.Automation.Runspaces.AuthenticationMechanism]::Basic
}
-try
+try
{
$sessEx = $null
if ($fExIsOnline)
@@ -1139,12 +1139,12 @@ try
{
$sessEx = New-PSSession -ConfigurationName microsoft.exchange -Credential $credEx -AllowRedirection -Authentication $authType -ConnectionUri https://$strExServer/powershell -WarningAction SilentlyContinue
}
-}
+}
catch
{
}
-if (!$sessEx)
+if (!$sessEx)
{
CleanupAndFail "Connecting to Exchange Powershell failed, please validate your server is accessible and credentials are correct"
}
@@ -1184,12 +1184,12 @@ if ($fHasOnline)
{
CleanupAndFail "Internal error - could not determine MS Online credentials"
}
- try
+ try
{
PrintAction "Connecting to Azure Active Directory Services..."
Connect-MsolService -Credential $credMsol
PrintSuccess "Connected to Azure Active Directory Services"
- }
+ }
catch
{
# This really shouldn't happen unless there is a network error
@@ -1201,26 +1201,26 @@ if ($fHasOnline)
PrintAction "Importing remote sessions into the local session..."
try
{
- $importEx = Import-PSSession $sessEx -AllowClobber -WarningAction SilentlyContinue -DisableNameChecking
- $importSfb = Import-PSSession $sessSfb -AllowClobber -WarningAction SilentlyContinue -DisableNameChecking
+ $importEx = Import-PSSession $sessEx -AllowClobber -WarningAction SilentlyContinue -DisableNameChecking
+ $importSfb = Import-PSSession $sessSfb -AllowClobber -WarningAction SilentlyContinue -DisableNameChecking
}
-catch
+catch
{
}
if (!$importEx -or !$importSfb)
{
- CleanupAndFail "Import failed"
+ CleanupAndFail "Import failed"
}
PrintSuccess "Import successful"
$mailbox = $null
-try
+try
{
$mailbox = Get-Mailbox -Identity $strUpn
-}
+}
catch
-{
+{
}
if (!$mailbox)
@@ -1334,12 +1334,12 @@ if ($casMailbox)
$policy = Get-ActiveSyncMailboxPolicy -Identity $strPolicy -WarningAction SilentlyContinue -ErrorAction SilentlyContinue
Validate -Test "The policy $strPolicy does not require a device password" -Condition ($policy.PasswordEnabled -ne $True) -FailureMsg "PasswordEnabled - policy requires a device password - the Surface Hub will not be able to send mail or sync its calendar."
}
-
+
if ($policy -ne $null)
{
Validate -Test "The policy $strPolicy allows non-provisionable devices" -Condition ($policy.AllowNonProvisionableDevices -eq $null -or $policy.AllowNonProvisionableDevices -eq $true) -FailureMsg "AllowNonProvisionableDevices - policy will not allow the SurfaceHub to sync"
}
-
+
}
@@ -1409,7 +1409,7 @@ if ($fHasOnline)
}
}
-#If there is an on-prem component, we can get the authorative AD user from mailbox
+#If there is an on-prem component, we can get the authorative AD user from mailbox
if ($fHasOnPrem)
{
$accountOnPrem = $null
@@ -1512,16 +1512,16 @@ if ($online)
{
try {
Import-Module LyncOnlineConnector
- }
+ }
catch
{
PrintError "Some dependencies are missing"
- PrintError "Please install the Windows PowerShell Module for Lync Online. For more information go to http://www.microsoft.com/download/details.aspx?id=39366"
+ PrintError "Please install the Windows PowerShell Module for Lync Online. For more information go to http://www.microsoft.com/download/details.aspx?id=39366"
PrintError "Please install the Azure Active Directory module for PowerShell from https://go.microsoft.com/fwlink/p/?linkid=236297"
CleanupAndFail
}
}
-else
+else
{
$strRegPool = Read-Host "Enter the FQDN of your Skype for Business Registrar Pool"
}
@@ -1633,7 +1633,7 @@ To apply the policy, the mailbox cannot be a room type, so it has to be converte
```PowerShell
# Convert user to regular type
Set-Mailbox $strRoomUpn -Type Regular
-# Set policy for account
+# Set policy for account
Set-CASMailbox $strRoomUpn -ActiveSyncMailboxPolicy $strPolicy
```
diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md
index 10317bd4e4..836ff19136 100644
--- a/devices/surface-hub/change-history-surface-hub.md
+++ b/devices/surface-hub/change-history-surface-hub.md
@@ -44,7 +44,7 @@ New or changed topic | Description
New or changed topic | Description
--- | ---
-[Create and test a device account (Surface Hub)](create-and-test-a-device-account-surface-hub.md) | Added section for account verification and testing, with link to new Surface Hub Hardware Diagnostic app.
+[Create and test a device account (Surface Hub)](create-and-test-a-device-account-surface-hub.md) | Added section for account verification and testing, with link to new Surface Hub Hardware Diagnostic app.
## February 2018
@@ -63,7 +63,7 @@ New or changed topic | Description
## November 2017
-New or changed topic | Description
+New or changed topic | Description
--- | ---
[Enable 802.1x wired authentication](enable-8021x-wired-authentication.md) | New
[Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Added settings for 802.1x wired authentication.
@@ -73,10 +73,10 @@ New or changed topic | Description
New or changed topic | Description |
--- | ---
[Install apps on your Microsoft Surface Hub](install-apps-on-surface-hub.md) | Updated instructions to use Windows Team device family
-[Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Updated the instructions for Exchange on-premises
+[Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Updated the instructions for Exchange on-premises
[Create a device account using UI](create-a-device-account-using-office-365.md) | Updated the instructions
[Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md) | Clarified user sign-in on Surface Hub
-[Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | Removed **How to control and manage Whiteboard to Whiteboard collaboration** due to issues with the EnterpriseModernAppmanagement CSP losing state during End Session.
+[Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | Removed **How to control and manage Whiteboard to Whiteboard collaboration** due to issues with the EnterpriseModernAppmanagement CSP losing state during End Session.
| [Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Removed settings for managing Whiteboard collaboration. |
[Top support solutions for Surface Hub](support-solutions-surface-hub.md) | Added link to Surface Hub warranty information
@@ -122,7 +122,7 @@ The topics in this library have been updated for Windows 10, version 1703 (also
- [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md)
->[Looking for the Surface Hub admin guide for Windows 10, version 1607?](http://download.microsoft.com/download/7/2/5/7252051B-7E97-4781-B5DF-58D4B1A4BB88/surface-hub-admin-guide-1607.pdf)
+>[Looking for the Surface Hub admin guide for Windows 10, version 1607?](https://download.microsoft.com/download/7/2/5/7252051B-7E97-4781-B5DF-58D4B1A4BB88/surface-hub-admin-guide-1607.pdf)
## May 2017
@@ -180,5 +180,5 @@ The topics in this library have been updated for Windows 10, version 1607 (also
| [Password management (Surface Hub)](password-management-for-surface-hub-device-accounts.md) | Updates to content. |
| [Create and test a device account (Surface Hub)](create-and-test-a-device-account-surface-hub.md) | Reorganize and streamline guidance on creating a device account. |
| [Introduction to Surface Hub](intro-to-surface-hub.md) | Move Surface Hub dependencies table to [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md). |
-| [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) | Add dependency table and reorganize topic. |
+| [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) | Add dependency table and reorganize topic. |
| [Local management for Surface Hub settings](local-management-surface-hub-settings.md) | New topic. |
\ No newline at end of file
diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md
index 6b6492acc1..4e42bd0dad 100644
--- a/devices/surface-hub/create-a-device-account-using-office-365.md
+++ b/devices/surface-hub/create-a-device-account-using-office-365.md
@@ -36,7 +36,7 @@ If you prefer to use a graphical user interface, you can create a device account
3. In the Office 365 Admin Center, navigate to **Resources** in the left panel, and then click **Rooms & equipment**.
-
+
4. Click **Add** to create a new Room account. Enter a display name and email address for the account, and then click **Add**.
@@ -77,7 +77,7 @@ In order to run cmdlets used by these PowerShell scripts, the following must be
- [Microsoft Online Services Sign-In Assistant for IT Professionals BETA](https://go.microsoft.com/fwlink/?LinkId=718149)
- [Windows Azure Active Directory Module for Windows PowerShell](https://www.microsoft.com/web/handlers/webpi.ashx/getinstaller/WindowsAzurePowershellGet.3f.3f.3fnew.appids)
-- [Skype for Business Online, Windows PowerShell Module](http://www.microsoft.com/download/details.aspx?id=39366)
+- [Skype for Business Online, Windows PowerShell Module](https://www.microsoft.com/download/details.aspx?id=39366)
### Connecting to online services
@@ -137,19 +137,19 @@ Now that you're connected to the online services, you can finish setting up the
1. You’ll need to enter the account’s mail address and create a variable with that value:
- ```powershell
+ ```powershell
$mailbox = (Get-Mailbox )
```
To store the value get it from the mailbox:
- ```powershell
+ ```powershell
$strEmail = $mailbox.WindowsEmailAddress
```
Print the value:
- ```powershell
+ ```powershell
$strEmail
```
@@ -160,7 +160,7 @@ Now that you're connected to the online services, you can finish setting up the
2. Run the following cmdlet:
```powershell
- Set-CASMailbox $strEmail -ActiveSyncMailboxPolicy "SurfaceHubDeviceMobilePolicy"
+ Set-CASMailbox $strEmail -ActiveSyncMailboxPolicy "SurfaceHubDeviceMobilePolicy"
```
4. Various Exchange properties can be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
@@ -192,15 +192,15 @@ In order to enable Skype for Business, your environment will need to meet the fo
1. Start by creating a remote PowerShell session from a PC.
```PowerShell
- Import-Module LyncOnlineConnector
- $cssess=New-CsOnlineSession -Credential $cred
+ Import-Module LyncOnlineConnector
+ $cssess=New-CsOnlineSession -Credential $cred
Import-PSSession $cssess -AllowClobber
```
2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
```PowerShell
- Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool
+ Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool
"sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress
```
@@ -351,15 +351,15 @@ In order to enable Skype for Business, your environment will need to meet the fo
1. Start by creating a remote PowerShell session from a PC.
```PowerShell
- Import-Module LyncOnlineConnector
- $cssess=New-CsOnlineSession -Credential $cred
+ Import-Module LyncOnlineConnector
+ $cssess=New-CsOnlineSession -Credential $cred
Import-PSSession $cssess -AllowClobber
```
2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
```PowerShell
- Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool
+ Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool
"sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress
```
diff --git a/devices/surface-hub/device-reset-surface-hub.md b/devices/surface-hub/device-reset-surface-hub.md
index b4ee4473f6..7fce01ab55 100644
--- a/devices/surface-hub/device-reset-surface-hub.md
+++ b/devices/surface-hub/device-reset-surface-hub.md
@@ -36,27 +36,27 @@ Initiating a reset will return the device to the last cumulative Windows update,
After the reset, Surface Hub restarts the [first run program](first-run-program-surface-hub.md) again. If the Surface Hub displays a Welcome screen, that indicates that the reset encountered a problem and rolled back to the previously existing OS image.
-If you see a blank screen for long periods of time during the **Reset device** process, please wait and do not take any action.
+If you see a blank screen for long periods of time during the **Reset device** process, please wait and do not take any action.
## Reset a Surface Hub from Settings
**To reset a Surface Hub**
-1. On your Surface Hub, open **Settings**.
+1. On your Surface Hub, open **Settings**.
-
+
2. Click **Update & Security**.
-
+
3. Click **Recovery**, and then, under **Reset device**, click **Get started**.
- 
+ 
## Recover a Surface Hub from the cloud
-
+
In the Windows Recovery Environment (Windows RE), you can recover your device by downloading a factory build from the cloud and installing it on the Surface Hub. This allows devices in an unusable state to recover without requiring assistance from Microsoft Support.
>[!NOTE]
@@ -64,7 +64,7 @@ In the Windows Recovery Environment (Windows RE), you can recover your device by
### Recover a Surface Hub in a bad state
-If the device account gets into an unstable state or the Admin account is running into issues, you can use cloud recovery in **Settings**. You should only use cloud recovery when [reset](#reset-a-surface-hub-from-settings) doesn't fix the problem.
+If the device account gets into an unstable state or the Admin account is running into issues, you can use cloud recovery in **Settings**. You should only use cloud recovery when [reset](#reset-a-surface-hub-from-settings) doesn't fix the problem.
1. On your Surface Hub, go to **Settings** > **Update & security** > **Recovery**.
@@ -74,23 +74,23 @@ If the device account gets into an unstable state or the Admin account is runnin
### Recover a locked Surface Hub
-On rare occasions, a Surface Hub may encounter an error while cleaning up user and app data at the end of a session. When this happens, the device will automatically reboot and try again. But if this operation fails repeatedly, the device will be automatically locked to protect user data. To unlock it, you must reset or recover the device from [Windows RE](https://technet.microsoft.com/library/cc765966.aspx).
+On rare occasions, a Surface Hub may encounter an error while cleaning up user and app data at the end of a session. When this happens, the device will automatically reboot and try again. But if this operation fails repeatedly, the device will be automatically locked to protect user data. To unlock it, you must reset or recover the device from [Windows RE](https://technet.microsoft.com/library/cc765966.aspx).
-1. From the welcome screen, toggle the Surface Hub's power switch 3 times. Wait a few seconds between each toggle. See the [Surface Hub Site Readiness Guide (PDF)](http://download.microsoft.com/download/3/8/8/3883E991-DFDB-4E70-8D28-20B26045FC5B/Surface-Hub-Site-Readiness-Guide_EN.pdf) for help with locating the power switch.
-2. The device should automatically boot into Windows RE.
+1. From the welcome screen, toggle the Surface Hub's power switch 3 times. Wait a few seconds between each toggle. See the [Surface Hub Site Readiness Guide (PDF)](https://download.microsoft.com/download/3/8/8/3883E991-DFDB-4E70-8D28-20B26045FC5B/Surface-Hub-Site-Readiness-Guide_EN.pdf) for help with locating the power switch.
+2. The device should automatically boot into Windows RE.
3. After the Surface Hub enters Windows RE, select **Recover from the cloud**. (Optionally, you can choose **Reset**, however **Recover from the cloud** is the recommended approach.)
-
+
-
+
4. Enter the Bitlocker key (if prompted).
5. When prompted, select **Reinstall**.
6. Select **Yes** to repartition the disk.
-
+
-
+
Reset will begin after the image is downloaded from the cloud. You will see progress indicators.
diff --git a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md
index 90479cad66..fde0bb2f8a 100644
--- a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md
+++ b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md
@@ -8,7 +8,7 @@ ms.sitesec: library
author: jdeckerms
ms.author: jdecker
ms.topic: article
-ms.date: 04/12/2018
+ms.date: 08/30/2018
ms.localizationpriority: medium
---
@@ -145,17 +145,17 @@ To enable Skype for Business online, your tenant users must have Exchange mailbo
| --- | --- | --- | --- |
| Join a scheduled meeting | Skype for Business Standalone Plan 1 | E1, 3, 4, or 5 | Skype for Business Server Standard CAL |
| Initiate an ad-hoc meeting | Skype for Business Standalone Plan 2 | E 1, 3, 4, or 5 | Skype for Business Server Standard CAL or Enterprise CAL |
-| Initiate an ad-hoc meeting and dial out from a meeting to phone numbers | Skype for Business Standalone Plan 2 with PSTN Conferencing**Note** PSTN consumption billing is optional | E1 or E3 with PSTN Conferencing, or E5| Skype for Business Server Standard CAL or Enterprise CAL |
-| Give the room a phone number and make or receive calls from the room or join a dial-in conference using a phone number | Skype for Business Standalone Plan 2 with Cloud PBX and a PSTN Voice Calling plan | E1 or E3 with Cloud PBX and a PSTN Voice Calling plan, or E5 | Skype for Business Server Standard CAL or Plus CAL |
+| Initiate an ad-hoc meeting and dial out from a meeting to phone numbers | Skype for Business Standalone Plan 2 with Audio Conferencing**Note** PSTN consumption billing is optional | E1 or E3 with Audio Conferencing, or E5| Skype for Business Server Standard CAL or Enterprise CAL |
+| Give the room a phone number and make or receive calls from the room or join a dial-in conference using a phone number | Skype for Business Standalone Plan 2 with Phone System and a PSTN Voice Calling plan | E1 or E3 with Phone System and a PSTN Voice Calling plan, or E5 | Skype for Business Server Standard CAL or Plus CAL |
The following table lists the Office 365 plans and Skype for Business options.
-| O365 Plan | Skype for Business | Cloud PBX | PSTN Conferencing | PSTN Calling |
+| O365 Plan | Skype for Business | Phone System | Audio Conferencing | Calling Plans |
| --- | --- | --- | --- | --- |
| O365 Business Essentials | Included | | | |
| O365 Business Premium | Included | | | |
-| E1 | Included | Add-on | Add-on | Add-on (requires Cloud PBX add-on) |
-| E3 | Included | Add-on | Add-on | Add-on (requires Cloud PBX add-on) |
+| E1 | Included | Add-on | Add-on | Add-on (requires Phone System add-on) |
+| E3 | Included | Add-on | Add-on | Add-on (requires Phone System add-on) |
| E5 | Included | Included | Included | Add-on |
1. Start by creating a remote PowerShell session from a PC to the Skype for Business online environment.
@@ -190,7 +190,7 @@ The following table lists the Office 365 plans and Skype for Business options.
- Click **Licenses**.
- - In **Assign licenses**, select Skype for Business (Plan 2) or Skype for Business (Plan 3), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 3 license if you want to use Enterprise Voice on your Surface Hub.
+ - In **Assign licenses**, select Skype for Business (Plan 1) or Skype for Business (Plan 2), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 2 license if you want to use Enterprise Voice on your Surface Hub.
- Click **Save**.
@@ -291,7 +291,8 @@ Use this procedure if you use Exchange online.
- Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected.
- >**Important** Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.
+ >[!IMPORTANT]
+ >Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.
diff --git a/devices/surface-hub/index.md b/devices/surface-hub/index.md
index 06b5ab6450..8ff6d0d31f 100644
--- a/devices/surface-hub/index.md
+++ b/devices/surface-hub/index.md
@@ -13,9 +13,9 @@ ms.localizationpriority: medium
# Microsoft Surface Hub admin guide
->[Looking for the Surface Hub admin guide for Windows 10, version 1607?](http://download.microsoft.com/download/7/2/5/7252051B-7E97-4781-B5DF-58D4B1A4BB88/surface-hub-admin-guide-1607.pdf)
+>[Looking for the Surface Hub admin guide for Windows 10, version 1607?](https://download.microsoft.com/download/7/2/5/7252051B-7E97-4781-B5DF-58D4B1A4BB88/surface-hub-admin-guide-1607.pdf)
->[Looking for the user's guide for Surface Hub?](http://download.microsoft.com/download/3/6/B/36B6331E-0C63-4E71-A05D-EE88D05081F8/surface-hub-user-guide-en-us.pdf)
+>[Looking for the user's guide for Surface Hub?](https://download.microsoft.com/download/3/6/B/36B6331E-0C63-4E71-A05D-EE88D05081F8/surface-hub-user-guide-en-us.pdf)
Microsoft Surface Hub is an all-in-one productivity device that is intended for brainstorming, collaboration, and presentations. In order to get the maximum benefit from Surface Hub, your organization’s infrastructure and the Surface Hub itself must be properly set up and integrated. The documentation in this library describes what needs to be done both before and during setup in order to help you optimize your use of the device.
@@ -41,9 +41,9 @@ In some ways, adding your new Surface Hub is just like adding any other Microsof
| [Prepare your environment for Microsoft Surface Hub](prepare-your-environment-for-surface-hub.md) | This section contains an overview of the steps required to prepare your environment so that you can use all of the features of Surface Hub. See [Intro to Surface Hub](intro-to-surface-hub.md) for a description of how the device and its features interact with your IT environment. |
| [Set up Microsoft Surface Hub](set-up-your-surface-hub.md) | Set up instructions for Surface Hub include a setup worksheet, and a walkthrough of the first-run program. |
| [Manage Microsoft Surface Hub](manage-surface-hub.md) | How to manage your Surface Hub after finishing the first-run program. |
-| [PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) |
+| [PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) |
| [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md) | This topic provides guidance on Wi-Fi Direct security risks, how the Surface Hub has addressed those risks, and how Surface Hub administrators can configure the device for the highest level of security. | PowerShell scripts to help set up and manage your Surface Hub. |
-| [Top support solutions for Surface Hub](support-solutions-surface-hub.md) | These are the top Microsoft Support solutions for common issues experienced using Surface Hub. |
+| [Top support solutions for Surface Hub](support-solutions-surface-hub.md) | These are the top Microsoft Support solutions for common issues experienced using Surface Hub. |
| [Troubleshoot Microsoft Surface Hub](troubleshoot-surface-hub.md) | Troubleshoot common problems, including setup issues, Exchange ActiveSync errors. |
| [Troubleshoot Miracast on Surface Hub](miracast-troubleshooting.md) | Learn how to resolve Miracast issues. |
| [Useful downloads for Surface Hub administrators](surface-hub-downloads.md) | This topic provides links to useful Surface Hub documents, such as product datasheets, the site readiness guide, and user's guide. |
diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md
index 953c771d7c..c62abeb7fa 100644
--- a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md
+++ b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md
@@ -7,7 +7,7 @@ ms.prod: surface-hub
ms.sitesec: library
author: jdeckerms
ms.author: jdecker
-ms.date: 06/01/2018
+ms.date: 08/28/2018
ms.localizationpriority: medium
---
@@ -108,8 +108,7 @@ If you have a single-forest on-premises deployment with Microsoft Exchange 2013
## Disable anonymous email and IM
->[!WARNING]
->This information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
Surface Hub uses a device account to provide email and collaboration services (IM, video, voice). This device account is used as the originating identity (the “from” party) when sending email, IM, and placing calls. As this account is not coming from an individual, identifiable user, it is deemed “anonymous” because it originated from the Surface Hub's device account.
diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md b/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md
index ff5af2b652..babce30d59 100644
--- a/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md
+++ b/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md
@@ -6,7 +6,7 @@ ms.prod: surface-hub
ms.sitesec: library
author: jdeckerms
ms.author: jdecker
-ms.date: 06/01/2018
+ms.date: 08/28/2018
ms.localizationpriority: medium
---
@@ -97,8 +97,7 @@ If you have a multi-forest on-premises deployment with Microsoft Exchange 2013 o
## Disable anonymous email and IM
->[!WARNING]
->This information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
Surface Hub uses a device account to provide email and collaboration services (IM, video, voice). This device account is used as the originating identity (the “from” party) when sending email, IM, and placing calls. As this account is not coming from an individual, identifiable user, it is deemed “anonymous” because it originated from the Surface Hub's device account.
diff --git a/devices/surface-hub/surface-hub-downloads.md b/devices/surface-hub/surface-hub-downloads.md
index 8ddafa924a..689358891c 100644
--- a/devices/surface-hub/surface-hub-downloads.md
+++ b/devices/surface-hub/surface-hub-downloads.md
@@ -16,22 +16,21 @@ This topic provides links to useful Surface Hub documents, such as product datas
| Link | Description |
| --- | --- |
-| [Surface Hub Site Readiness Guide (PDF)](http://download.microsoft.com/download/3/8/8/3883E991-DFDB-4E70-8D28-20B26045FC5B/Surface-Hub-Site-Readiness-Guide_EN.pdf) | Make sure your site is ready for Surface Hub, including structural and power requirements, and get technical specs for Surface Hub. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/27/aa/27aa7dd7-7cb7-40ea-9bd6-c7de0795f68c.mov?n=04.07.16_installation_video_01_site_readiness.mov) |
-| [Surface Hub Setup Guide (English, French, Spanish) (PDF)](http://download.microsoft.com/download/0/1/6/016363A4-8602-4F01-8281-9BE5C814DC78/Setup-Guide_EN-FR-SP.pdf) | Get a quick overview of how to set up the environment for your new Surface Hub. |
-| [Surface Hub Quick Reference Guide (PDF)](http://download.microsoft.com/download/9/E/E/9EE660F8-3FC6-4909-969E-89EA648F06DB/Surface%20Hub%20Quick%20Reference%20Guide_en-us.pdf) | Use this quick reference guide to get information about key features and functions of the Surface Hub. |
-| [Surface Hub User Guide (PDF)](http://download.microsoft.com/download/3/6/B/36B6331E-0C63-4E71-A05D-EE88D05081F8/surface-hub-user-guide-en-us.pdf) | Learn how to use Surface Hub in scheduled or ad-hoc meetings. Invite remote participants, use the built-in tools, save data from your meeting, and more. |
+| [Surface Hub Site Readiness Guide (PDF)](https://download.microsoft.com/download/3/8/8/3883E991-DFDB-4E70-8D28-20B26045FC5B/Surface-Hub-Site-Readiness-Guide_EN.pdf) | Make sure your site is ready for Surface Hub, including structural and power requirements, and get technical specs for Surface Hub. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/27/aa/27aa7dd7-7cb7-40ea-9bd6-c7de0795f68c.mov?n=04.07.16_installation_video_01_site_readiness.mov) |
+| [Surface Hub Setup Guide (English, French, Spanish) (PDF)](https://download.microsoft.com/download/0/1/6/016363A4-8602-4F01-8281-9BE5C814DC78/Setup-Guide_EN-FR-SP.pdf) | Get a quick overview of how to set up the environment for your new Surface Hub. |
+| [Surface Hub Quick Reference Guide (PDF)](https://download.microsoft.com/download/9/E/E/9EE660F8-3FC6-4909-969E-89EA648F06DB/Surface%20Hub%20Quick%20Reference%20Guide_en-us.pdf) | Use this quick reference guide to get information about key features and functions of the Surface Hub. |
+| [Surface Hub User Guide (PDF)](https://download.microsoft.com/download/3/6/B/36B6331E-0C63-4E71-A05D-EE88D05081F8/surface-hub-user-guide-en-us.pdf) | Learn how to use Surface Hub in scheduled or ad-hoc meetings. Invite remote participants, use the built-in tools, save data from your meeting, and more. |
| [Surface Hub Replacement PC Drivers](https://www.microsoft.com/download/details.aspx?id=52210) | The Surface Hub Replacement PC driver set is available for those customers who have chosen to disable the Surface Hub’s internal PC and use an external computer with their 84” or 55” Surface Hub. This download is meant to be used with the Surface Hub Admin Guide , which contains further details on configuring a Surface Hub Replacement PC. |
-| [Surface Hub SSD Replacement Guide (PDF)](http://download.microsoft.com/download/1/F/2/1F202254-7156-459F-ABD2-39CF903A25DE/surface-hub-ssd-replacement-guide_en-us.pdf) | Learn how to replace the solid state drive (SSD) for the 55- and 84-inch Surface Hub. |
-| [Microsoft Surface Hub Rollout and Adoption Success Kit (ZIP)](http://download.microsoft.com/download/F/A/3/FA3ADEA4-4966-456B-8BDE-0A594FD52C6C/Surface_Hub_Adoption_Kit_Final_0519.pdf) | Best practices for generating awareness and implementing change management to maximize adoption, usage, and benefits of Microsoft Surface Hub. The Rollout and Adoption Success Kit zip file includes the Rollout and Adoption Success Kit detailed document, Surface Hub presentation, demo guidance, awareness graphics, and more. |
-| [Unpacking Guide for 84-inch Surface Hub (PDF)](http://download.microsoft.com/download/5/2/B/52B4007E-D8C8-4EED-ACA9-FEEF93F6055C/84_Unpacking_Guide_English_French-Spanish.pdf) | Learn how to unpack your 84-inch Surface Hub efficiently and safely. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/75/2b/752b73dc-6e9d-4692-8ba1-0f9fc03bff6b.mov?n=04.07.16_installation_video_03_unpacking_84.mov) |
-| [Unpacking Guide for 55-inch Surface Hub (PDF)](http://download.microsoft.com/download/2/E/7/2E7616A2-F936-4512-8052-1E2D92DFD070/55_Unpacking_Guide_English-French-Spanish.PDF) | Learn how to unpack your 55-inch Surface Hub efficiently and safely. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/a9/d6/a9d6b4d7-d33f-4e8b-be92-28f7fc2c06d7.mov?n=04.07.16_installation_video_02_unpacking_55.mov) |
-| [Wall Mounting and Assembly Guide (PDF)](http://download.microsoft.com/download/7/0/2/702485E3-B55E-4DE8-B5DD-3B56F90DCF5D/SH-Guide_WACG_Wall_Mounts_EN-FR-ES-NL-DE-IT-PT-AR-DA-FI-NO-SV.pdf) | Detailed instructions on how to safely and securely assemble the wall brackets, and how to mount your Surface Hub onto them. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/bf/4d/bf4d6f06-370c-45ee-88e6-c409873914e8.mov?n=04.07.16_installation_video_05_wall_mount.mov) |
-| [Floor-Supported Mounting and Assembly Guide (PDF)](http://download.microsoft.com/download/7/0/2/702485E3-B55E-4DE8-B5DD-3B56F90DCF5D/SH-Guide_WACG_Floor_Support_Mount_EN-FR-ES-NL-DE-IT-AR-DA-FI-NO-SV.pdf) | Detailed instructions on how to safely and securely assemble the floor-supported brackets, and how to mount your Surface Hub onto them. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/ed/de/edde468a-e1d4-4ce8-8b61-c4527dd25c81.mov?n=04.07.16_installation_video_06_floor_support_mount.mov) |
-| [Rolling Stand Mounting and Assembly Guide (PDF)](http://download.microsoft.com/download/7/0/2/702485E3-B55E-4DE8-B5DD-3B56F90DCF5D/SH-Guide_WACG_Rolling_Stands_EN-FR-ES-NL-DE-IT-AR-DA-FI-NO-SV.pdf) | Detailed instructions on how to safely and securely assemble the rolling stand, and how to mount your Surface Hub onto it. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/1f/94/1f949613-3e4a-41e3-ad60-fe8aa7134115.mov?n=04.07.16_installation_video_04_rolling_stand_mount.mov) |
-| [Mounts and Stands Datasheet (PDF)](http://download.microsoft.com/download/5/0/1/501F98D9-1BCC-4448-A1DB-47056CEE33B6/20160711_Surface_Hub_Mounts_and_Stands_Datasheet.pdf) | Specifications and prices for all Surface Hub add-on stands and mounts that turn your workspace into a Surface Hub workspace. |
-| [Surface Hub Stand and Wall Mount Specifications (PDF)](http://download.microsoft.com/download/7/A/7/7A75BD0F-5A46-4BCE-B313-A80E47AEB581/20160720_Combined_Stand_Wall_Mount_Drawings.pdf) | Illustrated specifications for the 55” and 84” Surface Hub rolling stands, wall mounts, and floor-supported wall mounts. |
+| [Surface Hub SSD Replacement Guide (PDF)](https://download.microsoft.com/download/1/F/2/1F202254-7156-459F-ABD2-39CF903A25DE/surface-hub-ssd-replacement-guide_en-us.pdf) | Learn how to replace the solid state drive (SSD) for the 55- and 84-inch Surface Hub. |
+| [Microsoft Surface Hub Rollout and Adoption Success Kit (ZIP)](https://download.microsoft.com/download/F/A/3/FA3ADEA4-4966-456B-8BDE-0A594FD52C6C/Surface_Hub_Adoption_Kit_Final_0519.pdf) | Best practices for generating awareness and implementing change management to maximize adoption, usage, and benefits of Microsoft Surface Hub. The Rollout and Adoption Success Kit zip file includes the Rollout and Adoption Success Kit detailed document, Surface Hub presentation, demo guidance, awareness graphics, and more. |
+| [Unpacking Guide for 84-inch Surface Hub (PDF)](https://download.microsoft.com/download/5/2/B/52B4007E-D8C8-4EED-ACA9-FEEF93F6055C/84_Unpacking_Guide_English_French-Spanish.pdf) | Learn how to unpack your 84-inch Surface Hub efficiently and safely. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/75/2b/752b73dc-6e9d-4692-8ba1-0f9fc03bff6b.mov?n=04.07.16_installation_video_03_unpacking_84.mov) |
+| [Unpacking Guide for 55-inch Surface Hub (PDF)](https://download.microsoft.com/download/2/E/7/2E7616A2-F936-4512-8052-1E2D92DFD070/55_Unpacking_Guide_English-French-Spanish.PDF) | Learn how to unpack your 55-inch Surface Hub efficiently and safely. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/a9/d6/a9d6b4d7-d33f-4e8b-be92-28f7fc2c06d7.mov?n=04.07.16_installation_video_02_unpacking_55.mov) |
+| [Wall Mounting and Assembly Guide (PDF)](https://download.microsoft.com/download/7/0/2/702485E3-B55E-4DE8-B5DD-3B56F90DCF5D/SH-Guide_WACG_Wall_Mounts_EN-FR-ES-NL-DE-IT-PT-AR-DA-FI-NO-SV.pdf) | Detailed instructions on how to safely and securely assemble the wall brackets, and how to mount your Surface Hub onto them. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/bf/4d/bf4d6f06-370c-45ee-88e6-c409873914e8.mov?n=04.07.16_installation_video_05_wall_mount.mov) |
+| [Floor-Supported Mounting and Assembly Guide (PDF)](https://download.microsoft.com/download/7/0/2/702485E3-B55E-4DE8-B5DD-3B56F90DCF5D/SH-Guide_WACG_Floor_Support_Mount_EN-FR-ES-NL-DE-IT-AR-DA-FI-NO-SV.pdf) | Detailed instructions on how to safely and securely assemble the floor-supported brackets, and how to mount your Surface Hub onto them. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/ed/de/edde468a-e1d4-4ce8-8b61-c4527dd25c81.mov?n=04.07.16_installation_video_06_floor_support_mount.mov) |
+| [Rolling Stand Mounting and Assembly Guide (PDF)](https://download.microsoft.com/download/7/0/2/702485E3-B55E-4DE8-B5DD-3B56F90DCF5D/SH-Guide_WACG_Rolling_Stands_EN-FR-ES-NL-DE-IT-AR-DA-FI-NO-SV.pdf) | Detailed instructions on how to safely and securely assemble the rolling stand, and how to mount your Surface Hub onto it. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/1f/94/1f949613-3e4a-41e3-ad60-fe8aa7134115.mov?n=04.07.16_installation_video_04_rolling_stand_mount.mov) |
+| [Mounts and Stands Datasheet (PDF)](https://download.microsoft.com/download/5/0/1/501F98D9-1BCC-4448-A1DB-47056CEE33B6/20160711_Surface_Hub_Mounts_and_Stands_Datasheet.pdf) | Specifications and prices for all Surface Hub add-on stands and mounts that turn your workspace into a Surface Hub workspace. |
+| [Surface Hub Stand and Wall Mount Specifications (PDF)](https://download.microsoft.com/download/7/A/7/7A75BD0F-5A46-4BCE-B313-A80E47AEB581/20160720_Combined_Stand_Wall_Mount_Drawings.pdf) | Illustrated specifications for the 55” and 84” Surface Hub rolling stands, wall mounts, and floor-supported wall mounts. |
-
\ No newline at end of file
diff --git a/devices/surface-hub/surface-hub-recovery-tool.md b/devices/surface-hub/surface-hub-recovery-tool.md
index ef1cd24725..262bcc5d2a 100644
--- a/devices/surface-hub/surface-hub-recovery-tool.md
+++ b/devices/surface-hub/surface-hub-recovery-tool.md
@@ -14,9 +14,9 @@ ms.localizationpriority: medium
# Using the Surface Hub Recovery Tool
-The [Microsoft Surface Hub Recovery Tool](https://www.microsoft.com/download/details.aspx?id=52210) helps you re-image your Surface Hub Solid State Drive (SSD) using a Windows 10 desktop device, without calling support or replacing the SSD. With this tool, you can reimage an SSD that has an unknown Administrator password, boot errors, was unable to complete a cloud recovery, or for a device that has an older version of the operating system. The tool will not fix physically damaged SSDs.
+The [Microsoft Surface Hub Recovery Tool](https://www.microsoft.com/download/details.aspx?id=52210) helps you re-image your Surface Hub Solid State Drive (SSD) using a Windows 10 desktop device, without calling support or replacing the SSD. With this tool, you can reimage an SSD that has an unknown Administrator password, boot errors, was unable to complete a cloud recovery, or for a device that has an older version of the operating system. The tool will not fix physically damaged SSDs.
-To re-image the Surface Hub SSD using the Recovery Tool, you'll need to remove the SSD from the Surface Hub, connect the drive to the USB-to-SATA cable, and then connect the cable to the desktop PC on which the Recovery Tool is installed. For more information on how to remove the existing drive from your Surface Hub, please refer to the [Surface Hub SSD Replacement Guide (PDF)](http://download.microsoft.com/download/1/F/2/1F202254-7156-459F-ABD2-39CF903A25DE/surface-hub-ssd-replacement-guide_en-us.pdf).
+To re-image the Surface Hub SSD using the Recovery Tool, you'll need to remove the SSD from the Surface Hub, connect the drive to the USB-to-SATA cable, and then connect the cable to the desktop PC on which the Recovery Tool is installed. For more information on how to remove the existing drive from your Surface Hub, please refer to the [Surface Hub SSD Replacement Guide (PDF)](https://download.microsoft.com/download/1/F/2/1F202254-7156-459F-ABD2-39CF903A25DE/surface-hub-ssd-replacement-guide_en-us.pdf).
>[!IMPORTANT]
>Do not let the device go to sleep or interrupt the download of the image file.
@@ -31,15 +31,15 @@ If the tool is unsuccessful in reimaging your drive, please contact [Surface Hub
- Internet access
- Open USB 2.0 or greater port
- USB-to-SATA cable
-- 10 GB of free disk space on the host computer
-- SSDs shipped with Surface Hub or a SSD provided by Support as a replacement. SSDs not supplied by Microsoft are not supported.
+- 10 GB of free disk space on the host computer
+- SSDs shipped with Surface Hub or a SSD provided by Support as a replacement. SSDs not supplied by Microsoft are not supported.
### Recommended
- High-speed Internet connection
- Open USB 3.0 port
- USB 3.0 or higher USB-to-SATA cable
-- The imaging tool was tested with the following make and model of cables:
+- The imaging tool was tested with the following make and model of cables:
- Startech USB312SAT3CB
- Rosewill RCUC16001
- Ugreen 20231
@@ -57,7 +57,7 @@ Install Surface Hub Recovery Tool on the host PC.
## Run Surface Hub Recovery Tool
-1. On the host PC, select the **Start** button, scroll through the alphabetical list on the left, and select the recovery tool shortcut.
+1. On the host PC, select the **Start** button, scroll through the alphabetical list on the left, and select the recovery tool shortcut.
@@ -69,11 +69,11 @@ Install Surface Hub Recovery Tool on the host PC.
-4. click **Yes** to download the image. Time to download the recovery image is dependent on internet connection speeds. On an average corporate connection, it can take up to an hour to download the 8GB image file.
+4. click **Yes** to download the image. Time to download the recovery image is dependent on internet connection speeds. On an average corporate connection, it can take up to an hour to download the 8GB image file.
-5. When the download is complete, the tool instructs you to connect an SSD drive. If the tool is unable to locate the attached drive, there is a good chance that the cable being used is not reporting the name of the SSD to Windows. The imaging tool must find the name of the drive as "LITEON L CH-128V2S USB Device" before it can continue. For more information on how to remove the existing drive from your Surface Hub, please refer to the [Surface Hub SSD Replacement Guide (PDF)](http://download.microsoft.com/download/1/F/2/1F202254-7156-459F-ABD2-39CF903A25DE/surface-hub-ssd-replacement-guide_en-us.pdf).
+5. When the download is complete, the tool instructs you to connect an SSD drive. If the tool is unable to locate the attached drive, there is a good chance that the cable being used is not reporting the name of the SSD to Windows. The imaging tool must find the name of the drive as "LITEON L CH-128V2S USB Device" before it can continue. For more information on how to remove the existing drive from your Surface Hub, please refer to the [Surface Hub SSD Replacement Guide (PDF)](https://download.microsoft.com/download/1/F/2/1F202254-7156-459F-ABD2-39CF903A25DE/surface-hub-ssd-replacement-guide_en-us.pdf).
diff --git a/devices/surface/customize-the-oobe-for-surface-deployments.md b/devices/surface/customize-the-oobe-for-surface-deployments.md
index 0d4a26f5e9..4218ee9ba8 100644
--- a/devices/surface/customize-the-oobe-for-surface-deployments.md
+++ b/devices/surface/customize-the-oobe-for-surface-deployments.md
@@ -22,7 +22,7 @@ This article walks you through the process of customizing the Surface out-of-box
It is common practice in a Windows deployment to customize the user experience for the first startup of deployed computers — the out-of-box experience, or OOBE.
>[!NOTE]
->OOBE is also often used to describe the phase, or configuration pass, of Windows setup during which the user experience is displayed. For more information about the OOBE phase of setup, see [How Configuration Passes Work](http://msdn.microsoft.com/library/windows/hardware/dn898581.aspx).
+>OOBE is also often used to describe the phase, or configuration pass, of Windows setup during which the user experience is displayed. For more information about the OOBE phase of setup, see [How Configuration Passes Work](https://msdn.microsoft.com/library/windows/hardware/dn898581.aspx).
In some scenarios, you may want to provide complete automation to ensure that at the end of a deployment, computers are ready for use without any interaction from the user. In other scenarios, you may want to leave key elements of the experience for users to perform necessary actions or select between important choices. For administrators deploying to Surface devices, each of these scenarios presents a unique challenge to overcome.
@@ -30,8 +30,8 @@ This article provides a summary of the scenarios where a deployment might requir
>[!NOTE]
>Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see:
->- [Deploy Windows 10 with the Microsoft Deployment Toolkit](http://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit)
->- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](http://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager)
+>- [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit)
+>- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](https://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager)
diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md
index f6235d2f28..cbc27f2355 100644
--- a/devices/surface/step-by-step-surface-deployment-accelerator.md
+++ b/devices/surface/step-by-step-surface-deployment-accelerator.md
@@ -263,7 +263,7 @@ After you have prepared the USB drive for boot, the next step is to generate off
21. In the **Deployment Workbench** under the **Media** folder, right-click the newly created **MEDIA001** and click **Update Media Content**, as shown in Figure 12. This will update the media files with the content of the **Microsoft Surface Deployment Accelerator** deployment share.
-
+
*Figure 12. Select the Update Media Content option*
22. The **Update Media Content** window is displayed and shows the progress as the media files are created. When the process completes, click **Finish.**
@@ -313,7 +313,7 @@ The **2 – Create Windows Reference Image** task sequence is used to perform a
Like the **1 – Deploy Microsoft Surface** task sequence, the **2 – Create Windows Reference Image** task sequence performs a deployment of the unaltered Windows image directly from the installation media. Creation of a reference image should always be performed on a virtual machine. Using a virtual machine as your reference system helps to ensure that the resulting image is compatible with different hardware configurations.
>[!NOTE]
->Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and System Center Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information, see [Deploy a Windows 10 image using MDT 2013 Update 2](http://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt).
+>Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and System Center Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information, see [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt).
In addition to the information required by the **1 – Deploy Microsoft Surface** task sequence, you will also be prompted to capture an image when you run this task sequence on your reference virtual machine. The **Location** and **File name** fields are automatically populated with the proper information for your deployment share. All that you need to do is select the **Capture an image of this reference computer** option when you are prompted on the **Capture Image** page of the Windows Deployment Wizard.
diff --git a/education/index.md b/education/index.md
index c78b456b9e..20840df5df 100644
--- a/education/index.md
+++ b/education/index.md
@@ -125,245 +125,6 @@ ms.date: 10/30/2017
-
diff --git a/education/trial-in-a-box/educator-tib-get-started.md b/education/trial-in-a-box/educator-tib-get-started.md
index b9fffc43b3..3eb30e45f8 100644
--- a/education/trial-in-a-box/educator-tib-get-started.md
+++ b/education/trial-in-a-box/educator-tib-get-started.md
@@ -1,6 +1,6 @@
---
title: Educator Trial in a Box Guide
-description: Need help or have a question about using Microsoft Education? Start here.
+description: Need help or have a question about using Microsoft Education? Start here.
keywords: support, troubleshooting, education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, Microsoft Store for Education, Set up School PCs
ms.prod: w10
ms.technology: Windows
@@ -28,8 +28,8 @@ ms.date: 03/18/2018
| [](#edu-task3) | **Looking to foster collaboration, communication, and critical thinking in the classroom?** Launch [Microsoft Teams](#edu-task3) and learn how to set up digital classroom discussions, respond to student questions, and organize class content. |
| [](#edu-task4) | **Trying to expand classroom creativity and interaction between students?** Open [OneNote](#edu-task4) and create an example group project for your class. |
| [](#edu-task5) | **Curious about telling stories through video?** Try the [Photos app](#edu-task5) to make your own example video. |
-| [](#edu-task6) | **Want to teach kids to further collaborate and problem solve?** Play with [Minecraft: Education Edition](#edu-task6) to see how it can be used as a collaborative and versatile platform across subjects to encourage 21st century skills. |
-| [](#edu-task7) | **Want to provide a personal math tutor for your students?** Use [Windows Ink and the Math Assistant feature](#edu-task7) in OneNote to give students step-by-step instructions and interactive 2D graphs for math problems. |
+| [](#edu-task6) | **Want to teach kids to further collaborate and problem solve?** Play with [Minecraft: Education Edition](#edu-task6) to see how it can be used as a collaborative and versatile platform across subjects to encourage 21st century skills. |
+| [](#edu-task7) | **Want to provide a personal math tutor for your students?** Use [Windows Ink and the Math Assistant feature](#edu-task7) in OneNote to give students step-by-step instructions and interactive 2D graphs for math problems. |
| | |
@@ -40,21 +40,21 @@ ms.date: 03/18/2018
-
+
## 1. Log in and connect to the school network
To try out the educator tasks, start by logging in as a teacher.
1. Turn on **Device A** and ensure you plug in the PC to an electrical outlet.
2. Connect **Device A** to your school's Wi-Fi network or connect with a local Ethernet connection using the Ethernet adapter included in this kit.
>**Note**: If your Wi-Fi network requires a web browser login page to connect to the Internet, connect using the Ethernet port. If your Wi-Fi network has additional restrictions that will prevent the device from connecting to the internet without registration, consider connecting **Device A** to a different network.
-
+
3. Log in to **Device A** using the **Teacher Username** and **Teacher Password** included in the **Credentials Sheet** located in your kit.
-
+
## 2. Significantly improve student reading speed and comprehension
> [!VIDEO https://www.youtube.com/embed/GCzSAslq_2Y]
@@ -65,7 +65,7 @@ To try out the educator tasks, start by logging in as a teacher.
Learning Tools and the Immersive Reader can be used in the Microsoft Edge browser, Microsoft Word, and Microsoft OneNote to:
* Increase fluency for English language learners
* Build confidence for emerging readers
-* Provide text decoding solutions for students with learning differences such as dyslexia
+* Provide text decoding solutions for students with learning differences such as dyslexia
**Try this!**
@@ -75,7 +75,7 @@ Learning Tools and the Immersive Reader can be used in the Microsoft Edge browse
3. Select the **View** menu.
-4. Select the **Immersive Reader** button.
+4. Select the **Immersive Reader** button.
@@ -92,7 +92,7 @@ Learning Tools and the Immersive Reader can be used in the Microsoft Edge browse
-
+
## 3. Spark communication, critical thinking, and creativity in the classroom
> [!VIDEO https://www.youtube.com/embed/riQr4Dqb8B8]
@@ -100,7 +100,7 @@ Learning Tools and the Immersive Reader can be used in the Microsoft Edge browse
-Microsoft Teams is a digital hub that brings conversations, content, and apps together in one place. This guided tour walks you through the essential teaching features of the app. Then, through interactive prompts, experience how you can use this tool in your own classroom to spark digital classroom discussions, respond to student questions, organize content, and more!
+Microsoft Teams is a digital hub that brings conversations, content, and apps together in one place. This guided tour walks you through the essential teaching features of the app. Then, through interactive prompts, experience how you can use this tool in your own classroom to spark digital classroom discussions, respond to student questions, organize content, and more!
Take a guided tour of Microsoft Teams and test drive this digital hub.
@@ -113,7 +113,7 @@ Take a guided tour of Microsoft Teams and test drive this digital hub.
-
+
## 4. Expand classroom collaboration and interaction between students
> [!VIDEO https://www.youtube.com/embed/dzDSWMb_fIE]
@@ -125,7 +125,7 @@ Microsoft OneNote organizes curriculum and lesson plans for teachers and student
**Try this!**
See how a group project comes together with opportunities to interact with other students and collaborate with peers. This one works best with the digital pen, included with your Trial in a Box.
-When you're not using the pen, just use the magnet to stick it to the left side of the screen until you need it again.
+When you're not using the pen, just use the magnet to stick it to the left side of the screen until you need it again.
1. On the **Start** menu, click the OneNote shortcut named **Imagine Giza** to open the **Reimagine the Great Pyramid of Giza project**.
@@ -136,12 +136,12 @@ When you're not using the pen, just use the magnet to stick it to the left side
- - Type anywhere on the page! Just click your cursor where you want to place text.
- - Use the checkmark in the **Home** tab to keep track of completed tasks.
+ - Type anywhere on the page! Just click your cursor where you want to place text.
+ - Use the checkmark in the **Home** tab to keep track of completed tasks.
- - To find information without leaving OneNote, use the Researcher tool found under the Insert tab.
+ - To find information without leaving OneNote, use the Researcher tool found under the Insert tab.
@@ -160,18 +160,18 @@ The Photos app now has a built-in video editor, making it easy for you and your
**Try this!**
Use video to create a project summary.
-1. Check you have the latest version of Microsoft Photos. Open the **Start** menu and search for **Store**. Select the **See more** button (**…**) and select **Downloads and updates**. Select **Get updates**.
+1. Check you have the latest version of Microsoft Photos. Open the **Start** menu and search for **Store**. Select the **See more** button (**…**) and select **Downloads and updates**. Select **Get updates**.
-2. Open Microsoft Edge and visit http://aka.ms/PhotosTIB to download a zip file of the project media.
+2. Open Microsoft Edge and visit http://aka.ms/PhotosTIB to download a zip file of the project media.
-3. Once the download has completed, open the zip file and select **Extract** > **Extract all**. Select **Browse** and choose the **Pictures** folder as the destination, and then select **Extract**.
+3. Once the download has completed, open the zip file and select **Extract** > **Extract all**. Select **Browse** and choose the **Pictures** folder as the destination, and then select **Extract**.
-4. In the **Start** menu, search for **Photos** or select the Photos tile to launch the app.
+4. In the **Start** menu, search for **Photos** or select the Photos tile to launch the app.
5. Select the first video to preview it full screen. Select **Edit & Create**, then select **Create a video with text**.
- 1. If you don't see the **Edit & Create** menu, select the video and the menu will appear at the top of the screen.
+ 1. If you don't see the **Edit & Create** menu, select the video and the menu will appear at the top of the screen.
-6. Name your project “Laser Maze Project.” Hit Enter to continue.
+6. Name your project “Laser Maze Project.” Hit Enter to continue.
7. Select **Add photos and videos** and then **From my collection**. Scroll to select the 6 additional videos and select **Add**.
@@ -179,12 +179,12 @@ Use video to create a project summary.
-9. Select the first card in the Storyboard (the video of the project materials) and select **Text**, type a title in, a text style, a layout, and select **Done**.
+9. Select the first card in the Storyboard (the video of the project materials) and select **Text**, type a title in, a text style, a layout, and select **Done**.
-10. Select the third card in the Storyboard (the video of the children assembling the maze) and select **Trim**. Drag the trim handle on the left to shorten the duration of the clip and select **Done**.
+10. Select the third card in the Storyboard (the video of the children assembling the maze) and select **Trim**. Drag the trim handle on the left to shorten the duration of the clip and select **Done**.
11. Select the last card on the Storyboard and select **3D effects**.
- 1. Position the playback indicator to be roughly 1 second into the video clip, or when the boy moves down to examine the laser.
+ 1. Position the playback indicator to be roughly 1 second into the video clip, or when the boy moves down to examine the laser.
2. Find the **lightning bolt** effect and click or drag to add it to the scene. Rotate, scale, and position the effect so it looks like the lightning is coming out of the laser beam and hitting the black back of the mirror.
3. Position the blue anchor over the end of the laser pointer in the video and toggle on **Attach to a point** for the lightning bolt effect to anchor the effect in the scene.
4. Play back your effect.
@@ -196,30 +196,30 @@ Use video to create a project summary.
1. The music will update automatically to match the length of your video project, even as you make changes.
2. If you don’t see more than a few music options, confirm that you’re connected to Wi-Fi and then close and re-open Microsoft Photos (returning to your project via the **Albums** tab). Additional music files should download in the background.
-13. You can adjust the volume for the background music using the **Music volume** button.
+13. You can adjust the volume for the background music using the **Music volume** button.
14. Preview your video to see how it all came together.
-15. Select **Export or share** and select either the **Small** or **Medium** file size. You can share your video to social media, email, or another apps.
+15. Select **Export or share** and select either the **Small** or **Medium** file size. You can share your video to social media, email, or another apps.
Check out this use case video of the Photos team partnering with the Bureau Of Fearless Ideas in Seattle to bring the Photos app to local middle school students: https://www.youtube.com/watch?v=0dFFAu6XwPg
-
+
## 6. Get kids to further collaborate and problem solve
> [!VIDEO https://www.youtube.com/embed/QI_bRNUugog]
-Minecraft: Education Edition provides an immersive environment to develop creativity, collaboration, and problem-solving in an immersive environment where the only limit is your imagination.
+Minecraft: Education Edition provides an immersive environment to develop creativity, collaboration, and problem-solving in an immersive environment where the only limit is your imagination.
**Try this!**
Today, we'll explore a Minecraft world through the eyes of a student.
-1. Connect the included mouse to your computer for optimal interaction.
+1. Connect the included mouse to your computer for optimal interaction.
2. Open Microsoft Edge and visit https://aka.ms/lessonhub.
@@ -242,7 +242,7 @@ Today, we'll explore a Minecraft world through the eyes of a student.
* **A** moves left.
* **S** moves right.
* **D** moves backward.
-
+
10. Use your mouse as your "eyes". Just move it to look around.
11. For a bird's eye view, double-tap the SPACE BAR. Now press the SPACE BAR to fly higher. And then hold the SHIFT key to safely land.
@@ -265,7 +265,7 @@ Today, we'll explore a Minecraft world through the eyes of a student.
-
+
## 7. Use Windows Ink to provide a personal math tutor for your students
The **Math Assistant** and **Ink Replay** features available in the OneNote app for Windows 10 and OneNote Online give your students step-by-step instructions on how to solve their math problems and help them visualize math functions on an interactive 2D graph.
@@ -293,7 +293,7 @@ To solve the equation 3x+4=7, follow these instructions:
-3. On the **Draw** tab, click the **Math** button.
+3. On the **Draw** tab, click the **Math** button.
@@ -312,7 +312,7 @@ To graph the equation 3x+4=7, follow these instructions:
-2. Click the **Insert on Page** button below the graph to add a screenshot of the graph to your page.
+2. Click the **Insert on Page** button below the graph to add a screenshot of the graph to your page.
@@ -327,7 +327,7 @@ Bring out the best in students by providing a platform for collaborating, explor
## Update your apps
-Microsoft Education works hard to bring you the most current Trial in a Box program experience. As a result, you may need to update your apps to get our latest innovations.
+Microsoft Education works hard to bring you the most current Trial in a Box program experience. As a result, you may need to update your apps to get our latest innovations.
For more information about checking for updates, and how to optionally turn on automatic app updates, see the following articles:
diff --git a/education/windows/enable-s-mode-on-surface-go-devices.md b/education/windows/enable-s-mode-on-surface-go-devices.md
index e7a0c40d46..de525d8e81 100644
--- a/education/windows/enable-s-mode-on-surface-go-devices.md
+++ b/education/windows/enable-s-mode-on-surface-go-devices.md
@@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: edu
ms.localizationpriority: medium
author: kaushika-msft
-ms.author:
+ms.author:
ms.date: 07/30/2018
---
@@ -47,14 +47,14 @@ process](https://docs.microsoft.com/windows/deployment/windows-10-deployment-sce
The resulting xml should look like this…
Copy
- ```
+ ```
- 1
@@ -69,7 +69,7 @@ process](https://docs.microsoft.com/windows/deployment/windows-10-deployment-sce
```
> Note: in the above example, C:\\mount\\ is the local directory used to mount
- > the offline image.
+ > the offline image.
5. Commit the image changes and unmount the image
Copy
@@ -86,7 +86,7 @@ Your Windows 10 Pro (1803) image now has S mode enabled and is ready to deploy t
Education customers who wish to avoid the additional overhead associated with Windows image creation, customization, and deployment can enable S mode on a per-device basis. Performing the following steps on a Surface Go device will enable S mode on an existing installation of Windows 10 Pro (1803).
1. Create a bootable WinPE media. See [Create a bootable Windows PE USB
- drive](http://msdn.microsoft.com/library/windows/hardware/dn938386.aspx) for details.
+ drive](https://msdn.microsoft.com/library/windows/hardware/dn938386.aspx) for details.
2. Create an unattend.xml answer file, adding the
amd64_Microsoft_Windows_CodeIntegrity component to Pass 2 offline Servicing
@@ -95,12 +95,12 @@ Education customers who wish to avoid the additional overhead associated with Wi
Copy
```
- 1
@@ -126,7 +126,7 @@ Upon reboot, you should find your Surface Go device now is now in S mode.
|------------------------ |-----------------------|
|DISM fails to apply the unattend.xml because the OS drive is encrypted. | This is one reason why it’s best to enable S mode before setting up and configuring a device. If the OS drive has already been encrypted, you’ll need to fully decrypt the drive before you can enable S mode. |
|Unattend.xml has been applied and dism reports success. However, when I boot the device, it’s not in S mode. This can happen when a device was booted to Windows 10 Pro before S mode was enabled. To resolve this issue, do the following: | 1. **Run** “shutdown.exe -p -f” to force a complete shutdown. 2. Hold the **vol-up** button while pressing the **power** button to power on the device. Continue to hold **vol-up** until you see the Surface UEFI settings. 3. Under **Security** find the **Secure Boot** option and disable it. 4. With SecureBoot disabled choose **exit** -\> **restart now** to exit UEFI settings and reboot the device back to Windows. 5. Confirm that S mode is now properly enabled. 6. Once you’ve confirmed S mode, you should re-enable Secure Boot… repeat the above steps, choosing to **Enable** Secure Boot from the UEFI securitysettings.
-
+
## Additional Info
[Windows 10 deployment scenarios](https://docs.microsoft.com/en-us/windows/deployment/windows-10-deployment-scenarios)
diff --git a/education/windows/windows-editions-for-education-customers.md b/education/windows/windows-editions-for-education-customers.md
index 0c32462f68..77282ce61d 100644
--- a/education/windows/windows-editions-for-education-customers.md
+++ b/education/windows/windows-editions-for-education-customers.md
@@ -32,7 +32,7 @@ Windows 10 Pro Education builds on the commercial version of Windows 10 Pro and
For Cortana[1](#footnote1),
- If you're using version 1607, Cortana is removed.
- If you're using new devices with version 1703, Cortana is turned on by default.
-- If you're upgrading from version 1607 to version 1703, Cortana will be enabled.
+- If you're upgrading from version 1607 to version 1703, Cortana will be enabled.
You can use the **AllowCortana** policy to turn Cortana off. For more information, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md).
@@ -51,7 +51,7 @@ Windows 10 Education builds on Windows 10 Enterprise and provides the enterprise
For Cortana1,
- If you're using version 1607, Cortana1 is removed.
- If you're using new devices with version 1703, Cortana is turned on by default.
-- If you're upgrading from version 1607 to version 1703, Cortana will be enabled.
+- If you're upgrading from version 1607 to version 1703, Cortana will be enabled.
You can use the **AllowCortana** policy to turn Cortana off. For more information, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md).
@@ -63,7 +63,7 @@ For any other questions, contact [Microsoft Customer Service and Support](https:
## Related topics
* [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md)
-* [Windows deployment for education](http://aka.ms/edudeploy)
+* [Windows deployment for education](https://aka.ms/edudeploy)
* [Windows 10 upgrade paths](https://go.microsoft.com/fwlink/?LinkId=822787)
* [Volume Activation for Windows 10](https://go.microsoft.com/fwlink/?LinkId=822788)
* [Plan for volume activation](https://go.microsoft.com/fwlink/?LinkId=822789)
diff --git a/mdop/agpm/index.md b/mdop/agpm/index.md
index 4d7ec7cd8c..c3b4414d7c 100644
--- a/mdop/agpm/index.md
+++ b/mdop/agpm/index.md
@@ -61,14 +61,14 @@ In addition to the product documentation available online, supplemental product
MDOP is a suite of products that can help streamline desktop deployment, management, and support across the enterprise. MDOP is available as an additional subscription for Software Assurance customers.
-**Evaluate MDOP**
-MDOP is also available for test and evaluation to [MSDN](http://msdn.microsoft.com/subscriptions/downloads/default.aspx?PV=42:178) and [TechNet](http://technet.microsoft.com/subscriptions/downloads/default.aspx?PV=42:178) subscribers in accordance with MDSN and TechNet agreements.
+**Evaluate MDOP**
+MDOP is also available for test and evaluation to [MSDN](https://msdn.microsoft.com/subscriptions/downloads/default.aspx?PV=42:178) and [TechNet](https://technet.microsoft.com/subscriptions/downloads/default.aspx?PV=42:178) subscribers in accordance with MDSN and TechNet agreements.
-**Download MDOP**
+**Download MDOP**
MDOP subscribers can download the software at the [Microsoft Volume Licensing website (MVLS)](https://go.microsoft.com/fwlink/?LinkId=166331).
-**Purchase MDOP**
-Visit the enterprise [Purchase Windows Enterprise Licensing](http://www.microsoft.com/windows/enterprise/how-to-buy.aspx) website to find out how to purchase MDOP for your business.
+**Purchase MDOP**
+Visit the enterprise [Purchase Windows Enterprise Licensing](https://www.microsoft.com/windows/enterprise/how-to-buy.aspx) website to find out how to purchase MDOP for your business.
diff --git a/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md b/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md
index 5dec2b8fb8..4f285ff5cf 100644
--- a/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md
+++ b/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md
@@ -50,7 +50,7 @@ The hardware requirements are applicable to all versions.
Operating System
Edition
Service Pack
-
System Architecture
+
Achitectural SKU
@@ -74,31 +74,21 @@ The hardware requirements are applicable to all versions.
Windows 8
-
Professional or Enterprise Edition
+
Pro or Enterprise Edition
x86 and x64
-
-
-**Note**
The following software prerequisites are installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, the following products must be installed first.
-
- **Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2005 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=119961) (https://go.microsoft.com/fwlink/?LinkId=119961). For version 4.5 SP2 of the App-V client, download Vcredist\_x86.exe from [Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=169360) (https://go.microsoft.com/fwlink/?LinkId=169360).
+ - **Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)**—For more information about installing Microsoft Core XML Services (MSXML) 6.0 SP1 (x86), see [Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)](https://go.microsoft.com/fwlink/?LinkId=63266) (https://go.microsoft.com/fwlink/?LinkId=63266).
-- **Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)**—For more information about installing Microsoft Core XML Services (MSXML) 6.0 SP1 (x86), see [Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)](https://go.microsoft.com/fwlink/?LinkId=63266) (https://go.microsoft.com/fwlink/?LinkId=63266).
-
-
-
-**Note**
For the Application Virtualization (App-V) 4.6 Desktop Client, the following additional software prerequisite is installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, you must also install with the other prerequisites listed.
- **Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=150700) (https://go.microsoft.com/fwlink/?LinkId=150700).
-
-
### Software Requirements for Versions that Precede App-V 4.6 SP2
@@ -113,7 +103,7 @@ For the Application Virtualization (App-V) 4.6 Desktop Client, the following add
Operating System
Edition
Service Pack
-
System Architecture
+
Achitectural SKU
@@ -121,33 +111,26 @@ For the Application Virtualization (App-V) 4.6 Desktop Client, the following add
Windows XP
Professional Edition
SP2 or SP3
-
x86
+
x86 and x64
Windows Vista
Business, Enterprise, or Ultimate Edition
No service pack, SP1, or SP2
-
x86
+
x86 and x64
Windows 7¹
Professional, Enterprise, or Ultimate Edition
No service pack or SP1
-
x86
+
x86 and x64
-
-
-
¹Supported for App-V 4.5 SP1 and SP2, App-V 4.6 and 4.6 SP1 only
-**Note**
-The Application Virtualization (App-V) 4.6 Desktop Client supports 32-bit and 64-bit versions of these operating systems.
+The Application Virtualization (App-V) 4.6 Desktop Client supports x86 and x64 SKUs of these operating systems.
-
-
-**Note**
The following software prerequisites are installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, the following products must be installed first.
- **Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2005 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=119961) (https://go.microsoft.com/fwlink/?LinkId=119961). For version 4.5 SP2 of the App-V client, download Vcredist\_x86.exe from [Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=169360) (https://go.microsoft.com/fwlink/?LinkId=169360).
@@ -156,25 +139,16 @@ The following software prerequisites are installed automatically if you are usin
- **Microsoft Application Error Reporting**—The installation program for this software is included in the **Support\\Watson** folder in the self-extracting archive file.
-
-
-**Note**
For the Application Virtualization (App-V) 4.6 Desktop Client, the following additional software prerequisite is installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, you must also install with the other prerequisites listed.
- **Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=150700) (https://go.microsoft.com/fwlink/?LinkId=150700).
-
-
## Application Virtualization Client for Remote Desktop Services
-
Following are the recommended hardware and software requirements for the Application Virtualization Client for Remote Desktop Services. The requirements are listed first for appv461\_3, followed by the requirements for versions that preceded App-V 4.6 SP2.
-**Note**
The Application Virtualization (App-V) Client for Remote Desktop Services requires no additional processor or RAM resources beyond the requirements of the host operating system.
-
-
### Hardware Requirements
The hardware requirements are applicable to all versions.
@@ -199,7 +173,7 @@ The hardware requirements are applicable to all versions.
Operating System
Edition
Service Pack
-
System Architecture
+
Achitectural SKU
@@ -207,13 +181,13 @@ The hardware requirements are applicable to all versions.
Windows Server 2003 R2
Standard Edition, Enterprise Edition, or Datacenter Edition
SP2
-
x86
+
x86 and x64
Windows Server 2008
Standard, Enterprise, or Datacenter Edition
SP2
-
x86
+
x86 and x64
Windows Server 2008 R2
@@ -225,14 +199,11 @@ The hardware requirements are applicable to all versions.
Windows Server 2012
Standard, Enterprise, or Datacenter Edition
-
x86 or x64
+
x64
-
-
-**Note**
The following software prerequisites are installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, the following products must be installed first.
- **Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2005 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=119961) (https://go.microsoft.com/fwlink/?LinkId=119961). For version 4.5 SP2 of the App-V client, download Vcredist\_x86.exe from [Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=169360) (https://go.microsoft.com/fwlink/?LinkId=169360).
@@ -241,15 +212,10 @@ The following software prerequisites are installed automatically if you are usin
- **Microsoft Application Error Reporting**—The installation program for this software is included in the **Support\\Watson** folder in the self-extracting archive file.
-
-
-**Note**
For the Application Virtualization (App-V) 4.6 Desktop Client, the following additional software prerequisite is installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, you must also install with the other prerequisites listed.
- **Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=150700) (https://go.microsoft.com/fwlink/?LinkId=150700).
-
-
### Software Requirements for Versions that Precede App-V 4.6 SP2
@@ -264,7 +230,7 @@ For the Application Virtualization (App-V) 4.6 Desktop Client, the following add
Operating System
Edition
Service Pack
-
System Architecture
+
Achitectural SKU
@@ -272,19 +238,19 @@ For the Application Virtualization (App-V) 4.6 Desktop Client, the following add
Windows Server 2003
Standard Edition, Enterprise Edition, or Datacenter Edition
SP1 or SP2
-
x86
+
x86 and x64
Windows Server 2003 R2
Standard Edition, Enterprise Edition, or Datacenter Edition
No service pack or SP2
-
x86
+
x86 and x64
Windows Server 2008
Standard, Enterprise, or Datacenter Edition
SP1 or SP2
-
x86
+
x86 and x64
Windows Server 2008 R2
@@ -295,31 +261,11 @@ For the Application Virtualization (App-V) 4.6 Desktop Client, the following add
-
-
-**Note**
-The Application Virtualization (App-V) 4.6 Client for Remote Desktop Services supports 32-bit and 64-bit versions of these operating systems.
-
-
+The Application Virtualization (App-V) 4.6 Client for Remote Desktop Services supports x86 and x64 SKUs of these operating systems.
## Related topics
-
-
-[Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md)
-
-[Application Virtualization System Requirements](application-virtualization-system-requirements.md)
-
-[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md)
-
-[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md)
-
-[How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md)
-
-
-
-
-
-
-
-
-
+- [Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md)
+- [Application Virtualization System Requirements](application-virtualization-system-requirements.md)
+- [How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md)
+- [How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md)
+- [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md)
diff --git a/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md b/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md
index 01ed9e88ed..9186e17f03 100644
--- a/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md
+++ b/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md
@@ -86,7 +86,7 @@ The following list outlines the supported operating systems for running the App-
Windows 8
-
Professional or Enterprise Edition
+
Pro or Enterprise Edition
x86 and x64
diff --git a/mdop/appv-v5/about-app-v-50-sp3.md b/mdop/appv-v5/about-app-v-50-sp3.md
index c085c1698f..6aa8082174 100644
--- a/mdop/appv-v5/about-app-v-50-sp3.md
+++ b/mdop/appv-v5/about-app-v-50-sp3.md
@@ -99,7 +99,7 @@ Review the following information before you start the upgrade:
Note
-
To use the App-V client user interface, download the existing version from [Microsoft Application Virtualization 5.0 Client UI Application](http://www.microsoft.com/download/details.aspx?id=41186).
+
To use the App-V client user interface, download the existing version from [Microsoft Application Virtualization 5.0 Client UI Application](https://www.microsoft.com/download/details.aspx?id=41186).
@@ -190,7 +190,7 @@ Complete the following steps to upgrade each component of the App-V infrastructu
Management database
-
To install or upgrade, see [SQL scripts to install or upgrade the App-V 5.0 SP3 Management Server database fail](http://support.microsoft.com/kb/3031340).
+
To install or upgrade, see [SQL scripts to install or upgrade the App-V 5.0 SP3 Management Server database fail](https://support.microsoft.com/kb/3031340).
Reporting database
@@ -720,7 +720,7 @@ Cmdlet help is available in the following formats:
On TechNet as web pages
-
See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](http://technet.microsoft.com/library/dn520245.aspx).
+
See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://technet.microsoft.com/library/dn520245.aspx).
diff --git a/mdop/appv-v5/about-app-v-51-dynamic-configuration.md b/mdop/appv-v5/about-app-v-51-dynamic-configuration.md
index b88cdd9529..45009f6404 100644
--- a/mdop/appv-v5/about-app-v-51-dynamic-configuration.md
+++ b/mdop/appv-v5/about-app-v-51-dynamic-configuration.md
@@ -1,877 +1,905 @@
---
-title: About App-V 5.1 Dynamic Configuration
-description: About App-V 5.1 Dynamic Configuration
+title: About App-V 5.1 dynamic configuration
+description: You can use the dynamic configuration to customize an App-V 5.1 package for a user. Use the following information to create or edit an existing dynamic configuration file.
author: jamiejdt
-ms.assetid: 6cc1027c-576f-483b-ad0d-bb700594a92c
+ms.assetid: 35bc9908-d502-4a9c-873f-8ee17b6d9d74
ms.pagetype: mdop, appcompat, virtualization
ms.mktglfcycl: deploy
ms.sitesec: library
ms.prod: w10
-ms.date: 06/16/2016
+ms.date: 08/28/2018
+ms.author: pashort
---
+# About App-V 5.1 dynamic configuration
+With dynamic configuration, you can edit the dynamic configuration file to customize how an App-V 5.1 package runs for a user or group. Package customization removes the need to resequence packages using the desired settings. It also provides a way to keep package content and custom settings independent.
-# About App-V 5.1 Dynamic Configuration
+Virtual application packages contain a manifest that provides all the core information for the package. This information includes the defaults for the package settings and determines settings in the most basic form (with no additional customization).
+When a package gets created, the sequencer generates default deployment and user configuration .xml files automatically using the package manifest data. Therefore, these generated files reflect the default settings configured during sequencing. If you apply these files to a package in the form generated by the sequencer, the packages have the same default settings that came from their manifest.
-You can use the dynamic configuration to customize an App-V 5.1 package for a user. Use the following information to create or edit an existing dynamic configuration file.
+Use these generated files to make changes, if necessary, which doesn’t directly affect the package. If you want to add, delete or update the configuration files, make your changes about the default values in the manifest information.
-When you edit the dynamic configuration file it customizes how an App-V 5.1 package will run for a user or group. This helps to provide a more convenient method for package customization by removing the need to re-sequence packages using the desired settings, and provides a way to keep package content and custom settings independent.
+>[!TIP]
+>The order in which the files read are:
UserConfig.xml
DeploymentConfig.xml
Manifest
The first entry represents what gets read last. Therefore, its content takes precedence, and all packages inherently contain and provide default settings from the package manifest.
If customizing the DeploymentConfig.xml file and apply the customized settings, the default settings in the package manifest get overridden.
If customizing the UserConfig.xml and apply the customized settings, the default settings for both the deployment configuration and the package manifest get overridden.
-## Advanced: Dynamic Configuration
+## User configuration file contents (UserConfig.xml)
+The UserConfig file provides configuration settings that get applied for a specific user when deploying the package to a computer running the App-V 5.1 client. These settings don’t affect any other users on the client.
+Use the UserConfig file to specify or modify custom settings for a package:
-Virtual application packages contain a manifest that provides all the core information for the package. This information includes the defaults for the package settings and determines settings in the most basic form (with no additional customization). If you want to adjust these defaults for a particular user or group, you can create and edit the following files:
+- Extensions integrated into the native system per user: shortcuts, file-type associations, URL protocols, AppPaths, software clients and COM
+- Virtual subsystems: application objects, environment variables, registry modifications, services and fonts
+- Scripts (user context only)
+- Managing authority (for controlling co-existence of package with App-V 4.6)
-- User Configuration file
+### Header
-- Deployment configuration file
+The header of a dynamic user configuration file looks like:
-The previous .xml files specify package settings and allow for packages to be customized without directly affecting the packages. When a package is created, the sequencer automatically generates default deployment and user configuration .xml files using the package manifest data. Therefore, these automatically generated configuration files simply reflect the default settings that the package innately as from how things were configured during sequencing. If you apply these configuration files to a package in the form generated by the sequencer, the packages will have the same default settings that came from their manifest. This provides you with a package-specific template to get started if any of the defaults must be changed.
-
-**Note**
-The following information can only be used to modify sequencer generated configuration files to customize packages to meet specific user or group requirements.
-
-
-
-### Dynamic Configuration file contents
-
-All of the additions, deletions, and updates in the configuration files need to be made in relation to the default values specified by the package's manifest information. Review the following table:
-
-
-
-
-
-
-
-
User Configuration .xml file
-
-
-
Deployment Configuration .xml file
-
-
-
Package Manifest
-
-
-
-
-
-
-The previous table represents how the files will be read. The first entry represents what will be read last, therefore, its content takes precedence. Therefore, all packages inherently contain and provide default settings from the package manifest. If a deployment configuration .xml file with customized settings is applied, it will override the package manifest defaults. If a user configuration .xml file with customized settings is applied prior to that, it will override both the deployment configuration and the package manifest defaults.
-
-The following list displays more information about the two file types:
-
-- **User Configuration File (UserConfig)** – Allows you to specify or modify custom settings for a package. These settings will be applied for a specific user when the package is deployed to a computer running the App-V 5.1 client.
-
-- **Deployment Configuration File (DeploymentConfig)** – Allows you to specify or modify the default settings for a package. These settings will be applied for all users when a package is deployed to a computer running the App-V 5.1 client.
-
-To customize the settings for a package for a specific set of users on a computer or to make changes that will be applied to local user locations such as HKCU, the UserConfig file should be used. To modify the default settings of a package for all users on a machine or to make changes that will be applied to global locations such as HKEY\_LOCAL\_MACHINE and the all users folder, the DeploymentConfig file should be used.
-
-The UserConfig file provides configuration settings that can be applied to a single user without affecting any other users on a client:
-
-- Extensions that will be integrated into the native system per user:- shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients and COM
-
-- Virtual Subsystems:- Application Objects, Environment variables, Registry modifications, Services and Fonts
-
-- Scripts (User context only)
-
-- Managing Authority (for controlling co-existence of package with App-V 4.6)
-
-The DeploymentConfig file provides configuration settings in two sections, one relative to the machine context and one relative to the user context providing the same capabilities listed in the UserConfig list above:
-
-- All UserConfig settings above
-
-- Extensions that can only be applied globally for all users
-
-- Virtual Subsystems that can be configured for global machine locations e.g. registry
-
-- Product Source URL
-
-- Scripts (Machine context only)
-
-- Controls to Terminate Child Processes
-
-### File structure
-
-The structure of the App-V 5.1 Dynamic Configuration file is explained in the following section.
-
-### Dynamic User Configuration file
-
-**Header** - the header of a dynamic user configuration file is as follows:
-
-<?xml version="1.0" encoding="utf-8"?><UserConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="http://schemas.microsoft.com/appv/2010/userconfiguration">
-
-The **PackageId** is the same value as exists in the Manifest file.
-
-**Body** - the body of the Dynamic User Configuration file can include all the app extension points that are defined in the Manifest file, as well as information to configure virtual applications. There are four subsections allowed in the body:
-
-1. **Applications** - All app-extensions that are contained in the Manifest file within a package are assigned with an Application ID, which is also defined in the manifest file. This allows you to enable or disable all the extensions for a given application within a package. The **Application ID** must exist in the Manifest file or it will be ignored.
-
- <UserConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="http://schemas.microsoft.com/appv/2010/userconfiguration">
-
- <Applications>
-
- <!-- No new application can be defined in policy. AppV Client will ignore any application ID that is not also in the Manifest file -->
-
- <Application Id="{a56fa627-c35f-4a01-9e79-7d36aed8225a}" Enabled="false">
-
- </Application>
-
- </Applications>
-
- …
-
- </UserConfiguration>
-
-2. **Subsystems** - AppExtensions and other subsystems are arranged as subnodes under the <Subsystems>:
-
- <UserConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="http://schemas.microsoft.com/appv/2010/userconfiguration">
-
- <Subsystems>
-
- ..
-
- </Subsystems>
-
- ..
-
- </UserConfiguration>
-
- Each subsystem can be enabled/disabled using the “**Enabled**” attribute. Below are the various subsystems and usage samples.
-
- **Extensions:**
-
- Some subsystems (Extension Subsystems) control Extensions. Those subsystems are:- shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients and COM
-
- Extension Subsystems can be enabled and disabled independently of the content. Thus if Shortcuts are enabled, The client will use the shortcuts contained within the manifest by default. Each Extension Subsystem can contain an <Extensions> node. If this child element is present, the client will ignore the content in the Manifest file for that subsystem and only use the content in the configuration file.
-
- Example using the shortcuts subsystem:
-
- 1. If the user defined this in either the dynamic or deployment config file:
-
- **<Shortcuts Enabled="true">**
-
- **<Extensions>**
-
- ...
-
- **</Extensions>**
-
- **</Shortcuts>**
-
- Content in the manifest will be ignored.
-
- 2. If the user defined only the following:
-
- **<Shortcuts Enabled="true"/>**
-
- Then the content in the Manifest will be integrated during publishing.
-
- 3. If the user defines the following
-
- **<Shortcuts Enabled="true">**
-
- **<Extensions/>**
-
- **</Shortcuts>**
-
- Then all the shortcuts within the manifest will still be ignored. There will be no shortcuts integrated.
-
- The supported Extension Subsystems are:
-
- **Shortcuts:** This controls shortcuts that will be integrated into the local system. Below is a sample with 2 shortcuts:
-
- <Subsystems>
-
- <Shortcuts Enabled="true">
-
- <Extensions>
-
- <Extension Category="AppV.Shortcut">
-
- <Shortcut>
-
- <File>\[{Common Programs}\]\\Microsoft Contoso\\Microsoft ContosoApp Filler 2010.lnk</File>
-
- <Target>\[{PackageRoot}\]\\Contoso\\ContosoApp.EXE</Target>
-
- <Icon>\[{Windows}\]\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\inficon.exe</Icon>
-
- <Arguments />
-
- <WorkingDirectory />
-
- <AppUserModelId>ContosoApp.Filler.3</AppUserModelId>
-
- <Description>Fill out dynamic forms to gather and reuse information throughout the organization using Microsoft ContosoApp.</Description>
-
- <Hotkey>0</Hotkey>
-
- <ShowCommand>1</ShowCommand>
-
- <ApplicationId>\[{PackageRoot}\]\\Contoso\\ContosoApp.EXE</ApplicationId>
-
- </Shortcut>
-
- </Extension>
-
- <Extension Category="AppV.Shortcut">
-
- <Shortcut>
-
- <File>\[{AppData}\]\\Microsoft\\Contoso\\Recent\\Templates.LNK</File>
-
- <Target>\[{AppData}\]\\Microsoft\\Templates</Target>
-
- <Icon />
-
- <Arguments />
-
- <WorkingDirectory />
-
- <AppUserModelId />
-
- <Description />
-
- <Hotkey>0</Hotkey>
-
- <ShowCommand>1</ShowCommand>
-
- <!-- Note the ApplicationId is optional -->
-
- </Shortcut>
-
- </Extension>
-
- </Extensions>
-
- </Shortcuts>
-
- **File-Type Associations:** Associates File-types with programs to open by default as well as setup the context menu. (MIME types can also be setup using this susbsystem). Sample File-type Association is below:
-
- <FileTypeAssociations Enabled="true">
-
- <Extensions>
-
- <Extension Category="AppV.FileTypeAssociation">
-
- <FileTypeAssociation>
-
- <FileExtension MimeAssociation="true">
-
- <Name>.docm</Name>
-
- <ProgId>contosowordpad.DocumentMacroEnabled.12</ProgId>
-
- <PerceivedType>document</PerceivedType>
-
- <ContentType>application/vnd.ms-contosowordpad.document.macroEnabled.12</ContentType>
-
- <OpenWithList>
-
- <ApplicationName>wincontosowordpad.exe</ApplicationName>
-
- </OpenWithList>
-
- <OpenWithProgIds>
-
- <ProgId>contosowordpad.8</ProgId>
-
- </OpenWithProgIds>
-
- <ShellNew>
-
- <Command />
-
- <DataBinary />
-
- <DataText />
-
- <FileName />
-
- <NullFile>true</NullFile>
-
- <ItemName />
-
- <IconPath />
-
- <MenuText />
-
- <Handler />
-
- </ShellNew>
-
- </FileExtension>
-
- <ProgId>
-
- <Name>contosowordpad.DocumentMacroEnabled.12</Name>
-
- <DefaultIcon>\[{Windows}\]\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\contosowordpadicon.exe,15</DefaultIcon>
-
- <Description>Blah Blah Blah</Description>
-
- <FriendlyTypeName>\[{FOLDERID\_ProgramFilesX86}\]\\Microsoft Contoso 14\\res.dll,9182</FriendlyTypeName>
-
- <InfoTip>\[{FOLDERID\_ProgramFilesX86}\]\\Microsoft Contoso 14\\res.dll,1424</InfoTip>
-
- <EditFlags>0</EditFlags>
-
- <ShellCommands>
-
- <DefaultCommand>Open</DefaultCommand>
-
- <ShellCommand>
-
- <ApplicationId>{e56fa627-c35f-4a01-9e79-7d36aed8225a}</ApplicationId>
-
- <Name>Edit</Name>
-
- <FriendlyName>&Edit</FriendlyName>
-
- <CommandLine>"\[{PackageRoot}\]\\Contoso\\WINcontosowordpad.EXE" /vu "%1"</CommandLine>
-
- </ShellCommand>
-
- </ShellCommand>
-
- <ApplicationId>{e56fa627-c35f-4a01-9e79-7d36aed8225a}</ApplicationId>
-
- <Name>Open</Name>
-
- <FriendlyName>&Open</FriendlyName>
-
- <CommandLine>"\[{PackageRoot}\]\\Contoso\\WINcontosowordpad.EXE" /n "%1"</CommandLine>
-
- <DropTargetClassId />
-
- <DdeExec>
-
- <Application>mscontosowordpad</Application>
-
- <Topic>ShellSystem</Topic>
-
- <IfExec>\[SHELLNOOP\]</IfExec>
-
- <DdeCommand>\[SetForeground\]\[ShellNewDatabase "%1"\]</DdeCommand>
-
- </DdeExec>
-
- </ShellCommand>
-
- </ShellCommands>
-
- </ProgId>
-
- </FileTypeAssociation>
-
- </Extension>
-
- </Extensions>
-
- </FileTypeAssociations>
-
- **URL Protocols**: This controls the URL Protocols that are integrated into the local registry of the client machine e.g. “mailto:”.
-
- <URLProtocols Enabled="true">
-
- <Extensions>
-
- <Extension Category="AppV.URLProtocol">
-
- <URLProtocol>
-
- <Name>mailto</Name>
-
- <ApplicationURLProtocol>
-
- <DefaultIcon>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE,-9403</DefaultIcon>
-
- <EditFlags>2</EditFlags>
-
- <Description />
-
- <AppUserModelId />
-
- <FriendlyTypeName />
-
- <InfoTip />
-
- <SourceFilter />
-
- <ShellFolder />
-
- <WebNavigableCLSID />
-
- <ExplorerFlags>2</ExplorerFlags>
-
- <CLSID />
-
- <ShellCommands>
-
- <DefaultCommand>open</DefaultCommand>
-
- <ShellCommand>
-
- <ApplicationId>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE</ApplicationId>
-
- <Name>open</Name>
-
- <CommandLine>\[{ProgramFilesX86}\\Microsoft Contoso\\Contoso\\contosomail.EXE" -c OEP.Note /m "%1"</CommandLine>
-
- <DropTargetClassId />
-
- <FriendlyName />
-
- <Extended>0</Extended>
-
- <LegacyDisable>0</LegacyDisable>
-
- <SuppressionPolicy>2</SuppressionPolicy>
-
- <DdeExec>
-
- <NoActivateHandler />
-
- <Application>contosomail</Application>
-
- <Topic>ShellSystem</Topic>
-
- <IfExec>\[SHELLNOOP\]</IfExec>
-
- <DdeCommand>\[SetForeground\]\[ShellNewDatabase "%1"\]</DdeCommand>
-
- </DdeExec>
-
- </ShellCommand>
-
- </ShellCommands>
-
- </ApplicationURLProtocol>
-
- </URLProtocol>
-
- </Extension>
-
- </Extension>
-
- </URLProtocols>
-
- **Software Clients**: Allows the app to register as an Email client, news reader, media player and makes the app visible in the Set Program Access and Computer Defaults UI. In most cases you should only need to enable and disable it. There is also a control to enable and disable the email client specifically if you want the other clients still enabled except for that client.
-
- <SoftwareClients Enabled="true">
-
- <ClientConfiguration EmailEnabled="false" />
-
- </SoftwareClients>
-
- AppPaths:- If an application for example contoso.exe is registered with an apppath name of “myapp”, it allows you type “myapp” under the run menu and it will open contoso.exe.
-
- <AppPaths Enabled="true">
-
- <Extensions>
-
- <Extension Category="AppV.AppPath">
-
- <AppPath>
-
- <ApplicationId>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE</ApplicationId>
-
- <Name>contosomail.exe</Name>
-
- <ApplicationPath>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE</ApplicationPath>
-
- <PATHEnvironmentVariablePrefix />
-
- <CanAcceptUrl>false</CanAcceptUrl>
-
- <SaveUrl />
-
- </AppPath>
-
- </Extension>
-
- </Extensions>
-
- </AppPaths>
-
- **COM**: Allows an Application register Local COM servers. Mode can be Integration, Isolated or Off. When Isol.
-
- <COM Mode="Isolated"/>
-
- **Other Settings**:
-
- In addition to Extensions, other subsystems can be enabled/disabled and edited:
-
- **Virtual Kernel Objects**:
-
- <Objects Enabled="false" />
-
- **Virtual Registry**: Used if you want to set a registry in the Virtual Registry within HKCU
-
- <Registry Enabled="true">
-
- <Include>
-
- <Key Path="\\REGISTRY\\USER\\\[{AppVCurrentUserSID}\]\\Software\\ABC">
-
- <Value Type="REG\_SZ" Name="Bar" Data="NewValue" />
-
- </Key>
-
- <Key Path="\\REGISTRY\\USER\\\[{AppVCurrentUserSID}\]\\Software\\EmptyKey" />
-
- </Include>
-
- <Delete>
-
- </Registry>
-
- **Virtual File System**
-
- <FileSystem Enabled="true" />
-
- **Virtual Fonts**
-
- <Fonts Enabled="false" />
-
- **Virtual Environment Variables**
-
- <EnvironmentVariables Enabled="true">
-
- <Include>
-
- <Variable Name="UserPath" Value="%path%;%UserProfile%" />
-
- <Variable Name="UserLib" Value="%UserProfile%\\ABC" />
-
- </Include>
-
- <Delete>
-
- <Variable Name="lib" />
-
- </Delete>
-
- </EnvironmentVariables>
-
- **Virtual services**
-
- <Services Enabled="false" />
-
-3. **UserScripts** – Scripts can be used to setup or alter the virtual environment as well as execute scripts at time of deployment or removal, before an application executes, or they can be used to “clean up” the environment after the application terminates. Please reference a sample User configuration file that is output by the sequencer to see a sample script. The Scripts section below provides more information on the various triggers that can be used.
-
-4. **ManagingAuthority** – Can be used when 2 versions of your package are co-existing on the same machine, one deployed to App-V 4.6 and the other deployed on App-V 5.0. To Allow App-V vNext to take over App-V 4.6 extension points for the named package enter the following in the UserConfig file (where PackageName is the Package GUID in App-V 4.6:
-
- <ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName="032630c0-b8e2-417c-acef-76fc5297fe81" />
-
-### Dynamic Deployment Configuration file
-
-**Header** - The header of a Deployment Configuration file is as follows:
-
-<?xml version="1.0" encoding="utf-8"?><DeploymentConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="http://schemas.microsoft.com/appv/2010/deploymentconfiguration">
+```xml
+
+```
The **PackageId** is the same value as exists in the manifest file.
-**Body** - The body of the deployment configuration file includes two sections:
-- User Configuration section –allows the same content as the User Configuration file described in the previous section. When the package is published to a user, any appextensions configuration settings in this section will override corresponding settings in the Manifest within the package unless a user configuration file is also provided. If a UserConfig file is also provided, it will be used instead of the User settings in the deployment configuration file. If the package is published globally, then only the contents of the deployment configuration file will be used in combination with the manifest.
+### Body
-- Machine Configuration section–contains information that can be configured only for an entire machine, not for a specific user on the machine. For example, HKEY\_LOCAL\_MACHINE registry keys in the VFS.
+The body of the dynamic user configuration file can include all the app extension points defined in the manifest file, as well as information to configure virtual applications. There are four subsections allowed in the body:
-<DeploymentConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="http://schemas.microsoft.com/appv/2010/deploymentconfiguration">
+1. **[Applications](#applications)**
+2. **[Subsystems](#subsystems)**
+3. **[UserScripts](#userscripts)**
+4. **[ManagingAuthority](#managingauthority)**
-<UserConfiguration>
+#### Applications
- ..
+All app-extensions contained in the manifest file within a package have an Application ID assigned, which you find in the manifest file. The Application ID lets you enable or disable all extensions for a given application within a package. The Application ID must exist in the manifest file, or it gets ignored.
-</UserConfiguration>
+```XML
+
-<MachineConfiguration>
+
+
+
+
+
+
+
+
+
..
-</MachineConfiguration>
+
+
+```
+
+#### Subsystems
+
+AppExtensions and other subsystems arranged as subnodes.
+
+```XML
+
+
+
..
-</MachineConfiguration>
+
-</DeploymentConfiguration>
+..
-**User Configuration** - use the previous **Dynamic User Configuration file** section for information on settings that are provided in the user configuration section of the Deployment Configuration file.
+
-Machine Configuration - the Machine configuration section of the Deployment Configuration File is used to configure information that can be set only for an entire machine, not for a specific user on the computer. For example, HKEY\_LOCAL\_MACHINE registry keys in the Virtual Registry. There are four subsections allowed in under this element
+```
-1. **Subsystems** - AppExtensions and other subsystems are arranged as subnodes under <Subsystems>:
+You can enable or disable each subsystem using the **Enabled** attribute.
- <MachineConfiguration>
+**Extensions**
- <Subsystems>
+Some subsystems (extension subsystems) control extensions. Those subsystems are Shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients, and COM.
- ..
+Extension subsystems can be enabled and disabled independently of the content. For example, if you enable Shortcuts, the client uses the Shortcuts contained within the manifest by default. Each extension subsystem can contain an \ node. If this child element is present, the client ignores the content in the manifest file for that subsystem and only use the content in the configuration file.
- </Subsystems>
+_**Examples:**_
- ..
+- If you define this in either the user or deployment config file, the content in the manifest gets ignored.
- </MachineConfiguration>
+ ```XML
- The following section displays the various subsystems and usage samples.
+
- **Extensions**:
+
- Some subsystems (Extension Subsystems) control Extensions which can only apply to all users. The subsystem is application capabilities. Because this can only apply to all users, the package must be published globally in order for this type of extension to be integrated into the local system. The same rules for controls and settings that apply to the Extensions in the User Configuration also apply to those in the MachineConfiguration section.
+ ...
- **Application Capabilities**: Used by default programs in windows operating system Interface. Allows an application to register itself as capable of opening certain file extensions, as a contender for the start menu internet browser slot, as capable of opening certain windows MIME types. This extension also makes the virtual application visible in the Set Default Programs UI.:
+
- <ApplicationCapabilities Enabled="true">
+
- <Extensions>
+ ```
+- If you define only the following, the content in the manifest gets integrated during publishing.
+
+ ```XML
- <Extension Category="AppV.ApplicationCapabilities">
+
- <ApplicationCapabilities>
+ ```
- <ApplicationId>\[{PackageRoot}\]\\LitView\\LitViewBrowser.exe</ApplicationId>
+- If you define the following, all Shortcuts within the manifest still get ignored. In other words, no Shortcuts get integrated.
- <Reference>
+ ```XML
- <Name>LitView Browser</Name>
+
- <Path>SOFTWARE\\LitView\\Browser\\Capabilities</Path>
+
- </Reference>
+
- <CapabilityGroup>
+ ```
- <Capabilities>
+_**Supported extension subsystems:**_
- <Name>@\[{ProgramFilesX86}\]\\LitView\\LitViewBrowser.exe,-12345</Name>
+**Shortcuts** extension subsystem controls what shortcuts get integrated into the local system.
- <Description>@\[{ProgramFilesX86}\]\\LitView\\LitViewBrowser.exe,-12346</Description>
+```XML
- <Hidden>0</Hidden>
+
- <EMailSoftwareClient>Lit View E-Mail Client</EMailSoftwareClient>
+
- <FileAssociationList>
+
- <FileAssociation Extension=".htm" ProgID="LitViewHTML" />
+
- <FileAssociation Extension=".html" ProgID="LitViewHTML" />
+
- <FileAssociation Extension=".shtml" ProgID="LitViewHTML" />
+ [{Common Programs}]\Microsoft Contoso\Microsoft ContosoApp Filler 2010.lnk
- </FileAssociationList>
+ [{PackageRoot}]\Contoso\ContosoApp.EXE
- <MIMEAssociationList>
+
+ [{Windows}]\Installer\{90140000-0011-0000-0000-0000000FF1CE}\inficon.exe
- <MIMEAssociation Type="audio/mp3" ProgID="LitViewHTML" />
+
- <MIMEAssociation Type="audio/mpeg" ProgID="LitViewHTML" />
+
- </MIMEAssociationList>
+ ContosoApp.Filler.3
- <URLAssociationList>
+ Fill out dynamic forms to gather and reuse information throughout the organization using Microsoft ContosoApp.
- <URLAssociation Scheme="http" ProgID="LitViewHTML.URL.http" />
+ 0
- </URLAssociationList>
+ 1
+
+ [{PackageRoot}]\Contoso\ContosoApp.EXE
- </Capabilities>
+
- </CapabilityGroup>
+
- </ApplicationCapabilities>
+
- </Extension>
+
+
+ [{AppData}]\Microsoft\Contoso\Recent\Templates.LNK
- </Extensions>
+ [{AppData}]\Microsoft\Templates
- </ApplicationCapabilities>
+
- **Other Settings**:
+
- In addition to Extensions, other subsystems can be edited:
+
- **Machine Wide Virtual Registry**: Used when you want to set a registry key in the virtual registry within HKEY\_Local\_Machine
+
- <Registry>
+
- <Include>
+ 0
- <Key Path="\\REGISTRY\\Machine\\Software\\ABC">
+ 1
- <Value Type="REG\_SZ" Name="Bar" Data="Baz" />
+
- </Key>
+
- <Key Path="\\REGISTRY\\Machine\\Software\\EmptyKey" />
+
- </Include>
+
- <Delete>
+
- </Registry>
+```
- **Machine Wide Virtual Kernel Objects**
+**File-Type Associates** extension subsystem associates file types with programs to open by default as well as set up the context menu.
- <Objects>
+>[!TIP]
+>You can set up the subsystem with MIME types.
- <NotIsolate>
+```XML
- <Object Name="testObject" />
+
- </NotIsolate>
+
- </Objects>
+
-2. **ProductSourceURLOptOut**: Indicates whether the URL for the package can be modified globally through PackageSourceRoot (to support branch office scenarios). Default is false and the setting change takes effect on the next launch.
+
- <MachineConfiguration>
+
- ..
+ .docm
- <ProductSourceURLOptOut Enabled="true" />
+ contosowordpad.DocumentMacroEnabled.12
- ..
+ document
+
+ application/vnd.ms-contosowordpad.document.macroEnabled.12
- </MachineConfiguration>
+
-3. **MachineScripts** – Package can be configured to execute scripts at time of deployment, publishing or removal. Please reference a sample deployment configuration file that is generated by the sequencer to see a sample script. The Scripts section below provides more information on the various triggers that can be used
+ wincontosowordpad.exe
-4. **TerminateChildProcess**:- An application executable can be specified, whose child processes will be terminated when the application exe process is terminated.
+
- <MachineConfiguration>
+
- ..
+ contosowordpad.8
- <TerminateChildProcesses>
+
- <Application Path="\[{PackageRoot}\]\\Contoso\\ContosoApp.EXE" />
+
- <Application Path="\[{PackageRoot}\]\\LitView\\LitViewBrowser.exe" />
+
- <Application Path="\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE" />
+
- </TerminateChildProcesses>
+
- ..
+
- </MachineConfiguration>
+ true
-### Scripts
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ contosowordpad.DocumentMacroEnabled.12
+
+ [{Windows}]\Installer\{90140000-0011-0000-0000-000000FF1CE}\contosowordpadicon.exe,15
+
+ Blah Blah Blah
+
+ [{FOLDERID_ProgramFilesX86}]\Microsoft Contoso 14\res.dll,9182
+
+ [{FOLDERID_ProgramFilesX86}]\Microsoft Contoso 14\res.dll,1424
+
+ 0
+
+
+
+ Open
+
+
+
+ {e56fa627-c35f-4a01-9e79-7d36aed8225a}
+
+ Edit
+
+ &Edit
+
+ "[{PackageRoot}]\Contoso\WINcontosowordpad.EXE" /vu "%1"
+
+
+
+
+
+ {e56fa627-c35f-4a01-9e79-7d36aed8225a}
+
+ Open
+
+ &Open
+
+ "[{PackageRoot}]\Contoso\WINcontosowordpad.EXE" /n "%1"
+
+
+
+
+
+ mscontosowordpad
+
+ ShellSystem
+
+ [SHELLNOOP]
+
+ [SetForeground][ShellNewDatabase"%1"]
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+**URL Protocols** extension subsystem controls the URL protocols integrated into the local registry of the client machine, for example, _mailto:_.
+
+```XML
+
+
+
+
+
+
+
+
+
+ mailto
+
+
+
+ [{ProgramFilesX86}]\MicrosoftContoso\Contoso\contosomail.EXE,-9403
+
+ 2
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 2
+
+
+
+
+
+ open
+
+
+
+ [{ProgramFilesX86}]\Microsoft Contoso\Contoso\contosomail.EXE
+
+ open
+
+ [{ProgramFilesX86}\Microsoft Contoso\Contoso\contosomail.EXE" -c OEP.Note /m "%1"
+
+
+
+
+
+ 0
+
+ 0
+
+ 2
+
+
+
+
+
+ contosomail
+
+ ShellSystem
+
+ [SHELLNOOP]
+
+ [SetForeground][ShellNewDatabase "%1"]
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+**Software Clients** extension subsystem allows the app to register as an email client, news reader, media player and makes the app visible in the Set program access and Computer defaults UI. In most cases, you should only need to enable and disable it. There is also a control to enable and disable the email client specifically if you want the other clients still enabled except for that client.
+
+```XML
+
+
+
+
+
+
+
+```
+
+**AppPaths** extension subsystem opens apps registered with an application path. For example, if contoso.exe has an apppath name of _myapp_, users can type _myapp_ from the run menu, opening contoso.exe.
+
+```XML
+
+
+
+
+
+
+
+
+
+ [{ProgramFilesX86}]\Microsoft Contoso\Contoso\contosomail.EXE
+
+ contosomail.exe
+
+ [{ProgramFilesX86}]\Microsoft Contoso\Contoso\contosomail.EXE
+
+
+
+ false
+
+
+
+
+
+
+
+
+
+
+
+```
+
+**COM** extensions subsystem allows an application registered to local COM servers. The mode can be:
+
+- Integration
+- Isolated
+- Off
+
+```XML
+
+
+
+```
+
+**Virtual Kernel Objects**
+
+```XML
+
+
+
+```
+
+**Virtual Registry** sets a registry in the virtual registry within HKCU.
+
+```XML
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+**Virtual File System**
+
+```XML
+
+
+
+```
+
+**Virtual Fonts**
+
+```XML
+
+
+
+```
+
+**Virtual Environment Variables**
+
+```XML
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+**Virtual services**
+
+```XML
+
+
+
+```
+
+#### UserScripts
+
+Use UserScripts to set up or alter the virtual environment. You can also execute scripts at the time of deployment or to clean up the environment after the application terminates. To see a sample script, refer to the user configuration file generated by the sequencer.
+The Scripts section below provides more information on the various triggers that can be used.
+
+#### ManagingAuthority
+
+Use ManagingAuthority when two versions of your package co-exist on the same machine, one deployed to App-V 4.6 and another deployed on App-V 5.0. To allow App-V vNext to take over App-V 4.6 extension points for the named package enter the following in the UserConfig file (where PackageName is the Package GUID in App-V 4.6:
+
+```XML
+
+
+
+```
+
+## Deployment configuration file (DeploymentConfig.xml)
+
+The DeploymentConfig file provides configuration settings for machine context and user context, providing the same capabilities listed in the UserConfig file. The setting get applied when deploying the package to a computer running the App-V 5.1 client.
+
+Use the DeploymentConfig file to specify or modify custom settings for a package:
+
+- All UserConfig settings
+- Extensions that can only be applied globally for all users
+- Virtual subsystems for global machine locations, for example, registry
+- Product source URL
+- Scripts (machine context only)
+- Controls to terminate child processes
+
+### Header
+
+The header of a dynamic deployment configuration file looks like:
+
+```XML
+
+```
+
+The **PackageId** is the same value as exists in the manifest file.
+
+### Body
+
+The body of the dynamic deployment configuration file includes two sections:
+
+- **UserConfiguration:** allows the same content as the user configuration file described in the previous section. When publishing the package to a user, any appextensions configuration settings in this section override corresponding settings in the manifest within the package, unless you provide a user configuration file. If also providing a UserConfig file, it gets used instead of the User settings in the deployment configuration file. If publishing the package globally, then only the contents of the deployment configuration file get used in combination with the manifest. For more details, see [User configuration file contents (UserConfig.xml)](#user-configuration-file-contents-userconfigxml).
+
+- **MachineConfiguration:** contains information that can be configured only for an entire machine, not for a specific user on the machine. For example, HKEY_LOCAL_MACHINE registry keys in the VFS.
+
+```XML
+
+
+
+
+
+...
+
+
+
+
+
+...
+
+
+
+...
+
+
+
+
+
+```
+
+### UserConfiguration
+
+Refer to [User configuration file contents (UserConfig.xml)](#user-configuration-file-contents-userconfigxml) for information on the settings provided for this section.
+
+### MachineConfiguration
+
+Use the MachineConfiguration section to configure information for an entire machine; not for a specific user on the computer. For example, HKEY_LOCAL_MACHINE registry keys in the virtual registry. There are four subsections allowed in under this element:
+
+1. **[Subsystems](#subsystems-1)**
+2. **[ProductSourceURLOptOut](#productsourceurloptout)**
+3. **[MachineScripts](#machinescripts)**
+4. **[TerminateChildProcess](#terminatechildprocess)**
+
+#### Subsystems
+
+AppExtensions and other subsystems arranged as subnodes.
+
+```XML
+
+
+
+
+
+ …
+
+
+
+…
+
+
+
+```
+
+You can enable or disable each subsystem using the **Enabled** attribute.
+
+**Extensions**
+
+Some subsystems (extension subsystems) control extensions. The subsystem is Application Capabilities that default programs use. For this type of extension, the package must be published globally for integration into the local system. The same rules for controls and settings that apply to the Extensions in the User Configuration also, apply to those in the MachineConfiguration section.
+
+**Application Capabilities**: Used by default programs that allow an application to register itself as:
+
+- Capable of opening specific file extensions
+- A contender for the start menu internet browser slot
+- Capable of opening specific windows MIME types
+
+This extension also makes the virtual application visible in the Set default programs UI.
+
+```XML
+
+
+
+
+
+
+
+
+
+
+ [{PackageRoot}]\LitView\LitViewBrowser.exe
+
+
+
+ LitView Browser
+
+ SOFTWARE\LitView\Browser\Capabilities
+
+
+
+
+
+
+
+
+ @[{ProgramFilesX86}]\LitView\LitViewBrowser.exe,-12345
+
+
+ @[{ProgramFilesX86}]\LitView\LitViewBrowser.exe,-12346
+
+ 0
+
+ Lit View E-Mail Client
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+_**Supported extension subsystems:**_
+
+**Machine Wide Virtual Registry** extension subsystem sets a registry key in the virtual registry within HKEY_Local_Machine.
+
+```XML
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+```
+
+**Machine Wide Virtual Kernel Objects**
+
+```XML
+
+
+
+
+
+
+
+
+
+
+
+```
+
+#### ProductSourceURLOptOut
+
+Use ProductSourceURLOptOut to indicate that the URL for the package can be modified globally through _PackageSourceRoot_ (to support branch office scenarios). Changes take effect on the next launch.
+
+```XML
+
+
+
+ ...
+
+
+
+ ...
+
+
+
+```
+
+#### MachineScripts
+
+The package can be configured to execute scripts at time of deployment, publishing or removal. To see a sample script, refer to the deployment configuration file generated by the sequencer.
+
+The Scripts section below provides more information on the various triggers that can be used.
+
+#### TerminateChildProcess
+
+An application executable can be specified, whose child processes get terminated when the application exe process terminates.
+
+```XML
+
+
+
+ ...
+
+
+
+
+
+
+
+
+
+
+
+ ...
+
+
+
+```
+
+
+
+## Scripts
The following table describes the various script events and the context under which they can be run.
-
-
-
-
-
-
-
-
-
-
-
-
Script Execution Time
-
Can be specified in Deployment Configuration
-
Can be specified in User Configuration
-
Can run in the Virtual Environment of the package
-
Can be run in the context of a specific application
-
Runs in system/user context: (Deployment Configuration, User Configuration)
-
-
-
-
-
AddPackage
-
X
-
-
-
-
(SYSTEM, N/A)
-
-
-
PublishPackage
-
X
-
X
-
-
-
(SYSTEM, User)
-
-
-
UnpublishPackage
-
X
-
X
-
-
-
(SYSTEM, User)
-
-
-
RemovePackage
-
X
-
-
-
-
(SYSTEM, N/A)
-
-
-
StartProcess
-
X
-
X
-
X
-
X
-
(User, User)
-
-
-
ExitProcess
-
X
-
X
-
-
X
-
(User, User)
-
-
-
StartVirtualEnvironment
-
X
-
X
-
X
-
-
(User, User)
-
-
-
TerminateVirtualEnvironment
-
X
-
X
-
-
-
(User, User)
-
-
-
-
-
+| Script Execution Time | Can be specified in Deployment Configuration | Can be specified in User Configuration | Can run in the Virtual Environment of the package | Can be run in the context of a specific application | Runs in system/user context: (Deployment Configuration, User Configuration) |
+|-----------------------------|----------------------------------------------|----------------------------------------|---------------------------------------------------|-----------------------------------------------------|-----------------------------------------------------------------------------|
+| AddPackage | X | | | | (SYSTEM, N/A) |
+| PublishPackage | X | X | | | (SYSTEM, User) |
+| UnpublishPackage | X | X | | | (SYSTEM, User) |
+| RemovePackage | X | | | | (SYSTEM, N/A) |
+| StartProcess | X | X | X | X | (User, User) |
+| ExitProcess | X | X | | X | (User, User) |
+| StartVirtualEnvironment | X | X | X | | (User, User) |
+| TerminateVirtualEnvironment | X | X | | | (User, User) |
### Using multiple scripts on a single event trigger
-App-V 5.1 supports the use of multiple scripts on a single event trigger for App-V packages, including packages that you convert from App-V 4.6 to App-V 5.0 or later. To enable the use of multiple scripts, App-V 5.1 uses a script launcher application, named ScriptRunner.exe, which is installed as part of the App-V client installation.
+App-V 5.1 supports the use of multiple scripts on a single event trigger for
+App-V packages, including packages that you convert from App-V 4.6 to App-V 5.0
+or later. To enable the use of multiple scripts, App-V 5.1 uses a script
+launcher application, named ScriptRunner.exe, which is installed as part of the
+App-V client installation.
-**How to use multiple scripts on a single event trigger:**
+### How to use multiple scripts on a single event trigger
-For each script that you want to run, pass that script as an argument to the ScriptRunner.exe application. The application then runs each script separately, along with the arguments that you specify for each script. Use only one script (ScriptRunner.exe) per trigger.
+For each script that you want to run, pass that script as an argument to the
+ScriptRunner.exe application. The application then runs each script separately,
+along with the arguments that you specify for each script. Use only one script
+(ScriptRunner.exe) per trigger.
-**Note**
-We recommended that you run the multi-script line from a command prompt first to make sure that all arguments are built correctly before adding them to the deployment configuration file.
+>[!NOTE]
-
+>We recommended that you run the multi-script line from a command prompt
+first to make sure that all arguments are built correctly before adding them to
+the deployment configuration file.
-**Example script and parameter descriptions**
+### Example script and parameter descriptions
-Using the following example file and table, modify the deployment or user configuration file to add the scripts that you want to run.
+Using the following example file and table, modify the deployment or user
+configuration file to add the scripts that you want to run.
-``` syntax
+```XML
ScriptRunner.exe
@@ -885,89 +913,64 @@ Using the following example file and table, modify the deployment or user config
```
-
-
-
-
-
-
-
-
Parameter in the example file
-
Description
-
-
-
-
-
<AddPackage>
-
Name of the event trigger for which you are running a script, such as adding a package or publishing a package.
-
-
-
<Path>ScriptRunner.exe</Path>
-
The script launcher application that is installed as part of the App-V client installation.
-
-Note
-
Although ScriptRunner.exe is installed as part of the App-V client, the location of the App-V client must be in %path% or ScriptRunner will not run. ScriptRunner.exe is typically located in the C:\Program Files\Microsoft Application Virtualization\Client folder.
-
-
-
-
-
-
-
<Arguments>
--appvscript script1.exe arg1 arg2 –appvscriptrunnerparameters –wait –timeout=10
--appvscript script2.vbs arg1 arg2
+**Parameters in the example file include:**
--appvscript script3.bat arg1 arg2 –appvscriptrunnerparameters –wait –timeout=30 -rollbackonerror
-</Arguments>
-
-appvscript - Token that represents the actual script that you want to run.
-
script1.exe – Name of the script that you want to run.
-
arg1 arg2 – Arguments for the script that you want to run.
-
-appvscriptrunnerparameters – Token that represents the execution options for script1.exe
-
-wait – Token that informs ScriptRunner to wait for execution of script1.exe to complete before proceeding to the next script.
-
-timeout=x – Token that informs ScriptRunner to stop running the current script after x number of seconds. All other specified scripts will still run.
-
-rollbackonerror – Token that informs ScriptRunner to stop running all scripts that haven't yet run and to roll back an error to the App-V client.
-
-
-
<Wait timeout=”40” RollbackOnError=”true”/>
-
Waits for overall completion of ScriptRunner.exe.
-
Set the timeout value for the overall runner to be greater than or equal to the sum of the timeout values on the individual scripts.
-
If any individual script reported an error and rollbackonerror was set to true, then ScriptRunner would report the error to App-V client.
-
-
-
+#### \
-
+Name of the event trigger for which you are running a script, such as adding a package or publishing a package.
-ScriptRunner will run any script whose file type is associated with an application installed on the computer. If the associated application is missing, or the script’s file type is not associated with any application on the computer, the script will not run.
+#### \ScriptRunner.exe\
-### Create a Dynamic Configuration file using an App-V 5.1 Manifest file
+The script launcher application that is installed as part of the App-V client installation.
-You can create the Dynamic Configuration file using one of three methods: either manually, using the App-V 5.1 Management Console or sequencing a package, which will be generated with 2 sample files.
+>[!NOTE]
-For more information about how to create the file using the App-V 5.1 Management Console see, [How to Create a Custom Configuration File by Using the App-V 5.1 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md).
+>Although ScriptRunner.exe is installed as part of the App-V client, the location of the App-V client must be in %path% or ScriptRunner will not run. ScriptRunner.exe is typically located in the C:FilesApplication Virtualizationfolder.
+
+#### \
+
+`-appvscript` - Token that represents the actual script that you want to run.
+
+`script1.exe` – Name of the script that you want to run.
+
+`arg1 arg2` – Arguments for the script that you want to run.
+
+`-appvscriptrunnerparameters` – Token that represents the execution options for script1.exe.
+
+`-wait` – Token that informs ScriptRunner to wait for execution of script1.exe to complete before proceeding to the next script.
+
+`-timeout=x` – Token that informs ScriptRunner to stop running the current script after x number of seconds. All other specified scripts still runs.
+
+`-rollbackonerror` – Token that informs ScriptRunner to stop running all scripts that haven't yet run and to roll back an error to the App-V client.
+
+#### \
+
+Waits for overall completion of ScriptRunner.exe.
+
+Set the timeout value for the overall runner to be greater than or equal to the sum of the timeout values on the individual scripts.
+
+If any individual script reported an error and rollbackonerror was set to true, then ScriptRunner would report the error to App-V client.
+
+ScriptRunner runs any script whose file type is associated with an application installed on the computer. If the associated application is missing, or the script’s file type is not associated with any application on the computer, the script does not run.
+
+### Create a dynamic configuration file using an App-V 5.1 manifest file
+
+You can create the dynamic configuration file using one of three methods: either manually, using the App-V 5.1 Management Console or sequencing a package, which generates two sample files. For more information about how to create the file using the App-V 5.1 Management Console see, [How to create a custom configuration File by using the App-V 5.1 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md).
To create the file manually, the information above in previous sections can be combined into a single file. We recommend you use files generated by the sequencer.
## Got a suggestion for App-V?
-
-Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+- Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).
+- For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
## Related topics
+- [How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell51.md)
-[How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell51.md)
-
-[How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell51.md)
-
-[Operations for App-V 5.1](operations-for-app-v-51.md)
-
-
-
-
-
-
-
+- [How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell51.md)
+- [Operations for App-V 5.1](operations-for-app-v-51.md)
+---
\ No newline at end of file
diff --git a/mdop/appv-v5/about-app-v-51.md b/mdop/appv-v5/about-app-v-51.md
index 9f0cdd5170..700251df9c 100644
--- a/mdop/appv-v5/about-app-v-51.md
+++ b/mdop/appv-v5/about-app-v-51.md
@@ -96,7 +96,7 @@ Review the following information before you start the upgrade:
Note
-
Prior to App-V 5.0 SP2, the Client Management User Interface (UI) was provided with the App-V Client installation. For App-V 5.0 SP2 installations (or later), you can use the Client Management UI by downloading from [Application Virtualization 5.0 Client UI Application](http://www.microsoft.com/download/details.aspx?id=41186).
+
Prior to App-V 5.0 SP2, the Client Management User Interface (UI) was provided with the App-V Client installation. For App-V 5.0 SP2 installations (or later), you can use the Client Management UI by downloading from [Application Virtualization 5.0 Client UI Application](https://www.microsoft.com/download/details.aspx?id=41186).
diff --git a/mdop/appv-v5/app-v-50-prerequisites.md b/mdop/appv-v5/app-v-50-prerequisites.md
index 8d90940d1b..986a0450c7 100644
--- a/mdop/appv-v5/app-v-50-prerequisites.md
+++ b/mdop/appv-v5/app-v-50-prerequisites.md
@@ -60,7 +60,7 @@ The following table lists prerequisite information that pertains to specific ope
Note
@@ -107,7 +107,7 @@ The following table lists the installation prerequisites for the App-V 5.0 clien
-
Download and install [KB2533623](http://support.microsoft.com/kb/2533623) (http://support.microsoft.com/kb/2533623)
+
Download and install [KB2533623](https://support.microsoft.com/kb/2533623) (http://support.microsoft.com/kb/2533623)
Important
@@ -119,12 +119,12 @@ The following table lists the installation prerequisites for the App-V 5.0 clien
The client installer (.exe) will detect if it is necessary to install the following prerequisites, and it will do so accordingly:
-
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) (http://www.microsoft.com/download/details.aspx?id=40784)
+
[Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784) (http://www.microsoft.com/download/details.aspx?id=40784)
This prerequisite is only required if you have installed Hotfix Package 4 for Application Virtualization 5.0 SP2 or later.
-
[The Microsoft Visual C++ 2010 Redistributable](http://www.microsoft.com/download/details.aspx?id=26999) (https://go.microsoft.com/fwlink/?LinkId=26999)
+
[The Microsoft Visual C++ 2010 Redistributable](https://www.microsoft.com/download/details.aspx?id=26999) (https://go.microsoft.com/fwlink/?LinkId=26999)
-
[Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](http://www.microsoft.com/download/details.aspx?id=5638) (http://www.microsoft.com/download/details.aspx?id=5638)
+
[Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://www.microsoft.com/download/details.aspx?id=5638) (http://www.microsoft.com/download/details.aspx?id=5638)
@@ -157,8 +157,8 @@ The following table lists the installation prerequisites for the App-V 5.0 Remot
Note
@@ -179,12 +179,12 @@ The following table lists the installation prerequisites for the App-V 5.0 Remot
The client (.exe) installer will detect if it is necessary to install the following prerequisites, and it will do so accordingly:
-
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) (http://www.microsoft.com/download/details.aspx?id=40784)
+
[Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784) (http://www.microsoft.com/download/details.aspx?id=40784)
This prerequisite is required only if you have installed Hotfix Package 4 for Application Virtualization 5.0 SP2 or later.
-
[The Microsoft Visual C++ 2010 Redistributable](http://www.microsoft.com/download/details.aspx?id=26999) (https://go.microsoft.com/fwlink/?LinkId=26999)
+
[The Microsoft Visual C++ 2010 Redistributable](https://www.microsoft.com/download/details.aspx?id=26999) (https://go.microsoft.com/fwlink/?LinkId=26999)
-
[Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](http://www.microsoft.com/download/details.aspx?id=5638) (http://www.microsoft.com/download/details.aspx?id=5638)
+
[Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://www.microsoft.com/download/details.aspx?id=5638) (http://www.microsoft.com/download/details.aspx?id=5638)
@@ -222,14 +222,14 @@ If the system requirements of a locally installed application exceed the require
Software requirements
-
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784) (http://www.microsoft.com/download/details.aspx?id=40784)
+
[Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784) (http://www.microsoft.com/download/details.aspx?id=40784)
This prerequisite is required only if you have installed Hotfix Package 4 for Application Virtualization 5.0 SP2.
Download and install [KB2533623](http://support.microsoft.com/kb/2533623) (http://support.microsoft.com/kb/2533623)
+
Download and install [KB2533623](https://support.microsoft.com/kb/2533623) (http://support.microsoft.com/kb/2533623)
For computers running Microsoft Windows Server 2008 R2 SP1, download and install [KB2533623](https://go.microsoft.com/fwlink/?LinkId=286102 ) (https://go.microsoft.com/fwlink/?LinkId=286102)
@@ -256,7 +256,7 @@ The following prerequisites are already installed for computers that run Windows
- Windows PowerShell 3.0
-- Download and install [KB2533623](http://support.microsoft.com/kb/2533623) (http://support.microsoft.com/kb/2533623)
+- Download and install [KB2533623](https://support.microsoft.com/kb/2533623) (http://support.microsoft.com/kb/2533623)
**Important**
You can still download install the previous KB. However, it may have been replaced with a more recent version.
@@ -294,8 +294,8 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve
@@ -304,7 +304,7 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve
Windows Web Server with the IIS role enabled and the following features: Common HTTP Features (static content and default document), Application Development (ASP.NET, .NET Extensibility, ISAPI Extensions and ISAPI Filters), Security (Windows Authentication, Request Filtering), Management Tools (IIS Management Console).
-
Download and install [KB2533623](http://support.microsoft.com/kb/2533623) (http://support.microsoft.com/kb/2533623)
+
Download and install [KB2533623](https://support.microsoft.com/kb/2533623) (http://support.microsoft.com/kb/2533623)
Important
@@ -313,7 +313,7 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve
-
[Microsoft Visual C++ 2010 SP1 Redistributable Package (x64)](http://www.microsoft.com/download/details.aspx?id=13523) (http://www.microsoft.com/download/details.aspx?id=13523)
+
[Microsoft Visual C++ 2010 SP1 Redistributable Package (x64)](https://www.microsoft.com/download/details.aspx?id=13523) (http://www.microsoft.com/download/details.aspx?id=13523)
[Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=267110) (https://go.microsoft.com/fwlink/?LinkId=267110)
64-bit ASP.NET registration
@@ -345,7 +345,7 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve
[Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=267110)(https://go.microsoft.com/fwlink/?LinkId=267110)
The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management database.
@@ -361,7 +361,7 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve
[Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=267110)(https://go.microsoft.com/fwlink/?LinkId=267110)
The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 reporting database.
@@ -404,7 +404,7 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve
[Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=267110)(https://go.microsoft.com/fwlink/?LinkId=267110)
Windows Web Server with the IIS role with the following features: Common HTTP Features (static content and default document), Application Development (ASP.NET, .NET Extensibility, ISAPI Extensions and ISAPI Filters), Security (Windows Authentication, Request Filtering), Security (Windows Authentication, Request Filtering), Management Tools (IIS Management Console)
64-bit ASP.NET registration
diff --git a/mdop/appv-v5/app-v-50-sp3-prerequisites.md b/mdop/appv-v5/app-v-50-sp3-prerequisites.md
index c1277e22ab..da61af1bfa 100644
--- a/mdop/appv-v5/app-v-50-sp3-prerequisites.md
+++ b/mdop/appv-v5/app-v-50-sp3-prerequisites.md
@@ -135,19 +135,19 @@ Install the required prerequisite software for the App-V 5.0 SP3 Server componen
For supported versions, see [App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md).
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784)
+
[Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
@@ -266,7 +266,7 @@ The Management database is required only if you are using the App-V 5.0 SP3 Mana
Microsoft SQL Server Service Agent
-
Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see [Configure SQL Server Agent to Restart Services Automatically](http://technet.microsoft.com/magazine/gg313742.aspx).
+
Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see [Configure SQL Server Agent to Restart Services Automatically](https://technet.microsoft.com/magazine/gg313742.aspx).
@@ -288,11 +288,11 @@ The Management database is required only if you are using the App-V 5.0 SP3 Mana
Applies to Windows 7 only: Download and install the KB.
-
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784)
+
[Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
diff --git a/mdop/appv-v5/app-v-50-sp3-supported-configurations.md b/mdop/appv-v5/app-v-50-sp3-supported-configurations.md
index fb07569e2a..fdd9c0c8ac 100644
--- a/mdop/appv-v5/app-v-50-sp3-supported-configurations.md
+++ b/mdop/appv-v5/app-v-50-sp3-supported-configurations.md
@@ -440,7 +440,7 @@ The App-V client supports the following versions of System Center Configuration
- System Center 2012 R2 Configuration Manager SP1
-For more information about how Configuration Manager integrates with App-V, see [Planning for App-V Integration with Configuration Manager](http://technet.microsoft.com/library/jj822982.aspx).
+For more information about how Configuration Manager integrates with App-V, see [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx).
## Got a suggestion for App-V?
diff --git a/mdop/appv-v5/app-v-50-supported-configurations.md b/mdop/appv-v5/app-v-50-supported-configurations.md
index ea0cd97733..c45a8eda10 100644
--- a/mdop/appv-v5/app-v-50-supported-configurations.md
+++ b/mdop/appv-v5/app-v-50-supported-configurations.md
@@ -508,7 +508,7 @@ You can use Microsoft System Center 2012 Configuration Manager or System Cen
-For more information about how Configuration Manager integrates with App-V, see [Planning for App-V Integration with Configuration Manager](http://technet.microsoft.com/library/jj822982.aspx).
+For more information about how Configuration Manager integrates with App-V, see [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx).
## Got a suggestion for App-V?
diff --git a/mdop/appv-v5/app-v-51-prerequisites.md b/mdop/appv-v5/app-v-51-prerequisites.md
index 5289f56ed3..f8078582a5 100644
--- a/mdop/appv-v5/app-v-51-prerequisites.md
+++ b/mdop/appv-v5/app-v-51-prerequisites.md
@@ -145,19 +145,19 @@ Install the required prerequisite software for the App-V 5.1 Server components.
For supported versions, see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md).
[Visual C++ Redistributable Packages for Visual Studio 2013](http://www.microsoft.com/download/details.aspx?id=40784)
+
[Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
@@ -277,7 +277,7 @@ The Management database is required only if you are using the App-V 5.1 Manageme
Microsoft SQL Server Service Agent
-
Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see [Configure SQL Server Agent to Restart Services Automatically](http://technet.microsoft.com/magazine/gg313742.aspx).
+
Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see [Configure SQL Server Agent to Restart Services Automatically](https://technet.microsoft.com/magazine/gg313742.aspx).
@@ -299,11 +299,11 @@ The Management database is required only if you are using the App-V 5.1 Manageme
Applies to Windows 7 only: Download and install the KB.
diff --git a/mdop/appv-v5/app-v-51-supported-configurations.md b/mdop/appv-v5/app-v-51-supported-configurations.md
index 715eccb830..b60c43d593 100644
--- a/mdop/appv-v5/app-v-51-supported-configurations.md
+++ b/mdop/appv-v5/app-v-51-supported-configurations.md
@@ -467,7 +467,7 @@ The App-V client supports the following versions of System Center Configuration
The following App-V and System Center Configuration Manager version matrix shows all officially supported combinations of App-V and Configuration Manager.
-**Note:** Both App-V 4.5 and 4.6 have exited Mainstream support.
+**Note:** Both App-V 4.5 and 4.6 have exited Mainstream support.
@@ -518,7 +518,7 @@ The following App-V and System Center Configuration Manager version matrix shows
-For more information about how Configuration Manager integrates with App-V, see [Planning for App-V Integration with Configuration Manager](http://technet.microsoft.com/library/jj822982.aspx).
+For more information about how Configuration Manager integrates with App-V, see [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx).
## Got a suggestion for App-V?
diff --git a/mdop/appv-v5/application-publishing-and-client-interaction.md b/mdop/appv-v5/application-publishing-and-client-interaction.md
index 48a137c6bb..b3bd9b1dbb 100644
--- a/mdop/appv-v5/application-publishing-and-client-interaction.md
+++ b/mdop/appv-v5/application-publishing-and-client-interaction.md
@@ -38,7 +38,7 @@ This article provides technical information about common App-V client operations
- [Client logging](#bkmk-client-logging)
-For additional reference information, see [Microsoft Application Virtualization (App-V) Documentation Resources Download Page](http://www.microsoft.com/download/details.aspx?id=27760).
+For additional reference information, see [Microsoft Application Virtualization (App-V) Documentation Resources Download Page](https://www.microsoft.com/download/details.aspx?id=27760).
## App-V package files created by the Sequencer
@@ -93,7 +93,7 @@ The Sequencer creates App-V packages and produces a virtualized application. The
-For information about sequencing, see [Application Virtualization 5.0 Sequencing Guide](http://www.microsoft.com/download/details.aspx?id=27760).
+For information about sequencing, see [Application Virtualization 5.0 Sequencing Guide](https://www.microsoft.com/download/details.aspx?id=27760).
## What’s in the appv file?
@@ -241,7 +241,7 @@ The App-V Client manages the applications assets mounted in the package store. T
Example of a path to a specific application:
``` syntax
-C:\ProgramData\App-V\PackGUID\VersionGUID
+C:\ProgramData\App-V\PackGUID\VersionGUID
```
To change the default location of the package store during setup, see [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md).
diff --git a/mdop/appv-v5/application-publishing-and-client-interaction51.md b/mdop/appv-v5/application-publishing-and-client-interaction51.md
index 59628e39ad..dfaa56d9c0 100644
--- a/mdop/appv-v5/application-publishing-and-client-interaction51.md
+++ b/mdop/appv-v5/application-publishing-and-client-interaction51.md
@@ -38,7 +38,7 @@ This article provides technical information about common App-V client operations
- [Client logging](#bkmk-client-logging)
-For additional reference information, see [Microsoft Application Virtualization (App-V) Documentation Resources Download Page](http://www.microsoft.com/download/details.aspx?id=27760).
+For additional reference information, see [Microsoft Application Virtualization (App-V) Documentation Resources Download Page](https://www.microsoft.com/download/details.aspx?id=27760).
## App-V package files created by the Sequencer
@@ -241,7 +241,7 @@ The App-V Client manages the applications assets mounted in the package store. T
Example of a path to a specific application:
``` syntax
-C:\ProgramData\App-V\PackGUID\VersionGUID
+C:\ProgramData\App-V\PackGUID\VersionGUID
```
To change the default location of the package store during setup, see [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md).
diff --git a/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md b/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md
index 0b805161f8..69af0d0e77 100644
--- a/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md
+++ b/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md
@@ -17,7 +17,7 @@ ms.date: 06/16/2016
After you have properly deployed the Microsoft Application Virtualization (App-V) 5.0 sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application.
**Note**
-For more information about configuring the Microsoft Application Virtualization (App-V) 5.0 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](http://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx) (http://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx).
+For more information about configuring the Microsoft Application Virtualization (App-V) 5.0 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx) (http://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx).
diff --git a/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md b/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md
index 4b78b20309..4062dd1379 100644
--- a/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md
+++ b/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md
@@ -17,9 +17,9 @@ ms.date: 06/16/2016
After you have properly deployed the Microsoft Application Virtualization (App-V) 5.1 sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application.
**Note**
-For more information about configuring the App-V 5.1 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](http://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx).
+For more information about configuring the App-V 5.1 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx).
-**Note**
+**Note**
The App-V 5.x Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated.
## Sequencing an application
diff --git a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md
index b2a242e96e..6a30148ca3 100644
--- a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md
+++ b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md
@@ -102,7 +102,7 @@ Before you deploy Office by using App-V, review the following requirements.
Visio Pro for Office 365
Project Pro for Office 365
-
You must enable [shared computer activation](http://technet.microsoft.com/library/dn782860.aspx).
+
You must enable [shared computer activation](https://technet.microsoft.com/library/dn782860.aspx).
You don’t use shared computer activation if you’re deploying a volume licensed product, such as:
Office Professional Plus 2013
@@ -135,7 +135,7 @@ The following table describes the recommended methods for excluding specific Off
Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.
Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.
-
For more information, see [ExcludeApp element](http://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).
+
For more information, see [ExcludeApp element](https://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).
@@ -204,7 +204,7 @@ Create Office 2013 App-V packages on 64-bit Windows computers. Once created, the
Office 2013 App-V Packages are created using the Office Deployment Tool, which generates an Office 2013 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation:
-1. Download the [Office Deployment Tool for Click-to-Run](http://www.microsoft.com/download/details.aspx?id=36778).
+1. Download the [Office Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=36778).
2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved.
@@ -233,7 +233,7 @@ The XML file that is included in the Office Deployment Tool specifies the produc
-
+
```
@@ -418,7 +418,7 @@ After you download the Office 2013 applications through the Office Deployment To
<Product ID="VisioProRetail">
<Language ID="en-us" />
</Product>
- </Add>
+ </Add>
</Configuration>
In this example, the following changes were made to create a package with Subscription licensing:
@@ -452,7 +452,7 @@ After you download the Office 2013 applications through the Office Deployment To
<Product ID="VisioProVolume">
<Language ID="en-us" />
</Product>
- </Add>
+ </Add>
</Configuration>
In this example, the following changes were made to create a package with Volume licensing:
@@ -668,7 +668,7 @@ Use the steps in this section to enable Office plug-ins with your Office package
You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2013 App-V package has been published, you will save the changes, add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications.
**Note**
-To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. For more information, see [Reference for Click-to-Run configuration.xml file](http://technet.microsoft.com/library/jj219426.aspx).
+To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. For more information, see [Reference for Click-to-Run configuration.xml file](https://technet.microsoft.com/library/jj219426.aspx).
@@ -721,7 +721,7 @@ You may want to disable shortcuts for certain Office applications instead of unp
2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut.
``` syntax
- Shortcuts
+ Shortcuts
-->
@@ -836,7 +836,7 @@ The following table describes the requirements and options for deploying Visio 2
Create a package that contains Office, Visio, and Project.
Deploy the package to all users.
-
Use [Microsoft AppLocker](http://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.
+
Use [Microsoft AppLocker](https://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.
diff --git a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md
index 91c0f3ed75..8b3ad7e937 100644
--- a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md
+++ b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md
@@ -101,7 +101,7 @@ Before you deploy Office by using App-V, review the following requirements.
Visio Pro for Office 365
Project Pro for Office 365
-
You must enable [shared computer activation](http://technet.microsoft.com/library/dn782860.aspx).
+
You must enable [shared computer activation](https://technet.microsoft.com/library/dn782860.aspx).
You don’t use shared computer activation if you’re deploying a volume licensed product, such as:
Office Professional Plus 2013
@@ -134,7 +134,7 @@ The following table describes the recommended methods for excluding specific Off
Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.
Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.
-
For more information, see [ExcludeApp element](http://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).
+
For more information, see [ExcludeApp element](https://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).
@@ -206,7 +206,7 @@ Create Office 2013 App-V packages on 64-bit Windows computers. Once created, the
Office 2013 App-V Packages are created using the Office Deployment Tool, which generates an Office 2013 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation:
-1. Download the [Office Deployment Tool for Click-to-Run](http://www.microsoft.com/download/details.aspx?id=36778).
+1. Download the [Office Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=36778).
2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved.
@@ -235,7 +235,7 @@ The XML file that is included in the Office Deployment Tool specifies the produc
-
+
```
@@ -424,7 +424,7 @@ After you download the Office 2013 applications through the Office Deployment To
<Product ID="VisioProRetail">
<Language ID="en-us" />
</Product>
- </Add>
+ </Add>
</Configuration>
In this example, the following changes were made to create a package with Subscription licensing:
@@ -458,7 +458,7 @@ After you download the Office 2013 applications through the Office Deployment To
<Product ID="VisioProVolume">
<Language ID="en-us" />
</Product>
- </Add>
+ </Add>
</Configuration>
In this example, the following changes were made to create a package with Volume licensing:
@@ -674,7 +674,7 @@ Use the steps in this section to enable Office plug-ins with your Office package
You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2013 App-V package has been published, you will save the changes, add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications.
**Note**
-To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. For more information, see [Reference for Click-to-Run configuration.xml file](http://technet.microsoft.com/library/jj219426.aspx).
+To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. For more information, see [Reference for Click-to-Run configuration.xml file](https://technet.microsoft.com/library/jj219426.aspx).
@@ -727,7 +727,7 @@ You may want to disable shortcuts for certain Office applications instead of unp
2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut.
``` syntax
- Shortcuts
+ Shortcuts
-->
@@ -842,7 +842,7 @@ The following table describes the requirements and options for deploying Visio 2
Create a package that contains Office, Visio, and Project.
Deploy the package to all users.
-
Use [Microsoft AppLocker](http://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.
+
Use [Microsoft AppLocker](https://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.
diff --git a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md
index d397429c2f..ceacdbb6dc 100644
--- a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md
+++ b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md
@@ -103,7 +103,7 @@ Before you deploy Office by using App-V, review the following requirements.
Visio Pro for Office 365
Project Pro for Office 365
-
You must enable [shared computer activation](http://technet.microsoft.com/library/dn782860.aspx).
+
You must enable [shared computer activation](https://technet.microsoft.com/library/dn782860.aspx).
@@ -131,7 +131,7 @@ The following table describes the recommended methods for excluding specific Off
Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.
Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.
-
For more information, see [ExcludeApp element](http://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).
+
For more information, see [ExcludeApp element](https://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).
@@ -228,7 +228,7 @@ The XML file that is included in the Office Deployment Tool specifies the produc
-
+
```
@@ -410,7 +410,7 @@ After you download the Office 2016 applications through the Office Deployment To
<Product ID="VisioProRetail">
<Language ID="en-us" />
</Product>
- </Add>
+ </Add>
</Configuration>
In this example, the following changes were made to create a package with Subscription licensing:
@@ -658,7 +658,7 @@ You may want to disable shortcuts for certain Office applications instead of unp
2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut.
``` syntax
- Shortcuts
+ Shortcuts
-->
@@ -754,7 +754,7 @@ The following table describes the requirements and options for deploying Visio 2
Create a package that contains Office, Visio, and Project.
Deploy the package to all users.
-
Use [Microsoft AppLocker](http://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.
+
Use [Microsoft AppLocker](https://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.
diff --git a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md
index 2439d3d384..d2b4fb5e5e 100644
--- a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md
+++ b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md
@@ -103,7 +103,7 @@ Before you deploy Office by using App-V, review the following requirements.
Visio Pro for Office 365
Project Pro for Office 365
-
You must enable [shared computer activation](http://technet.microsoft.com/library/dn782860.aspx).
+
You must enable [shared computer activation](https://technet.microsoft.com/library/dn782860.aspx).
@@ -131,7 +131,7 @@ The following table describes the recommended methods for excluding specific Off
Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.
Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.
-
For more information, see [ExcludeApp element](http://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).
+
For more information, see [ExcludeApp element](https://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).
@@ -228,7 +228,7 @@ The XML file that is included in the Office Deployment Tool specifies the produc
-
+
```
@@ -410,7 +410,7 @@ After you download the Office 2016 applications through the Office Deployment To
<Product ID="VisioProRetail">
<Language ID="en-us" />
</Product>
- </Add>
+ </Add>
</Configuration>
In this example, the following changes were made to create a package with Subscription licensing:
@@ -442,7 +442,7 @@ After you download the Office 2016 applications through the Office Deployment To
PACKAGEGUID (optional)
By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.
-
+
>**Note** Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
@@ -658,7 +658,7 @@ You may want to disable shortcuts for certain Office applications instead of unp
2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut.
``` syntax
- Shortcuts
+ Shortcuts
-->
@@ -754,7 +754,7 @@ The following table describes the requirements and options for deploying Visio 2
Create a package that contains Office, Visio, and Project.
Deploy the package to all users.
-
Use [Microsoft AppLocker](http://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.
+
Use [Microsoft AppLocker](https://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.
diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md b/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md
index 521ad09c45..b9dfd5d542 100644
--- a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md
+++ b/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md
@@ -34,7 +34,7 @@ Use the following information to install the App-V 5.0 client (preferably, with
- [How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v.md)
-5. Test that your App-V 5.0 packages are successful, and then remove the 4.6 packages. To check the user state of your client computers, we recommend that you use [User Experience Virtualization](http://technet.microsoft.com/library/dn458947.aspx) or another user environment management tool.
+5. Test that your App-V 5.0 packages are successful, and then remove the 4.6 packages. To check the user state of your client computers, we recommend that you use [User Experience Virtualization](https://technet.microsoft.com/library/dn458947.aspx) or another user environment management tool.
**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md b/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md
index 65546d80c5..e617718801 100644
--- a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md
+++ b/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md
@@ -20,7 +20,7 @@ Use the following information to install the Microsoft Application Virtualizatio
1. Install the following version of the App-V client on the computer that is running App-V 4.6.
- - [Microsoft Application Virtualization 4.6 Service Pack 3](http://www.microsoft.com/download/details.aspx?id=41187)
+ - [Microsoft Application Virtualization 4.6 Service Pack 3](https://www.microsoft.com/download/details.aspx?id=41187)
2. Install the App-V 5.1 client on the computer that is running the App-V 4.6 SP3 version of the client. For best results, we recommend that you install all available updates to the App-V 5.1 client.
@@ -42,7 +42,7 @@ Use the following information to install the Microsoft Application Virtualizatio
- [How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md)
-6. Test that your App-V 5.1 packages are successful, and then remove the 4.6 packages. To check the user state of your client computers, we recommend that you use [User Experience Virtualization](http://technet.microsoft.com/library/dn458947.aspx) or another user environment management tool.
+6. Test that your App-V 5.1 packages are successful, and then remove the 4.6 packages. To check the user state of your client computers, we recommend that you use [User Experience Virtualization](https://technet.microsoft.com/library/dn458947.aspx) or another user environment management tool.
**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts.md b/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts.md
index 0a450eda33..cfd6725e5d 100644
--- a/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts.md
+++ b/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts.md
@@ -49,7 +49,7 @@ Use the following instructions to use SQL scripts, rather than the Windows Insta
ManagementDatabase subfolder
Important
-
If you are upgrading to or installing the App-V 5.0 SP3 Management database, see [SQL scripts to install or upgrade the App-V 5.0 SP3 Management Server database fail](http://support.microsoft.com/kb/3031340).
+
If you are upgrading to or installing the App-V 5.0 SP3 Management database, see [SQL scripts to install or upgrade the App-V 5.0 SP3 Management Server database fail](https://support.microsoft.com/kb/3031340).
diff --git a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md b/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md
index a3898dfd1d..c552e9a3a8 100644
--- a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md
+++ b/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md
@@ -193,7 +193,7 @@ Starting in App-V 5.0 SP3, cmdlet help is available in two formats:
On TechNet as web pages
-
See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](http://technet.microsoft.com/library/dn520245.aspx).
+
See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://technet.microsoft.com/library/dn520245.aspx).
diff --git a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md b/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md
index 6e024f6302..253c7dc664 100644
--- a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md
+++ b/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md
@@ -192,7 +192,7 @@ Starting in App-V 5.0 SP3, cmdlet help is available in two formats:
On TechNet as web pages
-
See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](http://technet.microsoft.com/library/dn520245.aspx).
+
See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://technet.microsoft.com/library/dn520245.aspx).
diff --git a/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md b/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md
index 0a5aa62dcf..bbc5378d44 100644
--- a/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md
+++ b/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md
@@ -265,9 +265,9 @@ The following table displays the required steps to prepare the base image and th
We recommend using Microsoft User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. UE-V is optimized for RDS and VDI scenarios.
-For more information see [Getting Started With User Experience Virtualization 2.0](http://technet.microsoft.com/library/dn458936.aspx)
+For more information see [Getting Started With User Experience Virtualization 2.0](https://technet.microsoft.com/library/dn458936.aspx)
-In essence all that is required is to install the UE-V client and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](http://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information around UE-V templates see [The UE-V specific resource for acquiring and registering the template](http://technet.microsoft.com/library/dn458936.aspx).
+In essence all that is required is to install the UE-V client and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](https://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information around UE-V templates see [The UE-V specific resource for acquiring and registering the template](https://technet.microsoft.com/library/dn458936.aspx).
**Note**
Without performing an additional configuration step, the Microsoft User Environment Virtualization (UE-V) will not be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default.
@@ -341,7 +341,7 @@ Registry – HKEY\_CURRENT\_USER
Additionally, we recommend using Microsoft User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions.
-For more information see [Getting Started With User Experience Virtualization 1.0](http://technet.microsoft.com/library/jj680015.aspx) and [Sharing Settings Location Templates with the UE-V Template Gallery](http://technet.microsoft.com/library/jj679972.aspx).
+For more information see [Getting Started With User Experience Virtualization 1.0](https://technet.microsoft.com/library/jj680015.aspx) and [Sharing Settings Location Templates with the UE-V Template Gallery](https://technet.microsoft.com/library/jj679972.aspx).
### User Experience Walk-through
@@ -445,37 +445,37 @@ The following section contains lists with information about Microsoft documentat
About NGEN technology
-- [How to speed up NGEN optimaztion](http://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx)
+- [How to speed up NGEN optimaztion](https://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx)
-- [Script](http://aka.ms/DrainNGenQueue)
+- [Script](https://aka.ms/DrainNGenQueue)
**Windows Server and Server Roles**
Server Performance Tuning Guidelines for
-- [Microsoft Windows Server 2012 R2](http://msdn.microsoft.com/library/windows/hardware/dn529133.aspx)
+- [Microsoft Windows Server 2012 R2](https://msdn.microsoft.com/library/windows/hardware/dn529133.aspx)
-- [Microsoft Windows Server 2012](http://download.microsoft.com/download/0/0/B/00BE76AF-D340-4759-8ECD-C80BC53B6231/performance-tuning-guidelines-windows-server-2012.docx)
+- [Microsoft Windows Server 2012](https://download.microsoft.com/download/0/0/B/00BE76AF-D340-4759-8ECD-C80BC53B6231/performance-tuning-guidelines-windows-server-2012.docx)
-- [Microsoft Windows Server 2008 R2](http://download.microsoft.com/download/6/B/2/6B2EBD3A-302E-4553-AC00-9885BBF31E21/Perf-tun-srv-R2.docx)
+- [Microsoft Windows Server 2008 R2](https://download.microsoft.com/download/6/B/2/6B2EBD3A-302E-4553-AC00-9885BBF31E21/Perf-tun-srv-R2.docx)
**Server Roles**
-- [Remote Desktop Virtualization Host](http://msdn.microsoft.com/library/windows/hardware/dn567643.aspx)
+- [Remote Desktop Virtualization Host](https://msdn.microsoft.com/library/windows/hardware/dn567643.aspx)
-- [Remote Desktop Session Host](http://msdn.microsoft.com/library/windows/hardware/dn567648.aspx)
+- [Remote Desktop Session Host](https://msdn.microsoft.com/library/windows/hardware/dn567648.aspx)
-- [IIS Relevance: App-V Management, Publishing, Reporting Web Services](http://msdn.microsoft.com/library/windows/hardware/dn567678.aspx)
+- [IIS Relevance: App-V Management, Publishing, Reporting Web Services](https://msdn.microsoft.com/library/windows/hardware/dn567678.aspx)
-- [File Server (SMB) Relevance: If used for App-V Content Storage and Delivery in SCS Mode](http://technet.microsoft.com/library/jj134210.aspx)
+- [File Server (SMB) Relevance: If used for App-V Content Storage and Delivery in SCS Mode](https://technet.microsoft.com/library/jj134210.aspx)
**Windows Client (Guest OS) Performance Tuning Guidance**
-- [Microsoft Windows 7](http://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx)
+- [Microsoft Windows 7](https://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx)
- [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2012/10/15/the-microsoft-premier-field-engineer-pfe-view-on-virtual-desktop-vdi-density.aspx)
-- [Microsoft Windows 8](http://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf)
+- [Microsoft Windows 8](https://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf)
- [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2013/04/09/hot-off-the-presses-get-it-now-the-windows-8-vdi-optimization-script-courtesy-of-pfe.aspx)
diff --git a/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md b/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md
index f97427ff85..2f09ab6f22 100644
--- a/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md
+++ b/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md
@@ -267,7 +267,7 @@ We recommend using Microsoft User Experience Virtualization (UE-V) to capture an
For more information see [Getting Started With User Experience Virtualization 2.0](https://technet.microsoft.com/library/dn458926.aspx)
-In essence all that is required is to install the UE-V client and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](http://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information around UE-V templates see [The UE-V specific resource for acquiring and registering the template](https://technet.microsoft.com/library/dn458926.aspx).
+In essence all that is required is to install the UE-V client and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](https://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information around UE-V templates see [The UE-V specific resource for acquiring and registering the template](https://technet.microsoft.com/library/dn458926.aspx).
**Note**
Without performing an additional configuration step, the Microsoft User Environment Virtualization (UE-V) will not be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default.
@@ -348,7 +348,7 @@ Registry – HKEY\_CURRENT\_USER
Additionally, we recommend using Microsoft User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions.
-For more information see [Getting Started With User Experience Virtualization 1.0](http://technet.microsoft.com/library/jj680015.aspx) and [Sharing Settings Location Templates with the UE-V Template Gallery](http://technet.microsoft.com/library/jj679972.aspx).
+For more information see [Getting Started With User Experience Virtualization 1.0](https://technet.microsoft.com/library/jj680015.aspx) and [Sharing Settings Location Templates with the UE-V Template Gallery](https://technet.microsoft.com/library/jj679972.aspx).
### User Experience Walk-through
@@ -452,37 +452,37 @@ The following section contains lists with information about Microsoft documentat
About NGEN technology
-- [How to speed up NGEN optimaztion](http://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx)
+- [How to speed up NGEN optimaztion](https://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx)
-- [Script](http://aka.ms/DrainNGenQueue)
+- [Script](https://aka.ms/DrainNGenQueue)
**Windows Server and Server Roles**
Server Performance Tuning Guidelines for
-- [Microsoft Windows Server 2012 R2](http://msdn.microsoft.com/library/windows/hardware/dn529133.aspx)
+- [Microsoft Windows Server 2012 R2](https://msdn.microsoft.com/library/windows/hardware/dn529133.aspx)
-- [Microsoft Windows Server 2012](http://download.microsoft.com/download/0/0/B/00BE76AF-D340-4759-8ECD-C80BC53B6231/performance-tuning-guidelines-windows-server-2012.docx)
+- [Microsoft Windows Server 2012](https://download.microsoft.com/download/0/0/B/00BE76AF-D340-4759-8ECD-C80BC53B6231/performance-tuning-guidelines-windows-server-2012.docx)
-- [Microsoft Windows Server 2008 R2](http://download.microsoft.com/download/6/B/2/6B2EBD3A-302E-4553-AC00-9885BBF31E21/Perf-tun-srv-R2.docx)
+- [Microsoft Windows Server 2008 R2](https://download.microsoft.com/download/6/B/2/6B2EBD3A-302E-4553-AC00-9885BBF31E21/Perf-tun-srv-R2.docx)
**Server Roles**
-- [Remote Desktop Virtualization Host](http://msdn.microsoft.com/library/windows/hardware/dn567643.aspx)
+- [Remote Desktop Virtualization Host](https://msdn.microsoft.com/library/windows/hardware/dn567643.aspx)
-- [Remote Desktop Session Host](http://msdn.microsoft.com/library/windows/hardware/dn567648.aspx)
+- [Remote Desktop Session Host](https://msdn.microsoft.com/library/windows/hardware/dn567648.aspx)
-- [IIS Relevance: App-V Management, Publishing, Reporting Web Services](http://msdn.microsoft.com/library/windows/hardware/dn567678.aspx)
+- [IIS Relevance: App-V Management, Publishing, Reporting Web Services](https://msdn.microsoft.com/library/windows/hardware/dn567678.aspx)
-- [File Server (SMB) Relevance: If used for App-V Content Storage and Delivery in SCS Mode](http://technet.microsoft.com/library/jj134210.aspx)
+- [File Server (SMB) Relevance: If used for App-V Content Storage and Delivery in SCS Mode](https://technet.microsoft.com/library/jj134210.aspx)
**Windows Client (Guest OS) Performance Tuning Guidance**
-- [Microsoft Windows 7](http://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx)
+- [Microsoft Windows 7](https://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx)
- [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2012/10/15/the-microsoft-premier-field-engineer-pfe-view-on-virtual-desktop-vdi-density.aspx)
-- [Microsoft Windows 8](http://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf)
+- [Microsoft Windows 8](https://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf)
- [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2013/04/09/hot-off-the-presses-get-it-now-the-windows-8-vdi-optimization-script-courtesy-of-pfe.aspx)
diff --git a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md
index 5cf5ae27cc..111265456f 100644
--- a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md
+++ b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md
@@ -21,7 +21,7 @@ Use the following information to plan how to migrate to App-V 5.0 from previous
Before you start any upgrades, review the following requirements:
-- If you are upgrading from a version earlier than App-V 4.6 SP2, upgrade to version App-V 4.6 SP3 first before upgrading to App-V 5.0 or later. In this scenario, upgrade the App-V clients first, and then upgrade the server components.
+- If you are upgrading from a version earlier than App-V 4.6 SP2, upgrade to version App-V 4.6 SP3 first before upgrading to App-V 5.0 or later. In this scenario, upgrade the App-V clients first, and then upgrade the server components.
**Note:** App-V 4.6 has exited Mainstream support.
- App-V 5.0 supports only packages that are created using App-V 5.0, or packages that have been converted to the App-V 5.0 (**.appv**) format.
@@ -74,7 +74,7 @@ To run coexisting clients, you must:
- Install the App-V 4.6 client before you install the App-V 5.0 client.
-- Enable the **Enable Migration Mode** Group Policy setting, which is in the **App-V** > **Client Coexistence** node. To get the deploy the .admx template, see [How to Download and Deploy MDOP Group Policy (.admx) Templates](http://technet.microsoft.com/library/dn659707.aspx).
+- Enable the **Enable Migration Mode** Group Policy setting, which is in the **App-V** > **Client Coexistence** node. To get the deploy the .admx template, see [How to Download and Deploy MDOP Group Policy (.admx) Templates](https://technet.microsoft.com/library/dn659707.aspx).
### Client downloads and documentation
@@ -94,7 +94,7 @@ The following table provides link to the TechNet documentation about the release
App-V 4.6 SP3
-
[About Microsoft Application Virtualization 4.6 SP3](http://technet.microsoft.com/library/dn511019.aspx)
+
[About Microsoft Application Virtualization 4.6 SP3](https://technet.microsoft.com/library/dn511019.aspx)
App-V 5.0 SP3
@@ -109,7 +109,7 @@ For more information about how to configure App-V 5.0 client coexistence, see:
- [How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md)
-- [App-V 5.0 Coexistence and Migration](http://technet.microsoft.com/windows/jj835811.aspx)
+- [App-V 5.0 Coexistence and Migration](https://technet.microsoft.com/windows/jj835811.aspx)
## Converting “previous-version” packages using the package converter
diff --git a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md
index 935ab2548a..ccdd275962 100644
--- a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md
+++ b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md
@@ -21,7 +21,7 @@ Use the following information to plan how to migrate to Microsoft Application Vi
Before you start any upgrades, review the following requirements:
-- If you are upgrading from a version earlier than App-V 4.6 SP2, upgrade to version App-V 4.6 SP3 first before upgrading to App-V 5.1 or later. In this scenario, upgrade the App-V clients first, and then upgrade the server components.
+- If you are upgrading from a version earlier than App-V 4.6 SP2, upgrade to version App-V 4.6 SP3 first before upgrading to App-V 5.1 or later. In this scenario, upgrade the App-V clients first, and then upgrade the server components.
**Note:** App-V 4.6 has exited Mainstream support.
- App-V 5.1 supports only packages that are created using App-V 5.0 or App-V 5.1, or packages that have been converted to the **.appv** format.
@@ -74,7 +74,7 @@ To run coexisting clients, you must:
- Install the App-V 4.6 client before you install the App-V 5.1 client.
-- Enable the **Enable Migration Mode** Group Policy setting, which is in the **App-V** > **Client Coexistence** node. To deploy the .admx template, see [How to Download and Deploy MDOP Group Policy (.admx) Templates](http://technet.microsoft.com/library/dn659707.aspx).
+- Enable the **Enable Migration Mode** Group Policy setting, which is in the **App-V** > **Client Coexistence** node. To deploy the .admx template, see [How to Download and Deploy MDOP Group Policy (.admx) Templates](https://technet.microsoft.com/library/dn659707.aspx).
**Note**
App-V 5.1 packages can run side by side with App-V 4.6 packages if you have coexisting installations of App-V 5.1 and 4.6. However, App-V 5.1 packages cannot interact with App-V 4.6 packages in the same virtual environment.
@@ -99,7 +99,7 @@ The following table provides links to the App-V 4.6 client downloads and to the
App-V 4.6 SP3
-
[About Microsoft Application Virtualization 4.6 SP3](http://technet.microsoft.com/library/dn511019.aspx)
+
[About Microsoft Application Virtualization 4.6 SP3](https://technet.microsoft.com/library/dn511019.aspx)
App-V 4.6 SP3
@@ -114,7 +114,7 @@ For more information about how to configure App-V 5.1 client coexistence, see:
- [How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md)
-- [App-V 5.0 Coexistence and Migration](http://technet.microsoft.com/windows/jj835811.aspx)
+- [App-V 5.0 Coexistence and Migration](https://technet.microsoft.com/windows/jj835811.aspx)
## Converting “previous-version” packages using the package converter
diff --git a/mdop/appv-v5/planning-for-using-app-v-with-office.md b/mdop/appv-v5/planning-for-using-app-v-with-office.md
index bc10c246f9..83ae379e97 100644
--- a/mdop/appv-v5/planning-for-using-app-v-with-office.md
+++ b/mdop/appv-v5/planning-for-using-app-v-with-office.md
@@ -129,11 +129,11 @@ Before implementing Office coexistence, review the following Office documentatio
Office 2013
-
[Information about how to use Office 2013 suites and programs (MSI deployment) on a computer that is running another version of Office](http://support.microsoft.com/kb/2784668)
+
[Information about how to use Office 2013 suites and programs (MSI deployment) on a computer that is running another version of Office](https://support.microsoft.com/kb/2784668)
Office 2010
-
[Information about how to use Office 2010 suites and programs on a computer that is running another version of Office](http://support.microsoft.com/kb/2121447)
+
[Information about how to use Office 2010 suites and programs on a computer that is running another version of Office](https://support.microsoft.com/kb/2121447)
@@ -184,7 +184,7 @@ The Windows Installer-based and Click-to-Run Office installation methods integra
-Microsoft recommends that you deploy Office coexistence with only one integrated Office instance. For example, if you’re using App-V to deploy Office 2010 and Office 2013, you should sequence Office 2010 in non-integrated mode. For more information about sequencing Office in non-integration (isolated) mode, see [How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](http://support.microsoft.com/kb/2830069).
+Microsoft recommends that you deploy Office coexistence with only one integrated Office instance. For example, if you’re using App-V to deploy Office 2010 and Office 2013, you should sequence Office 2010 in non-integrated mode. For more information about sequencing Office in non-integration (isolated) mode, see [How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/kb/2830069).
### Known limitations of Office coexistence scenarios
diff --git a/mdop/appv-v5/planning-for-using-app-v-with-office51.md b/mdop/appv-v5/planning-for-using-app-v-with-office51.md
index 0413034d8b..12a63c2e9c 100644
--- a/mdop/appv-v5/planning-for-using-app-v-with-office51.md
+++ b/mdop/appv-v5/planning-for-using-app-v-with-office51.md
@@ -66,11 +66,11 @@ Before implementing Office coexistence, review the following Office documentatio
Office 2013
-
[Information about how to use Office 2013 suites and programs (MSI deployment) on a computer that is running another version of Office](http://support.microsoft.com/kb/2784668)
+
[Information about how to use Office 2013 suites and programs (MSI deployment) on a computer that is running another version of Office](https://support.microsoft.com/kb/2784668)
Office 2010
-
[Information about how to use Office 2010 suites and programs on a computer that is running another version of Office](http://support.microsoft.com/kb/2121447)
+
[Information about how to use Office 2010 suites and programs on a computer that is running another version of Office](https://support.microsoft.com/kb/2121447)
@@ -121,7 +121,7 @@ The Windows Installer-based and Click-to-Run Office installation methods integra
-Microsoft recommends that you deploy Office coexistence with only one integrated Office instance. For example, if you’re using App-V to deploy Office 2010 and Office 2013, you should sequence Office 2010 in non-integrated mode. For more information about sequencing Office in non-integration (isolated) mode, see [How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](http://support.microsoft.com/kb/2830069).
+Microsoft recommends that you deploy Office coexistence with only one integrated Office instance. For example, if you’re using App-V to deploy Office 2010 and Office 2013, you should sequence Office 2010 in non-integrated mode. For more information about sequencing Office in non-integration (isolated) mode, see [How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/kb/2830069).
### Known limitations of Office coexistence scenarios
diff --git a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md
index cfabb0ba9f..a1f34fddf2 100644
--- a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md
+++ b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md
@@ -49,7 +49,7 @@ This topic contains the following sections:
Ensure that the following folders are available to each user who logs into the computer that is running the App-V 5.0 SP2 or later client:
-
%AppData% is configured to the desired network location (with or without [Offline Files](http://technet.microsoft.com/library/cc780552.aspx) support).
+
%AppData% is configured to the desired network location (with or without [Offline Files](https://technet.microsoft.com/library/cc780552.aspx) support).
%LocalAppData% is configured to the desired local folder.
@@ -169,7 +169,7 @@ The following table describes how folder redirection works when %AppData% is red
diff --git a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md
index be01b37844..83456b984c 100644
--- a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md
+++ b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md
@@ -49,7 +49,7 @@ This topic contains the following sections:
Ensure that the following folders are available to each user who logs into the computer that is running the App-V 5.0 SP2 or later client:
-
%AppData% is configured to the desired network location (with or without [Offline Files](http://technet.microsoft.com/library/cc780552.aspx) support).
+
%AppData% is configured to the desired network location (with or without [Offline Files](https://technet.microsoft.com/library/cc780552.aspx) support).
%LocalAppData% is configured to the desired local folder.
@@ -169,7 +169,7 @@ The following table describes how folder redirection works when %AppData% is red
diff --git a/mdop/appv-v5/release-notes-for-app-v-50-sp3.md b/mdop/appv-v5/release-notes-for-app-v-50-sp3.md
index 8f37aafe6b..2fcfd69810 100644
--- a/mdop/appv-v5/release-notes-for-app-v-50-sp3.md
+++ b/mdop/appv-v5/release-notes-for-app-v-50-sp3.md
@@ -32,9 +32,9 @@ The issue occurs because the Server files are not being deleted when you uninsta
## Querying AD DS can cause some applications to work incorrectly
-When you receive updated packages by querying Active Directory Domain Services for updated group memberships, it can cause some applications to work incorrectly if the applications depend on the user’s access token. In addition, frequent group membership queries can cause the domain controller to overload. For more information about user access tokens, see [Access Tokens](http://msdn.microsoft.com/library/windows/desktop/aa374909.aspx).
+When you receive updated packages by querying Active Directory Domain Services for updated group memberships, it can cause some applications to work incorrectly if the applications depend on the user’s access token. In addition, frequent group membership queries can cause the domain controller to overload. For more information about user access tokens, see [Access Tokens](https://msdn.microsoft.com/library/windows/desktop/aa374909.aspx).
-**Workaround**: Wait until the user logs off and then logs back on before you query for updated group memberships. Do not use the registry key, described in [Hotfix Package 2 for Microsoft Application Virtualization 5.0 Service Pack 1](http://support.microsoft.com/kb/2897087), to query for updated group memberships.
+**Workaround**: Wait until the user logs off and then logs back on before you query for updated group memberships. Do not use the registry key, described in [Hotfix Package 2 for Microsoft Application Virtualization 5.0 Service Pack 1](https://support.microsoft.com/kb/2897087), to query for updated group memberships.
## Got a suggestion for App-V?
diff --git a/mdop/dart-v8/about-dart-81.md b/mdop/dart-v8/about-dart-81.md
index 6c1d8eeaca..ba9aa61695 100644
--- a/mdop/dart-v8/about-dart-81.md
+++ b/mdop/dart-v8/about-dart-81.md
@@ -58,7 +58,7 @@ Microsoft Diagnostics and Recovery Toolset (DaRT) 8.1 provides the following enh
- To download Windows ADK 8.1, see [Windows Assessment and Deployment Kit (Windows ADK) for Windows 8.1](http://www.microsoft.com/download/details.aspx?id=39982) in the Microsoft Download Center.
+ To download Windows ADK 8.1, see [Windows Assessment and Deployment Kit (Windows ADK) for Windows 8.1](https://www.microsoft.com/download/details.aspx?id=39982) in the Microsoft Download Center.
- **Microsoft .NET Framework 4.5.1**
@@ -68,7 +68,7 @@ Microsoft Diagnostics and Recovery Toolset (DaRT) 8.1 provides the following enh
To use the Crash Analyzer tool in DaRT 8.1, you need the required debugging tools, which are available in the Software Development Kit for Windows 8.1.
- To download, see [Windows Software Development Kit (SDK) for Windows 8.1](http://msdn.microsoft.com/library/windows/desktop/bg162891.aspx) in the Microsoft Download Center.
+ To download, see [Windows Software Development Kit (SDK) for Windows 8.1](https://msdn.microsoft.com/library/windows/desktop/bg162891.aspx) in the Microsoft Download Center.
## Language availability
diff --git a/mdop/index.md b/mdop/index.md
index ef4167770e..757a88fd9a 100644
--- a/mdop/index.md
+++ b/mdop/index.md
@@ -163,11 +163,11 @@ In addition to the product documentation available online, supplemental product
MDOP is a suite of products that can help streamline desktop deployment, management, and support across the enterprise. MDOP is available as an additional subscription for Software Assurance customers.
-**Download MDOP**
+**Download MDOP**
MDOP subscribers can download the software at the [Microsoft Volume Licensing website (MVLS)](https://go.microsoft.com/fwlink/p/?LinkId=166331).
-**Purchase MDOP**
-Visit the enterprise [Purchase Windows Enterprise Licensing](http://www.microsoft.com/windows/enterprise/how-to-buy.aspx) website to find out how to purchase MDOP for your business.
+**Purchase MDOP**
+Visit the enterprise [Purchase Windows Enterprise Licensing](https://www.microsoft.com/windows/enterprise/how-to-buy.aspx) website to find out how to purchase MDOP for your business.
diff --git a/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md b/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md
index 8b32b75d9e..23cbf71a1e 100644
--- a/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md
+++ b/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md
@@ -38,7 +38,7 @@ Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup o
-5. For specific steps about how and where to install the templates, see [How to Download and Deploy MDOP Group Policy (.admx) Templates](http://technet.microsoft.com/library/dn659707.aspx).
+5. For specific steps about how and where to install the templates, see [How to Download and Deploy MDOP Group Policy (.admx) Templates](https://technet.microsoft.com/library/dn659707.aspx).
6. After the Microsoft BitLocker Administration and Monitoring Setup wizard displays installation pages for the selected features, click **Finish** to close MBAM Setup.
diff --git a/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md b/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md
index 735cf97bab..113fd20178 100644
--- a/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md
+++ b/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md
@@ -87,9 +87,9 @@ Microsoft Error Reporting is not turned on or off by MBAM. MBAM will utilize wha
Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the PC. You can also use the Last Known Good Configuration startup option if you encounter problems after manual changes have been applied.
-Important Information: Enterprise customers can use Group Policy to configure how Microsoft Error Reporting behaves on their PCs. Configuration options include the ability to turn off Microsoft Error Reporting. If you are an administrator and wish to configure Group Policy for Microsoft Error Reporting, technical details are available on [TechNet](http://technet.microsoft.com/library/cc709644.aspx).
+Important Information: Enterprise customers can use Group Policy to configure how Microsoft Error Reporting behaves on their PCs. Configuration options include the ability to turn off Microsoft Error Reporting. If you are an administrator and wish to configure Group Policy for Microsoft Error Reporting, technical details are available on [TechNet](https://technet.microsoft.com/library/cc709644.aspx).
-Additional information on how to modify enable and disable error reporting is available at this support article: [(http://support.microsoft.com/kb/188296)](http://support.microsoft.com/kb/188296).
+Additional information on how to modify enable and disable error reporting is available at this support article: [(http://support.microsoft.com/kb/188296)](https://support.microsoft.com/kb/188296).
### Microsoft Update
diff --git a/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md b/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md
index 4854c11fbb..098ae2f798 100644
--- a/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md
@@ -59,9 +59,9 @@ END
EXEC dbo.sp_add_job
@job_name = N'CreateCache',
@enabled = 1;
-
+
EXEC dbo.sp_add_jobstep
- @job_name = N'CreateCache',
+ @job_name = N'CreateCache',
@step_name = N'Copy Data',
@subsystem = N'TSQL',
@command = N'EXEC [ComplianceCore].UpdateCache',
@@ -69,52 +69,52 @@ EXEC dbo.sp_add_jobstep
@retry_attempts = 5,
@retry_interval = 5;
-
+
EXEC dbo.sp_add_jobschedule
- @job_name = N'CreateCache',
+ @job_name = N'CreateCache',
@name = N'ReportCacheSchedule1am',
@freq_type = 4,
@freq_interval = 1,
@active_start_time = 010000,
@active_end_time = 020000;
-EXEC dbo.sp_attach_schedule
+EXEC dbo.sp_attach_schedule
@job_name = N'CreateCache',
@schedule_name = N'ReportCacheSchedule1am';
EXEC dbo.sp_add_jobschedule
- @job_name = N'CreateCache',
+ @job_name = N'CreateCache',
@name = N'ReportCacheSchedule7am',
@freq_type = 4,
@freq_interval = 1,
@active_start_time = 070000,
@active_end_time = 080000;
-EXEC dbo.sp_attach_schedule
+EXEC dbo.sp_attach_schedule
@job_name = N'CreateCache',
@schedule_name = N'ReportCacheSchedule7am';
EXEC dbo.sp_add_jobschedule
- @job_name = N'CreateCache',
+ @job_name = N'CreateCache',
@name = N'ReportCacheSchedule1pm',
@freq_type = 4,
@freq_interval = 1,
@active_start_time = 130000,
@active_end_time = 140000;
-EXEC dbo.sp_attach_schedule
+EXEC dbo.sp_attach_schedule
@job_name = N'CreateCache',
@schedule_name = N'ReportCacheSchedule1pm';
EXEC dbo.sp_add_jobschedule
- @job_name = N'CreateCache',
+ @job_name = N'CreateCache',
@name = N'ReportCacheSchedule7pm',
@freq_type = 4,
@freq_interval = 1,
@active_start_time = 190000,
@active_end_time = 200000;
-EXEC dbo.sp_attach_schedule
+EXEC dbo.sp_attach_schedule
@job_name = N'CreateCache',
@schedule_name = N'ReportCacheSchedule7pm';
@@ -196,82 +196,82 @@ This section contains hotfixes and KB articles for MBAM 2.0.
2831166
Installing Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 fails with "System Center CM Objects Already Installed"
diff --git a/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md b/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md
index 0fdf152e67..7ca9dcb801 100644
--- a/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md
+++ b/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md
@@ -8,14 +8,16 @@ ms.pagetype: mdop, security
ms.mktglfcycl: manage
ms.sitesec: library
ms.prod: w10
-ms.date: 5/30/2018
+ms.date: 8/30/2018
+ms.author: pashort
+author: shortpatti
---
# Applying hotfixes on MBAM 2.5 SP1
This topic describes the process for applying the hotfixes for Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 SP1
### Before you begin, download the latest hotfix of Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 SP1
-[Desktop Optimization Pack](https://www.microsoft.com/en-us/download/details.aspx?id=56126)
+[Desktop Optimization Pack](https://www.microsoft.com/en-us/download/details.aspx?id=57157)
#### Steps to update the MBAM Server for existing MBAM environment
1. Remove MBAM server feature (do this by opening the MBAM Server Configuration Tool, then selecting Remove Features).
diff --git a/mdop/mbam-v25/evaluating-mbam-25-in-a-test-environment.md b/mdop/mbam-v25/evaluating-mbam-25-in-a-test-environment.md
index cd19e01e59..b44f1f559e 100644
--- a/mdop/mbam-v25/evaluating-mbam-25-in-a-test-environment.md
+++ b/mdop/mbam-v25/evaluating-mbam-25-in-a-test-environment.md
@@ -104,7 +104,7 @@ To evaluate MBAM by using the Stand-alone topology, use the information in the f
```
``` syntax
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM]
+ [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM]
"NoStartupDelay"=dword:00000001
```
@@ -177,7 +177,7 @@ To evaluate MBAM by using the Configuration Manager Integration topology, use th
Install the MBAM Server software on each server where you want to configure an MBAM Server feature.
Note
-
You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see [Data-tier Applications](http://technet.microsoft.com/library/ee210546.aspx).
+
You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see [Data-tier Applications](https://technet.microsoft.com/library/ee210546.aspx).
@@ -220,7 +220,7 @@ To evaluate MBAM by using the Configuration Manager Integration topology, use th
```
``` syntax
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM]
+ [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM]
"NoStartupDelay"=dword:00000001
```
@@ -315,7 +315,7 @@ To evaluate MBAM by using the Configuration Manager Integration topology, follow
Install the MBAM Server software on each server where you want to configure an MBAM Server feature.
Note
-
You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see [Data-tier Applications](http://technet.microsoft.com/library/ee210546.aspx).
+
You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see [Data-tier Applications](https://technet.microsoft.com/library/ee210546.aspx).
@@ -358,7 +358,7 @@ To evaluate MBAM by using the Configuration Manager Integration topology, follow
```
``` syntax
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM]
+ [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM]
"NoStartupDelay"=dword:00000001
```
@@ -401,7 +401,7 @@ To evaluate MBAM by using the Configuration Manager Integration topology, follow
## Got a suggestion for MBAM?
-- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
+- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/how-to-configure-the-mbam-25-databases.md b/mdop/mbam-v25/how-to-configure-the-mbam-25-databases.md
index af16424434..151b5e2b55 100644
--- a/mdop/mbam-v25/how-to-configure-the-mbam-25-databases.md
+++ b/mdop/mbam-v25/how-to-configure-the-mbam-25-databases.md
@@ -55,7 +55,7 @@ The instructions are based on the recommended architecture in [High-Level Archit
Install the MBAM Server software on each server where you plan to configure an MBAM Server feature.
Note
-
You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see [Data-tier Applications](http://technet.microsoft.com/library/ee210546.aspx).
+
You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see [Data-tier Applications](https://technet.microsoft.com/library/ee210546.aspx).
@@ -230,7 +230,7 @@ The instructions are based on the recommended architecture in [High-Level Archit
## Got a suggestion for MBAM?
-- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
+- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md b/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md
index 79cc189aaa..9cbd497eb0 100644
--- a/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md
+++ b/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md
@@ -44,10 +44,10 @@ This topic explains how to enable BitLocker on an end user's computer by using M
- Optionally encrypt FDDs
- - Escrow TPM OwnerAuth
- For Windows 7, MBAM must own the TPM for escrow to occur.
- For Windows 8.1, Windows 10 RTM and Windows 10 version 1511, escrow of TPM OwnerAuth is supported.
- For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](http://technet.microsoft.com/en-us/itpro/windows/keep-secure/change-the-tpm-owner-password) for further details.
+ - Escrow TPM OwnerAuth
+ For Windows 7, MBAM must own the TPM for escrow to occur.
+ For Windows 8.1, Windows 10 RTM and Windows 10 version 1511, escrow of TPM OwnerAuth is supported.
+ For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/change-the-tpm-owner-password) for further details.
- Escrow recovery keys and recovery key packages
@@ -63,10 +63,10 @@ This topic explains how to enable BitLocker on an end user's computer by using M
**WMI deployment methods for MBAM:** The following WMI methods have been added in MBAM 2.5 SP1 to support enabling BitLocker by using the `Invoke-MbamClientDeployment.ps1` PowerShell script.
- **MBAM\_Machine WMI Class**
+ **MBAM\_Machine WMI Class**
**PrepareTpmAndEscrowOwnerAuth:** Reads the TPM OwnerAuth and sends it to the MBAM recovery database by using the MBAM recovery service. If the TPM is not owned and auto-provisioning is not on, it generates a TPM OwnerAuth and takes ownership. If it fails, an error code is returned for troubleshooting.
- **Note** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](http://technet.microsoft.com/en-us/itpro/windows/keep-secure/change-the-tpm-owner-password) for further details.
+ **Note** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/change-the-tpm-owner-password) for further details.
| Parameter | Description |
| -------- | ----------- |
@@ -91,13 +91,13 @@ Here are a list of common error messages:
| **WS_E_INVALID_ENDPOINT_URL** 2151481376 (0x803D0020) | The endpoint address URL is not valid. The URL must start with “http” or “https”. |
**ReportStatus:** Reads the compliance status of the volume and sends it to the MBAM compliance status database by using the MBAM status reporting service. The status includes cipher strength, protector type, protector state and encryption state. If it fails, an error code is returned for troubleshooting.
-
+
| Parameter | Description |
| --------- | ----------- |
| ReportingServiceEndPoint | A string specifying the MBAM status reporting service endpoint. |
-
+
Here are a list of common error messages:
-
+
| Common return values | Error message |
| -------------------- | ------------- |
| **S_OK** 0 (0x0) | The method was successful |
@@ -108,20 +108,20 @@ Here are a list of common error messages:
| **WS_E_ENDPOINT_FAULT_RECEIVED** 2151481363 (0x803D0013) | A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint. |
| **WS_E_INVALID_ENDPOINT_URL** 2151481376 (0x803D0020) | The endpoint address URL is not valid. The URL must start with “http” or “https”. |
- **MBAM\_Volume WMI Class**
+ **MBAM\_Volume WMI Class**
**EscrowRecoveryKey:** Reads the recovery numerical password and key package of the volume and sends them to the MBAM recovery database by using the MBAM recovery service. If it fails, an error code is returned for troubleshooting.
-
+
| Parameter | Description |
| --------- | ----------- |
| RecoveryServiceEndPoint | A string specifying the MBAM recovery service endpoint. |
-
+
Here are a list of common error messages:
-
+
| Common return values | Error message |
| -------------------- | ------------- |
| **S_OK** 0 (0x0) | The method was successful |
| **FVE_E_LOCKED_VOLUME** 2150694912 (0x80310000) | The volume is locked. |
- | **FVE_E_PROTECTOR_NOT_FOUND** 2150694963 (0x80310033) | A Numerical Password protector was not found for the volume. |
+ | **FVE_E_PROTECTOR_NOT_FOUND** 2150694963 (0x80310033) | A Numerical Password protector was not found for the volume. |
| **WS_E_ENDPOINT_ACCESS_DENIED** 2151481349 (0x803D0005) | Access was denied by the remote endpoint. |
| **WS_E_ENDPOINT_NOT_FOUND** 2151481357 (0x803D000D) | The remote endpoint does not exist or could not be located. |
| **WS_E_ENDPOINT_FAILURE** 2151481357 (0x803D000F) | The remote endpoint could not process the request. |
@@ -139,7 +139,7 @@ Here are a list of common error messages:
**Caution**
If you are using BitLocker pre-provisioning (WinPE) and want to maintain the TPM owner authorization value, you must add the `SaveWinPETpmOwnerAuth.wsf` script in WinPE immediately before the installation reboots into the full operating system. **If you do not use this script, you will lose the TPM owner authorization value on reboot.**
-
+
2. Copy `Invoke-MbamClientDeployment.ps1` to **<DeploymentShare>\\Scripts**. If you are using pre-provisioning, copy the `SaveWinPETpmOwnerAuth.wsf` file into **<DeploymentShare>\\Scripts**.
3. Add the MBAM 2.5 SP1 client application to the Applications node in the deployment share.
@@ -178,8 +178,8 @@ Here are a list of common error messages:
3. Name the step **Persist TPM OwnerAuth**
- 4. Set the command line to `cscript.exe "%SCRIPTROOT%/SaveWinPETpmOwnerAuth.wsf"`
- **Note:** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](http://technet.microsoft.com/en-us/itpro/windows/keep-secure/change-the-tpm-owner-password) for further details.
+ 4. Set the command line to `cscript.exe "%SCRIPTROOT%/SaveWinPETpmOwnerAuth.wsf"`
+ **Note:** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/change-the-tpm-owner-password) for further details.
3. In the **State Restore** folder, delete the **Enable BitLocker** task.
@@ -279,7 +279,7 @@ Here are a list of common error messages:
**Note**
You can set Group Policy settings or registry values related to MBAM here. These settings will override previously set values.
-
+
Registry entry
Configuration settings
@@ -329,5 +329,5 @@ Here are a list of common error messages:
[Planning for MBAM 2.5 Client Deployment](planning-for-mbam-25-client-deployment.md)
## Got a suggestion for MBAM?
-- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
+- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
\ No newline at end of file
diff --git a/mdop/mbam-v25/how-to-move-the-mbam-25-databases.md b/mdop/mbam-v25/how-to-move-the-mbam-25-databases.md
index 2a97dc6cbb..518233e7db 100644
--- a/mdop/mbam-v25/how-to-move-the-mbam-25-databases.md
+++ b/mdop/mbam-v25/how-to-move-the-mbam-25-databases.md
@@ -38,7 +38,7 @@ Restore the databases FIRST, then run the MBAM Configuration Wizard, choose the
5. Self-Service Portal
>[!Note]
->To run the example Windows PowerShell scripts provided in this topic, you must update the Windows PowerShell execution policy to enable scripts to be run. See [Running Windows PowerShell Scripts](http://technet.microsoft.com/library/ee176949.aspx) for instructions.
+>To run the example Windows PowerShell scripts provided in this topic, you must update the Windows PowerShell execution policy to enable scripts to be run. See [Running Windows PowerShell Scripts](https://technet.microsoft.com/library/ee176949.aspx) for instructions.
## Move the Recovery Database
@@ -69,7 +69,7 @@ Stop-Website "Microsoft BitLocker Administration and Monitoring"
```
->[!NOTE]
+>[!NOTE]
>To run this command, you must add the Internet Information Services (IIS) module for Windows PowerShell to the current instance of Windows PowerShell.
### Back up the Recovery Database on Server A
@@ -80,47 +80,47 @@ Stop-Website "Microsoft BitLocker Administration and Monitoring"
```
USE master;
-
+
GO
-
+
ALTER DATABASE "MBAM Recovery and Hardware"
-
+
SET RECOVERY FULL;
-
+
GO
-
+
-- Create MBAM Recovery Database Data and MBAM Recovery logical backup devices.
-
+
USE master
-
+
GO
-
+
EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device',
-
+
'Z:\MBAM Recovery Database Data.bak';
-
+
GO
-
+
-- Back up the full MBAM Recovery Database.
-
+
BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device];
-
+
GO
-
+
BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate]
-
+
TO FILE = 'Z:\SQLServerInstanceCertificateFile'
-
+
WITH PRIVATE KEY
-
+
(
-
+
FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',
-
+
ENCRYPTION BY PASSWORD = '$PASSWORD$'
-
+
);
-
+
GO
```
@@ -235,7 +235,7 @@ Use the information in the following table to replace the values in the code exa
2. On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to update the connection string information for the MBAM websites.
-3. Edit the following registry key:
+3. Edit the following registry key:
**HKLM\\Software\\Microsoft\\MBAM Server\\Web\\RecoveryDBConnectionString**
@@ -293,11 +293,11 @@ On the server that is running the Administration and Monitoring Website, use the
To automate this procedure, you can use Windows PowerShell to run a command that is similar to the following:
-```powershell
+```powershell
Start-Website "Microsoft BitLocker Administration and Monitoring"
```
->[!NOTE]
+>[!NOTE]
>To run this command, you must add the IIS module for Windows PowerShell to the current instance of Windows PowerShell.
## Move the Compliance and Audit Database
@@ -330,7 +330,7 @@ Stop-Website "Microsoft BitLocker Administration and Monitoring"
```
->[!NOTE]
+>[!NOTE]
>To run this command, you must add the Internet Information Services (IIS) module for Windows PowerShell to the current instance of Windows PowerShell.
### Back up the Compliance and Audit Database on Server A
@@ -398,7 +398,7 @@ Stop-Website "Microsoft BitLocker Administration and Monitoring"
|----------------------|---------------------------------------------------------------|
| $SERVERNAME$ | Name of the server to which the files will be copied. |
| $DESTINATIONSHARE$ | Name of the share and path to which the files will be copied. |
-
+
### Restore the Compliance and Audit Database on Server B
@@ -447,7 +447,7 @@ Stop-Website "Microsoft BitLocker Administration and Monitoring"
2. On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to update the connection string information for the Website.
-3. Edit the following registry key:
+3. Edit the following registry key:
**HKLM\\Software\\Microsoft\\MBAM Server\\Web\\ComplianceDBConnectionString**
@@ -463,7 +463,7 @@ Stop-Website "Microsoft BitLocker Administration and Monitoring"
Catalog=$DATABASE$;Data Source=$SERVERNAME$\$SQLINSTANCENAME$" /f
```
- >[!NOTE]
+ >[!NOTE]
>This connection string is shared by all local MBAM web applications. Therefore, it needs to be updated only once per server.
@@ -476,7 +476,7 @@ Stop-Website "Microsoft BitLocker Administration and Monitoring"
### Install MBAM Server software and run the MBAM Server Configuration wizard on Server B
-1. Install the MBAM 2.5 Server software on Server B. For details, see [Installing the MBAM 2.5 Server Software](https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/mbam-v25/installing-the-mbam-25-server-software).
+1. Install the MBAM 2.5 Server software on Server B. For details, see [Installing the MBAM 2.5 Server Software](https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/mbam-v25/installing-the-mbam-25-server-software).
2. On Server B, start the MBAM Server Configuration wizard, click **Add New Features**, and then select only the **Compliance and Audit Database** feature. For details on how to configure the databases, see [How to Configure the MBAM 2.5 Databases](https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/mbam-v25/how-to-configure-the-mbam-25-databases).
@@ -495,5 +495,5 @@ Start-Website "Microsoft BitLocker Administration and Monitoring"
```
->[!NOTE]
+>[!NOTE]
>To run this command, you must add the IIS module for Windows PowerShell to the current instance of Windows PowerShell.
diff --git a/mdop/mbam-v25/how-to-move-the-mbam-25-reports.md b/mdop/mbam-v25/how-to-move-the-mbam-25-reports.md
index bc5fa5a455..980c43f797 100644
--- a/mdop/mbam-v25/how-to-move-the-mbam-25-reports.md
+++ b/mdop/mbam-v25/how-to-move-the-mbam-25-reports.md
@@ -27,7 +27,7 @@ The high-level steps for moving the Reports feature are:
4. Resume the instance of the MBAM Administration and Monitoring Website.
**Note**
-To run the example Windows PowerShell scripts in this topic, you must update the Windows PowerShell execution policy to enable scripts to be run. See [Running Windows PowerShell Scripts](http://technet.microsoft.com/library/ee176949.aspx) for instructions.
+To run the example Windows PowerShell scripts in this topic, you must update the Windows PowerShell execution policy to enable scripts to be run. See [Running Windows PowerShell Scripts](https://technet.microsoft.com/library/ee176949.aspx) for instructions.
@@ -130,7 +130,7 @@ To run the example Windows PowerShell scripts in this topic, you must update the
## Got a suggestion for MBAM?
-- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
+- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/index.md b/mdop/mbam-v25/index.md
index 84fc7c8df0..9e5c96e03d 100644
--- a/mdop/mbam-v25/index.md
+++ b/mdop/mbam-v25/index.md
@@ -18,25 +18,25 @@ Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 provides a simplifi
To get the MBAM software, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049).
-[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md)
+[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md)
[About MBAM 2.5](about-mbam-25.md)**|**[Release Notes for MBAM 2.5](release-notes-for-mbam-25.md)**|**[About MBAM 2.5 SP1](about-mbam-25-sp1.md)**|**[Release Notes for MBAM 2.5 SP1](release-notes-for-mbam-25-sp1.md)**|**[Evaluating MBAM 2.5 in a Test Environment](evaluating-mbam-25-in-a-test-environment.md)**|**[High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md)**|**[Accessibility for MBAM 2.5](accessibility-for-mbam-25.md)
-[Planning for MBAM 2.5](planning-for-mbam-25.md)
+[Planning for MBAM 2.5](planning-for-mbam-25.md)
[Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md)**|**[MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md)**|**[Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md)**|**[Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md)**|**[Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md)**|**[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md)**|**[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md)**|**[Planning for MBAM 2.5 High Availability](planning-for-mbam-25-high-availability.md)**|**[MBAM 2.5 Security Considerations](mbam-25-security-considerations.md)**|**[MBAM 2.5 Planning Checklist](mbam-25-planning-checklist.md)
-[Deploying MBAM 2.5](deploying-mbam-25.md)
+[Deploying MBAM 2.5](deploying-mbam-25.md)
[Deploying the MBAM 2.5 Server Infrastructure](deploying-the-mbam-25-server-infrastructure.md)**|**[Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md)**|**[Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md)**|**[MBAM 2.5 Deployment Checklist](mbam-25-deployment-checklist.md)**|**[Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions](upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md)**|**[Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md)
-[Operations for MBAM 2.5](operations-for-mbam-25.md)
+[Operations for MBAM 2.5](operations-for-mbam-25.md)
[Administering MBAM 2.5 Features](administering-mbam-25-features.md)**|**[Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md)**|**[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md)**|**[Maintaining MBAM 2.5](maintaining-mbam-25.md)**|**[Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md)
-[Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md)
+[Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md)
-[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md)
+[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md)
[Client Event Logs](client-event-logs.md)**|**[Server Event Logs](server-event-logs.md)
@@ -54,16 +54,16 @@ To get the MBAM software, see [How Do I Get MDOP](https://go.microsoft.com/fwlin
Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447).
-- [MBAM Deployment Guide](http://www.microsoft.com/download/details.aspx?id=38398)
+- [MBAM Deployment Guide](https://www.microsoft.com/download/details.aspx?id=38398)
Get help in choosing a deployment method for MBAM, including step-by-step instructions for each method.
- [Apply Hotfixes on MBAM 2.5 SP1 Server](apply-hotfix-for-mbam-25-sp1.md)
Guide of how to apply MBAM 2.5 SP1 Server hotfixes
-
+
## Got a suggestion for MBAM?
-- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
+- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/mbam-25-security-considerations.md b/mdop/mbam-v25/mbam-25-security-considerations.md
index 3f10ae0da3..bf45fa3815 100644
--- a/mdop/mbam-v25/mbam-25-security-considerations.md
+++ b/mdop/mbam-v25/mbam-25-security-considerations.md
@@ -32,7 +32,7 @@ This topic contains the following information about how to secure Microsoft BitL
## Configure MBAM to escrow the TPM and store OwnerAuth passwords
-**Note** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addition, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](http://technet.microsoft.com/en-us/itpro/windows/keep-secure/change-the-tpm-owner-password) for further details.
+**Note** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addition, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/change-the-tpm-owner-password) for further details.
Depending on its configuration, the Trusted Platform Module (TPM) will lock itself in certain situations ─ such as when too many incorrect passwords are entered ─ and can remain locked for a period of time. During TPM lockout, BitLocker cannot access the encryption keys to perform unlock or decryption operations, requiring the user to enter their BitLocker recovery key to access the operating system drive. To reset TPM lockout, you must provide the TPM OwnerAuth password.
@@ -40,7 +40,7 @@ MBAM can store the TPM OwnerAuth password in the MBAM database if it owns the TP
### Escrowing TPM OwnerAuth in Windows 8 and higher
-**Note** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](http://technet.microsoft.com/en-us/itpro/windows/keep-secure/change-the-tpm-owner-password) for further details.
+**Note** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/change-the-tpm-owner-password) for further details.
In Windows 8 or higher, MBAM no longer must own the TPM to store the OwnerAuth password, as long as the OwnerAuth is available on the local machine.
@@ -229,7 +229,7 @@ TPM lockout auto reset is only supported on computers running TPM version 1.2. T
## Secure connections to SQL Server
-In MBAM, SQL Server communicates with SQL Server Reporting Services and with the web services for the Administration and Monitoring Website and Self-Service Portal. We recommend that you secure the communication with SQL Server. For more information, see [Encrypting Connections to SQL Server](http://technet.microsoft.com/library/ms189067.aspx).
+In MBAM, SQL Server communicates with SQL Server Reporting Services and with the web services for the Administration and Monitoring Website and Self-Service Portal. We recommend that you secure the communication with SQL Server. For more information, see [Encrypting Connections to SQL Server](https://technet.microsoft.com/library/ms189067.aspx).
For more information about securing the MBAM websites, see [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md).
@@ -282,7 +282,7 @@ When TDE is enabled on a database, all backups are encrypted. Thus, special care
Back up the certificate with the database. Each certificate backup should have two files. Both of these files should be archived. Ideally for security, they should be backed up separately from the database backup file. You can alternatively consider using the extensible key management (EKM) feature (see Extensible Key Management) for storage and maintenance of keys that are used for TDE.
-For an example of how to enable TDE for MBAM database instances, see [Understanding Transparent Data Encryption (TDE)](http://technet.microsoft.com/library/bb934049.aspx).
+For an example of how to enable TDE for MBAM database instances, see [Understanding Transparent Data Encryption (TDE)](https://technet.microsoft.com/library/bb934049.aspx).
## Understand general security considerations
@@ -293,7 +293,7 @@ For an example of how to enable TDE for MBAM database instances, see [Understand
**Apply the most recent security updates to all computers**. Stay informed about new updates for Windows operating systems, SQL Server, and MBAM by subscribing to the Security Notification service at the [Security TechCenter](https://go.microsoft.com/fwlink/?LinkId=28819).
-**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all MBAM administrator accounts. Never use blank passwords. For more information about password concepts, see [Password Policy](http://technet.microsoft.com/library/hh994572.aspx).
+**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all MBAM administrator accounts. Never use blank passwords. For more information about password concepts, see [Password Policy](https://technet.microsoft.com/library/hh994572.aspx).
@@ -304,7 +304,7 @@ For an example of how to enable TDE for MBAM database instances, see [Understand
## Got a suggestion for MBAM?
-- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
+- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md b/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md
index 5d73f5edf1..0dc592b269 100644
--- a/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md
+++ b/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md
@@ -292,7 +292,7 @@ The following table lists the installation prerequisites for the MBAM Administra
Service Principal Name (SPN)
The web applications require an SPN for the virtual host name under the domain account that you use for the web application pools.
-
If your administrative rights permit you to create SPNs in Active Directory Domain Services, MBAM creates the SPN for you. See [Setspn](http://technet.microsoft.com/library/cc731241.aspx) for information about the rights required to create SPNs.
+
If your administrative rights permit you to create SPNs in Active Directory Domain Services, MBAM creates the SPN for you. See [Setspn](https://technet.microsoft.com/library/cc731241.aspx) for information about the rights required to create SPNs.
If you do not have administrative rights to create SPNs, you must ask the Active Directory administrators in your organization to create the SPN for you by using the following command.
The web applications require an SPN for the virtual host name under the domain account that you use for the web application pools.
-
If your administrative rights permit you to create SPNs in Active Directory Domain Services, MBAM creates the SPN for you. See [Setspn](http://technet.microsoft.com/library/cc731241.aspx) for information about the rights required to create SPNs.
+
If your administrative rights permit you to create SPNs in Active Directory Domain Services, MBAM creates the SPN for you. See [Setspn](https://technet.microsoft.com/library/cc731241.aspx) for information about the rights required to create SPNs.
If you do not have administrative rights to create SPNs, you must ask the Active Directory administrators in your organization administrators in your organization to create the SPN for you by using the following command.
@@ -422,7 +422,7 @@ Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser
## Got a suggestion for MBAM?
-- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
+- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/planning-for-mbam-25-high-availability.md b/mdop/mbam-v25/planning-for-mbam-25-high-availability.md
index fcf168b878..801ea71276 100644
--- a/mdop/mbam-v25/planning-for-mbam-25-high-availability.md
+++ b/mdop/mbam-v25/planning-for-mbam-25-high-availability.md
@@ -75,7 +75,7 @@ Complete the following tasks:
3. If you are configuring the websites in a web farm with a load balancer, you must configure the websites to use the same machine key.
- For more information, see the following sections in [machineKey Element (ASP.NET Settings Schema)](http://msdn.microsoft.com/library/vstudio/w8h3skw9.aspx):
+ For more information, see the following sections in [machineKey Element (ASP.NET Settings Schema)](https://msdn.microsoft.com/library/vstudio/w8h3skw9.aspx):
- Machine Key Explained
@@ -134,7 +134,7 @@ The VSS writer is registered on every server where you enable an MBAM web applic
## Got a suggestion for MBAM?
-- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
+- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md b/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md
index b59cdf6226..500b84672e 100644
--- a/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md
+++ b/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md
@@ -52,7 +52,7 @@ We recommend that you use a certificate to secure the communication between the:
- Browser and the Administration and Monitoring Website and the Self-Service Portal websites
-For information about requesting and installing a certificate, see [Configuring Internet Server Certificates](http://technet.microsoft.com/library/cc731977.aspx).
+For information about requesting and installing a certificate, see [Configuring Internet Server Certificates](https://technet.microsoft.com/library/cc731977.aspx).
**Note**
You can configure the websites and web services on different servers only if you are using Windows PowerShell. If you use the MBAM Server Configuration wizard to configure the websites, you must configure the websites and the web services on the same server.
@@ -326,7 +326,7 @@ If you already registered SPNs on the machine account rather than in an applicat
## Got a suggestion for MBAM?
-- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
+- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md b/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md
index f151a12f21..13d5e28e78 100644
--- a/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md
+++ b/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md
@@ -49,7 +49,7 @@ Before you install the MBAM Client software on end users' computers, ensure that
For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM.
In MBAM 2.5 SP1, you must turn on auto-provisioning.
-
See [TPM owner password](http://technet.microsoft.com/en-us/itpro/windows/keep-secure/change-the-tpm-owner-password) for further details.
+
See [TPM owner password](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/change-the-tpm-owner-password) for further details.
@@ -94,7 +94,7 @@ If BitLocker was used without MBAM, MBAM can be installed and utilize the existi
## Got a suggestion for MBAM?
-- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
+- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/release-notes-for-mbam-25.md b/mdop/mbam-v25/release-notes-for-mbam-25.md
index 91c710e6ee..5ed4366556 100644
--- a/mdop/mbam-v25/release-notes-for-mbam-25.md
+++ b/mdop/mbam-v25/release-notes-for-mbam-25.md
@@ -128,7 +128,7 @@ This table lists the hotfixes and KB articles for MBAM 2.5.
2975636
Hotfix Package 1 for Microsoft BitLocker Administration and Monitoring 2.5
@@ -174,7 +174,7 @@ This table lists the hotfixes and KB articles for MBAM 2.5.
## Got a suggestion for MBAM?
-- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
+- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/server-event-logs.md b/mdop/mbam-v25/server-event-logs.md
index 637ae371f3..c2d73ac15e 100644
--- a/mdop/mbam-v25/server-event-logs.md
+++ b/mdop/mbam-v25/server-event-logs.md
@@ -510,7 +510,7 @@ The following table contains messages and troubleshooting information for event
QueryRecoveryKeyIdsForUser: An error occurred while getting recovery key Ids from the database. Message:{message} -or-
QueryVolumeUsers: An error occurred while getting user information from the database.
This message is logged whenever there is an exception while communicating with the MBAM recovery database. Read through the information contained in the trace to get specific details about the exception.
-
For detailed troubleshooting steps, see the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](http://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx).
+
For detailed troubleshooting steps, see the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx).
101
@@ -522,7 +522,7 @@ The following table contains messages and troubleshooting information for event
QueryRecoveryKeyIdsForUser: An error occurred while logging an audit event to the compliance database. Message:{message} -or-
QueryDriveRecoveryData: An error occurred while logging an audit event to the compliance database. Message:{message}
This message is logged whenever there is an exception while communicating the MBAM compliance database. Read through the information contained in the trace to get specific details about the exception.
-
For detailed troubleshooting steps, see the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](http://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx).
+
For detailed troubleshooting steps, see the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx).
102
@@ -530,7 +530,7 @@ The following table contains messages and troubleshooting information for event
AgentServiceRecoveryDbError
This message indicates an exception when MBAM Agent service tries to communicate with the recovery database. Read through the message contained in the event to get specific information about the exception.
-
See the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](http://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify whether the MBAM app pool account has required permissions in place to connect or execute on MBAM recovery database.
+
See the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify whether the MBAM app pool account has required permissions in place to connect or execute on MBAM recovery database.
103
@@ -555,7 +555,7 @@ The following table contains messages and troubleshooting information for event
StatusServiceComplianceDbError
This error indicates that MBAM websites/web services were unable to connect to the MBAMCompliance database.
-
See the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](http://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify that the IIS app pool account could connect to the MBAM compliance database.
+
See the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify that the IIS app pool account could connect to the MBAM compliance database.
106
@@ -598,7 +598,7 @@ The following table contains messages and troubleshooting information for event
QueryRecoveryKeyIdsForUser: an error occurred while getting recovery key Ids for a user. Message:{message} -or-
An error occurred while getting TPM password hash from the Recovery database. EventDetails:{ExceptionMessage}
This message indicates that recovery database connection string information at "HKLM\Software\Microsoft\MBAM Server\Web\RecoveryDBConnectionString" is invalid. Verify the given registry key value. –or-
-
If any of the remaining messages are logged, refer to the troubleshooting steps listed at the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](http://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify whether a connection could be made to the MBAM Recovery database from IIS server using app pool credentials.
+
If any of the remaining messages are logged, refer to the troubleshooting steps listed at the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify whether a connection could be made to the MBAM Recovery database from IIS server using app pool credentials.
110
@@ -609,7 +609,7 @@ The following table contains messages and troubleshooting information for event
QueryRecoveryKeyIdsForUser: an error occurred while logging an audit event to the Compliance database. Message:{message} -or-
QueryRecoveryKeyIdsForUser: an error occurred while logging an audit event to the compliance database. Message:{message}
This message indicates that compliance db connection string information at "HKLM\Software\Microsoft\MBAM Server\Web\ComplianceDBConnectionString" is invalid. Verify the value corresponding to above registry key. –or-
-
If any of the remaining messages are logged, refer to the troubleshooting steps listed at the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](http://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify whether a connection could be made to the MBAM Compliance database from IIS server using app pool credentials.
+
If any of the remaining messages are logged, refer to the troubleshooting steps listed at the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify whether a connection could be made to the MBAM Compliance database from IIS server using app pool credentials.
111
@@ -622,7 +622,7 @@ The following table contains messages and troubleshooting information for event
MBAM websites/webservices execution account(app pool account) could not run the GetVersion stored procedure on MBAMCompliance OR MBAMRecovery database
The message contained in the event will provide more details about the exception.
-
Refer to the troubleshooting steps listed at the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](http://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify that the MBAM execution account (app pool account) could connect to MBAM compliance/recovery database and it has permissions in place to execute GetVersion stored procedure.
+
Refer to the troubleshooting steps listed at the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify that the MBAM execution account (app pool account) could connect to MBAM compliance/recovery database and it has permissions in place to execute GetVersion stored procedure.
112
@@ -670,7 +670,7 @@ The following table contains messages and troubleshooting information for event
## Got a suggestion for MBAM?
-- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
+- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md b/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md
index 3d7c288953..14bf916364 100644
--- a/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md
+++ b/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md
@@ -105,7 +105,7 @@ Use the steps in the following sections to upgrade MBAM for the Stand-alone topo
4. Install and configure the MBAM 2.5 or 2.5 SP1 databases, reports, and web applications, in that order. The databases are upgraded in place.
-5. Update the Group Policy Objects (GPOs) using the MBAM 2.5 Templates to leverage the new features in MBAM, such as enforced encryption. If you do not update the GPOs and the MBAM client to MBAM 2.5, earlier versions of MBAM clients will continue to report against your current GPOs with reduced functionality. See [How to Get MDOP Group Policy (.admx) Templates](http://www.microsoft.com/download/details.aspx?id=41183) to download the latest ADMX templates.
+5. Update the Group Policy Objects (GPOs) using the MBAM 2.5 Templates to leverage the new features in MBAM, such as enforced encryption. If you do not update the GPOs and the MBAM client to MBAM 2.5, earlier versions of MBAM clients will continue to report against your current GPOs with reduced functionality. See [How to Get MDOP Group Policy (.admx) Templates](https://www.microsoft.com/download/details.aspx?id=41183) to download the latest ADMX templates.
After you upgrade the MBAM Server infrastructure, the existing client computers continue to successfully report to the MBAM 2.5 or 2.5 SP1 Server, and recovery data continues to be stored.
@@ -161,7 +161,7 @@ MBAM supports upgrades to the MBAM 2.5 Client from any earlier version of the M
## Got a suggestion for MBAM?
-- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
+- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md b/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md
index 0e61567b46..8a48eb313c 100644
--- a/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md
+++ b/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md
@@ -92,7 +92,7 @@ The following server settings can be configured:
- [How to: Configure a Port with an SSL Certificate](https://go.microsoft.com/fwlink/?LinkID=183315)
- - [How to: Configure a Port with an SSL Certificate](http://msdn.microsoft.com/library/ms733791.aspx)
+ - [How to: Configure a Port with an SSL Certificate](https://msdn.microsoft.com/library/ms733791.aspx)
3. Click **OK**.
diff --git a/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md
index b845f8d421..5178ad8c46 100644
--- a/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md
+++ b/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md
@@ -73,34 +73,34 @@ UE-V uses the http://schemas.microsoft.com/UserExperienceVirtualization/2012/Set
These are the data types for the UE-V application template schema.
-**GUID**
+**GUID**
GUID describes a standard globally unique identifier regular expression in the form "\\{\[a-fA-F0-9\]{8}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{12}\\}". This is used in the Filesetting\\Root\\KnownFolder element to verify the formatting of well-known folders.
-**FilenameString**
+**FilenameString**
FilenameString refers to the file name of a process to be monitored. Its values are restricted by the regex \[^\\\\\\?\\\*\\|<>/:\]+, (that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon characters).
-**IDString**
+**IDString**
IDString refers to the ID value of Application elements, SettingsLocationTemplate, and Common elements (used to describe application suites that share common settings). It is restricted by the same regex as FilenameString (\[^\\\\\\?\\\*\\|<>/:\]+).
-**TemplateVersion**
+**TemplateVersion**
TemplateVersion is an integer value used to describe the revision of the settings location template. Its value may range from 0 to 2147483647.
-**Empty**
+**Empty**
Empty refers to a null value. This is used in Process\\ShellProcess to indicate that there is no process to monitor. This value should not be used in any application templates.
-**Author**
+**Author**
The Author data type is a complex type that identifies the author of a template. It contains two child elements: **Name** and **Email**. Within the Author data type, the Name element is mandatory while the Email element is optional. This type is described in more detail under the SettingsLocationTemplate element.
-**Range**
+**Range**
Range defines an integer class consisting of two child elements: **Minimum** and **Maximum**. This data type is implemented in the ProcessVersion data type. If specified, both Minimum and Maximum values must be included.
-**ProcessVersion**
+**ProcessVersion**
ProcessVersion defines a type with four child elements: **Major**, **Minor**, **Build**, and **Patch**. This data type is used by the Process element to populate its ProductVersion and FileVersion values. The data for this type is a Range value. The Major child element is mandatory and the others are optional.
-**Architecture**
+**Architecture**
Architecture enumerates two possible values: **Win32** and **Win64**. These values are used to specify process architecture.
-**Process**
+**Process**
The Process data type is a container used to describe processes to be monitored by UE-V. It contains six child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. This table details each element’s respective data type:
@@ -150,26 +150,26 @@ The Process data type is a container used to describe processes to be monitored
-**Processes**
+**Processes**
The Processes data type represents a container for a collection of one or more Process elements. Two child elements are supported in the Processes sequence type: **Process** and **ShellProcess**. Process is an element of type Process and ShellProcess is of data type Empty. At least one item must be identified in the sequence.
-**Path**
+**Path**
Path is consumed by RegistrySetting and FileSetting to refer to registry and file paths. This element supports two optional attributes: **Recursive** and **DeleteIfNotFound**. Both values are set to default=”False”.
Recursive indicates that the path and all subfolders are included for file settings or that all child registry keys are included for registry settings. In both cases, all items at the current level are included in the data captured. For a FileSettings object, all files within the specified folder are included in the data captured by UE-V but folders are not included. For registry paths, all values in the current path are captured but child registry keys are not captured. In both cases, care should be taken to avoid capturing large data sets or large numbers of items.
The DeleteIfNotFound attribute removes the setting from the user’s settings storage path data. This may be desirable in cases where removing these settings from the package will save a large amount of disk space on the settings storage path file server.
-**FileMask**
+**FileMask**
FileMask specifies only certain file types for the folder that is defined by Path. For example, Path might be `C:\users\username\files` and FileMask could be `*.txt` to include only text files.
-**RegistrySetting**
+**RegistrySetting**
RegistrySetting represents a container for registry keys and values and the associated desired behavior on the part of the UE-V Agent. Four child elements are defined within this type: **Path**, **Name**, **Exclude**, and a sequence of the values **Path** and **Name**.
-**FileSetting**
+**FileSetting**
FileSetting contains parameters associated with files and files paths. Four child elements are defined: **Root**, **Path**, **FileMask**, and **Exclude**. Root is mandatory and the others are optional.
-**Settings**
+**Settings**
Settings is a container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings described earlier. In addition, it can also contain the following child elements with behaviors described:
@@ -266,7 +266,7 @@ This value is queried to determine if a new version of a template should be appl
**Type: String**
-Author identifies the creator of the settings location template. Two optional child elements are supported: **Name** and **Email**. Both attributes are optional, but, if the Email child element is specified, it must be accompanied by the Name element. Author refers to the full name of the contact for the settings location template, and email should refer to an email address for the author. We recommend that you include this information in templates published publicly, for example, on the [UE-V Template Gallery](http://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V).
+Author identifies the creator of the settings location template. Two optional child elements are supported: **Name** and **Email**. Both attributes are optional, but, if the Email child element is specified, it must be accompanied by the Name element. Author refers to the full name of the contact for the settings location template, and email should refer to an email address for the author. We recommend that you include this information in templates published publicly, for example, on the [UE-V Template Gallery](https://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V).
### Processes and Process Element
@@ -373,7 +373,7 @@ For example, in a suited application, it might be useful to provide reminders ab
``` syntax
-
+
MyApplication.exeMy Application Main Engine
@@ -671,7 +671,7 @@ Here is the SettingsLocationTemplate.xsd file showing its elements, child elemen
-
+
@@ -708,7 +708,7 @@ Here is the SettingsLocationTemplate.xsd file showing its elements, child elemen
-
+
@@ -1011,34 +1011,34 @@ UE-V uses the http://schemas.microsoft.com/UserExperienceVirtualization/2012/Set
These are the data types for the UE-V application template schema.
-**GUID**
+**GUID**
GUID describes a standard globally unique identifier regular expression in the form "\\{\[a-fA-F0-9\]{8}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{12}\\}". This is used in the Filesetting\\Root\\KnownFolder element to verify the formatting of well-known folders.
-**FilenameString**
+**FilenameString**
FilenameString refers to the file name of a process to be monitored. Its values are restricted by the regex \[^\\\\\\?\\\*\\|<>/:\]+, (that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon characters).
-**IDString**
+**IDString**
IDString refers to the ID value of Application elements, SettingsLocationTemplate, and Common elements (used to describe application suites that share common settings). It is restricted by the same regex as FilenameString (\[^\\\\\\?\\\*\\|<>/:\]+).
-**TemplateVersion**
+**TemplateVersion**
TemplateVersion is an integer value used to describe the revision of the settings location template. Its value may range from 0 to 2147483647.
-**Empty**
+**Empty**
Empty refers to a null value. This is used in Process\\ShellProcess to indicate that there is no process to monitor. This value should not be used in any application templates.
-**Author**
+**Author**
The Author data type is a complex type that identifies the author of a template. It contains two child elements: **Name** and **Email**. Within the Author data type, the Name element is mandatory while the Email element is optional. This type is described in more detail under the SettingsLocationTemplate element.
-**Range**
+**Range**
Range defines an integer class consisting of two child elements: **Minimum** and **Maximum**. This data type is implemented in the ProcessVersion data type. If specified, both Minimum and Maximum values must be included.
-**ProcessVersion**
+**ProcessVersion**
ProcessVersion defines a type with four child elements: **Major**, **Minor**, **Build**, and **Patch**. This data type is used by the Process element to populate its ProductVersion and FileVersion values. The data for this type is a Range value. The Major child element is mandatory and the others are optional.
-**Architecture**
+**Architecture**
Architecture enumerates two possible values: **Win32** and **Win64**. These values are used to specify process architecture.
-**Process**
+**Process**
The Process data type is a container used to describe processes to be monitored by UE-V. It contains six child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. This table details each element’s respective data type:
@@ -1090,26 +1090,26 @@ The Process data type is a container used to describe processes to be monitored
-**Processes**
+**Processes**
The Processes data type represents a container for a collection of one or more Process elements. Two child elements are supported in the Processes sequence type: **Process** and **ShellProcess**. Process is an element of type Process and ShellProcess is of data type Empty. At least one item must be identified in the sequence.
-**Path**
+**Path**
Path is consumed by RegistrySetting and FileSetting to refer to registry and file paths. This element supports two optional attributes: **Recursive** and **DeleteIfNotFound**. Both values are set to default=”False”.
Recursive indicates that the path and all subfolders are included for file settings or that all child registry keys are included for registry settings. In both cases, all items at the current level are included in the data captured. For a FileSettings object, all files within the specified folder are included in the data captured by UE-V but folders are not included. For registry paths, all values in the current path are captured but child registry keys are not captured. In both cases, care should be taken to avoid capturing large data sets or large numbers of items.
The DeleteIfNotFound attribute removes the setting from the user’s settings storage path data. This may be desirable in cases where removing these settings from the package will save a large amount of disk space on the settings storage path file server.
-**FileMask**
+**FileMask**
FileMask specifies only certain file types for the folder that is defined by Path. For example, Path might be `C:\users\username\files` and FileMask could be `*.txt` to include only text files.
-**RegistrySetting**
+**RegistrySetting**
RegistrySetting represents a container for registry keys and values and the associated desired behavior on the part of the UE-V Agent. Four child elements are defined within this type: **Path**, **Name**, **Exclude**, and a sequence of the values **Path** and **Name**.
-**FileSetting**
+**FileSetting**
FileSetting contains parameters associated with files and files paths. Four child elements are defined: **Root**, **Path**, **FileMask**, and **Exclude**. Root is mandatory and the others are optional.
-**Settings**
+**Settings**
Settings is a container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings described earlier. In addition, it can also contain the following child elements with behaviors described:
@@ -1203,7 +1203,7 @@ This value is queried to determine if a new version of a template should be appl
**Type: String**
-Author identifies the creator of the settings location template. Two optional child elements are supported: **Name** and **Email**. Both attributes are optional, but, if the Email child element is specified, it must be accompanied by the Name element. Author refers to the full name of the contact for the settings location template, and email should refer to an email address for the author. We recommend that you include this information in templates published publicly, for example, on the [UE-V Template Gallery](http://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V).
+Author identifies the creator of the settings location template. Two optional child elements are supported: **Name** and **Email**. Both attributes are optional, but, if the Email child element is specified, it must be accompanied by the Name element. Author refers to the full name of the contact for the settings location template, and email should refer to an email address for the author. We recommend that you include this information in templates published publicly, for example, on the [UE-V Template Gallery](https://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V).
### Processes and Process Element
@@ -1310,7 +1310,7 @@ For example, in a suited application, it might be useful to provide reminders ab
``` syntax
-
+
MyApplication.exeMy Application Main Engine
diff --git a/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md b/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md
index 391e491fa5..43c909ff82 100644
--- a/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md
+++ b/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md
@@ -14,7 +14,7 @@ ms.date: 06/16/2016
# Configuring UE-V 2.x with Group Policy Objects
-Some Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 Group Policy settings can be defined for computers, and other Group Policy settings can be defined for users. For information about how to install UE-V Group Policy ADMX files, see [Installing the UE-V 2 Group Policy ADMX Templates](http://technet.microsoft.com/library/dn458891.aspx#admx).
+Some Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 Group Policy settings can be defined for computers, and other Group Policy settings can be defined for users. For information about how to install UE-V Group Policy ADMX files, see [Installing the UE-V 2 Group Policy ADMX Templates](https://technet.microsoft.com/library/dn458891.aspx#admx).
The following policy settings can be configured for UE-V.
@@ -169,7 +169,7 @@ In addition, Group Policy settings are available for many desktop applications a
-For more information about synchronizing Windows apps, see [Windows App List](http://technet.microsoft.com/library/dn458925.aspx#win8applist).
+For more information about synchronizing Windows apps, see [Windows App List](https://technet.microsoft.com/library/dn458925.aspx#win8applist).
**To configure computer-targeted Group Policy settings**
diff --git a/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md b/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md
index 31551db716..80cd44d2e9 100644
--- a/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md
+++ b/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md
@@ -42,7 +42,7 @@ UE-V requires a location in which to store user settings in settings package fil
If you don’t create a settings storage location, the UE-V Agent will use Active Directory (AD) by default.
**Note**
-As a matter of [performance and capacity planning](http://technet.microsoft.com/library/dn458932.aspx#capacity) and to reduce problems with network latency, create settings storage locations on the same local networks where the users’ computers reside. We recommend 20 MB of disk space per user for the settings storage location.
+As a matter of [performance and capacity planning](https://technet.microsoft.com/library/dn458932.aspx#capacity) and to reduce problems with network latency, create settings storage locations on the same local networks where the users’ computers reside. We recommend 20 MB of disk space per user for the settings storage location.
@@ -54,11 +54,11 @@ The settings storage location is defined by setting the SettingsStoragePath conf
- When you [Deploy the UE-V Agent](#agent) through a command-line parameter or in a batch script
-- Through [Group Policy](http://technet.microsoft.com/library/dn458893.aspx) settings
+- Through [Group Policy](https://technet.microsoft.com/library/dn458893.aspx) settings
-- With the [System Center Configuration Pack](http://technet.microsoft.com/library/dn458917.aspx) for UE-V
+- With the [System Center Configuration Pack](https://technet.microsoft.com/library/dn458917.aspx) for UE-V
-- After installation of the UE-V Agent, by using [Windows PowerShell or Windows Management Instrumentation (WMI)](http://technet.microsoft.com/library/dn458937.aspx)
+- After installation of the UE-V Agent, by using [Windows PowerShell or Windows Management Instrumentation (WMI)](https://technet.microsoft.com/library/dn458937.aspx)
The path must be in a universal naming convention (UNC) path of the server and share. For example, **\\\\Server\\Settingsshare\\**. This configuration option supports the use of variables to enable specific synchronization scenarios. For example, you can use the `%username%\%computername%` variables to preserve the end user settings experience in these scenarios:
@@ -158,7 +158,7 @@ You want to figure out which configuration method you'll use to manage UE-V afte
You can configure UE-V before, during, or after UE-V Agent installation, depending on the configuration method that you use.
-- [Group Policy](http://technet.microsoft.com/library/dn458893.aspx)**:** You can use your existing Group Policy infrastructure to configure UE-V before or after UE-V Agent deployment. The UE-V Group Policy ADMX template enables the central management of common UE-V Agent configuration options, and it includes settings to configure UE-V synchronization.
+- [Group Policy](https://technet.microsoft.com/library/dn458893.aspx)**:** You can use your existing Group Policy infrastructure to configure UE-V before or after UE-V Agent deployment. The UE-V Group Policy ADMX template enables the central management of common UE-V Agent configuration options, and it includes settings to configure UE-V synchronization.
**Installing the UE-V Group Policy ADMX Templates:** Group Policy ADMX templates for UE-V configure the synchronization settings for the UE-V Agent and enable the central management of common UE-V Agent configuration settings by using an existing Group Policy infrastructure.
@@ -168,9 +168,9 @@ You can configure UE-V before, during, or after UE-V Agent installation, dependi
Windows Server 2012 and Windows Server 2012 R2
-- [Configuration Manager](http://technet.microsoft.com/library/dn458917.aspx)**:** The UE-V Configuration Pack lets you use the Compliance Settings feature of System Center Configuration Manager 2012 SP1 or later to apply consistent configurations across sites where UE-V and Configuration Manager are installed.
+- [Configuration Manager](https://technet.microsoft.com/library/dn458917.aspx)**:** The UE-V Configuration Pack lets you use the Compliance Settings feature of System Center Configuration Manager 2012 SP1 or later to apply consistent configurations across sites where UE-V and Configuration Manager are installed.
-- [Windows PowerShell and WMI](http://technet.microsoft.com/library/dn458937.aspx)**:** You can use scripted commands for Windows PowerShell and Windows Management Instrumentation (WMI) to modify configurations after you install the UE-V Agent.
+- [Windows PowerShell and WMI](https://technet.microsoft.com/library/dn458937.aspx)**:** You can use scripted commands for Windows PowerShell and Windows Management Instrumentation (WMI) to modify configurations after you install the UE-V Agent.
**Note**
Registry modification can result in data loss, or the computer becomes unresponsive. We recommend that you use other configuration methods.
diff --git a/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md b/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md
index 65b8567965..6d433b417b 100644
--- a/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md
+++ b/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md
@@ -88,7 +88,7 @@ However, only changes to the HKEY\_CURRENT\_USER hive will be sync-ed.
The UE-V Agent installs a default group of settings location templates for common Microsoft applications and Windows settings. If you customize these templates, or create settings location templates to synchronize settings for custom applications, the UE-V Agent can be configured to use a settings template catalog to store the templates. In this case, you will need to include the default templates along with the custom templates in the settings template catalog.
-When you [Deploy a UE-V Agent](http://technet.microsoft.com/library/dn458891.aspx#agent), you can use the command-line parameter `RegisterMSTemplates` to disable the registration of the default Microsoft templates.
+When you [Deploy a UE-V Agent](https://technet.microsoft.com/library/dn458891.aspx#agent), you can use the command-line parameter `RegisterMSTemplates` to disable the registration of the default Microsoft templates.
When you use Group Policy to configure the settings template catalog path, you can choose to replace the default Microsoft templates. If you configure the policy settings to replace the default Microsoft templates, all of the default Microsoft templates that are installed by the UE-V Agent are deleted and only the templates that are located in the settings template catalog are used. The UE-V Agent configuration setting parameter `RegisterMSTemplates` must be set to *true* in order to override the default Microsoft template.
@@ -284,7 +284,7 @@ Use the UE-V Generator to create settings location templates for line-of-busines
After you have created the settings location template for an application, you should test the template. Deploy the template in a lab environment before you put it into production in the enterprise.
-[Application Template Schema Reference for UE-V](http://technet.microsoft.com/library/dn763947.aspx) details the XML structure of the UE-V settings location template and provides guidance for editing these files.
+[Application Template Schema Reference for UE-V](https://technet.microsoft.com/library/dn763947.aspx) details the XML structure of the UE-V settings location template and provides guidance for editing these files.
## Deploy the Custom Settings Location Templates
diff --git a/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md b/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md
index 28a058a570..70d85ed710 100644
--- a/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md
+++ b/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md
@@ -122,7 +122,7 @@ Also…
## Step 2: Deploy the Settings Storage Location for UE-V 2
-You’ll need to deploy a settings storage location, a standard network share where user settings are stored in a settings package file. When you create the settings storage share, you should limit access to users that require it. [Deploy a Settings Storage Location](http://technet.microsoft.com/library/dn458891.aspx#ssl) provides more detailed information.
+You’ll need to deploy a settings storage location, a standard network share where user settings are stored in a settings package file. When you create the settings storage share, you should limit access to users that require it. [Deploy a Settings Storage Location](https://technet.microsoft.com/library/dn458891.aspx#ssl) provides more detailed information.
**Create a network share**
@@ -209,7 +209,7 @@ Run the AgentSetup.exe file from the command line to install the UE-V Agent. It
AgentSetup.exe SettingsStoragePath=\\server\settingsshare\%username%
```
-You must specify the SettingsStoragePath command line parameter as the network share from Step 2. [Deploy a UE-V Agent](http://technet.microsoft.com/library/dn458891.aspx#agent) provides more detailed information.
+You must specify the SettingsStoragePath command line parameter as the network share from Step 2. [Deploy a UE-V Agent](https://technet.microsoft.com/library/dn458891.aspx#agent) provides more detailed information.
## Step 4: Test Your UE-V 2 Evaluation Deployment
diff --git a/mdop/uev-v2/index.md b/mdop/uev-v2/index.md
index 95edeaf0d2..8932147ff3 100644
--- a/mdop/uev-v2/index.md
+++ b/mdop/uev-v2/index.md
@@ -76,7 +76,7 @@ This diagram shows how deployed UE-V components work together to synchronize set
Windows app list
Settings for Windows apps are captured and applied dynamically. The app developer specifies the settings that are synchronized for each app. UE-V determines which Windows apps are enabled for settings synchronization using a managed list of apps. By default, this list includes most Windows apps.
-
You can add or remove applications in the Windows app list by following the procedures shown [here](http://technet.microsoft.com/library/dn458925.aspx).
+
You can add or remove applications in the Windows app list by following the procedures shown [here](https://technet.microsoft.com/library/dn458925.aspx).
@@ -100,7 +100,7 @@ Use these UE-V components to create and manage custom templates for your third-p
Settings template catalog
The settings template catalog is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores the custom settings location templates. The UE-V Agent checks this location once a day, retrieves new or updated templates, and updates its synchronization behavior.
-
If you use only the UE-V default settings location templates, then a settings template catalog is unnecessary. For more information about settings deployment catalogs, see [Configure a UE-V settings template catalog](http://technet.microsoft.com/library/dn458942.aspx#deploycatalogue).
+
If you use only the UE-V default settings location templates, then a settings template catalog is unnecessary. For more information about settings deployment catalogs, see [Configure a UE-V settings template catalog](https://technet.microsoft.com/library/dn458942.aspx#deploycatalogue).
@@ -112,7 +112,7 @@ Use these UE-V components to create and manage custom templates for your third-p
## Settings Synchronized by Default
-UE-V synchronizes settings for these applications by default. For a complete list and more detailed information, see [Settings that are automatically synchronized in a UE-V deployment](http://technet.microsoft.com/library/dn458932.aspx#autosyncsettings).
+UE-V synchronizes settings for these applications by default. For a complete list and more detailed information, see [Settings that are automatically synchronized in a UE-V deployment](https://technet.microsoft.com/library/dn458932.aspx#autosyncsettings).
Microsoft Office 2013 applications (UE-V 2.1 SP1 and 2.1)
@@ -131,7 +131,7 @@ Many Windows desktop applications, such as Notepad
Many Windows settings, such as desktop background or wallpaper
**Note**
-You can also [customize UE-V to synchronize settings](http://technet.microsoft.com/library/dn458942.aspx) for applications other than those synchronized by default.
+You can also [customize UE-V to synchronize settings](https://technet.microsoft.com/library/dn458942.aspx) for applications other than those synchronized by default.
@@ -301,10 +301,10 @@ For more information, and for late-breaking news that did not make it into the d
### More information
-[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286)
+[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286)
Learn about the latest MDOP information and resources.
-[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032)
+[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032)
Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447).
## Got a suggestion for UE-V?
diff --git a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md
index 15e567ef80..681806fa2d 100644
--- a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md
+++ b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md
@@ -132,72 +132,72 @@ This section contains hotfixes and KB articles for UE-V 2.0.
2927019
Hotfix Package 1 for Microsoft User Experience Virtualization 2.0
diff --git a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md
index 1de783ee2e..7b0cb4d3e4 100644
--- a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md
+++ b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md
@@ -136,8 +136,8 @@ WORKAROUND: When migrating from UE-V 1 to UE-V 2 and it is likely you’ll have
Occassionally on logoff, UE-V takes a long time to sync settings. Typically, this is due to a high latency network or incorrect use of Distrubuted File System (DFS).
For DFS support, see [Microsoft’s Support Statement Around Replicated User Profile Data](https://support.microsoft.com/en-us/kb/2533009) for further details.
-WORKAROUND: Starting with HF03, a new registry key has been introduced
-The following registry key provides a mechanism by which the maximum logoff delay can be specified
+WORKAROUND: Starting with HF03, a new registry key has been introduced
+The following registry key provides a mechanism by which the maximum logoff delay can be specified
\\Software\\Microsoft\\UEV\\Agent\\Configuration\\LogOffWaitInterval
See [UE-V registry settings](https://support.microsoft.com/en-us/kb/2770042) for further details
@@ -164,62 +164,62 @@ This section contains hotfixes and KB articles for UE-V 2.1 SP1.
3018608
UE-V 2.1 - TemplateConsole.exe crashes when UE-V WMI classes are missing
diff --git a/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md b/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md
index 8aac3b863b..8c8ee9c750 100644
--- a/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md
+++ b/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md
@@ -26,21 +26,21 @@ First, let’s look at the tasks you’ll do to deploy UE-V:
Every UE-V deployment requires these activities:
- - [Define a settings storage location](http://technet.microsoft.com/library/dn458891.aspx#ssl)
+ - [Define a settings storage location](https://technet.microsoft.com/library/dn458891.aspx#ssl)
- - [Decide how to deploy the UE-V Agent and manage UE-V configurations](http://technet.microsoft.com/library/dn458891.aspx#config)
+ - [Decide how to deploy the UE-V Agent and manage UE-V configurations](https://technet.microsoft.com/library/dn458891.aspx#config)
- - [Install the UE-V Agent](http://technet.microsoft.com/library/dn458891.aspx#agent) on every user computer that needs settings synchronized
+ - [Install the UE-V Agent](https://technet.microsoft.com/library/dn458891.aspx#agent) on every user computer that needs settings synchronized
- Optionally, you can [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md)
Planning will help you figure out whether you want UE-V to support the synchronization of settings for custom applications (third-party or line-of-business), which requires these UE-V features:
- - [Install the UEV Generator](http://technet.microsoft.com/library/dn458942.aspx#uevgen) so you can create, edit, and validate the custom settings location templates required to synchronize custom application settings
+ - [Install the UEV Generator](https://technet.microsoft.com/library/dn458942.aspx#uevgen) so you can create, edit, and validate the custom settings location templates required to synchronize custom application settings
- - [Create custom settings location templates](http://technet.microsoft.com/library/dn458942.aspx#createcustomtemplates) by using the UE-V Generator
+ - [Create custom settings location templates](https://technet.microsoft.com/library/dn458942.aspx#createcustomtemplates) by using the UE-V Generator
- - [Deploy a UE-V settings template catalog](http://technet.microsoft.com/library/dn458942.aspx#deploycatalogue) that you use to store your custom settings location templates
+ - [Deploy a UE-V settings template catalog](https://technet.microsoft.com/library/dn458942.aspx#deploycatalogue) that you use to store your custom settings location templates
This workflow diagram provides a high-level understanding of a UE-V deployment and the decisions that determine how you deploy UE-V in your enterprise.
@@ -77,7 +77,7 @@ Windows desktop settings that are synchronized by default
A statement of support for Windows app setting synchronization
-See [User Experience Virtualization (UE-V) settings templates for Microsoft Office](http://www.microsoft.com/download/details.aspx?id=46367) to download a complete list of the specific Microsoft Office 2013, Microsoft Office 2010, and Microsoft Office 2007 settings that are synchronized by UE-V.
+See [User Experience Virtualization (UE-V) settings templates for Microsoft Office](https://www.microsoft.com/download/details.aspx?id=46367) to download a complete list of the specific Microsoft Office 2013, Microsoft Office 2010, and Microsoft Office 2007 settings that are synchronized by UE-V.
### Desktop applications synchronized by default in UE-V 2.1 and UE-V 2.1 SP1
@@ -102,7 +102,7 @@ When you install the UE-V 2.1 or 2.1 SP1 Agent, it registers a default group of
Microsoft Office 2010 applications
-
([Download a list of all settings synced](http://www.microsoft.com/download/details.aspx?id=46367))
+
([Download a list of all settings synced](https://www.microsoft.com/download/details.aspx?id=46367))
Microsoft Word 2010
Microsoft Excel 2010
Microsoft Outlook 2010
@@ -119,7 +119,7 @@ When you install the UE-V 2.1 or 2.1 SP1 Agent, it registers a default group of
Microsoft Office 2013 applications
-
([Download a list of all settings synced](http://www.microsoft.com/download/details.aspx?id=46367))
+
([Download a list of all settings synced](https://www.microsoft.com/download/details.aspx?id=46367))
Microsoft Word 2013
Microsoft Excel 2013
Microsoft Outlook 2013
@@ -191,7 +191,7 @@ When you install the UE-V 2.0 Agent, it registers a default group of settings lo
Microsoft Office 2007 applications
-
([Download a list of all settings synced](http://www.microsoft.com/download/details.aspx?id=46367))
+
([Download a list of all settings synced](https://www.microsoft.com/download/details.aspx?id=46367))
Microsoft Access 2007
Microsoft Communicator 2007
Microsoft Excel 2007
@@ -207,7 +207,7 @@ When you install the UE-V 2.0 Agent, it registers a default group of settings lo
Microsoft Office 2010 applications
-
([Download a list of all settings synced](http://www.microsoft.com/download/details.aspx?id=46367))
+
([Download a list of all settings synced](https://www.microsoft.com/download/details.aspx?id=46367))
Microsoft Word 2010
Microsoft Excel 2010
Microsoft Outlook 2010
@@ -504,9 +504,9 @@ Credentials are encrypted during synchronization.
-[Company Settings Center](http://technet.microsoft.com/library/dn458903.aspx)**:** Check the Roaming Credential Settings check box under Windows Settings to enable credential synchronization. Uncheck the box to disable it. This check box only appears in Company Settings Center if your account is not configured to synchronize settings using a Microsoft Account.
+[Company Settings Center](https://technet.microsoft.com/library/dn458903.aspx)**:** Check the Roaming Credential Settings check box under Windows Settings to enable credential synchronization. Uncheck the box to disable it. This check box only appears in Company Settings Center if your account is not configured to synchronize settings using a Microsoft Account.
-[PowerShell](http://technet.microsoft.com/library/dn458937.aspx)**:** This PowerShell cmdlet enables credential synchronization:
+[PowerShell](https://technet.microsoft.com/library/dn458937.aspx)**:** This PowerShell cmdlet enables credential synchronization:
``` syntax
Enable-UevTemplate RoamingCredentialSettings
@@ -518,7 +518,7 @@ This PowerShell cmdlet disables credential synchronization:
Disable-UevTemplate RoamingCredentialSettings
```
-[Group Policy](http://technet.microsoft.com/library/dn458893.aspx)**:** You must [deploy the latest MDOP ADMX template](https://go.microsoft.com/fwlink/p/?LinkId=393944) to enable credential synchronization through group policy. Credentials synchronization is managed with the Windows settings. To manage this feature with Group Policy, enable the Synchronize Windows settings policy.
+[Group Policy](https://technet.microsoft.com/library/dn458893.aspx)**:** You must [deploy the latest MDOP ADMX template](https://go.microsoft.com/fwlink/p/?LinkId=393944) to enable credential synchronization through group policy. Credentials synchronization is managed with the Windows settings. To manage this feature with Group Policy, enable the Synchronize Windows settings policy.
1. Open Group Policy Editor and navigate to **User Configuration – Administrative Templates – Windows Components – Microsoft User Experience Virtualization**.
@@ -552,7 +552,7 @@ UE-V manages Windows app settings synchronization in three ways:
- **Unlisted Default Sync Behavior:** Determine the synchronization behavior of Windows apps that are not in the Windows app list.
-For more information, see the [Windows App List](http://technet.microsoft.com/library/dn458925.aspx#win8applist).
+For more information, see the [Windows App List](https://technet.microsoft.com/library/dn458925.aspx#win8applist).
### Custom UE-V settings location templates
@@ -590,7 +590,7 @@ UE-V uses a Server Message Block (SMB) share for the storage of settings package
To reduce problems with network latency, create settings storage locations on the same local networks where the users’ computers reside. We recommend 20 MB of disk space per user for the settings storage location.
-By default, UE-V synchronization times out after 2 seconds to prevent excessive lag due to a large settings package. You can configure the SyncMethod=SyncProvider setting by using [Group Policy Objects](http://technet.microsoft.com/library/dn458893.aspx).
+By default, UE-V synchronization times out after 2 seconds to prevent excessive lag due to a large settings package. You can configure the SyncMethod=SyncProvider setting by using [Group Policy Objects](https://technet.microsoft.com/library/dn458893.aspx).
### High Availability for UE-V
@@ -598,15 +598,15 @@ The UE-V settings storage location and settings template catalog support storing
- Format the storage volume with an NTFS file system.
-- The share can use Distributed File System (DFS) but there are restrictions.
-Specifically, Distributed File System Replication (DFS-R) single target configuration with or without a Distributed File System Namespace (DFS-N) is supported.
+- The share can use Distributed File System (DFS) but there are restrictions.
+Specifically, Distributed File System Replication (DFS-R) single target configuration with or without a Distributed File System Namespace (DFS-N) is supported.
Likewise, only single target configuration is supported with DFS-N.
For detailed information, see [Microsoft’s Support Statement Around Replicated User Profile Data](https://go.microsoft.com/fwlink/p/?LinkId=313991)
and also [Information about Microsoft support policy for a DFS-R and DFS-N deployment scenario](https://support.microsoft.com/kb/2533009).
In addition, because SYSVOL uses DFS-R for replication, SYSVOL cannot be used for UE-V data file replication.
-- Configure the share permissions and NTFS access control lists (ACLs) as specified in [Deploying the Settings Storage Location for UE-V 2.x](http://technet.microsoft.com/library/dn458891.aspx#ssl).
+- Configure the share permissions and NTFS access control lists (ACLs) as specified in [Deploying the Settings Storage Location for UE-V 2.x](https://technet.microsoft.com/library/dn458891.aspx#ssl).
- Use file server clustering along with the UE-V Agent to provide access to copies of user state data in the event of communications failures.
@@ -742,7 +742,7 @@ The UE-V Agent synchronizes user settings for computers that are not always conn
Enable this configuration through one of these methods:
-- During UE-V installation, at the command prompt or in a batch file, set the AgentSetup.exe parameter *SyncMethod = None*. [Deploying the UE-V 2.x Agent](http://technet.microsoft.com/library/dn458891.aspx#agent) provides more information.
+- During UE-V installation, at the command prompt or in a batch file, set the AgentSetup.exe parameter *SyncMethod = None*. [Deploying the UE-V 2.x Agent](https://technet.microsoft.com/library/dn458891.aspx#agent) provides more information.
- After the UE-V installation, use the Settings Management feature in System Center 2012 Configuration Manager or the MDOP ADMX templates to push the *SyncMethod = None* configuration.
@@ -765,7 +765,7 @@ If you set *SyncMethod = None*, any settings changes are saved directly to the s
**Support for shared VDI sessions:** UE-V 2.1 and 2.1 SP1 provide support for VDI sessions that are shared among end users. You can register and configure a special VDI template, which ensures that UE-V keeps all of its functionality intact for non-persistent VDI sessions.
**Note**
-If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as [back-up/restore and last known good (LKG)](http://technet.microsoft.com/library/dn878331.aspx).
+If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as [back-up/restore and last known good (LKG)](https://technet.microsoft.com/library/dn878331.aspx).
diff --git a/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md
index 3680c97240..752d0190eb 100644
--- a/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md
+++ b/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md
@@ -79,13 +79,13 @@ This table explains the changes to SyncMethod from UE-V v1.0 to v2.0 to v2.1, as
You can configure the sync method in these ways:
-- When you [Deploy the UE-V Agent](http://technet.microsoft.com/library/dn458891.aspx#agent) through a command-line parameter or in a batch script
+- When you [Deploy the UE-V Agent](https://technet.microsoft.com/library/dn458891.aspx#agent) through a command-line parameter or in a batch script
-- Through [Group Policy](http://technet.microsoft.com/library/dn458893.aspx) settings
+- Through [Group Policy](https://technet.microsoft.com/library/dn458893.aspx) settings
-- With the [System Center Configuration Pack](http://technet.microsoft.com/library/dn458917.aspx) for UE-V
+- With the [System Center Configuration Pack](https://technet.microsoft.com/library/dn458917.aspx) for UE-V
-- After installation of the UE-V Agent, by using [Windows PowerShell or Windows Management Instrumentation (WMI)](http://technet.microsoft.com/library/dn458937.aspx)
+- After installation of the UE-V Agent, by using [Windows PowerShell or Windows Management Instrumentation (WMI)](https://technet.microsoft.com/library/dn458937.aspx)
## Got a suggestion for UE-V?
diff --git a/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md
index bcff8113a3..349fdff40a 100644
--- a/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md
+++ b/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md
@@ -37,7 +37,7 @@ The following table explains the trigger events for classic applications and Win
Windows Logon
Application and Windows settings are imported to the local cache from the settings storage location.
-
[Asynchronous Windows settings](http://technet.microsoft.com/library/dn458932.aspx#autosyncsettings2) are applied.
+
[Asynchronous Windows settings](https://technet.microsoft.com/library/dn458932.aspx#autosyncsettings2) are applied.
Synchronous Windows settings will be applied during the next Windows logon.
Application settings will be applied when the application starts.
@@ -91,7 +91,7 @@ The following table explains the trigger events for classic applications and Win
Asynchronous Windows settings are applied directly.
Application settings are applied when the application starts.
Both asynchronous and synchronous Windows settings are applied during the next Windows logon.
-
Windows app (AppX) settings are applied during the next refresh. See [Monitor Application Settings](http://technet.microsoft.com/library/dn458944.aspx) for more information.
+
Windows app (AppX) settings are applied during the next refresh. See [Monitor Application Settings](https://technet.microsoft.com/library/dn458944.aspx) for more information.
NA
@@ -117,7 +117,7 @@ Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microso
[Changing the Frequency of UE-V 2.x Scheduled Tasks](changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md)
-[Choose the Configuration Method for UE-V 2.x](http://technet.microsoft.com/library/dn458891.aspx#config)
+[Choose the Configuration Method for UE-V 2.x](https://technet.microsoft.com/library/dn458891.aspx#config)
diff --git a/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md b/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md
index 50221baf3c..f81fd70279 100644
--- a/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md
+++ b/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md
@@ -111,7 +111,7 @@ You can deploy UE-V settings location template with the following methods:
For more information using UE-V and Windows PowerShell, see [Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI](managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md).
-- **Registering template via Template Catalog Path**. If you use the Settings Template Catalog Path to manage templates on users’ computers, copy the Office 2013 template into the folder defined in the UE-V Agent. The next time the Template Auto Update (ApplySettingsCatalog.exe) scheduled task runs, the settings location template will be registered on the device. For more information, see [Deploying the Settings Template Catalog for UE-V 2](http://technet.microsoft.com/library/dn458942.aspx#deploycatalogue).
+- **Registering template via Template Catalog Path**. If you use the Settings Template Catalog Path to manage templates on users’ computers, copy the Office 2013 template into the folder defined in the UE-V Agent. The next time the Template Auto Update (ApplySettingsCatalog.exe) scheduled task runs, the settings location template will be registered on the device. For more information, see [Deploying the Settings Template Catalog for UE-V 2](https://technet.microsoft.com/library/dn458942.aspx#deploycatalogue).
- **Registering template via Configuration Manager**. If you use Configuration Manager to manage your UE-V settings storage templates, then recreate the Template Baseline CAB, import it into Configuration Manager, and then deploy the baseline to your clients. For more information, see the guidance provided in the documentation for the [System Center 2012 Configuration Pack for Microsoft User Experience Virtualization 2](https://go.microsoft.com/fwlink/?LinkId=317263).
diff --git a/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md b/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md
index ae5cac69a9..881a2d0c8b 100644
--- a/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md
+++ b/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md
@@ -34,7 +34,7 @@ To enable settings synchronization using UE-V 2.1, do one of the following:
- Do not enable the Office 365 synchronization experience during Office 2013 installation
-UE-V 2.1 ships [Office 2013 and Office 2010 templates](http://technet.microsoft.com/library/dn458932.aspx#autosyncsettings). This release removes the Office 2007 templates. Users can still use Office 2007 templates from UE-V 2.0 or earlier and can still get the templates from the UE-V template gallery located [here](https://go.microsoft.com/fwlink/p/?LinkID=246589).
+UE-V 2.1 ships [Office 2013 and Office 2010 templates](https://technet.microsoft.com/library/dn458932.aspx#autosyncsettings). This release removes the Office 2007 templates. Users can still use Office 2007 templates from UE-V 2.0 or earlier and can still get the templates from the UE-V template gallery located [here](https://go.microsoft.com/fwlink/p/?LinkID=246589).
## Fix for Distributed File System Namespace Users
@@ -50,7 +50,7 @@ Set-UevConfiguration -DisableSyncProviderPing
## Synchronization for Credentials
-UE-V 2.1 gives customers the ability to synchronize credentials and certificates stored in the Windows Credential Manager. This component is disabled by default. Enabling this component lets users keep their domain credentials and certificates in sync. Users can sign in one time on a device, and these credentials will roam for that user across all of their UE-V enabled devices. [Manage Credentials with UE-V 2.1](http://technet.microsoft.com/library/dn458932.aspx#creds) provides more information.
+UE-V 2.1 gives customers the ability to synchronize credentials and certificates stored in the Windows Credential Manager. This component is disabled by default. Enabling this component lets users keep their domain credentials and certificates in sync. Users can sign in one time on a device, and these credentials will roam for that user across all of their UE-V enabled devices. [Manage Credentials with UE-V 2.1](https://technet.microsoft.com/library/dn458932.aspx#creds) provides more information.
**Note**
In Windows 8 and later, Credential Manager contains web credentials. These credentials are not synchronized between users’ devices.
@@ -65,12 +65,12 @@ UE-V detects if “Sync settings with OneDrive”, also known as Microsoft Accou
## Support for the SyncMethod External
-A new [SyncMethod configuration](http://technet.microsoft.com/library/dn554321.aspx) called **External** specifies that if UE-V settings are written to a local folder on the user computer, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different computers that users access.
+A new [SyncMethod configuration](https://technet.microsoft.com/library/dn554321.aspx) called **External** specifies that if UE-V settings are written to a local folder on the user computer, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different computers that users access.
## Enhanced Support for VDI Mode
-UE-V 2.1 includes [support for VDI sessions](http://technet.microsoft.com/library/dn458932.aspx#vdi) that are shared among end users. As an administrator, you can register and configure a special VDI template, which ensures that UE-V keeps all of its functionality intact for non-persistent VDI sessions.
+UE-V 2.1 includes [support for VDI sessions](https://technet.microsoft.com/library/dn458932.aspx#vdi) that are shared among end users. As an administrator, you can register and configure a special VDI template, which ensures that UE-V keeps all of its functionality intact for non-persistent VDI sessions.
**Note**
If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as back-up/restore and LKG.
diff --git a/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md b/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md
index 6cb5d4878e..6677e1864c 100644
--- a/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md
+++ b/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md
@@ -73,7 +73,7 @@ To enable settings synchronization using UE-V 2.1, do one of the following:
- Do not enable the Office 365 synchronization experience during Office 2013 installation
-UE-V 2.1 ships [Office 2013 and Office 2010 templates](http://technet.microsoft.com/library/dn458932.aspx#autosyncsettings). This release removes the Office 2007 templates. Users can still use Office 2007 templates from UE-V 2.0 or earlier and can still get the templates from the UE-V template gallery located [here](https://go.microsoft.com/fwlink/p/?LinkID=246589).
+UE-V 2.1 ships [Office 2013 and Office 2010 templates](https://technet.microsoft.com/library/dn458932.aspx#autosyncsettings). This release removes the Office 2007 templates. Users can still use Office 2007 templates from UE-V 2.0 or earlier and can still get the templates from the UE-V template gallery located [here](https://go.microsoft.com/fwlink/p/?LinkID=246589).
## Got a suggestion for UE-V?
diff --git a/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md b/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md
index b08324cf77..1bfb3b6b04 100644
--- a/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md
+++ b/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md
@@ -108,7 +108,7 @@ If you edit a UE-V 1.0 template by using the UE-V 2 Generator, the template is a
2. Open the settings location template file with an XML editor.
-3. Edit the settings location template file. All changes must conform to the UE-V schema file that is defined in [SettingsLocationTempate.xsd](http://technet.microsoft.com/library/dn763947.aspx). By default, a copy of the .xsd file is located in \\ProgramData\\Microsoft\\UEV\\Templates.
+3. Edit the settings location template file. All changes must conform to the UE-V schema file that is defined in [SettingsLocationTempate.xsd](https://technet.microsoft.com/library/dn763947.aspx). By default, a copy of the .xsd file is located in \\ProgramData\\Microsoft\\UEV\\Templates.
4. Increment the **Version** number for the settings location template.
diff --git a/store-for-business/add-profile-to-devices.md b/store-for-business/add-profile-to-devices.md
index 8c447d9f6a..dbd5c9acfb 100644
--- a/store-for-business/add-profile-to-devices.md
+++ b/store-for-business/add-profile-to-devices.md
@@ -1,6 +1,6 @@
---
title: Manage Windows device deployment with Windows Autopilot Deployment
-description: Add an Autopilot profile to devices. Autopilot profiles control what is included in Windows set up experience for your employees.
+description: Add an Autopilot profile to devices. Autopilot profiles control what is included in Windows set up experience for your employees.
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
@@ -24,44 +24,44 @@ Watch this video to learn more about Windows Autopilot in Micrsoft Store for Bus
> [!video https://www.microsoft.com/en-us/videoplayer/embed/3b30f2c2-a3e2-4778-aa92-f65dbc3ecf54?autoplay=false]
## What is Windows Autopilot?
-In Microsoft Store for Business, you can manage devices for your organization and apply an *Autopilot deployment profile* to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows based on the Autopilot deployment profile you applied to the device.
+In Microsoft Store for Business, you can manage devices for your organization and apply an *Autopilot deployment profile* to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows based on the Autopilot deployment profile you applied to the device.
-You can create and apply Autopilot deployment profiles to these devices. The overall process looks like this.
+You can create and apply Autopilot deployment profiles to these devices. The overall process looks like this.
Figure 1 - Windows Autopilot Deployment Program process
-Autopilot deployment profiles have two main parts: default settings that can't be changed, and optional settings that you can include.
+Autopilot deployment profiles have two main parts: default settings that can't be changed, and optional settings that you can include.
### Autopilot deployment profiles - default settings
These settings are configured with all Autopilot deployment profiles:
- Skip Cortana, OneDrive, and OEM registration setup pages
- Automatically setup for work or school
-- Sign in experience with company or school brand
+- Sign in experience with company or school brand
### Autopilot deployment profiles - optional settings
These settings are off by default. You can turn them on for your Autopilot deployment profiles:
- Skip privacy settings
### Support for Autopilot profile settings
-Autopilot profile settings are supported beginning with the version of Windows they were introduced in. This table summarizes the settings and what they are supported on.
+Autopilot profile settings are supported beginning with the version of Windows they were introduced in. This table summarizes the settings and what they are supported on.
| Setting | Supported on |
| ------- | ------------- |
| Deployment default features| Windows 10, version 1703 or later |
| Skip privacy settings | Windows 10, version 1703 or later |
-| Disable local admin account creation on the device | Windows 10, version 1703 or later |
+| Disable local admin account creation on the device | Windows 10, version 1703 or later |
| Skip End User License Agreement (EULA) | Windows 10, version 1709 or later. [Learn about Windows Autopilot EULA dismissal](https://docs.microsoft.com/windows/deployment/Windows-Autopilot-EULA-note) |
## Windows Autopilot deployment profiles in Microsoft Store for Business and Education
You can manage new devices in Microsoft Store for Business or Microsoft Store for Education. Devices need to meet these requirements:
- Windows 10, version 1703 or later
-- New devices that have not been through Windows out-of-box experience.
+- New devices that have not been through Windows out-of-box experience.
## Add devices and apply Autopilot deployment profile
-To manage devices through Microsoft Store for Business and Education, you'll need a .csv file that contains specific information about the devices. You should be able to get this from your Microsoft account contact, or the store where you purchased the devices. Upload the .csv file to Microsoft Store to add the devices.
+To manage devices through Microsoft Store for Business and Education, you'll need a .csv file that contains specific information about the devices. You should be able to get this from your Microsoft account contact, or the store where you purchased the devices. Upload the .csv file to Microsoft Store to add the devices.
### Device information file format
Columns in the device information file need to use this naming and be in this order:
@@ -73,61 +73,61 @@ Here's a sample device information file:
-When you add devices, you need to add them to an *Autopilot deployment group*. Use these groups to apply Autopilot deployment profiles to a group of devices. The first time you add devices to a group, you'll need to create an Autopilot deployment group.
+When you add devices, you need to add them to an *Autopilot deployment group*. Use these groups to apply Autopilot deployment profiles to a group of devices. The first time you add devices to a group, you'll need to create an Autopilot deployment group.
> [!NOTE]
-> You can only add devices to a group when you add devices to **Microsoft Store for Business and Education**. If you decide to reorganize devices into different groups, you'll need to delete them from **Devices** in **Microsoft Store**, and add them again.
+> You can only add devices to a group when you add devices to **Microsoft Store for Business and Education**. If you decide to reorganize devices into different groups, you'll need to delete them from **Devices** in **Microsoft Store**, and add them again.
**Add and group devices**
-1. Sign in to [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
+1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
2. Click **Manage**, and then click **Devices**.
-3. Click **Add devices**, navigate to the *.csv file and select it.
+3. Click **Add devices**, navigate to the *.csv file and select it.
4. Type a name for a new Autopilot deployment group, or choose one from the list, and then click **Add**.
-If you don't add devices to a group, you can select the individual devices to apply a profile to.
+If you don't add devices to a group, you can select the individual devices to apply a profile to.
-
-5. Click the devices or Autopilot deployment group that you want to manage. You need to select devices before you can apply an Autopilot deployment profile. You can switch between seeing groups or devices by clicking **View groups** or **View devices**.
+
+5. Click the devices or Autopilot deployment group that you want to manage. You need to select devices before you can apply an Autopilot deployment profile. You can switch between seeing groups or devices by clicking **View groups** or **View devices**.
**Apply Autopilot deployment profile**
-1. When you have devices selected, click **Autopilot deployment**.
+1. When you have devices selected, click **Autopilot deployment**.
2. Choose the Autopilot deployment profile to apply to the selected devices.
-
+
> [!NOTE]
> The first time you use Autopilot deployment profiles, you'll need to create one. See [Create Autopilot profile](#create-autopilot-profile).
-
+
3. Microsoft Store for Business applies the profile to your selected devices, and shows the profile name on **Devices**.
## Manage Autopilot deployment profiles
-You can manage the Autopilot deployment profiles created in Microsoft Store. You can create a new profile, edit, or delete a profile.
+You can manage the Autopilot deployment profiles created in Microsoft Store. You can create a new profile, edit, or delete a profile.
### Create Autopilot profile
-1. Sign in to [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
+1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
2. Click **Manage**, and then click **Devices**.
-3. Click **Autopilot deployment**, and then click **Create new profile**.
+3. Click **Autopilot deployment**, and then click **Create new profile**.
4. Name the profile, choose the settings to include, and then click **Create**.
-The new profile is added to the **Autopilot deployment** list.
+The new profile is added to the **Autopilot deployment** list.
### Edit or delete Autopilot profile
-1. Sign in to [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
+1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
2. Click **Manage**, and then click **Devices**.
3. Click **Autopilot deployment**, click **Edit your profiles**, and then choose the profile to edit.
TBD: art
-4. Change settings for the profile, and then click **Save**.
+4. Change settings for the profile, and then click **Save**.
-or-
-Click **Delete profile** to delete the profile.
+Click **Delete profile** to delete the profile.
## Apply a different Autopilot deployment profile to devices
-After you've applied an Autopilot deployment profile to a device, if you decide to apply a different profile, you can remove the profile and apply a new profile.
+After you've applied an Autopilot deployment profile to a device, if you decide to apply a different profile, you can remove the profile and apply a new profile.
> [!NOTE]
-> The new profile will only be applied if the device has not been started, and gone through the out-of-box experience. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device.
+> The new profile will only be applied if the device has not been started, and gone through the out-of-box experience. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device.
## Autopilot device information file error messages
-Here's info on some of the errors you might see while working with Autopilot deployment profiles in **Microsoft Store for Business and Education**.
+Here's info on some of the errors you might see while working with Autopilot deployment profiles in **Microsoft Store for Business and Education**.
-| Message Id | Message explanation |
+| Message Id | Message explanation |
| ---------- | ------------------- |
| wadp001 | Check your file, or ask your device partner for a complete .csv file. This file is missing Serial Number and Product Id info. |
| wadp002 | Check your file, or ask your device partner for updated hardware hash info in the .csv file. Hardware hash info is invalid in the current .csv file. |
diff --git a/store-for-business/add-unsigned-app-to-code-integrity-policy.md b/store-for-business/add-unsigned-app-to-code-integrity-policy.md
index 247ff479fa..4ffb3b7e72 100644
--- a/store-for-business/add-unsigned-app-to-code-integrity-policy.md
+++ b/store-for-business/add-unsigned-app-to-code-integrity-policy.md
@@ -86,7 +86,7 @@ Catalog signing is a vital step to adding your unsigned apps to your code integr
**To sign a catalog file with Device Guard signing portal**
-1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Store for Education](https://educationstore.microsoft.com).
+1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Store for Education](https://educationstore.microsoft.com).
2. Click **Settings**, click **Store settings**, and then click **Device Guard**.
3. Click **Upload** to upload your unsigned catalog files. These are the catalog files you created earlier in [Create catalog files for your unsigned app](#create-catalog-files).
4. After the files are uploaded, click **Sign** to sign the catalog files.
@@ -94,7 +94,7 @@ Catalog signing is a vital step to adding your unsigned apps to your code integr
- signed catalog file
- default policy
- root certificate for your organization
-
+
When you use the Device Guard signing portal to sign a catalog file, the signing certificate is added to the default policy. When you download the signed catalog file, you should also download the default policy and merge this code integrity policy with your existing code integrity policies to protect machines running the catalog file. You need to do this step to trust and run your catalog files. For more information, see the Merging code integrity policies in the [Device Guard deployment guide](https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide).
6. Open the root certificate that you downloaded, and follow the steps in **Certificate Import wizard** to install the certificate in your machine's certificate store.
diff --git a/store-for-business/app-inventory-management-microsoft-store-for-business.md b/store-for-business/app-inventory-management-microsoft-store-for-business.md
index b15ad00612..62db55062d 100644
--- a/store-for-business/app-inventory-management-microsoft-store-for-business.md
+++ b/store-for-business/app-inventory-management-microsoft-store-for-business.md
@@ -19,7 +19,7 @@ ms.date: 06/07/2018
- Windows 10
- Windows 10 Mobile
-You can manage all apps that you've acquired on your **Apps & software** page. This page shows all of the content you've acquired, including apps that from Microsoft Store, and line-of-business (LOB) apps that you've accepted into your inventory. After LOB apps are submitted to your organization, you'll see a notification on your **Apps & software** page. On the **New LOB apps** tab, you can accept, or reject the LOB apps. For more information on LOB apps, see [Working with line-of-business apps](working-with-line-of-business-apps.md). The inventory page includes apps acquired by all people in your organization with the Store for Business Admin role.
+You can manage all apps that you've acquired on your **Apps & software** page. This page shows all of the content you've acquired, including apps that from Microsoft Store, and line-of-business (LOB) apps that you've accepted into your inventory. After LOB apps are submitted to your organization, you'll see a notification on your **Apps & software** page. On the **New LOB apps** tab, you can accept, or reject the LOB apps. For more information on LOB apps, see [Working with line-of-business apps](working-with-line-of-business-apps.md). The inventory page includes apps acquired by all people in your organization with the Store for Business Admin role.
All of these apps are treated the same once they are in your inventory and you can perform app lifecycle tasks for them: distribute apps, add apps to private store, review license details, and reclaim app licenses.
@@ -40,7 +40,7 @@ The last modified date tracks changes about the app as an item in your inventory
- Reclaim license
- Refund order (applies to purchased apps, not free apps)
-The last modified date does not correspond to when an app was last updated in Microsoft Store. It tracks activity for that app, as an item in your inventory.
+The last modified date does not correspond to when an app was last updated in Microsoft Store. It tracks activity for that app, as an item in your inventory.
## Find apps in your inventory
@@ -51,8 +51,8 @@ There are a couple of ways to find specific apps, or groups of apps in your inve
- **License type** - Online or offline licenses. For more info, see [Apps in Microsoft Store for Business](apps-in-microsoft-store-for-business.md#licensing-model).
- **Supported devices** - Lists the devices that apps in your inventory were originally written to support. This list is cumulative for all apps in your inventory.
- **Source** - **Store**, for apps acquired from Store for Business, or LOB, for line-of-business apps.
-- **Product type** - Product categories, such as app, or game.
-- **Private store** - Whether or not the app is in the private store, or status if the app is being added or removed from private store.
+- **Product type** - Product categories, such as app, or game.
+- **Private store** - Whether or not the app is in the private store, or status if the app is being added or removed from private store.
## Manage apps in your inventory
Each app in the Store for Business has an online, or an offline license. For more information on Store for Business licensing model, see [Apps in the Microsoft Store for Business](apps-in-microsoft-store-for-business.md#licensing-model). There are different actions you can take depending on the app license type. They're summarized in this table.
@@ -99,17 +99,17 @@ Another way to distribute apps is by assigning them to people in your organizati
If you decide that you don't want an app available for employees to install on their own, you can remove it from your private store.
**To remove an app from the private store**
-
-1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://businessstore.microsoft.com).
+
+1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://businessstore.microsoft.com).
2. Click **Manage**, and then choose **Products & services**.
3. Find an app, click the ellipses, choose **Remove from private store**, and then click **Remove**.
-4. Choose the private store collection, and then under **In collection**, switch to **Off**.
+4. Choose the private store collection, and then under **In collection**, switch to **Off**.
-The app will still be in your inventory, but your employees will not have access to the app from your private store.
+The app will still be in your inventory, but your employees will not have access to the app from your private store.
**To assign an app to an employee**
-1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://businessstore.microsoft.com).
+1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://businessstore.microsoft.com).
2. Click **Manage**, and then choose **Inventory**.
3. Find an app, click the ellipses, and then choose **Assign to people**.
4. Type the email address for the employee that you're assigning the app to, and click **Confirm**.
@@ -124,7 +124,7 @@ For each app in your inventory, you can view and manage license details. This gi
1. Sign in to [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkId=691845) or [Microsoft Store for Education](https://businessstore.microsoft.com).
2. Click **Manage**, and then choose **Apps & software**.
-3. Click an app you want to manage.
+3. Click an app you want to manage.
4. On the app page, you'll see the names of people in your organization who have installed the app and are using one of the licenses. From here, you can:
- Assign the app to other people in your organization.
@@ -147,16 +147,16 @@ Microsoft Store updates the list of assigned licenses.
Microsoft Store updates the list of assigned licenses.
## Purchase additional licenses
-You can purchase additional licenses for apps in your Inventory.
+You can purchase additional licenses for apps in your Inventory.
**To purchase additional app licenses**
1. Sign in to [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkId=691845) or [Microsoft Store for Education](https://businessstore.microsoft.com)
2. Click **Manage**, and then choose **Apps & software**.
-3. From **Apps & software**, click an app.
-4. On the app page, click **Buy more** for additional licenses, or click **Assign users** to manage your current licenses.
+3. From **Apps & software**, click an app.
+4. On the app page, click **Buy more** for additional licenses, or click **Assign users** to manage your current licenses.
-You'll have a summary of current license availability.
+You'll have a summary of current license availability.
## Download offline-licensed app
Offline licensing is a new feature in Windows 10 and allows apps to be deployed to devices that are not connected to the Internet. This means organizations can deploy apps when users or devices do not have connectivity to the Store.
@@ -171,9 +171,9 @@ For more information about online and offline licenses, see [Apps in the Microso
For more information about downloading offline-licensed apps, see [Download offline apps](distribute-offline-apps.md).
-## Manage products programmatically
+## Manage products programmatically
-Microsoft Store for Business and Education provides a set of Admin management APIs. If you orgranization develops scripts or tools, these APIs allow Admins to programmatically manage items in **Apps & software**. For more information, see [REST API reference for Microsoft Store for Business](https://docs.microsoft.com/windows/client-management/mdm/rest-api-reference-windows-store-for-business).
+Microsoft Store for Business and Education provides a set of Admin management APIs. If you orgranization develops scripts or tools, these APIs allow Admins to programmatically manage items in **Apps & software**. For more information, see [REST API reference for Microsoft Store for Business](https://docs.microsoft.com/windows/client-management/mdm/rest-api-reference-windows-store-for-business).
You can download a preview PoweShell script that uses REST APIs. The script is available from PowerShell Gallery. You can use to the script to:
- View items in inventory (**Apps & software**)
@@ -181,4 +181,4 @@ You can download a preview PoweShell script that uses REST APIs. The script is a
- Perform bulk options using .csv files - this automates license management for customers with large numbers of licenses
> [!NOTE]
-> The Microsoft Store for Business and Education Admin role is required to manage products and to use the MSStore module. This requires advanced knowledge of PowerShell.
\ No newline at end of file
+> The Microsoft Store for Business and Education Admin role is required to manage products and to use the MSStore module. This requires advanced knowledge of PowerShell.
\ No newline at end of file
diff --git a/store-for-business/configure-mdm-provider-microsoft-store-for-business.md b/store-for-business/configure-mdm-provider-microsoft-store-for-business.md
index de12fe9dbc..502bdc4c27 100644
--- a/store-for-business/configure-mdm-provider-microsoft-store-for-business.md
+++ b/store-for-business/configure-mdm-provider-microsoft-store-for-business.md
@@ -30,17 +30,17 @@ Your management tool needs to be installed and configured with Azure AD, in the
4. Click **Mobility (MDM and MAM)**.
3. Click **+Add Applications**, find the application, and add it to your directory.
-After your management tool is added to your Azure AD directory, you can configure it to work with Microsoft Store. You can configure multiple management tools - just repeat the following procedure.
+After your management tool is added to your Azure AD directory, you can configure it to work with Microsoft Store. You can configure multiple management tools - just repeat the following procedure.
**To configure a management tool in Microsoft Store for Business**
-1. Sign in to the [Store for Business](http://businessstore.microsoft.com) or [Store for Education](https://educationstore.microsoft.com)
-2. Click **Manage**, click **Settings**.
+1. Sign in to the [Store for Business](https://businessstore.microsoft.com) or [Store for Education](https://educationstore.microsoft.com)
+2. Click **Manage**, click **Settings**.
3. Under **Distribute**, click **Management tools**.
3. From the list of MDM tools, select the one you want to synchronize with Microsoft Store, and then click **Activate.**
Your MDM tool is ready to use with Microsoft Store. To learn how to configure synchronization and deploy apps, see these topics:
- [Manage apps you purchased from Microsoft Store for Business with Microsoft Intune](https://docs.microsoft.com/intune-classic/deploy-use/manage-apps-you-purchased-from-the-windows-store-for-business-with-microsoft-intune)
-- [Manage apps from Microsoft Store for Business with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business)
+- [Manage apps from Microsoft Store for Business with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business)
For third-party MDM providers or management servers, check your product documentation.
\ No newline at end of file
diff --git a/store-for-business/distribute-offline-apps.md b/store-for-business/distribute-offline-apps.md
index 2f445c4301..eefb7fd379 100644
--- a/store-for-business/distribute-offline-apps.md
+++ b/store-for-business/distribute-offline-apps.md
@@ -45,13 +45,13 @@ You can't distribute offline-licensed apps directly from Microsoft Store. Once y
- [Manage apps from Microsoft Store for Business with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business)
- [Manage apps from Microsoft Store for Business with Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/manage-apps-you-purchased-from-the-windows-store-for-business-with-microsoft-intune)
-For third-party MDM providers or management servers, check your product documentation.
+For third-party MDM providers or management servers, check your product documentation.
## Download an offline-licensed app
There are several items to download or create for offline-licensed apps. The app package and app license are required; app metadata and app frameworks are optional. This section includes more info on each item, and tells you how to download an offline-licensed app.
-- **App metadata** - App metadata is optional. The metadata includes app details, links to icons, product id, localized product ids, and other items. Devs who plan to use an app as part of another app or tool, might want the app metadata.
+- **App metadata** - App metadata is optional. The metadata includes app details, links to icons, product id, localized product ids, and other items. Devs who plan to use an app as part of another app or tool, might want the app metadata.
- **App package** - App packages are required for distributing offline apps. There are app packages for different combinations of app platform and device architecture. You'll need to know what device architectures you have in your organization to know if there are app packages to support your devices.
@@ -62,19 +62,19 @@ There are several items to download or create for offline-licensed apps. The app
**To download an offline-licensed app**
-1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com/) or [Microsoft Store for Education](https://educationstore.microsoft.com).
+1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com/) or [Microsoft Store for Education](https://educationstore.microsoft.com).
2. Click **Manage**, and then choose **Apps & software**.
3. Refine results by **License type** to show apps with offline licenses.
4. Find the app you want to download, click the ellipses under **Actions**, and then choose **Download for offline use**.
- - **To download app metadata**: Choose the language for the app metadata, and then click **Download**. Save the downloaded app metadata. This is optional.
- - **To download app package**: Click to expand the package details information, choose the Platform and Architecture combination that you need for your organization, and then click **Download**. Save the downloaded app package. This is required.
- - **To download an app license**: Choose either **Encoded**, or **Unencoded**, and then click **Generate license**. Save the downloaded license. This is required.
- - **To download an app framework**: Find the framework you need to support your app package, and click **Download**. This is optional.
-
+ - **To download app metadata**: Choose the language for the app metadata, and then click **Download**. Save the downloaded app metadata. This is optional.
+ - **To download app package**: Click to expand the package details information, choose the Platform and Architecture combination that you need for your organization, and then click **Download**. Save the downloaded app package. This is required.
+ - **To download an app license**: Choose either **Encoded**, or **Unencoded**, and then click **Generate license**. Save the downloaded license. This is required.
+ - **To download an app framework**: Find the framework you need to support your app package, and click **Download**. This is optional.
+
> [!NOTE]
> You need the framework to support your app package, but if you already have a copy, you don't need to download it again. Frameworks are backward compatible.
-
+
diff --git a/store-for-business/manage-mpsa-software-microsoft-store-for-business.md b/store-for-business/manage-mpsa-software-microsoft-store-for-business.md
index 37ab81c66d..4967eb20a1 100644
--- a/store-for-business/manage-mpsa-software-microsoft-store-for-business.md
+++ b/store-for-business/manage-mpsa-software-microsoft-store-for-business.md
@@ -19,23 +19,23 @@ ms.date: 3/20/2018
- Windows 10
- Windows 10 Mobile
-Software purchased with the Microsoft Products and Services Agreement (MPSA) can now be managed in Microsoft Store for Business. This allows customers to manage online software purchases in one location.
+Software purchased with the Microsoft Products and Services Agreement (MPSA) can now be managed in Microsoft Store for Business. This allows customers to manage online software purchases in one location.
-There are a couple of things you might need to set up to manage MPSA software purchases in Store for Business.
+There are a couple of things you might need to set up to manage MPSA software purchases in Store for Business.
-**To manage MPSA software in Microsoft Store for Business**
-1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com).
+**To manage MPSA software in Microsoft Store for Business**
+1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com).
2. Click **Manage**, and then click **My Organization**.
-3. Click **Connected tenants** to see purchasing accounts and the tenants that they are connected to.
+3. Click **Connected tenants** to see purchasing accounts and the tenants that they are connected to.
## Add tenant
-The tenant or tenants that are added to your purchasing account control how you can distribute software to people in your organization. If there isn't a tenant listed for your purchasing account, you'll need to add one before you can use or manage the software you've purchased. When we give you a list to choose from, tenants are grouped by domain.
+The tenant or tenants that are added to your purchasing account control how you can distribute software to people in your organization. If there isn't a tenant listed for your purchasing account, you'll need to add one before you can use or manage the software you've purchased. When we give you a list to choose from, tenants are grouped by domain.
-**To add a tenant to a purchasing account**
-1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com).
+**To add a tenant to a purchasing account**
+1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com).
2. Click **Manage**, and then click **My Organization**.
3. Click **Connected tenants**, and then click the ellipses for a purchasing account without a tenant listed.
-4. Click **Choose a tenant**, and then click **Submit**.
+4. Click **Choose a tenant**, and then click **Submit**.
If you don't see your tenant in the list, you can add the name of your tenant
@@ -43,19 +43,19 @@ If you don't see your tenant in the list, you can add the name of your tenant
1. On **Add a tenant**, click **Don't see your tenant?**.
2. Enter a domain name, and then click **Next**, and then click **Done**.
-You'll need to get permissions for the admin that manages the domain you want to add. We'll take you to Business Center Portal where you can manage permissions and roles. The admin will need to be the **Account Manager**.
+You'll need to get permissions for the admin that manages the domain you want to add. We'll take you to Business Center Portal where you can manage permissions and roles. The admin will need to be the **Account Manager**.
## Add global admin
In some cases, we might not have info on who the global admin is for the tenant that you select. It might be that the tenant is unmanaged, and you'll need to identify a global admin. Or, you might only need to share account info for the global admin.
If you need to nominate someone to be the global admin, they need sufficient permissions:
- someone who can distribute sofware
-- in Business Center Portal (BCP), it should be someone with **Agreement Admin** role
+- in Business Center Portal (BCP), it should be someone with **Agreement Admin** role
**To add a global admin to a tenant**
-We'll ask for a global admin if we need that info when you add a tenant to a purchasing account. You'd see the request for a global admin before returning to **Store for Business**.
+We'll ask for a global admin if we need that info when you add a tenant to a purchasing account. You'd see the request for a global admin before returning to **Store for Business**.
- On **Add a Global Admin**, click **Make me the Global Admin**, and then click **Submit**.
-or-
-- On **Add a Global Admin**, type a name in **Invite someone else**, and then click **Submit**.
\ No newline at end of file
+- On **Add a Global Admin**, type a name in **Invite someone else**, and then click **Submit**.
\ No newline at end of file
diff --git a/store-for-business/manage-orders-microsoft-store-for-business.md b/store-for-business/manage-orders-microsoft-store-for-business.md
index 12d927fce2..66650f1c89 100644
--- a/store-for-business/manage-orders-microsoft-store-for-business.md
+++ b/store-for-business/manage-orders-microsoft-store-for-business.md
@@ -1,6 +1,6 @@
---
title: Manage app orders in Microsoft Store for Business or Microsoft Store for Education (Windows 10)
-description: You can view your order history with Micrsoft Store for Business or Micrsoft Store for Education.
+description: You can view your order history with Micrsoft Store for Business or Micrsoft Store for Education.
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
@@ -14,14 +14,14 @@ ms.date: 11/10/2017
# Manage app orders in Microsoft Store for Business and Education
-After you've acquired apps, you can review order information and invoices on **Order history**. On this page, you can view invoices, and request refunds.
+After you've acquired apps, you can review order information and invoices on **Order history**. On this page, you can view invoices, and request refunds.
**Order history** lists orders in chronological order and shows:
- Date ordered
- Product name
- Product publisher
- Total cost
-- Order status.
+- Order status.
Click to expand an order, and the following info is available:
- Who purchased the app
@@ -32,32 +32,32 @@ Click to expand an order, and the following info is available:
## Invoices
-Invoices for orders are available approximately 24 hours after your purchase. The link opens a .pdf that you can save for your records.
+Invoices for orders are available approximately 24 hours after your purchase. The link opens a .pdf that you can save for your records.
## Refund an order
-Refunds work a little differently for free apps, and apps that have a price. In both cases, you must reclaim licenses before requesting a refund.
+Refunds work a little differently for free apps, and apps that have a price. In both cases, you must reclaim licenses before requesting a refund.
**Refunds for free apps**
-
- For free apps, there isn't really a refund to request -- you're removing the app from your inventory. You must first reclaim any assigned licenses, and then you can remove the app from your organization's inventory.
-
+
+ For free apps, there isn't really a refund to request -- you're removing the app from your inventory. You must first reclaim any assigned licenses, and then you can remove the app from your organization's inventory.
+
**Refunds for apps that have a price**
-
+
There are a few requirements for apps that have a price:
- **Timing** - Refunds are available for the first 30 days after you place your order. For example, if your order is placed on June 1, you can self-refund through June 30.
- **Available licenses** - You need to have enough available licenses to cover the number of licenses in the order you are refunding. For example, if you purchased 10 copies of an app and you want to request a refund, you must have at least 10 licenses of the app available in your inventory -- those 10 licenses can't be assigned to people in your organization.
- - **Whole order refunds only** - You must refund the complete amount of apps in an order. You can't refund a part of an order. For example, if you purchased 10 copies of an app, but later found you only needed 5 copies, you'll need to request a refund for the 10 apps, and then make a separate order for 5 apps. If you have had multiple orders of the same app, you can refund one order but still keep the rest of the inventory.
+ - **Whole order refunds only** - You must refund the complete amount of apps in an order. You can't refund a part of an order. For example, if you purchased 10 copies of an app, but later found you only needed 5 copies, you'll need to request a refund for the 10 apps, and then make a separate order for 5 apps. If you have had multiple orders of the same app, you can refund one order but still keep the rest of the inventory.
**To refund an order**
-Reclaim licenses, and then request a refund. If you haven't assigned licenses, start on step 5.
-1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
+Reclaim licenses, and then request a refund. If you haven't assigned licenses, start on step 5.
+1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
2. Click **Manage**, and then choose **Apps & software**.
3. Find the app you want to refund, click the ellipses under **Actions**, and then choose **View license details**.
-4. Select the people who you want to reclaim license from, click the ellipses under **Actions**, and then choose **Reclaim licenses**.
+4. Select the people who you want to reclaim license from, click the ellipses under **Actions**, and then choose **Reclaim licenses**.
5. Click **Order history**, click the order you want to refund, and click **Refund order**.
-For free apps, the app will be removed from your inventory in **Apps & software**.
+For free apps, the app will be removed from your inventory in **Apps & software**.
-For apps with a price, your payment option will be refunded with the cost of the app, and the app will be removed from your inventory.
+For apps with a price, your payment option will be refunded with the cost of the app, and the app will be removed from your inventory.
diff --git a/store-for-business/manage-private-store-settings.md b/store-for-business/manage-private-store-settings.md
index 1462bb3ee3..ee4baa3b88 100644
--- a/store-for-business/manage-private-store-settings.md
+++ b/store-for-business/manage-private-store-settings.md
@@ -31,7 +31,7 @@ You can change the name of your private store in Microsoft Store.
## Change private store name
**To change the name of your private store**
-1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
+1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
2. Click **Settings**, click **Distribute**.
3. In the **Private store** section, click **Change**.
4. Type a new display name for your private store, and click **Save**.
@@ -39,14 +39,14 @@ You can change the name of your private store in Microsoft Store.
## Private store collections
-You can create collections of apps within your private store. Collections allow you to group or categorize apps - you might want a group of apps for different job functions in your company, or classes in your school.
+You can create collections of apps within your private store. Collections allow you to group or categorize apps - you might want a group of apps for different job functions in your company, or classes in your school.
**To add a Collection to your private store**
You can add a collection to your private store from the private store, or from the details page for an app.
-**From private store**
-1. Sign in to [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
+**From private store**
+1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
2. Click your private store.
@@ -55,16 +55,16 @@ You can add a collection to your private store from the private store, or from t
4. Type a name for your collection, and then click **Next**.
-5. Add at least one product to your collection, and then click **Done**. You can search for apps and refine results based on the source of the app, or the supported devices.
+5. Add at least one product to your collection, and then click **Done**. You can search for apps and refine results based on the source of the app, or the supported devices.
-> [!NOTE]
-> New collections require at least one app, or they will not be created.
+> [!NOTE]
+> New collections require at least one app, or they will not be created.
-**From app details page**
-1. Sign in to [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
-2. Click **Manage**, and then click **Products & services**.
-3. Under **Apps & software**, choose an app you want to include in a new collection.
-4. Under **Private Store Collections**, click **Add a collection**.
+**From app details page**
+1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
+2. Click **Manage**, and then click **Products & services**.
+3. Under **Apps & software**, choose an app you want to include in a new collection.
+4. Under **Private Store Collections**, click **Add a collection**.
@@ -74,34 +74,34 @@ You can add a collection to your private store from the private store, or from t
Currently, changes to collections will generally show within minutes in the Microsoft Store app on Windows 10. In some cases, it may take up an hour.
## Edit Collections
-If you've already added a Collection to your private store, you can easily add and remove products, or rename the collection.
+If you've already added a Collection to your private store, you can easily add and remove products, or rename the collection.
-**To add or remove products from a collection**
-1. Sign in to [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
+**To add or remove products from a collection**
+1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
2. Click your private store.
-3. Click the ellipses next to the collection name, and click **Edit collection**.
-4. Add or remove products from the collection, and then click **Done**.
+3. Click the ellipses next to the collection name, and click **Edit collection**.
+4. Add or remove products from the collection, and then click **Done**.
-You can also add an app to a collection from the app details page.
-1. Sign in to [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
-2. Click **Manage**, and then click **Products & services**.
-3. Under **Apps & software**, choose an app you want to include in a new collection.
+You can also add an app to a collection from the app details page.
+1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
+2. Click **Manage**, and then click **Products & services**.
+3. Under **Apps & software**, choose an app you want to include in a new collection.
4. Under **Private Store Collections**, turn on the collection you want to add the app to.
- 
+ 
## Private store performance
-We've recently made performance improvements for changes in the private store. This table includes common actions, and the current estimate for amount of time required for the change.
+We've recently made performance improvements for changes in the private store. This table includes common actions, and the current estimate for amount of time required for the change.
| Action | Estimated time |
| ------------------------------------------------------ | -------------- |
| Add a product to the private store - Apps recently added to your inventory, including line-of-business (LOB) apps and new purchases, will take up to 36 hours to add to the private store. That time begins when the product is purchased, or added to your inventory. - It will take an additional 36 hours for the product to be searchable in private store, even if you see the app available from the private store tab. | - 15 minutes: available on private store tab - 36 hours: searchable in private store - 36 hours: searchable in private store tab |
-| Remove a product from private store | - 15 minutes: private store tab - 36 hours: searchable in private store |
+| Remove a product from private store | - 15 minutes: private store tab - 36 hours: searchable in private store |
| Accept a new LOB app into your inventory (under **Products & services)**) | - 15 minutes: available on private store tab - 36 hours: searchable in private store |
| Create a new collection | 15 minutes|
| Edit or remove a collection | 15 minutes |
| Create private store tab | 4-6 hours |
-| Rename private store tab | 4-6 hours |
+| Rename private store tab | 4-6 hours |
diff --git a/store-for-business/microsoft-store-for-business-education-powershell-module.md b/store-for-business/microsoft-store-for-business-education-powershell-module.md
index 889c27f140..4b53678c9c 100644
--- a/store-for-business/microsoft-store-for-business-education-powershell-module.md
+++ b/store-for-business/microsoft-store-for-business-education-powershell-module.md
@@ -1,6 +1,6 @@
---
title: Microsoft Store for Business and Education PowerShell module - preview
-description: Preview version of PowerShell module
+description: Preview version of PowerShell module
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
@@ -42,16 +42,16 @@ All of the **Microsoft Store for Business and Education** PowerShell cmdlets fol
## Install Microsoft Store for Business and Education PowerShell module
> [!NOTE]
-> Installing **Microsoft Store for Business and Education** PowerShell model using **PowerShellGet** requires [Windows Management Framework 5.0](http://www.microsoft.com/download/details.aspx?id=48729). The framework is included with Windows 10 by default).
+> Installing **Microsoft Store for Business and Education** PowerShell model using **PowerShellGet** requires [Windows Management Framework 5.0](https://www.microsoft.com/download/details.aspx?id=48729). The framework is included with Windows 10 by default).
To install **Microsoft Store for Business and Education PowerShell** with PowerShellGet, run this command:
```powershell
# Install the Microsoft Store for Business and Education PowerShell module from PowerShell Gallery
-Install-Module -Name MSStore
+Install-Module -Name MSStore
-```
+```
## Import Microsoft Store for Business and Education PowerShell module into the PowerShell session
Once you install the module on your Windows 10 device, you will need to then import it into each PowerShell session you start.
@@ -63,7 +63,7 @@ Import-Module -Name MSStore
```
-Next, authorize the module to call **Microsoft Store for Business and Education** on your behalf. This step is required once, per user of the PowerShell module.
+Next, authorize the module to call **Microsoft Store for Business and Education** on your behalf. This step is required once, per user of the PowerShell module.
To authorize the PowerShell module, run this command. You'll need to sign-in with your work or school account, and authorize the module to access your tenant.
@@ -76,7 +76,7 @@ Grant-MSStoreClientAppAccess
You will be promted to sign in with your work or school account and then to authorize the PowerShell Module to access your **Microsoft Store for Business and Education** account. Once the module has been imported into the current PowerShell session and authorized to call into your **Microsoft Store for Business and Education** account, Azure PowerShell cmdlets are loaded and ready to be used.
## View items in Products and Services
-Service management should encounter no breaking changes as a result of the separation of Azure Service Management and **Microsoft Store for Business and Education PowerShell** preview.
+Service management should encounter no breaking changes as a result of the separation of Azure Service Management and **Microsoft Store for Business and Education PowerShell** preview.
```powershell
# View items in inventory (Apps & software)
@@ -105,17 +105,17 @@ Get-MSStoreSeatAssignments -ProductId 9NBLGGH4R2R6 -SkuId 0016
> [!Important]
> Microsoft Store for Business and Education identifies Minecraft: Education Edition license types using a combination of Product ID and SKU ID. To manage license assignments for your Minecraft: Education Edition, you need to specify Product and SKU IDs for the licenses you want to manage in the cmdlet. The following table lists the Product and SKU IDs.
-
+
| License Type | Product ID | SKU ID |
| ------------ | -----------| -------|
| Purchased through Microsoft Store for Business and Education with a credit card | CFQ7TTC0K5DR | 0001 |
| Purchased through Microsoft Store for Business and Education with an invoice | CFQ7TTC0K5DR | 0004 |
| Purchased through Microsoft Volume Licensing Agreement | CFQ7TTC0K5DR | 0002 |
-| Acquired through Windows 10 device promotion | CFQ7TTC0K5DR | 0005 |
+| Acquired through Windows 10 device promotion | CFQ7TTC0K5DR | 0005 |
## Assign or reclaim products
-Once you have enumerated items in **Products and Service**, you can assign or reclaim licenses to and from people in your org.
+Once you have enumerated items in **Products and Service**, you can assign or reclaim licenses to and from people in your org.
These commands assign a product to a user and then reclaim it.
@@ -131,7 +131,7 @@ Remove-MSStoreSeatAssignment -ProductId 9NBLGGH4R2R6 -SkuId 0016 -Username 'user
```
## Assign or reclaim a product with a .csv file
-You can also use the PowerShell module to perform bulk operations on items in **Product and Services**. You'll need a .CSV file with at least one column for “Principal Names” (for example, user@host.com). You can create such a CSV using the AzureAD PowerShell Module.
+You can also use the PowerShell module to perform bulk operations on items in **Product and Services**. You'll need a .CSV file with at least one column for “Principal Names” (for example, user@host.com). You can create such a CSV using the AzureAD PowerShell Module.
**To assign or reclaim seats in bulk:**
@@ -147,7 +147,7 @@ Remove-MSStoreSeatAssignments -ProductId 9NBLGGH4R2R6 -SkuId 0016 -PathToCsv C:
```
## Uninstall Microsoft Store for Business and Education PowerShell module
-You can remove **Microsoft Store for Business and Education PowerShell** from your computer by running the following PowerShell Command.
+You can remove **Microsoft Store for Business and Education PowerShell** from your computer by running the following PowerShell Command.
```powershell
# Uninstall the MSStore Module
diff --git a/store-for-business/release-history-microsoft-store-business-education.md b/store-for-business/release-history-microsoft-store-business-education.md
index aa159ddffe..67c65aeebb 100644
--- a/store-for-business/release-history-microsoft-store-business-education.md
+++ b/store-for-business/release-history-microsoft-store-business-education.md
@@ -8,7 +8,7 @@ ms.pagetype: store
author: TrudyHa
ms.author: TrudyHa
ms.topic: conceptual
-ms.date: 07/31/2018
+ms.date: 08/29/2018
---
# Microsoft Store for Business and Education release history
@@ -17,6 +17,9 @@ Microsoft Store for Business and Education regularly releases new and improved f
Looking for info on the latest release? Check out [What's new in Microsoft Store for Business and Education](whats-new-microsoft-store-business-education.md)
+## July 2018
+- Bug fixes and permformance improvements.
+
## June 2018
- **Change order within private store collection** - Continuing our focus on improvements for private store, now you can customize the order of products in each private store collection.
- **Performance improvements in private store** - We continue to work on performance improvements in the private store. Now, most products new to your inventory are available in your private store within 15 minutes of adding them. [Get more info](https://docs.microsoft.com/microsoft-store/manage-private-store-settings#private-store-performance)
@@ -44,15 +47,12 @@ Looking for info on the latest release? Check out [What's new in Microsoft Store
- **Microsoft Product and Services Agreement customers can invite people to take roles** - MPSA admins can invite people to take Microsoft Store for Business roles even if the person is not in their tenant. You provide an email address when you assign the role, and we'll add the account to your tenant and assign the role.
## December 2017
-
- Bug fixes and permformance improvements.
## November 2017
-
- **Export list of Minecraft: Education Edition users** - Admins and teachers can now export a list of users who have Minecraft: Education Edition licenses assigned to them. Click **Export users**, and Store for Education creates an Excel spreadsheet for you, and saves it as a .csv file.
## October 2017
-
- Bug fixes and permformance improvements.
## September 2017
diff --git a/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md b/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md
index 29c8a0abe7..f9feb738d7 100644
--- a/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md
+++ b/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md
@@ -32,7 +32,7 @@ Before you get started, be sure to review these best practices:
**To sign a code integrity policy**
-1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
+1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
2. Click **Manage**, click **Store settings**, and then click **Device Guard**.
3. Click **Upload** to upload your code integrity policy.
4. After the files are uploaded, click **Sign** to sign the code integrity policy.
diff --git a/store-for-business/update-microsoft-store-for-business-account-settings.md b/store-for-business/update-microsoft-store-for-business-account-settings.md
index 9b5502382f..3ac104dedf 100644
--- a/store-for-business/update-microsoft-store-for-business-account-settings.md
+++ b/store-for-business/update-microsoft-store-for-business-account-settings.md
@@ -22,22 +22,22 @@ ms.date: 10/17/2017
The **Payments & billing** page in Microsoft Store for Business allows you to manage organization information, billing information, and payment options. The organization information and payment options are required before you can acquire apps that have a price.
## Organization information
-
+
We need your business address, email contact, and tax-exemption certificates that apply to your country or locale.
-
+
### Business address and email contact
-Before purchasing apps that have a fee, you need to add or update your organization's business address, and contact email address.
+Before purchasing apps that have a fee, you need to add or update your organization's business address, and contact email address.
-We use the Business address to calculate sales tax. If your organization's address has already been entered for other commercial purchases through Microsoft Store, or through other online purchases such as Office 365 or Azure subscriptions, then we’ll use the same address in Microsoft Store for Business and Microsoft Store for Education. If we don’t have an address, we’ll ask you to enter it during your first purchase.
+We use the Business address to calculate sales tax. If your organization's address has already been entered for other commercial purchases through Microsoft Store, or through other online purchases such as Office 365 or Azure subscriptions, then we’ll use the same address in Microsoft Store for Business and Microsoft Store for Education. If we don’t have an address, we’ll ask you to enter it during your first purchase.
-We need an email address in case we need to contact you about your Microsoft Store for Business and for Education account. This email account should reach the admin for your organization’s Office 365 or Azure AD tenant that is used with Microsoft Store.
+We need an email address in case we need to contact you about your Microsoft Store for Business and for Education account. This email account should reach the admin for your organization’s Office 365 or Azure AD tenant that is used with Microsoft Store.
**To update Organization information**
1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com)
2. Click **Manage**, click **Billing**, **Account profile**, and then click **Edit**.
-## Organization tax information
+## Organization tax information
Taxes for Microsoft Store for Business purchases are determined by your business address. Businesses in these countries can provide their VAT number or local equivalent:
- Austria
- Belgium
@@ -72,7 +72,7 @@ Taxes for Microsoft Store for Business purchases are determined by your business
- Switzerland
- United Kingdom
-These countries can provide their VAT number or local equivalent in **Payments & billing**.
+These countries can provide their VAT number or local equivalent in **Payments & billing**.
|Market| Tax identifier |
|------|----------------|
@@ -84,9 +84,9 @@ These countries can provide their VAT number or local equivalent in **Payments &
| Monaco | VAT ID (optional) |
| Taiwan | VAT ID (optional) |
-### Tax-exempt status
+### Tax-exempt status
-If you qualify for tax-exempt status in your market, start a service request to establish tax exempt status for your organization.
+If you qualify for tax-exempt status in your market, start a service request to establish tax exempt status for your organization.
**To start a service request**
1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com).
@@ -98,14 +98,14 @@ You’ll need this documentation:
|------------------|----------------|
| United States | Sales Tax Exemption Certificate |
| Canada | Certificate of Exemption (or equivalent letter of authorization) |
-| Ireland | 13B/56A Tax Exemption Certificate|
+| Ireland | 13B/56A Tax Exemption Certificate|
| International organizations that hold tax exaemption | Certification / letter confirmation from local tax authorities |
### Calculating tax
-Sales taxes are calculated against the unit price, and then aggregated.
-
+Sales taxes are calculated against the unit price, and then aggregated.
+
For example:
(unit price X tax rate) X quantity = total sales tax
@@ -114,36 +114,36 @@ For example:
($1.29 X .095) X 100 = $12.25
## Payment options
-You can purchase apps from Microsoft Store for Business using your credit card. You can enter your credit card information on Account Information, or when you purchase an app. We currently accept these credit cards:
-1. VISA
-2. MasterCard
-3. Discover
-4. American Express
+You can purchase apps from Microsoft Store for Business using your credit card. You can enter your credit card information on Account Information, or when you purchase an app. We currently accept these credit cards:
+1. VISA
+2. MasterCard
+3. Discover
+4. American Express
5. Japan Commercial Bureau (JCB)
> [!NOTE]
> Not all cards available in all countries. When you add a payment option, Microsoft Store for Business shows which cards are available in your region.
-**To add a new payment option**
+**To add a new payment option**
-1. Sign in to the [Store for Business](http://businessstore.microsoft.com) or [Store for Education](https://educationstore.microsoft.com).
-2. Click **Manage**, click **Billing**, and then click **Payments methods**.
-3. Click **Add a payment options**, and then select the type of credit card that you want to add.
-4. Add information to required fields, and then click **Next**.
+1. Sign in to the [Store for Business](https://businessstore.microsoft.com) or [Store for Education](https://educationstore.microsoft.com).
+2. Click **Manage**, click **Billing**, and then click **Payments methods**.
+3. Click **Add a payment options**, and then select the type of credit card that you want to add.
+4. Add information to required fields, and then click **Next**.
-Once you click Next, the information you provided will be validated with a test authorization transaction and, if validated, the payment option will be added to your list of available payment options. Otherwise, you will be prompted for additional information or notified if there are any problems.
+Once you click Next, the information you provided will be validated with a test authorization transaction and, if validated, the payment option will be added to your list of available payment options. Otherwise, you will be prompted for additional information or notified if there are any problems.
> [!NOTE]
-> When adding credit or debit cards, you may be prompted to enter a CVV. The CVV is only used for verification purposes and is not stored in our systems after validation.
+> When adding credit or debit cards, you may be prompted to enter a CVV. The CVV is only used for verification purposes and is not stored in our systems after validation.
-**To update a payment option**
+**To update a payment option**
+
+1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
+2. Click **Manage**, click **Billing**, and then click **Payments methods**.
+3. Select the payment option that you want to update, and then click **Update**.
+4. Enter any updated information in the appropriate fields, and then click **Next**.
+Once you click **Next**, the information you provided will be validated with a test authorization transaction and, if validated, the payment option will be added to your list of available payment options. Otherwise, you will be prompted for additional information or notified if there are any problems.
-1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
-2. Click **Manage**, click **Billing**, and then click **Payments methods**.
-3. Select the payment option that you want to update, and then click **Update**.
-4. Enter any updated information in the appropriate fields, and then click **Next**.
-Once you click **Next**, the information you provided will be validated with a test authorization transaction and, if validated, the payment option will be added to your list of available payment options. Otherwise, you will be prompted for additional information or notified if there are any problems.
-
> [!NOTE]
> Certain actions, like updating or adding a payment option, require temporary “test authorization” transactions to validate the payment option. These may appear on your statement as $0.00 authorizations or as small pending transactions. These transactions are temporary and should not impact your account unless you make several changes in a short period of time, or have a low balance.
@@ -151,15 +151,15 @@ Once you click **Next**, the information you provided will be validated with a
Offline licensing is a new licensing option for Windows 10. With offline licenses, organizations can cache apps and their licenses to deploy within their network. ISVs or devs can opt-in their apps for offline licensing when they submit them to the developer center. Only apps that are opted in to offline licensing will show that they are available for offline licensing in Microsoft Store for Business. This model means organizations can deploy apps when users or devices do not have connectivity to the Store. For more information on Microsoft Store for Business licensing model, see [licensing model](https://docs.microsoft.com/microsoft-store/apps-in-microsoft-store-for-business#licensing-model).
-Admins can decide whether or not offline licenses are shown for apps in Microsoft Store.
+Admins can decide whether or not offline licenses are shown for apps in Microsoft Store.
**To set offline license visibility**
-1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
-2. Click **Manage**, and then click **Settings - Shop**.
+1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
+2. Click **Manage**, and then click **Settings - Shop**.
3. Under **Shopping experience** turn on or turn off **Show offline apps**,to show availability for offline-licensed apps.
You have the following distribution options for offline-licensed apps:
- Include the app in a provisioning package, and then use it as part of imaging a device.
-- Distribute the app through a management tool.
+- Distribute the app through a management tool.
For more information, see [Distribute apps to your employees from Microsoft Store for Business](distribute-apps-with-management-tool.md).
\ No newline at end of file
diff --git a/store-for-business/whats-new-microsoft-store-business-education.md b/store-for-business/whats-new-microsoft-store-business-education.md
index 3f6676128a..efce0d7fd7 100644
--- a/store-for-business/whats-new-microsoft-store-business-education.md
+++ b/store-for-business/whats-new-microsoft-store-business-education.md
@@ -8,7 +8,7 @@ ms.pagetype: store
author: TrudyHa
ms.author: TrudyHa
ms.topic: conceptual
-ms.date: 07/31/2018
+ms.date: 08/29/2018
---
# What's new in Microsoft Store for Business and Education
@@ -17,9 +17,10 @@ Microsoft Store for Business and Education regularly releases new and improved f
## Latest updates for Store for Business and Education
-**July 2018**
-
-We’ve been working on bug fixes and performance improvements to provide you a better experience. Stay tuned for new feature
+**August 2018**
+| | |
+|-----------------------|---------------------------------|
+|  |**App requests**
People in your organization can make requests for apps that they need. They can also request them on behalf of other people. Admins review requests and can decide on purchases.
[Get more info](https://docs.microsoft.com/microsoft-store/acquire-apps-microsoft-store-for-business#allow-app-requests)
**Applies to**: Microsoft Store for Business Microsoft Store for Education |
@@ -1196,8 +1196,8 @@ This example configures the following apps: Skype, Learning, Feedback Hub, and C
-
AzureAD\multiusertest@analogfre.onmicrosoft.com
diff --git a/windows/client-management/mdm/assignedaccess-ddf.md b/windows/client-management/mdm/assignedaccess-ddf.md
index a76545fe53..e68f76f543 100644
--- a/windows/client-management/mdm/assignedaccess-ddf.md
+++ b/windows/client-management/mdm/assignedaccess-ddf.md
@@ -17,8 +17,8 @@ This topic shows the OMA DM device description framework (DDF) for the **Assigne
You can download the DDF files from the links below:
-- [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
+- [Download all the DDF files for Windows 10, version 1703](https://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
+- [Download all the DDF files for Windows 10, version 1607](https://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
The XML below is for Windows 10, version 1803.
@@ -62,7 +62,7 @@ The XML below is for Windows 10, version 1803.
This node can accept and return json string which comprises of account name, and AUMID for Kiosk mode app.
-Example: {"User":"domain\\user", "AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"}.
+Example: {"User":"domain\\user", "AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"}.
When configuring kiosk mode app, account name will be used to find the target user. Account name includes domain name and user name. Domain name can be optional if user name is unique across the system. For a local account, domain name should be machine name. When "Get" is executed on this node, domain name is always returned in the output.
diff --git a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md
index e5d61253aa..f8e1ed6025 100644
--- a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md
+++ b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md
@@ -58,7 +58,7 @@ In both scenarios, the enrollment flow provides an opportunity for the MDM servi
In the out-of-the-box scenario, the web view is 100% full screen, which gives the MDM vendor the ability to paint an edge-to-edge experience. With great power comes great responsibility! It is important that MDM vendors who chose to integrate with Azure AD to respect the Windows 10 design guidelines to the letter. This includes using a responsive web design and respecting the Windows accessibility guidelines, which includes the forward and back buttons that are properly wired to the navigation logic. Additional details are provided later in this topic.
-For Azure AD enrollment to work for an Active Directory Federated Services (AD FS) backed Azure AD account, you must enable password authentication for the intranet on the ADFS service as described in solution \#2 in [this article](http://go.microsoft.com/fwlink/?LinkId=690246).
+For Azure AD enrollment to work for an Active Directory Federated Services (AD FS) backed Azure AD account, you must enable password authentication for the intranet on the ADFS service as described in solution \#2 in [this article](https://go.microsoft.com/fwlink/?LinkId=690246).
Once a user has an Azure AD account added to Windows 10 and enrolled in MDM, the enrollment can be manages through **Settings** > **Accounts** > **Work access**. Device management of either Azure AD Join for corporate scenarios or BYOD scenarios are similar.
@@ -79,31 +79,31 @@ Azure AD MDM enrollment is a two-step process:
To support Azure AD enrollment, MDM vendors must host and expose a Terms of Use endpoint and an MDM enrollment endpoint.
-**Terms of Use endpoint**
+**Terms of Use endpoint**
Use this endpoint to inform users of the ways in which their device can be controlled by their organization. The Terms of Use page is responsible for collecting user’s consent before the actual enrollment phase begins.
It’s important to understand that the Terms of Use flow is a "black box" to Windows and Azure AD. The whole web view is redirected to the Terms of Use URL, and the user is expected to be redirected back after approving (or in some cases rejecting) the Terms. This design allows the MDM vendor to customize their Terms of Use for different scenarios (e.g., different levels of control are applied on BYOD vs. company-owned devices) or implement user/group based targeting (e.g. users in certain geographies may be subject to stricter device management policies).
The Terms of Use endpoint can be used to implement additional business logic, such as collecting a one-time PIN provided by IT to control device enrollment. However, MDM vendors must not use the Terms of Use flow to collect user credentials, which could lead to a highly degraded user experience. It’s not needed, since part of the MDM integration ensures that the MDM service can understand tokens issued by Azure AD.
-**MDM enrollment endpoint**
+**MDM enrollment endpoint**
After the users accepts the Terms of Use, the device is registered in Azure AD and the automatic MDM enrollment begins.
The following diagram illustrates the high-level flow involved in the actual enrollment process. The device is first registered with Azure AD. This process assigns a unique device identifier to the device and presents the device with the ability to authenticate itself with Azure AD (device authentication). Subsequently, the device is enrolled for management with the MDM. This is done by calling the enrollment endpoint and requesting enrollment for the user and device. At this point, the user has been authenticated and device has been registered and authenticated with Azure AD. This information is made available to the MDM in the form of claims within an access token presented at the enrollment endpoint.
-The MDM is expected to use this information about the device (Device ID) when reporting device compliance back to Azure AD using the [Azure AD Graph API](http://go.microsoft.com/fwlink/p/?LinkID=613654). A sample for reporting device compliance is provided later in this topic.
+The MDM is expected to use this information about the device (Device ID) when reporting device compliance back to Azure AD using the [Azure AD Graph API](https://go.microsoft.com/fwlink/p/?LinkID=613654). A sample for reporting device compliance is provided later in this topic.
## Make the MDM a reliable party of Azure AD
-To participate in the integrated enrollment flow outlined in the previous section, the MDM must be able to consume access tokens issued by Azure AD. To report compliance to Azure AD, the MDM must be able to authenticate itself to Azure AD and obtain authorization in the form of an access token that allows it to invoke the [Azure AD Graph API](http://go.microsoft.com/fwlink/p/?LinkID=613654).
+To participate in the integrated enrollment flow outlined in the previous section, the MDM must be able to consume access tokens issued by Azure AD. To report compliance to Azure AD, the MDM must be able to authenticate itself to Azure AD and obtain authorization in the form of an access token that allows it to invoke the [Azure AD Graph API](https://go.microsoft.com/fwlink/p/?LinkID=613654).
### Add a cloud-based MDM
A cloud-based MDM is a SaaS application that provides device management capabilities in the cloud. It is a multi-tenant application. This application is registered with Azure AD in the home tenant of the MDM vendor. When an IT admin decides to use this MDM solution, an instance of this application is made visible in the tenant of the customer.
-The MDM vendor must first register the application in their home tenant and mark it as a multi-tenant application. Here a code sample from GitHub that explains how to add multi-tenant applications to Azure AD, [WepApp-WebAPI-MultiTenant-OpenIdConnect-DotNet](http://go.microsoft.com/fwlink/p/?LinkId=613661).
+The MDM vendor must first register the application in their home tenant and mark it as a multi-tenant application. Here a code sample from GitHub that explains how to add multi-tenant applications to Azure AD, [WepApp-WebAPI-MultiTenant-OpenIdConnect-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613661).
> **Note** For the MDM provider, if you don't have an existing Azure AD tentant with an Azure AD subscription that you manage, follow the step-by-step guide in [Add an Azure AD tenant and Azure AD subscription](add-an-azure-ad-tenant-and-azure-ad-subscription.md) to set up a tenant, add a subscription, and manage it via the Azure Portal.
@@ -115,7 +115,7 @@ Use the following steps to register a cloud-based MDM application with Azure AD.
1. Login to the Azure Management Portal using an admin account in your home tenant.
2. In the left navigation, click on the **Active Directory**.
3. Click the directory tenant where you want to register the application.
-
+
Ensure that you are logged into your home tenant.
4. Click the **Applications** tab.
5. In the drawer, click **Add**.
@@ -132,7 +132,7 @@ Use the following steps to register a cloud-based MDM application with Azure AD.
You will need this to call the Azure AD Graph API to report device compliance. This is covered in the subsequent section.
-For more information about how to register a sample application with Azure AD, see the steps to register the **TodoListService Web API** in [NativeClient-DotNet](http://go.microsoft.com/fwlink/p/?LinkId=613667)
+For more information about how to register a sample application with Azure AD, see the steps to register the **TodoListService Web API** in [NativeClient-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613667)
### Add an on-premises MDM
@@ -142,13 +142,13 @@ The customer experience for adding an on-premises MDM to their tenant is similar
Your on-premises MDM product must expose a configuration experience where administrators can provide the client ID, app ID, and the key configured in their directory for that MDM application. You can use this client ID and key to request tokens from Azure AD when reporting device compliance.
-For more information about registering applications with Azure AD, see [Basics of Registering an Application in Azure AD](http://go.microsoft.com/fwlink/p/?LinkId=613671).
+For more information about registering applications with Azure AD, see [Basics of Registering an Application in Azure AD](https://go.microsoft.com/fwlink/p/?LinkId=613671).
### Key management and security guidelines
The application keys used by your MDM service are a sensitive resource. They should be protected and rolled over periodically for greater security. Access tokens obtained by your MDM service to call the Azure AD Graph API are bearer tokens and should be protected to avoid unauthorized disclosure.
-For security best practices, see [Windows Azure Security Essentials](http://go.microsoft.com/fwlink/p/?LinkId=613715).
+For security best practices, see [Windows Azure Security Essentials](https://go.microsoft.com/fwlink/p/?LinkId=613715).
You can rollover the application keys used by a cloud-based MDM service without requiring a customer interaction. There is a single set of keys across all customer tenants that are managed by the MDM vendor in their Azure AD tenant.
@@ -167,7 +167,7 @@ The following image illustrates how MDM applications will show up in the Azure a
You should work with the Azure AD engineering team if your MDM application is cloud-based. The following table shows the required information to create an entry in the Azure AD app gallery.
-
+
@@ -211,7 +211,7 @@ However, key management is different for on-premises MDM. You must obtain the cl
## Themes
-The pages rendered by the MDM as part of the integrated enrollment process must use Windows 10 templates ([Download the Windows 10 templates and CSS files](http://download.microsoft.com/download/3/E/5/3E535D52-6432-47F6-B460-4E685C5D543A/MDM-ISV_1.1.3.zip)). This is important for enrollment during the Azure AD Join experience in OOBE where all of the pages are edge-to-edge HTML pages. Don't try to copy the templates because you'll never get the button placement right. Using the shared Windows 10 templates ensure a seamless experience for the customers.
+The pages rendered by the MDM as part of the integrated enrollment process must use Windows 10 templates ([Download the Windows 10 templates and CSS files](https://download.microsoft.com/download/3/E/5/3E535D52-6432-47F6-B460-4E685C5D543A/MDM-ISV_1.1.3.zip)). This is important for enrollment during the Azure AD Join experience in OOBE where all of the pages are edge-to-edge HTML pages. Don't try to copy the templates because you'll never get the button placement right. Using the shared Windows 10 templates ensure a seamless experience for the customers.
There are 3 distinct scenarios:
@@ -221,7 +221,7 @@ There are 3 distinct scenarios:
Scenarios 1, 2, and 3 are available in Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. Scenarios 1 and 3 are available in Windows 10 Mobile. Support for scenario 1 was added in Windows 10 Mobile, version 1511.
-The CSS files provided by Microsoft contains version information and we recommend that you use the latest version. There are separate CSS files for desktop and mobile devices, OOBE, and post-OOBE experiences. [Download the Windows 10 templates and CSS files](http://download.microsoft.com/download/3/E/5/3E535D52-6432-47F6-B460-4E685C5D543A/MDM-ISV_1.1.3.zip).
+The CSS files provided by Microsoft contains version information and we recommend that you use the latest version. There are separate CSS files for desktop and mobile devices, OOBE, and post-OOBE experiences. [Download the Windows 10 templates and CSS files](https://download.microsoft.com/download/3/E/5/3E535D52-6432-47F6-B460-4E685C5D543A/MDM-ISV_1.1.3.zip).
### Using themes
@@ -348,7 +348,7 @@ The following claims are expected in the access token passed by Windows to the T
> **Note** There is no device ID claim in the access token because the device may not yet be enrolled at this time.
-To retrieve the list of group memberships for the user, you can use the [Azure AD Graph API](http://go.microsoft.com/fwlink/p/?LinkID=613654).
+To retrieve the list of group memberships for the user, you can use the [Azure AD Graph API](https://go.microsoft.com/fwlink/p/?LinkID=613654).
Here's an example URL.
@@ -399,7 +399,7 @@ Location:
Example:
-HTTP/1.1 302
+HTTP/1.1 302
Location: ms-appx-web://App1/ToUResponse?error=access_denied&error_description=Acess%20is%20denied%2E
```
@@ -594,13 +594,13 @@ With Azure integrated MDM enrollment, there is no discovery phase and the discov
There are two different MDM enrollment types that take advantage of integration with Azure AD and therefore make use of Azure AD user and device identities. Depending on the enrollment type, the MDM service may need to manage a single user or multiple users.
-**Multiple user management for Azure AD joined devices**
+**Multiple user management for Azure AD joined devices**
In this scenario the MDM enrollment applies to every Azure AD user who logs on to the Azure AD joined device - call this enrollment type a device enrollment or a multi-user enrollment. The management server can determine the user identity, conclude what policies are targeted for this user, and send corresponding policies to the device. To allow management server to identify current user that is logged on to the device, the OMA DM client uses the Azure AD user tokens. Each management session contains an additional HTTP header that contains an Azure AD user token. This information is provided in the DM package sent to the management server. However, in some circumstances Azure AD user token is not sent over to the management server. One such scenario happens immediately after MDM enrollments completes during Azure AD join process. Until Azure AD join process is finished and Azure AD user logs on to the machine, Azure AD user token is not available to OMA-DM process. Typically MDM enrollment completes before Azure AD user logs on to machine and the initial management session does not contain an Azure AD user token. The management server should check if the token is missing and only send device policies in such case. Another possible reason for a missing Azure AD token in the OMA-DM payload is when a guest user is logged on to the device.
-**Adding a work account and MDM enrollment to a device**
+**Adding a work account and MDM enrollment to a device**
In this scenario, the MDM enrollment applies to a single user who initially added his work account and enrolled the device. In this enrollment type the management server can ignore Azure AD tokens that may be sent over during management session. Whether Azure AD token is present or missing, the management server sends both user and device policies to the device.
-**Evaluating Azure AD user tokens**
+**Evaluating Azure AD user tokens**
The Azure AD token is in the HTTP Authorization header in the following format:
``` syntax
@@ -616,8 +616,8 @@ Additional claims may be present in the Azure AD token, such as:
Access token issued by Azure AD are JSON web tokens (JWTs). A valid JWT token is presented by Windows at the MDM enrollment endpoint to initiate the enrollment process. There are a couple of options to evaluate the tokens:
-- Use the JWT Token Handler extension for WIF to validate the contents of the access token and extract claims required for use. For more information, see [JSON Web Token Handler](http://go.microsoft.com/fwlink/p/?LinkId=613820).
-- Refer to the Azure AD authentication code samples to get a sample for working with access tokens. For an example, see [NativeClient-DotNet](http://go.microsoft.com/fwlink/p/?LinkId=613667).
+- Use the JWT Token Handler extension for WIF to validate the contents of the access token and extract claims required for use. For more information, see [JSON Web Token Handler](https://go.microsoft.com/fwlink/p/?LinkId=613820).
+- Refer to the Azure AD authentication code samples to get a sample for working with access tokens. For an example, see [NativeClient-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613667).
## Device Alert 1224 for Azure AD user token
@@ -625,21 +625,21 @@ An alert is sent when the DM session starts and there is an Azure AD user logged
``` syntax
Alert Type: com.microsoft/MDM/AADUserToken
-
-Alert sample:
-
-
- 1
- 1224
-
-
- com.microsoft/MDM/AADUserToken
-
- UserToken inserted here
-
-
- … other xml tags …
-
+
+Alert sample:
+
+
+ 1
+ 1224
+
+
+ com.microsoft/MDM/AADUserToken
+
+ UserToken inserted here
+
+
+ … other xml tags …
+
```
## Determine when a user is logged in through polling
@@ -656,18 +656,18 @@ An alert is send to the MDM server in DM package\#1.
Here's an example.
``` syntax
-
-
- 1
- 1224
-
-
- com.microsoft/MDM/LoginStatus
-
- user
-
-
- … other xml tags …
+
+
+ 1
+ 1224
+
+
+ com.microsoft/MDM/LoginStatus
+
+ user
+
+
+ … other xml tags …
```
@@ -675,7 +675,7 @@ Here's an example.
Once a device is enrolled with the MDM for management, corporate policies configured by the IT administrator are enforced on the device. The device compliance with configured policies is evaluated by the MDM and then reported to Azure AD. This section covers the Graph API call you can use to report a device compliance status to Azure AD.
-For a sample that illustrates how an MDM can obtain an access token using OAuth 2.0 client\_credentials grant type, see [Daemon\_CertificateCredential-DotNet](http://go.microsoft.com/fwlink/p/?LinkId=613822).
+For a sample that illustrates how an MDM can obtain an access token using OAuth 2.0 client\_credentials grant type, see [Daemon\_CertificateCredential-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=613822).
- **Cloud-based MDM** - If your product is a cloud-based multi-tenant MDM service, you have a single key configured for your service within your tenant. Use this key to authenticate the MDM service with Azure AD, in order to obtain authorization.
- **On-premises MDM** - If your product is an on-premises MDM, customers must configure your product with the key used to authenticate with Azure AD. This is because each on-premises instance of your MDM product has a different tenant-specific key. For this purpose, you may need to expose a configuration experience in your MDM product that enables administrators to specify the key to be used to authenticate with Azure AD.
@@ -687,15 +687,15 @@ The following sample REST API call illustrates how an MDM can use the Azure AD G
> **Note** This is only applicable for approved MDM apps on Windows 10 devices.
``` syntax
-Sample Graph API Request:
+Sample Graph API Request:
-PATCH https://graph.windows.net/contoso.com/devices/db7ab579-3759-4492-a03f-655ca7f52ae1?api-version=beta HTTP/1.1
-Authorization: Bearer eyJ0eXAiO………
-Accept: application/json
-Content-Type: application/json
-{ “isManaged”:true,
- “isCompliant”:true
-}
+PATCH https://graph.windows.net/contoso.com/devices/db7ab579-3759-4492-a03f-655ca7f52ae1?api-version=beta HTTP/1.1
+Authorization: Bearer eyJ0eXAiO………
+Accept: application/json
+Content-Type: application/json
+{ “isManaged”:true,
+ “isCompliant”:true
+}
```
Where:
diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md
index 622256b740..44813e0616 100644
--- a/windows/client-management/mdm/bitlocker-csp.md
+++ b/windows/client-management/mdm/bitlocker-csp.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 07/16/2018
+ms.date: 08/31/2018
---
# BitLocker CSP
@@ -14,7 +14,7 @@ ms.date: 07/16/2018
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-The BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. This CSP was added in Windows 10, version 1703.
+The BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. This CSP was added in Windows 10, version 1703. Starting in Windows 10, next major version, it is also supported in Windows 10 Pro.
> [!Note]
> Settings are enforced only at the time encryption is started. Encryption is not restarted with settings changes.
@@ -257,7 +257,7 @@ The following diagram shows the BitLocker configuration service provider in tree
On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 6-digit to 20-digit personal identification number (PIN), or both.
> [!Note]
-> In Windows 10, version 1709, you can use a minimum PIN of 4 digits. SystemDrivesMinimumPINLength policy must be set to allow PINs shorter than 6 digits.
+> In Windows 10, version 1703 release B, you can use a minimum PIN of 4 digits. SystemDrivesMinimumPINLength policy must be set to allow PINs shorter than 6 digits.
If you enable this policy setting, users can configure advanced startup options in the BitLocker setup wizard.
@@ -347,7 +347,7 @@ The following diagram shows the BitLocker configuration service provider in tree
This setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 6 digits and can have a maximum length of 20 digits.
> [!Note]
-> In Windows 10, version 1709, you can use a minimum PIN length of 4 digits.
+> In Windows 10, version 1703 release B, you can use a minimum PIN length of 4 digits.
>
>In TPM 2.0 if minimum PIN length is set below 6 digits, Windows will attempt to update the TPM lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset. This does not apply to TPM 1.2.
diff --git a/windows/client-management/mdm/clientcertificateinstall-csp.md b/windows/client-management/mdm/clientcertificateinstall-csp.md
index bf01d38374..128a41801d 100644
--- a/windows/client-management/mdm/clientcertificateinstall-csp.md
+++ b/windows/client-management/mdm/clientcertificateinstall-csp.md
@@ -27,18 +27,18 @@ The following image shows the ClientCertificateInstall configuration service pro
-**Device or User**
+**Device or User**
For device certificates, use **./Device/Vendor/MSFT** path and for user certificates use **./User/Vendor/MSFT** path.
-**ClientCertificateInstall**
+**ClientCertificateInstall**
The root node for the ClientCertificateInstaller configuration service provider.
-**ClientCertificateInstall/PFXCertInstall**
+**ClientCertificateInstall/PFXCertInstall**
Required for PFX certificate installation. The parent node grouping the PFX certificate related settings.
Supported operation is Get.
-**ClientCertificateInstall/PFXCertInstall/****_UniqueID_**
+**ClientCertificateInstall/PFXCertInstall/****_UniqueID_**
Required for PFX certificate installation. A unique ID to differentiate different certificate install requests.
The data type format is node.
@@ -47,7 +47,7 @@ The following image shows the ClientCertificateInstall configuration service pro
Calling Delete on this node should delete the certificates and the keys that were installed by the corresponding PFX blob.
-**ClientCertificateInstall/PFXCertInstall/*UniqueID*/KeyLocation**
+**ClientCertificateInstall/PFXCertInstall/*UniqueID*/KeyLocation**
Required for PFX certificate installation. Indicates the KeyStorage provider to target the private key installation to.
Supported operations are Get, Add, and Replace.
@@ -62,14 +62,14 @@ The following image shows the ClientCertificateInstall configuration service pro
| 4 | Install to Windows Hello for Business (formerly known as Microsoft Passport for Work) whose name is specified |
-**ClientCertificateInstall/PFXCertInstall/*UniqueID*/ContainerName**
+**ClientCertificateInstall/PFXCertInstall/*UniqueID*/ContainerName**
Optional. Specifies the Windows Hello for Business (formerly known as Microsoft Passport for Work) container name (if Windows Hello for Business storage provider (KSP) is chosen for the KeyLocation). If this node is not specified when Windows Hello for Business KSP is chosen, enrollment will fail.
Date type is string.
Supported operations are Get, Add, Delete, and Replace.
-**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertBlob**
+**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertBlob**
CRYPT\_DATA\_BLOB structure that contains a PFX packet with the exported and encrypted certificates and keys. The Add operation triggers the addition to the PFX certificate. This requires that all the other nodes under UniqueID that are parameters for PFX installation (Container Name, KeyLocation, CertPassword, KeyExportable) are present before this is called. This also sets the Status node to the current Status of the operation.
The data type format is binary.
@@ -80,16 +80,16 @@ The following image shows the ClientCertificateInstall configuration service pro
If Add is called on this node for a new PFX, the certificate will be added. When a certificate does not exist, Replace operation on this node will fail.
-
In other words, using Replace or Add will result in the effect of either overwriting the old certificate or adding a new certificate CRYPT\_DATA\_BLOB, which can be found in [CRYPT\_INTEGER\_BLOB](http://go.microsoft.com/fwlink/p/?LinkId=523871).
+
In other words, using Replace or Add will result in the effect of either overwriting the old certificate or adding a new certificate CRYPT\_DATA\_BLOB, which can be found in [CRYPT\_INTEGER\_BLOB](https://go.microsoft.com/fwlink/p/?LinkId=523871).
-**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertPassword**
+**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertPassword**
Password that protects the PFX blob. This is required if the PFX is password protected.
Data Type is a string.
Supported operations are Get, Add, and Replace.
-**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertPasswordEncryptionType**
+**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertPasswordEncryptionType**
Optional. Used to specify whtether the PFX certificate password is encrypted with the MDM certificate by the MDM sever.
The data type is int. Valid values:
@@ -102,7 +102,7 @@ The following image shows the ClientCertificateInstall configuration service pro
Supported operations are Get, Add, and Replace.
-**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXKeyExportable**
+**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXKeyExportable**
Optional. Used to specify if the private key installed is exportable (and can be exported later). The PFX is not exportable when it is installed to TPM.
> **Note** You can only set PFXKeyExportable to true if KeyLocation=3. For any other KeyLocation value, the CSP will fail.
@@ -112,38 +112,38 @@ The following image shows the ClientCertificateInstall configuration service pro
Supported operations are Get, Add, and Replace.
-**ClientCertificateInstall/PFXCertInstall/*UniqueID*/Thumbprint**
+**ClientCertificateInstall/PFXCertInstall/*UniqueID*/Thumbprint**
Returns the thumbprint of the installed PFX certificate.
The datatype is a string.
Supported operation is Get.
-**ClientCertificateInstall/PFXCertInstall/*UniqueID*/Status**
+**ClientCertificateInstall/PFXCertInstall/*UniqueID*/Status**
Required. Returns the error code of the PFX installation from the GetLastError command called after the PfxImportCertStore.
Data type is an integer.
Supported operation is Get.
-**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertPasswordEncryptionStore**
+**ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXCertPasswordEncryptionStore**
Added in Windows 10, version 1511. When PFXCertPasswordEncryptionType = 2, it specifies the store name of the certificate used for decrypting the PFXCertPassword.
Data type is string.
Supported operations are Add, Get, and Replace.
-**ClientCertificateInstall/SCEP**
+**ClientCertificateInstall/SCEP**
Node for SCEP.
> **Note** An alert is sent after the SCEP certificate is installed.
-**ClientCertificateInstall/SCEP/****_UniqueID_**
+**ClientCertificateInstall/SCEP/****_UniqueID_**
A unique ID to differentiate different certificate installation requests.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install**
A node required for SCEP certificate enrollment. Parent node to group SCEP cert installation related requests.
Supported operations are Get, Add, Replace, and Delete.
@@ -151,21 +151,21 @@ The following image shows the ClientCertificateInstall configuration service pro
> **Note** Although the child nodes under Install support Replace commands, once the Exec command is sent to the device, the device will take the values that are set when the Exec command is accepted. The server should not expect the node value change after Exec command is accepted, as it will impact the current enrollment underway. The server should check the Status node value and make sure the device is not at an unknown state before changing child node values.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/ServerURL**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/ServerURL**
Required for SCEP certificate enrollment. Specifies the certificate enrollment server. Multiple server URLs can be listed, separated by semicolons.
Data type is string.
Supported operations are Get, Add, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/Challenge**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/Challenge**
Required for SCEP certificate enrollment. B64 encoded SCEP enrollment challenge. Challenge is deleted shortly after the Exec command is accepted.
Data type is string.
Supported operations are Add, Get, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/EKUMapping**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/EKUMapping**
Required. Specifies extended key usages. Subject to SCEP server configuration. The list of OIDs are separated by a plus **+**. For example, *OID1*+*OID2*+*OID3*.
Data type is string.
@@ -175,14 +175,14 @@ Data type is string.
Supported operations are Add, Get, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/SubjectName**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/SubjectName**
Required. Specifies the subject name.
Data type is string.
Supported operations are Add, Get, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/KeyProtection**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/KeyProtection**
Optional. Specifies where to keep the private key.
> **Note** Even if the private key is protected by TPM, it is not protected with a TPM PIN.
@@ -200,12 +200,12 @@ Data type is string.
Supported operations are Add, Get, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/KeyUsage**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/KeyUsage**
Required for enrollment. Specify the key usage bits (0x80, 0x20, 0xA0, etc.) for the certificate in decimal format. The value should at least have second (0x20) or forth (0x80) or both bits set. If the value doesn’t have those bits set, configuration will fail.
Supported operations are Add, Get, Delete, and Replace. Value type is integer.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/RetryDelay**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/RetryDelay**
Optional. When the SCEP server sends a pending status, this value specifies the device retry waiting time in minutes.
Data type format is an integer.
@@ -216,7 +216,7 @@ Data type is string.
Supported operations are Add, Get, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/RetryCount**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/RetryCount**
Optional. Unique to SCEP. Specifies the device retry times when the SCEP server sends a pending status.
Data type is integer.
@@ -229,7 +229,7 @@ Data type is string.
Supported operations are Add, Get, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/TemplateName**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/TemplateName**
Optional. OID of certificate template name.
> **Note** This name is typically ignored by the SCEP server; therefore the MDM server typically doesn’t need to provide it.
@@ -239,7 +239,7 @@ Data type is string.
Supported operations are Add, Get, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/KeyLength**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/KeyLength**
Required for enrollment. Specify private key length (RSA).
Data type is integer.
@@ -250,7 +250,7 @@ Data type is string.
Supported operations are Add, Get, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/HashAlgorithm**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/HashAlgorithm**
Required. Hash algorithm family (SHA-1, SHA-2, SHA-3) specified by MDM server. If multiple hash algorithm families are specified, they must be separated with **+**.
For Windows Hello for Business, only SHA256 is the supported algorithm.
@@ -259,14 +259,14 @@ Data type is string.
Supported operations are Add, Get, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/CAThumbprint**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/CAThumbprint**
Required. Specifies Root CA thumbprint. This is a 20-byte value of the SHA1 certificate hash specified as a hexadecimal string value. When client authenticates the SCEP server, it checks the CA certificate from the SCEP server to verify a match with this certificate. If it is not a match, the authentication will fail.
Data type is string.
Supported operations are Add, Get, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/SubjectAlternativeNames**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/SubjectAlternativeNames**
Optional. Specifies subject alternative names (SAN). Multiple alternative names can be specified by this node. Each name is the combination of name format+actual name. Refer to the name type definitions in MSDN for more information.
Each pair is separated by semicolon. For example, multiple SANs are presented in the format of *\[name format1\]*+*\[actual name1\]*;*\[name format 2\]*+*\[actual name2\]*.
@@ -275,7 +275,7 @@ Data type is string.
Supported operations are Add, Get, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/ValidPeriod**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/ValidPeriod**
Optional. Specifies the units for the valid certificate period.
Data type is string.
@@ -291,7 +291,7 @@ Data type is string.
Supported operations are Add, Get, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/ValidPeriodUnits**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/ValidPeriodUnits**
Optional. Specifies the desired number of units used in the validity period. This is subject to SCEP server configuration. Default value is 0. The unit type (days, months, or years) are defined in the ValidPeriod node. Note the valid period specified by MDM will overwrite the valid period specified in the certificate template. For example, if ValidPeriod is Days and ValidPeriodUnits is 30, it means the total valid duration is 30 days.
Data type is string.
@@ -301,35 +301,35 @@ Data type is string.
Supported operations are Add, Get, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/ContainerName**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/ContainerName**
Optional. Specifies the Windows Hello for Business container name (if Windows Hello for Business KSP is chosen for the node). If this node is not specified when Windows Hello for Business KSP is chosen, the enrollment will fail.
Data type is string.
Supported operations are Add, Get, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/CustomTextToShowInPrompt**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/CustomTextToShowInPrompt**
Optional. Specifies the custom text to show on the Windows Hello for Business PIN prompt during certificate enrollment. The admin can choose to provide more contextual information in this field for why the user needs to enter the PIN and what the certificate will be used for.
Data type is string.
Supported operations are Add, Get, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/Enroll**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/Enroll**
Required. Triggers the device to start the certificate enrollment. The device will not notify MDM server after certificate enrollment is done. The MDM server could later query the device to find out whether new certificate is added.
The date type format is Null, meaning this node doesn’t contain a value.
The only supported operation is Execute.
-**ClientCertificateInstall/SCEP/*UniqueID*/Install/AADKeyIdentifierList**
+**ClientCertificateInstall/SCEP/*UniqueID*/Install/AADKeyIdentifierList**
Optional. Specify the AAD Key Identifier List as a list of semicolon separated values. On Enroll, the values in this list are validated against the AAD Key present on the device. If no match is found, enrollment will fail.
Data type is string.
Supported operations are Add, Get, Delete, and Replace.
-**ClientCertificateInstall/SCEP/*UniqueID*/CertThumbprint**
+**ClientCertificateInstall/SCEP/*UniqueID*/CertThumbprint**
Optional. Specifies the current certificate’s thumbprint if certificate enrollment succeeds. It is a 20-byte value of the SHA1 certificate hash specified as a hexadecimal string value.
If the certificate on the device becomes invalid (Cert expired, Cert chain is not valid, private key deleted) then it will return an empty string.
@@ -338,7 +338,7 @@ Data type is string.
The only supported operation is Get.
-**ClientCertificateInstall/SCEP/*UniqueID*/Status**
+**ClientCertificateInstall/SCEP/*UniqueID*/Status**
Required. Specifies latest status of the certificated during the enrollment request.
Data type is string. Valid values:
@@ -353,12 +353,12 @@ Data type is string.
| 32 | Unknown |
-**ClientCertificateInstall/SCEP/*UniqueID*/ErrorCode**
+**ClientCertificateInstall/SCEP/*UniqueID*/ErrorCode**
Optional. An integer value that indicates the HRESULT of the last enrollment error code.
The only supported operation is Get.
-**ClientCertificateInstall/SCEP/*UniqueID*/RespondentServerUrl**
+**ClientCertificateInstall/SCEP/*UniqueID*/RespondentServerUrl**
Required. Returns the URL of the SCEP server that responded to the enrollment request.
Data type is string.
@@ -561,7 +561,7 @@ Enroll a client certificate through SCEP.
-
+
@@ -617,7 +617,7 @@ Add a PFX certificate. The PFX certificate password is encrypted with a custom c
Base64Encoded_Encrypted_Password_Blog
-
+
$CmdID$
@@ -629,7 +629,7 @@ Add a PFX certificate. The PFX certificate password is encrypted with a custom c
2
-
+
$CmdID$
@@ -641,7 +641,7 @@ Add a PFX certificate. The PFX certificate password is encrypted with a custom c
My
-
+
$CmdID$
diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md
index 7128dc2808..dbcadd6903 100644
--- a/windows/client-management/mdm/configuration-service-provider-reference.md
+++ b/windows/client-management/mdm/configuration-service-provider-reference.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 08/17/2018
+ms.date: 08/27/2018
---
# Configuration service provider reference
@@ -23,8 +23,8 @@ Additional lists:
- [List of CSPs supported in Microsoft Surface Hub ](#surfacehubcspsupport)
- [List of CSPs supported in Windows 10 IoT Core](#iotcoresupport)
-The following tables show the configuration service providers support in Windows 10.
-Footnotes:
+The following tables show the configuration service providers support in Windows 10.
+Footnotes:
- 1 - Added in Windows 10, version 1607
- 2 - Added in Windows 10, version 1703
- 3 - Added in Windows 10, version 1709
@@ -34,10 +34,10 @@ Footnotes:
-## CSP support
+## CSP support
-[AccountManagement CSP](accountmanagement-csp.md)
+[AccountManagement CSP](accountmanagement-csp.md)
@@ -2647,9 +2647,9 @@ Footnotes:
- Footnotes:
+ Footnotes:
- 1 - Added in Windows 10, version 1607
-- 2 - Added in Windows 10, version 1703
+- 2 - Added in Windows 10, version 1703
- 3 - Added in Windows 10, version 1709
- 4 - Added in Windows 10, version 1803
- 5 - Added in Windows 10, next major version
@@ -2658,10 +2658,10 @@ Footnotes:
You can download the DDF files for various CSPs from the links below:
-- [Download all the DDF files for Windows 10, version 1803](http://download.microsoft.com/download/6/2/7/6276FE19-E3FD-4254-9C16-3C31CAA2DE50/Windows10_1803_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1709](http://download.microsoft.com/download/9/7/C/97C6CF99-F75C-475E-AF18-845F8CECCFA4/Windows10_1709_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
-- [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
+- [Download all the DDF files for Windows 10, version 1803](https://download.microsoft.com/download/6/2/7/6276FE19-E3FD-4254-9C16-3C31CAA2DE50/Windows10_1803_DDF_download.zip)
+- [Download all the DDF files for Windows 10, version 1709](https://download.microsoft.com/download/9/7/C/97C6CF99-F75C-475E-AF18-845F8CECCFA4/Windows10_1709_DDF_download.zip)
+- [Download all the DDF files for Windows 10, version 1703](https://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
+- [Download all the DDF files for Windows 10, version 1607](https://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip)
## CSPs supported in Windows Holographic
@@ -2695,9 +2695,9 @@ The following list shows the configuration service providers supported in Window
| [WiFi CSP](wifi-csp.md) |  |  |
| [WindowsLicensing CSP](windowslicensing-csp.md) |  |  |
- Footnotes:
+ Footnotes:
- 1 - Added in Windows 10, version 1607
-- 2 - Added in Windows 10, version 1703
+- 2 - Added in Windows 10, version 1703
- 3 - Added in Windows 10, version 1709
- 4 - Added in Windows 10, version 1803
- 5 - Added in Windows 10, next major version
@@ -2727,7 +2727,7 @@ The following list shows the configuration service providers supported in Window
- [Reporting CSP](reporting-csp.md)
- [RootCATrustedCertificates CSP](rootcacertificates-csp.md)
- [SurfaceHub CSP](surfacehub-csp.md)
-- [UEFI CSP](uefi-csp.md)
+- [UEFI CSP](uefi-csp.md)
- [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md)
diff --git a/windows/client-management/mdm/device-update-management.md b/windows/client-management/mdm/device-update-management.md
index 2e48c36d75..0af729754b 100644
--- a/windows/client-management/mdm/device-update-management.md
+++ b/windows/client-management/mdm/device-update-management.md
@@ -30,7 +30,7 @@ In Windows 10, the MDM protocol has been extended to better enable IT admins to
- Specify a per-device update approval list, to ensure devices don’t install unapproved updates that have not been tested.
- Approve EULAs on behalf of the end-user so update deployment can be automated even for updates with EULAs.
-The OMA DM APIs for specifying update approvals and getting compliance status reference updates using an Update ID, which is a GUID that identifies a particular update. The MDM, of course, will want to expose IT-friendly information about the update (instead of a raw GUID), including the update’s title, description, KB, update type (for example, a security update or service pack). For more information, see [\[MS-WSUSSS\]: Windows Update Services: Server-Server Protocol](http://go.microsoft.com/fwlink/p/?LinkId=526707).
+The OMA DM APIs for specifying update approvals and getting compliance status reference updates using an Update ID, which is a GUID that identifies a particular update. The MDM, of course, will want to expose IT-friendly information about the update (instead of a raw GUID), including the update’s title, description, KB, update type (for example, a security update or service pack). For more information, see [\[MS-WSUSSS\]: Windows Update Services: Server-Server Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526707).
For more information about the CSPs, see [Update CSP](update-csp.md) and the update policy area of the [Policy CSP](policy-configuration-service-provider.md).
The following diagram provides a conceptual overview of how this works:
@@ -53,12 +53,12 @@ This section describes how this is done. The following diagram shows the server-
MSDN provides much information about the Server-Server sync protocol. In particular:
-- It is a SOAP-based protocol, and you can get the WSDL in [Server Sync Web Service](http://go.microsoft.com/fwlink/p/?LinkId=526727). The WSDL can be used to generate calling proxies for many programming environments, which will simplify your development.
-- You can find code samples in [Protocol Examples](http://go.microsoft.com/fwlink/p/?LinkId=526720). The sample code shows raw SOAP commands, which can be used. Although it’s even simpler to make the call from a programming language like .NET (calling the WSDL-generated proxies). The stub generated by the Server Sync WSDL from the MSDN link above generates an incorrect binding URL. The binding URL should be set to https://fe2.update.microsoft.com/v6/ServerSyncWebService/serversyncwebservice.asmx.
+- It is a SOAP-based protocol, and you can get the WSDL in [Server Sync Web Service](https://go.microsoft.com/fwlink/p/?LinkId=526727). The WSDL can be used to generate calling proxies for many programming environments, which will simplify your development.
+- You can find code samples in [Protocol Examples](https://go.microsoft.com/fwlink/p/?LinkId=526720). The sample code shows raw SOAP commands, which can be used. Although it’s even simpler to make the call from a programming language like .NET (calling the WSDL-generated proxies). The stub generated by the Server Sync WSDL from the MSDN link above generates an incorrect binding URL. The binding URL should be set to https://fe2.update.microsoft.com/v6/ServerSyncWebService/serversyncwebservice.asmx.
Some important highlights:
-- The protocol has an authorization phase (calling GetAuthConfig, GetAuthorizationCookie, and GetCookie). In [Protocol Examples](http://go.microsoft.com/fwlink/p/?LinkId=526720), the **Sample 1: Authorization** code shows how this is done. Even though this is called the authorization phase, the protocol is completely open (no credentials are needed to run this phase of the protocol). This sequence of calls needs to be done to obtain a cookie for the main part of the sync protocol. As an optimization, you can cache the cookie and only call this sequence again if your cookie has expired.
+- The protocol has an authorization phase (calling GetAuthConfig, GetAuthorizationCookie, and GetCookie). In [Protocol Examples](https://go.microsoft.com/fwlink/p/?LinkId=526720), the **Sample 1: Authorization** code shows how this is done. Even though this is called the authorization phase, the protocol is completely open (no credentials are needed to run this phase of the protocol). This sequence of calls needs to be done to obtain a cookie for the main part of the sync protocol. As an optimization, you can cache the cookie and only call this sequence again if your cookie has expired.
- The protocol allows the MDM to sync update metadata for a particular update by calling GetUpdateData. For more information, see [GetUpdateData](https://msdn.microsoft.com/library/dd304816.aspx) in MSDN. The LocURI to get the applicable updates with their revision Numbers is `./Vendor/MSFT/Update/InstallableUpdates?list=StructData`. Because not all updates are available via S2S sync, make sure you handle SOAP errors.
- For mobile devices, you can either sync metadata for a particular update by calling GetUpdateData, or for a local on-premises solution, you can use WSUS and manually import the mobile updates from the Microsoft Update Catalog site. For more information, see [Process flow diagram and screenshots of server sync process](#process-flow-diagram-and-screenshots-of-server-sync-process).
@@ -67,7 +67,7 @@ Some important highlights:
## Examples of update metadata XML structure and element descriptions
-The response of the GetUpdateData call returns an array of ServerSyncUpdateData that contains the update metadata in the XmlUpdateBlob element. The schema of the update xml is available at [Protocol Examples](http://go.microsoft.com/fwlink/p/?LinkId=526720). Some of the key elements are described below:
+The response of the GetUpdateData call returns an array of ServerSyncUpdateData that contains the update metadata in the XmlUpdateBlob element. The schema of the update xml is available at [Protocol Examples](https://go.microsoft.com/fwlink/p/?LinkId=526720). Some of the key elements are described below:
- **UpdateID** – The unique identifier for an update
- **RevisionNumber** – Revision number for the update in case the update was modified.
@@ -101,8 +101,8 @@ The following procedure describes a basic algorithm for a metadata sync service:
- Initialization, composed of the following:
1. Create an empty list of “needed update IDs to fault in”. This list will get updated by the MDM service component that uses OMA DM. We recommend not adding definition updates to this list, since those are temporary in nature (for example, Defender releases about 4 new definition updates per day, each of which is cumulative).
- Sync periodically (we recommend once every 2 hours - no more than once/hour).
- 1. Implement the authorization phase of the protocol to get a cookie if you don’t already have a non-expired cookie. See **Sample 1: Authorization** in [Protocol Examples](http://go.microsoft.com/fwlink/p/?LinkId=526720).
- 2. Implement the metadata portion of the protocol (see **Sample 2: Metadata and Deployments Synchronization** in [Protocol Examples](http://go.microsoft.com/fwlink/p/?LinkId=526720)), and:
+ 1. Implement the authorization phase of the protocol to get a cookie if you don’t already have a non-expired cookie. See **Sample 1: Authorization** in [Protocol Examples](https://go.microsoft.com/fwlink/p/?LinkId=526720).
+ 2. Implement the metadata portion of the protocol (see **Sample 2: Metadata and Deployments Synchronization** in [Protocol Examples](https://go.microsoft.com/fwlink/p/?LinkId=526720)), and:
- Call GetUpdateData for all updates in the "needed update IDs to fault in" list if the update metadata has not already been pulled into the DB.
- If the update is a newer revision of an existing update (same UpdateID, higher revision number), replace the previous update metadata with the new one.
- Remove updates from the "needed update IDs to fault in" list once they have been brought in.
@@ -134,7 +134,7 @@ The following diagram shows the Update policies in a tree format.
-**Update/ActiveHoursEnd**
+**Update/ActiveHoursEnd**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -148,7 +148,7 @@ The following diagram shows the Update policies in a tree format.
The default is 17 (5 PM).
-**Update/ActiveHoursMaxRange**
+**Update/ActiveHoursMaxRange**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -159,7 +159,7 @@ The following diagram shows the Update policies in a tree format.
The default value is 18 (hours).
-**Update/ActiveHoursStart**
+**Update/ActiveHoursStart**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -173,7 +173,7 @@ The following diagram shows the Update policies in a tree format.
The default value is 8 (8 AM).
-**Update/AllowAutoUpdate**
+**Update/AllowAutoUpdate**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -197,7 +197,7 @@ The following diagram shows the Update policies in a tree format.
If the policy is not configured, end-users get the default behavior (Auto install and restart).
-**Update/AllowMUUpdateService**
+**Update/AllowMUUpdateService**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education
@@ -209,7 +209,7 @@ The following diagram shows the Update policies in a tree format.
- 0 – Not allowed or not configured.
- 1 – Allowed. Accepts updates received through Microsoft Update.
-**Update/AllowNonMicrosoftSignedUpdate**
+**Update/AllowNonMicrosoftSignedUpdate**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -225,7 +225,7 @@ The following diagram shows the Update policies in a tree format.
This policy is specific to desktop and local publishing via WSUS for 3rd party updates (binaries and updates not hosted on Microsoft Update) and allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location.
-**Update/AllowUpdateService**
+**Update/AllowUpdateService**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -245,7 +245,7 @@ The following diagram shows the Update policies in a tree format.
> This policy applies only when the desktop or device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy.
-**Update/AutoRestartNotificationSchedule**
+**Update/AutoRestartNotificationSchedule**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -256,7 +256,7 @@ The following diagram shows the Update policies in a tree format.
The default value is 15 (minutes).
-**Update/AutoRestartRequiredNotificationDismissal**
+**Update/AutoRestartRequiredNotificationDismissal**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -268,7 +268,7 @@ The following diagram shows the Update policies in a tree format.
- 1 (default) – Auto Dismissal.
- 2 – User Dismissal.
-**Update/BranchReadinessLevel**
+**Update/BranchReadinessLevel**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -280,7 +280,7 @@ The following diagram shows the Update policies in a tree format.
- 16 (default) – User gets all applicable upgrades from Current Branch (CB).
- 32 – User gets upgrades from Current Branch for Business (CBB).
-**Update/DeferFeatureUpdatesPeriodInDays**
+**Update/DeferFeatureUpdatesPeriodInDays**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education.
Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
@@ -290,7 +290,7 @@ The following diagram shows the Update policies in a tree format.
Supported values are 0-180.
-**Update/DeferQualityUpdatesPeriodInDays**
+**Update/DeferQualityUpdatesPeriodInDays**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -299,7 +299,7 @@ The following diagram shows the Update policies in a tree format.
Supported values are 0-30.
-**Update/DeferUpdatePeriod**
+**Update/DeferUpdatePeriod**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
>
@@ -371,7 +371,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
-**Update/DeferUpgradePeriod**
+**Update/DeferUpgradePeriod**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education.
>
@@ -388,7 +388,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.
-**Update/EngagedRestartDeadline**
+**Update/EngagedRestartDeadline**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -399,7 +399,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
The default value is 0 days (not specified).
-**Update/EngagedRestartSnoozeSchedule**
+**Update/EngagedRestartSnoozeSchedule**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -410,7 +410,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
The default value is 3 days.
-**Update/EngagedRestartTransitionSchedule**
+**Update/EngagedRestartTransitionSchedule**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -421,7 +421,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
The default value is 7 days.
-**Update/ExcludeWUDriversInQualityUpdate**
+**Update/ExcludeWUDriversInQualityUpdate**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education.
> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
@@ -433,8 +433,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
- 0 (default) – Allow Windows Update drivers.
- 1 – Exclude Windows Update drivers.
-**Update/IgnoreMOAppDownloadLimit**
-
Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies.
+**Update/IgnoreMOAppDownloadLimit**
+
Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies.
> [!WARNING]
> Setting this policy might cause devices to incur costs from MO operators.
@@ -447,7 +447,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
To validate this policy:
1. Enable the policy ensure the device is on a cellular network.
-2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell:
+2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell:
- `regd delete HKEY_USERS\S-1-5-21-2702878673-795188819-444038987-2781\software\microsoft\windows\currentversion\windowsupdate /v LastAutoAppUpdateSearchSuccessTime /f`
- `exec-device schtasks.exe -arguments ""/run /tn """"\Microsoft\Windows\WindowsUpdate\Automatic App Update"""" /I""`
@@ -455,8 +455,8 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
3. Verify that any downloads that are above the download size limit will complete without being paused.
-**Update/IgnoreMOUpdateDownloadLimit**
-
Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies.
+**Update/IgnoreMOUpdateDownloadLimit**
+
Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies.
> [!WARNING]
> Setting this policy might cause devices to incur costs from MO operators.
@@ -469,13 +469,13 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
To validate this policy:
1. Enable the policy and ensure the device is on a cellular network.
-2. Run the scheduled task on phone to check for OS updates in the background. For example, on a mobile device, run the following commands in TShell:
+2. Run the scheduled task on phone to check for OS updates in the background. For example, on a mobile device, run the following commands in TShell:
- `exec-device schtasks.exe -arguments ""/run /tn """"\Microsoft\Windows\WindowsUpdate\AUScheduledInstall"""" /I""`
3. Verify that any downloads that are above the download size limit will complete without being paused.
-**Update/PauseDeferrals**
+**Update/PauseDeferrals**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
>
@@ -493,7 +493,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect.
-**Update/PauseFeatureUpdates**
+**Update/PauseFeatureUpdates**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education.
Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
@@ -506,7 +506,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
- 0 (default) – Feature Updates are not paused.
- 1 – Feature Updates are paused for 60 days or until value set to back to 0, whichever is sooner.
-**Update/PauseQualityUpdates**
+**Update/PauseQualityUpdates**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -518,7 +518,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
- 0 (default) – Quality Updates are not paused.
- 1 – Quality Updates are paused for 35 days or until value set back to 0, whichever is sooner.
-**Update/RequireDeferUpgrade**
+**Update/RequireDeferUpgrade**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
>
@@ -532,7 +532,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
- 0 (default) – User gets upgrades from Current Branch.
- 1 – User gets upgrades from Current Branch for Business.
-**Update/RequireUpdateApproval**
+**Update/RequireUpdateApproval**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -552,7 +552,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
- 0 – Not configured. The device installs all applicable updates.
- 1 – The device only installs updates that are both applicable and on the Approved Updates list. Set this policy to 1 if IT wants to control the deployment of updates on devices, such as when testing is required prior to deployment.
-**Update/ScheduleImminentRestartWarning**
+**Update/ScheduleImminentRestartWarning**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -563,7 +563,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
The default value is 15 (minutes).
-**Update/ScheduledInstallDay**
+**Update/ScheduledInstallDay**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -585,7 +585,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
- 6 – Friday
- 7 – Saturday
-**Update/ScheduledInstallTime**
+**Update/ScheduledInstallTime**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -600,7 +600,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
The default value is 3.
-**Update/ScheduleRestartWarning**
+**Update/ScheduleRestartWarning**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -611,7 +611,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
The default value is 4 (hours).
-**Update/SetAutoRestartNotificationDisable**
+**Update/SetAutoRestartNotificationDisable**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
@@ -623,11 +623,11 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego
- 0 (default) – Enabled
- 1 – Disabled
-**Update/UpdateServiceUrl**
+**Update/UpdateServiceUrl**
> [!NOTE]
> This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise
-> [!Important]
+> [!Important]
> Starting in Windows 10, version 1703 this policy is not supported in Windows 10 Mobile Enteprise and IoT Enterprise.
Allows the device to check for updates from a WSUS server instead of Microsoft Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet.
@@ -657,7 +657,7 @@ Example
```
-**Update/UpdateServiceUrlAlternate**
+**Update/UpdateServiceUrlAlternate**
> **Note** This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education.
@@ -669,9 +669,9 @@ Example
Value type is string and the default value is an empty string, "". If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet.
-> [!Note]
-> If the "Configure Automatic Updates" Group Policy is disabled, then this policy has no effect.
-> If the "Alternate Download Server" Group Policy is not set, it will use the WSUS server by default to download updates.
+> [!Note]
+> If the "Configure Automatic Updates" Group Policy is disabled, then this policy has no effect.
+> If the "Alternate Download Server" Group Policy is not set, it will use the WSUS server by default to download updates.
> This policy is not supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs.
### Update management
@@ -680,12 +680,12 @@ The enterprise IT can configure the set of approved updates and get compliance s
-**Update**
+**Update**
The root node.
Supported operation is Get.
-**ApprovedUpdates**
+**ApprovedUpdates**
Node for update approvals and EULA acceptance on behalf of the end-user.
> **Note** When the RequireUpdateApproval policy is set, the MDM uses the ApprovedUpdates list to pass the approved GUIDs. These GUIDs should be a subset of the InstallableUpdates list.
@@ -700,10 +700,10 @@ The update approval list enables IT to approve individual updates and update cla
Supported operations are Get and Add.
-**ApprovedUpdates/****_Approved Update Guid_**
+**ApprovedUpdates/****_Approved Update Guid_**
Specifies the update GUID.
-To auto-approve a class of updates, you can specify the [Update Classifications](http://go.microsoft.com/fwlink/p/?LinkId=526723) GUIDs. We strongly recommend to always specify the DefinitionsUpdates classification (E0789628-CE08-4437-BE74-2495B842F43B), which are used for anti-malware signatures. There are released periodically (several times a day). Some businesses may also want to auto-approve security updates to get them deployed quickly.
+To auto-approve a class of updates, you can specify the [Update Classifications](https://go.microsoft.com/fwlink/p/?LinkId=526723) GUIDs. We strongly recommend to always specify the DefinitionsUpdates classification (E0789628-CE08-4437-BE74-2495B842F43B), which are used for anti-malware signatures. There are released periodically (several times a day). Some businesses may also want to auto-approve security updates to get them deployed quickly.
Supported operations are Get and Add.
@@ -713,52 +713,52 @@ Sample syncml:
./Vendor/MSFT/Update/ApprovedUpdates/%7ba317dafe-baf4-453f-b232-a7075efae36e%7d
```
-**ApprovedUpdates/*Approved Update Guid*/ApprovedTime**
+**ApprovedUpdates/*Approved Update Guid*/ApprovedTime**
Specifies the time the update gets approved.
Supported operations are Get and Add.
-**FailedUpdates**
+**FailedUpdates**
Specifies the approved updates that failed to install on a device.
Supported operation is Get.
-**FailedUpdates/****_Failed Update Guid_**
+**FailedUpdates/****_Failed Update Guid_**
Update identifier field of the UpdateIdentity GUID that represent an update that failed to download or install.
Supported operation is Get.
-**FailedUpdates/*Failed Update Guid*/HResult**
+**FailedUpdates/*Failed Update Guid*/HResult**
The update failure error code.
Supported operation is Get.
-**FailedUpdates/*Failed Update Guid*/Status**
+**FailedUpdates/*Failed Update Guid*/Status**
Specifies the failed update status (for example, download, install).
Supported operation is Get.
-**InstalledUpdates**
+**InstalledUpdates**
The updates that are installed on the device.
Supported operation is Get.
-**InstalledUpdates/****_Installed Update Guid_**
+**InstalledUpdates/****_Installed Update Guid_**
UpdateIDs that represent the updates installed on a device.
Supported operation is Get.
-**InstallableUpdates**
+**InstallableUpdates**
The updates that are applicable and not yet installed on the device. This includes updates that are not yet approved.
Supported operation is Get.
-**InstallableUpdates/****_Installable Update Guid_**
+**InstallableUpdates/****_Installable Update Guid_**
Update identifiers that represent the updates applicable and not installed on a device.
Supported operation is Get.
-**InstallableUpdates/*Installable Update Guid*/Type**
+**InstallableUpdates/*Installable Update Guid*/Type**
The UpdateClassification value of the update. Valid values are:
- 0 - None
@@ -767,32 +767,32 @@ The UpdateClassification value of the update. Valid values are:
Supported operation is Get.
-**InstallableUpdates/*Installable Update Guid*/RevisionNumber**
+**InstallableUpdates/*Installable Update Guid*/RevisionNumber**
The revision number for the update that must be passed in server to server sync to get the metadata for the update.
Supported operation is Get.
-**PendingRebootUpdates**
+**PendingRebootUpdates**
The updates that require a reboot to complete the update session.
Supported operation is Get.
-**PendingRebootUpdates/****_Pending Reboot Update Guid_**
+**PendingRebootUpdates/****_Pending Reboot Update Guid_**
Update identifiers for the pending reboot state.
Supported operation is Get.
-**PendingRebootUpdates/*Pending Reboot Update Guid*/InstalledTime**
+**PendingRebootUpdates/*Pending Reboot Update Guid*/InstalledTime**
The time the update is installed.
Supported operation is Get.
-**LastSuccessfulScanTime**
+**LastSuccessfulScanTime**
The last successful scan time.
Supported operation is Get.
-**DeferUpgrade**
+**DeferUpgrade**
Upgrades deferred until the next period.
Supported operation is Get.
diff --git a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md
index 13878c6f74..4d3c1904a5 100644
--- a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md
+++ b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md
@@ -42,7 +42,7 @@ In Windows, after the user confirms the account deletion command and before the
This action utilizes the OMA DM generic alert 1226 function to send a user an MDM unenrollment user alert to the MDM server after the device accepts the user unenrollment request, but before it deletes any enterprise data. The server should set the expectation that unenrollment may succeed or fail, and the server can check whether the device is unenrolled by either checking whether the device calls back at scheduled time or by sending a push notification to the device to see whether it responds back. If the server plans to send a push notification, it should allow for some delay to give the device the time to complete the unenrollment work.
-> **Note** The user unenrollment is an OMA DM standard. For more information about the 1226 generic alert, refer to the OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](http://go.microsoft.com/fwlink/p/?LinkId=267526).
+> **Note** The user unenrollment is an OMA DM standard. For more information about the 1226 generic alert, refer to the OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526).
The vendor uses the Type attribute to specify what type of generic alert it is. For device initiated MDM unenrollment, the alert type is **com.microsoft:mdm.unenrollment.userrequest**.
diff --git a/windows/client-management/mdm/enterpriseappmanagement-csp.md b/windows/client-management/mdm/enterpriseappmanagement-csp.md
index a17fca7628..d5e7c87b9c 100644
--- a/windows/client-management/mdm/enterpriseappmanagement-csp.md
+++ b/windows/client-management/mdm/enterpriseappmanagement-csp.md
@@ -23,33 +23,33 @@ The following diagram shows the EnterpriseAppManagement configuration service pr
-***EnterpriseID***
+***EnterpriseID***
Optional. A dynamic node that represents the EnterpriseID as a GUID. It is used to enroll or unenroll enterprise applications.
Supported operations are Add, Delete, and Get.
-***EnterpriseID*/EnrollmentToken**
+***EnterpriseID*/EnrollmentToken**
Required. Used to install or update the binary representation of the application enrollment token (AET) and initiate "phone home" token validation. Scope is dynamic.
Supported operations are Get, Add, and Replace.
-***EnterpriseID*/StoreProductID**
+***EnterpriseID*/StoreProductID**
Required. The node to host the ProductId node. Scope is dynamic.
Supported operation is Get.
-**/StoreProductID/ProductId**
+**/StoreProductID/ProductId**
The character string that contains the ID of the first enterprise application (usually a Company Hub app), which is automatically installed on the device. Scope is dynamic.
Supported operations are Get and Add.
-***EnterpriseID*/StoreUri**
+***EnterpriseID*/StoreUri**
Optional. The character string that contains the URI of the first enterprise application to be installed on the device. The enrollment client downloads and installs the application from this URI. Scope is dynamic.
Supported operations are Get and Add.
-***EnterpriseID*/CertificateSearchCriteria**
-Optional. The character string that contains the search criteria to search for the DM-enrolled client certificate. The certificate is used for client authentication during enterprise application download. The company's application content server should use the enterprise-enrolled client certificate to authenticate the device. The value must be a URL encoded representation of the X.500 distinguished name of the client certificates Subject property. The X.500 name must conform to the format required by the [CertStrToName](http://go.microsoft.com/fwlink/p/?LinkId=523869) function. This search parameter is case sensitive. Scope is dynamic.
+***EnterpriseID*/CertificateSearchCriteria**
+Optional. The character string that contains the search criteria to search for the DM-enrolled client certificate. The certificate is used for client authentication during enterprise application download. The company's application content server should use the enterprise-enrolled client certificate to authenticate the device. The value must be a URL encoded representation of the X.500 distinguished name of the client certificates Subject property. The X.500 name must conform to the format required by the [CertStrToName](https://go.microsoft.com/fwlink/p/?LinkId=523869) function. This search parameter is case sensitive. Scope is dynamic.
Supported operations are Get and Add.
@@ -57,77 +57,77 @@ Supported operations are Get and Add.
-***EnterpriseID*/Status**
+***EnterpriseID*/Status**
Required. The integer value that indicates the current status of the application enrollment. Valid values are 0 (ENABLED), 1 (INSTALL\_DISABLED), 2 (REVOKED), and 3 (INVALID). Scope is dynamic.
Supported operation is Get.
-***EnterpriseID*/CRLCheck**
+***EnterpriseID*/CRLCheck**
Optional. Character value that specifies whether the device should do a CRL check when using a certificate to authenticate the server. Valid values are "1" (CRL check required), "0" (CRL check not required). Scope is dynamic.
Supported operations are Get, Add, and Replace.
-***EnterpriseID*/EnterpriseApps**
+***EnterpriseID*/EnterpriseApps**
Required. The root node to for individual enterprise application related settings. Scope is dynamic (this node is automatically created when EnterpriseID is added to the configuration service provider).
Supported operation is Get.
-**/EnterpriseApps/Inventory**
+**/EnterpriseApps/Inventory**
Required. The root node for individual enterprise application inventory settings. Scope is dynamic (this node is automatically created when EnterpriseID is added to the configuration service provider).
Supported operation is Get.
-**/Inventory/****_ProductID_**
+**/Inventory/****_ProductID_**
Optional. A node that contains s single enterprise application product ID in GUID format. Scope is dynamic.
Supported operation is Get.
-**/Inventory/*ProductID*/Version**
+**/Inventory/*ProductID*/Version**
Required. The character string that contains the current version of the installed enterprise application. Scope is dynamic.
Supported operation is Get.
-**/Inventory/*ProductID*/Title**
+**/Inventory/*ProductID*/Title**
Required. The character string that contains the name of the installed enterprise application. Scope is dynamic.
Supported operation is Get.
-**/Inventory/*ProductID*/Publisher**
+**/Inventory/*ProductID*/Publisher**
Required. The character string that contains the name of the publisher of the installed enterprise application. Scope is dynamic.
Supported operation is Get.
-**/Inventory/*ProductID*/InstallDate**
+**/Inventory/*ProductID*/InstallDate**
Required. The time (in the character format YYYY-MM-DD-HH:MM:SS) that the application was installed or updated. Scope is dynamic.
Supported operation is Get.
-**/EnterpriseApps/Download**
+**/EnterpriseApps/Download**
Required. This node groups application download-related parameters. The enterprise server can only automatically update currently installed enterprise applications. The end user controls which enterprise applications to download and install. Scope is dynamic.
Supported operation is Get.
-**/Download/****_ProductID_**
+**/Download/****_ProductID_**
Optional. This node contains the GUID for the installed enterprise application. Each installed application has a unique ID. Scope is dynamic.
Supported operations are Get, Add, and Replace.
-**/Download/*ProductID*/Version**
+**/Download/*ProductID*/Version**
Optional. The character string that contains version information (set by the caller) for the application currently being downloaded. Scope is dynamic.
Supported operations are Get, Add, and Replace.
-**/Download/*ProductID*/Name**
+**/Download/*ProductID*/Name**
Required. The character string that contains the name of the installed application. Scope is dynamic.
Supported operation is Get.
-**/Download/*ProductID*/URL**
+**/Download/*ProductID*/URL**
Optional. The character string that contains the URL for the updated version of the installed application. The device will download application updates from this link. Scope is dynamic.
Supported operations are Get, Add, and Replace.
-**/Download/*ProductID*/Status**
+**/Download/*ProductID*/Status**
Required. The integer value that indicates the status of the current download process. The following table shows the possible values.
@@ -175,15 +175,15 @@ Required. The integer value that indicates the status of the current download pr
Scope is dynamic. Supported operations are Get, Add, and Replace.
-**/Download/*ProductID*/LastError**
+**/Download/*ProductID*/LastError**
Required. The integer value that indicates the HRESULT of the last error code. If there are no errors, the value is 0 (S\_OK). Scope is dynamic.
Supported operation is Get.
-**/Download/*ProductID*/LastErrorDesc**
+**/Download/*ProductID*/LastErrorDesc**
Required. The character string that contains the human readable description of the last error code.
-**/Download/*ProductID*/DownloadInstall**
+**/Download/*ProductID*/DownloadInstall**
Required. The node to allow the server to trigger the download and installation for an updated version of the user installed application. The format for this node is null. The server must query the device later to determine the status. For each product ID, the status field is retained for up to one week. Scope is dynamic.
Supported operation is Exec.
@@ -342,7 +342,7 @@ Response from the device (that contains two installed applications):
-./Vendor/MSFT/EnterpriseAppManagement/4000000001/EnterpriseApps/Inventory/%7BB316008A-141D-4A79-810F-8B764C4CFDFB%7D
+./Vendor/MSFT/EnterpriseAppManagement/4000000001/EnterpriseApps/Inventory/%7BB316008A-141D-4A79-810F-8B764C4CFDFB%7D
diff --git a/windows/client-management/mdm/enterpriseassignedaccess-csp.md b/windows/client-management/mdm/enterpriseassignedaccess-csp.md
index e5f202eacb..58bdfc9908 100644
--- a/windows/client-management/mdm/enterpriseassignedaccess-csp.md
+++ b/windows/client-management/mdm/enterpriseassignedaccess-csp.md
@@ -18,7 +18,7 @@ The EnterpriseAssignedAccess configuration service provider allows IT administra
> **Note** The EnterpriseAssignedAccess CSP is only supported in Windows 10 Mobile.
-To use an app to create a lockdown XML see [Use the Lockdown Designer app to create a Lockdown XML file](https://docs.microsoft.com/en-us/windows/configuration/mobile-devices/mobile-lockdown-designer). For more information about how to interact with the lockdown XML at runtime, see [**DeviceLockdownProfile class**](https://msdn.microsoft.com/library/windows/hardware/mt186983).
+To use an app to create a lockdown XML see [Use the Lockdown Designer app to create a Lockdown XML file](https://docs.microsoft.com/en-us/windows/configuration/mobile-devices/mobile-lockdown-designer). For more information about how to interact with the lockdown XML at runtime, see [**DeviceLockdownProfile class**](https://msdn.microsoft.com/library/windows/hardware/mt186983).
The following diagram shows the EnterpriseAssignedAccess configuration service provider in tree format as used by both the Open Mobile Alliance (OMA) Device Management (DM) and OMA Client Provisioning.
@@ -26,13 +26,13 @@ The following diagram shows the EnterpriseAssignedAccess configuration service p
The following list shows the characteristics and parameters.
-**./Vendor/MSFT/EnterpriseAssignedAccess/**
+**./Vendor/MSFT/EnterpriseAssignedAccess/**
The root node for the EnterpriseAssignedAccess configuration service provider. Supported operations are Add, Delete, Get and Replace.
-**AssignedAccess/**
+**AssignedAccess/**
The parent node of assigned access XML.
-**AssignedAccess/AssignedAccessXml**
+**AssignedAccess/AssignedAccessXml**
The XML code that controls the assigned access settings that will be applied to the device.
Supported operations are Add, Delete, Get and Replace.
@@ -79,7 +79,7 @@ Application example:
``` syntax
- Large
@@ -90,7 +90,7 @@ aumid="microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.c
- Large
@@ -262,11 +262,11 @@ Here is an example for Windows 10, version 1703.
```
-**Quick action settings**
+**Quick action settings**
Starting in Windows 10, version 1511, you can specify the following quick action settings in the lockdown XML file. The following list shows the quick action settings and settings page dependencies (group and page).
-> [!Note]
+> [!Note]
> Only Windows 10, versions 1511 and 1607, the dependent settings group and pages are automatically added when the quick action item is specified in the lockdown XML. In Windows 10, version 1703, Quick action settings no longer require any dependencies from related group or page.
@@ -323,27 +323,27 @@ Starting in Windows 10, version 1703, Quick action settings no longer require an
- SystemSettings_System_Display_QuickAction_Brightness
-In this example, all settings pages and quick action settings are allowed. An empty \ node indicates that none of the settings are blocked.
+In this example, all settings pages and quick action settings are allowed. An empty \ node indicates that none of the settings are blocked.
``` syntax
```
-In this example for Windows 10, version 1511, all System setting pages are enabled. Note that the System page group is added as well as all of the System subpage names.
+In this example for Windows 10, version 1511, all System setting pages are enabled. Note that the System page group is added as well as all of the System subpage names.
``` syntax
-
-
-
+
+
+
-
-
+
+
-
-
-
+
+
+
```
Here is an example for Windows 10, version 1703.
@@ -363,7 +363,7 @@ Here is an example for Windows 10, version 1703.
Entry | Description
----------- | ------------
Buttons | The following list identifies the hardware buttons on the device that you can lock down in ButtonLockdownList. When a user taps a button that is in the lockdown list, nothing will happen.
-
+
Start
Back
@@ -374,12 +374,12 @@ Buttons | The following list identifies the hardware buttons on the device that
Custom3
-> [!Note]
-> Lock down of the Start button only prevents the press and hold event.
+> [!Note]
+> Lock down of the Start button only prevents the press and hold event.
>
> Custom buttons are hardware buttons that can be added to devices by OEMs.
-Buttons example:
+Buttons example:
``` syntax
@@ -398,8 +398,8 @@ Buttons example:
```
The Search and custom buttons can be remapped or configured to open a specific application. Button remapping takes effect for the device and applies to all users.
-> [!Note]
-> The lockdown settings for a button, per user role, will apply regardless of the button mapping.
+> [!Note]
+> The lockdown settings for a button, per user role, will apply regardless of the button mapping.
>
> Button remapping can enable a user to open an application that is not in the Allow list. Use button lock down to prevent application access for a user role.
@@ -415,7 +415,7 @@ To remap a button in lockdown XML, you supply the button name, the button event
```
-**Disabling navigation buttons**
+**Disabling navigation buttons**
To disable navigation buttons (such as Home or Back) in lockdown XML, you supply the name (for example, Start) and button event (typically "press").
The following section contains a sample lockdown XML file that shows how to disable navigation buttons.
@@ -496,7 +496,7 @@ Entry | Description
----------- | ------------
MenuItems | Use **DisableMenuItems** to prevent use of the context menu, which is displayed when a user presses and holds an application in the All Programs list. You can include this entry in the default profile and in any additional user role profiles that you create.
-> [!Important]
+> [!Important]
> If **DisableMenuItems** is not included in a profile, users of that profile can uninstall apps.
MenuItems example:
@@ -511,12 +511,12 @@ Entry | Description
----------- | ------------
Tiles | **Turning-on tile manipulation** - By default, under Assigned Access, tile manipulation is turned off (blocked) and only available if enabled in the user’s profile. If tile manipulation is enabled in the user’s profile, they can pin/unpin, move, and resize tiles based on their preferences. When multiple people use one device and you want to enable tile manipulation for multiple users, you must enable it for each user in their user profile.
-> [!Important]
+> [!Important]
> If a device is turned off then back on, the tiles reset to their predefined layout. If a device has only one profile, the only way to reset the tiles is to turn off then turn on the device. If a device has multiple profiles, the device resets the tiles to the predefined layout based on the logged-in user’s profile.
The following sample file contains configuration for enabling tile manipulation.
-> [!Note]
+> [!Note]
> Tile manipulation is disabled when you don’t have a `` node in lockdown XML, or if you have a `` node but don’t have the `` node.
``` syntax
@@ -596,25 +596,25 @@ Entry | Description
CSP Runner | Allows CSPs to be executed on the device per user role. You can use this to implement role specific policies, such as changing the color scheme when an admin logs on the device, or to set configurations per role.
-**LockscreenWallpaper/**
+**LockscreenWallpaper/**
The parent node of the lock screen-related parameters that let administrators query and manage the lock screen image on devices. Supported operations are Add, Delete, Get and Replace.
-**LockscreenWallpaper/BGFileName**
+**LockscreenWallpaper/BGFileName**
The file name of the lock screen. The image file for the lock screen can be in .jpg or .png format and must not exceed 2 MB. The file name can also be in the Universal Naming Convention (UNC) format, in which case the device downloads it from the shared network and then sets it as the lock screen wallpaper.
Supported operations are Add, Get, and Replace.
-**Theme/**
+**Theme/**
The parent node of theme-related parameters.
Supported operations are Add, Delete, Get and Replace.
-**Theme/ThemeBackground**
+**Theme/ThemeBackground**
Indicates whether the background color is light or dark. Set to **0** for light; set to **1** for dark.
Supported operations are Get and Replace.
-**Theme/ThemeAccentColorID**
+**Theme/ThemeAccentColorID**
The accent color to apply as the foreground color for tiles, controls, and other visual elements on the device. The following table shows the possible values.
@@ -724,22 +724,22 @@ The accent color to apply as the foreground color for tiles, controls, and other
Supported operations are Get and Replace.
-**Theme/ThemeAccentColorValue**
+**Theme/ThemeAccentColorValue**
A 6-character string for the accent color to apply to controls and other visual elements.
To use a custom accent color for Enterprise, enter **151** for *ThemeAccentColorID* before *ThemeAccentColorValue* in lockdown XML. *ThemeAccentColorValue* configures the custom accent color using hex values for red, green, and blue, in RRGGBB format. For example, enter FF0000 for red.
Supported operations are Get and Replace.
-**PersistData**
+**PersistData**
Not supported in Windows 10.
The parent node of whether to persist data that has been provisioned on the device.
-**PersistData/PersistProvisionedData**
+**PersistData/PersistProvisionedData**
Not supported in Windows 10. Use doWipePersistProvisionedData in [RemoteWipe CSP](remotewipe-csp.md) instead.
-**Clock/TimeZone/**
+**Clock/TimeZone/**
An integer that specifies the time zone of the device. The following table shows the possible values.
Supported operations are Get and Replace.
@@ -1172,8 +1172,8 @@ Supported operations are Get and Replace.
-**Locale/Language/**
-The culture code that identifies the language to display on a device, and specifies the formatting of numbers, currencies, time, and dates. For language values, see [Locale IDs Assigned by Microsoft](http://go.microsoft.com/fwlink/p/?LinkID=189567).
+**Locale/Language/**
+The culture code that identifies the language to display on a device, and specifies the formatting of numbers, currencies, time, and dates. For language values, see [Locale IDs Assigned by Microsoft](https://go.microsoft.com/fwlink/p/?LinkID=189567).
The language setting is configured in the Default User profile only.
@@ -1195,14 +1195,14 @@ The XML examples in this section show how to perform various tasks by using OMA
The following example shows how to add a new policy.
``` syntax
-
-
-
-
-
-
-
+
+
+
+
+
+
+
```
### Language
@@ -1210,13 +1210,13 @@ The following example shows how to add a new policy.
The following example shows how to specify the language to display on the device.
``` syntax
-
-
-
-
+
+
+
-
-
+
+
```
## OMA DM examples
@@ -1229,20 +1229,20 @@ These XML examples show how to perform various tasks using OMA DM.
The following example shows how to lock down a device.
``` syntax
-
-
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/AssignedAccess/AssignedAccessXml
-
- <?xml version="1.0" encoding="utf-8"?><HandheldLockdown version="1.0"><Default><Apps><Application productId="{5B04B775-356B-4AA0-AAF8-6491FFEA5615}" pinToStart="1"/><Application productId="{5B04B775-356B-4AA0-AAF8-6491FFEA5612}" pinToStart="2"/></Apps><Settings><System name="Microsoft.Themes" /><System name="Microsoft.About" /></Settings><Buttons><Button name="Start" disableEvents="PressAndHold" /><Button name="Camera" disableEvents="All" /><Button name="Search" disableEvents="All" /></Buttons><MenuItems><DisableMenuItems/></MenuItems></Default><RoleList><Role guid="{76C01983-A872-4C4E-B4C6-321EAC709CEA}" name="Associate"><Apps><Application productId="{5B04B775-356B-4AA0-AAF8-6491FFEA5615}" pinToStart="1"/></Apps><Settings><System name="Microsoft.Themes" /><System name="Microsoft.About" /></Settings><Buttons><Button name="Start" disableEvents="PressAndHold" /><Button name="Camera" disableEvents="All" /></Buttons><MenuItems><DisableMenuItems/></MenuItems></Role><Role guid="{8ABB8A10-4418-4467-9E18-99D11FA54E30}" name="Manager"><Apps><Application productId="{5B04B775-356B-4AA0-AAF8-6491FFEA5612}" pinToStart="1"/></Apps><Settings><System name="Microsoft.Themes" /></Settings><Buttons><Button name="Start" disableEvents="PressAndHold" /></Buttons><MenuItems><DisableMenuItems/></MenuItems></Role></RoleList></HandheldLockdown>
-
-
-
-
-
+
+
+
+ 2
+
+
+ ./Vendor/MSFT/EnterpriseAssignedAccess/AssignedAccess/AssignedAccessXml
+
+ <?xml version="1.0" encoding="utf-8"?><HandheldLockdown version="1.0"><Default><Apps><Application productId="{5B04B775-356B-4AA0-AAF8-6491FFEA5615}" pinToStart="1"/><Application productId="{5B04B775-356B-4AA0-AAF8-6491FFEA5612}" pinToStart="2"/></Apps><Settings><System name="Microsoft.Themes" /><System name="Microsoft.About" /></Settings><Buttons><Button name="Start" disableEvents="PressAndHold" /><Button name="Camera" disableEvents="All" /><Button name="Search" disableEvents="All" /></Buttons><MenuItems><DisableMenuItems/></MenuItems></Default><RoleList><Role guid="{76C01983-A872-4C4E-B4C6-321EAC709CEA}" name="Associate"><Apps><Application productId="{5B04B775-356B-4AA0-AAF8-6491FFEA5615}" pinToStart="1"/></Apps><Settings><System name="Microsoft.Themes" /><System name="Microsoft.About" /></Settings><Buttons><Button name="Start" disableEvents="PressAndHold" /><Button name="Camera" disableEvents="All" /></Buttons><MenuItems><DisableMenuItems/></MenuItems></Role><Role guid="{8ABB8A10-4418-4467-9E18-99D11FA54E30}" name="Manager"><Apps><Application productId="{5B04B775-356B-4AA0-AAF8-6491FFEA5612}" pinToStart="1"/></Apps><Settings><System name="Microsoft.Themes" /></Settings><Buttons><Button name="Start" disableEvents="PressAndHold" /></Buttons><MenuItems><DisableMenuItems/></MenuItems></Role></RoleList></HandheldLockdown>
+
+
+
+
+
```
### Theme
@@ -1250,66 +1250,66 @@ The following example shows how to lock down a device.
The following example shows how to change the accent color to one of the standard colors.
``` syntax
-
-
-
- 1
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeAccentColorID
-
-
- int
-
-
- 7
-
-
-
-
+
+
+
+ 1
+
+
+ ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeAccentColorID
+
+
+ int
+
+
+ 7
+
+
+
+
```
The following example shows how to change the theme.
``` syntax
-
-
-
- 1
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeBackground
-
-
- int
-
-
- 1
-
-
-
-
-
+
+
+
+ 1
+
+
+ ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeBackground
+
+
+ int
+
+
+ 1
+
+
+
+
+
```
The following example shows how to set a custom theme accent color for the enterprise environment.
``` syntax
-
-
- 1
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeAccentColorID
-
-
- int
-
-
- 151
-
-
+
+
+ 1
+
+
+ ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeAccentColorID
+
+
+ int
+
+
+ 151
+
+ 2
@@ -1323,8 +1323,8 @@ The following example shows how to set a custom theme accent color for the enter
FF0000
-
-
+
+
```
### Lock screen
@@ -1332,55 +1332,55 @@ The following example shows how to set a custom theme accent color for the enter
Use the examples in this section to set a new lock screen and manage the lock screen features. If using a UNC path, format the LocURI as \\\\host\\share\\image.jpg.
``` syntax
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/LockScreenWallpaper/BGFileName
-
- chr
- text/plain
-
- c:\windows\system32\lockscreen\480x800\Wallpaper_015.jpg
-
-
-
+
+ 2
+
+
+ ./Vendor/MSFT/EnterpriseAssignedAccess/LockScreenWallpaper/BGFileName
+
+ chr
+ text/plain
+
+ c:\windows\system32\lockscreen\480x800\Wallpaper_015.jpg
+
+
+
```
The following example shows how to query the device for the file being used as the lock screen.
``` syntax
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/LockScreenWallpaper/BGFileName
-
-
-
+
+ 2
+
+
+ ./Vendor/MSFT/EnterpriseAssignedAccess/LockScreenWallpaper/BGFileName
+
+
+
```
The following example shows how to change the existing lock screen image to one of your choosing.
``` syntax
-
-
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/LockScreenWallpaper/BGFileName
-
-
- chr
- text/plain
-
- c:\windows\system32\lockscreen\480x800\Wallpaper_015.jpg
-
-
-
-
-
+
+
+
+ 2
+
+
+ ./Vendor/MSFT/EnterpriseAssignedAccess/LockScreenWallpaper/BGFileName
+
+
+ chr
+ text/plain
+
+ c:\windows\system32\lockscreen\480x800\Wallpaper_015.jpg
+
+
+
+
+
```
### Time zone
@@ -1388,45 +1388,45 @@ The following example shows how to change the existing lock screen image to one
The following example shows how to set the time zone to UTC-07 Mountain Time (US & Canada).
``` syntax
-
-
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/Clock/TimeZone
-
-
- int
-
- 500
-
-
-
-
-
+
+
+
+ 2
+
+
+ ./Vendor/MSFT/EnterpriseAssignedAccess/Clock/TimeZone
+
+
+ int
+
+ 500
+
+
+
+
+
```
The following example shows how to set the time zone to Pacific Standard Time (UTC-08:00) without observing daylight savings time (UTC+01:00).
``` syntax
-
-
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/Clock/TimeZone
-
-
- int
-
- 400
-
-
-
-
-
+
+
+
+ 2
+
+
+ ./Vendor/MSFT/EnterpriseAssignedAccess/Clock/TimeZone
+
+
+ int
+
+ 400
+
+
+
+
+
```
### Language
@@ -1434,23 +1434,23 @@ The following example shows how to set the time zone to Pacific Standard Time (U
The following example shows how to set the language.
``` syntax
-
-
-
- 1
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/Locale/Language
-
-
- int
-
- 1033
-
-
-
-
-
+
+
+
+ 1
+
+
+ ./Vendor/MSFT/EnterpriseAssignedAccess/Locale/Language
+
+
+ int
+
+ 1033
+
+
+
+
+
```
## Product IDs in Windows 10 Mobile
diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md
index 2c036e00e7..221d222f22 100644
--- a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md
+++ b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md
@@ -21,34 +21,34 @@ The following diagram shows the EnterpriseDesktopAppManagement CSP in tree forma
-**./Device/Vendor/MSFT/EnterpriseDesktopAppManagement**
+**./Device/Vendor/MSFT/EnterpriseDesktopAppManagement**
The root node for the EnterpriseDesktopAppManagement configuration service provider.
-**MSI**
+**MSI**
Node for all settings.
-**MSI/****_ProductID_**
+**MSI/****_ProductID_**
The MSI product code for the application.
-**MSI/*ProductID*/Version**
+**MSI/*ProductID*/Version**
Version number. Value type is string. Supported operation is Get.
-**MSI/*ProductID*/Name**
+**MSI/*ProductID*/Name**
Name of the application. Value type is string. Supported operation is Get.
-**MSI/*ProductID*/Publisher**
+**MSI/*ProductID*/Publisher**
Publisher of application. Value type is string. Supported operation is Get.
-**MSI/*ProductID*/InstallPath**
+**MSI/*ProductID*/InstallPath**
Installation path of the application. Value type is string. Supported operation is Get.
-**MSI/*ProductID*/InstallDate**
+**MSI/*ProductID*/InstallDate**
Installation date of the application. Value type is string. Supported operation is Get.
-**MSI/*ProductID*/DownloadInstall**
+**MSI/*ProductID*/DownloadInstall**
Executes the download and installation of the application. Value type is string. Supported operations are Execute and Get.
-In Windows 10, version 1703 service release, a new tag \ was added to the \ section of the XML. The default value is 0 (do not send token). This tag is optional and needs to be set to 1 in case the server wants the download URL to get the AADUserToken.
+In Windows 10, version 1703 service release, a new tag \ was added to the \ section of the XML. The default value is 0 (do not send token). This tag is optional and needs to be set to 1 in case the server wants the download URL to get the AADUserToken.
Here is an example:
@@ -68,7 +68,7 @@ Here is an example:
```
-**MSI/*ProductID*/Status**
+**MSI/*ProductID*/Status**
Status of the application. Value type is string. Supported operation is Get.
| Status | Value |
@@ -86,23 +86,23 @@ Status of the application. Value type is string. Supported operation is Get.
-**MSI/*ProductID*/LastError**
+**MSI/*ProductID*/LastError**
The last error code during the application installation process. This is typically stored as an HRESULT format. Depending on what was occurring when the error happened, this could be the result of executing MSIExec.exe or the error result from an API that failed.
Value type is string. Supported operation is Get.
-**MSI/*ProductID*/LastErrorDesc**
+**MSI/*ProductID*/LastErrorDesc**
Contains the last error code description. The LastErrorDesc value is looked up for the matching LastError value. Sometimes there is no LastErrorDesc returned.
Value type is string. Supported operation is Get.
-**MSI/UpgradeCode**
+**MSI/UpgradeCode**
Added in the March service release of Windows 10, version 1607.
-**MSI/UpgradeCode/_Guid_**
+**MSI/UpgradeCode/_Guid_**
Added in the March service release of Windows 10, version 1607. A gateway (or device management server) uses this method to detect matching upgrade MSI product when a Admin wants to update an existing MSI app. If the same upgrade product is installed, then the update is allowed.
-Value type is string. Supported operation is Get.
+Value type is string. Supported operation is Get.
## Examples
@@ -226,7 +226,7 @@ The following table describes the fields in the previous sample:
https://dp2.com/packages/myApp.msi
-
+ 134D8F1F7C3C036DC3DCDA9F97515C8C7951DB154B73365C9C22962BD23E3EB3
@@ -532,7 +532,7 @@ Properties can be specified in the package, passed through the command line, mod
Here's a list of references:
- [Using Windows Installer](https://technet.microsoft.com/library/cc782896.aspx)
-- [Authoring a single package for Per-User or Per-Machine Installation context in Windows 7](http://blogs.msdn.com/b/windows_installer_team/archive/2009/09/02/authoring-a-single-package-for-per-user-or-per-machine-installation-context-in-windows-7.aspx)
+- [Authoring a single package for Per-User or Per-Machine Installation context in Windows 7](https://blogs.msdn.com/b/windows_installer_team/archive/2009/09/02/authoring-a-single-package-for-per-user-or-per-machine-installation-context-in-windows-7.aspx)
- SyncML Representation Protocol, Draft Version 1.3 - 27 Aug 2009 (OMA-TS-SyncML\_RepPro-V1\_3-20090827-D)
## Alert example
diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md
index 65466b03e1..aed90a1771 100644
--- a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md
+++ b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 08/21/2018
+ms.date: 08/27/2018
---
# EnterpriseModernAppManagement CSP
@@ -127,8 +127,7 @@ Parameters:
User (optional): Specifies the SID of the particular user for whom to remove the package; only the package for the specified user can be removed.
-
-
+
Supported operation is Execute.
@@ -164,6 +163,39 @@ Required. Used for managing apps from the Microsoft Store.
Supported operations are Get and Delete.
+**AppManagement/AppStore/ReleaseManagement**
+Added in Windows 10, next major version. Interior node for the managing updates through the Microsoft Store. These settings allow the IT admin to specify update channels for apps that they want their users to use for receiving updates. It allows the IT admin to assign a specific release to a smaller group for testing before the large deployment to the rest of the organization.
+
+> [!Note]
+> ReleaseManagement settings only apply to updates through the Microsoft Store.
+
+**AppManagement/AppStore/ReleaseManagement/_ReleaseManagementKey_**
+Added in Windows 10, next major version. Identifier for the app or set of apps. If there is only one app, it is the PackageFamilyName. If it is for a set of apps, it is the PackageFamilyName of the main app.
+
+
+**AppManagement/AppStore/ReleaseManagement/_ReleaseManagementKey_/ChannelId**
+Added in Windows 10, next major version. Specifies the app channel ID.
+
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
+
+**AppManagement/AppStore/ReleaseManagement/_ReleaseManagementKey_/ReleaseManagementId**
+Added in Windows 10, next major version. The IT admin can specify a release ID to indicate a specific release they would like the user or device to be on.
+
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
+
+**AppManagement/AppStore/ReleaseManagement/_ReleaseManagementKey_/EffectiveRelease**
+Added in Windows 10, next major version. Interior node used to specify the effective app release to use when multiple user policies are set on the device. The device policy or last user policy is used.
+
+**AppManagement/AppStore/ReleaseManagement/_ReleaseManagementKey_/EffectiveRelease/ChannelId**
+Added in Windows 10, next major version. Returns the last user channel ID on the device.
+
+Value type is string. Supported operation is Get.
+
+**AppManagement/AppStore/ReleaseManagement/_ReleaseManagementKey_/EffectiveRelease/ReleaseManagementId**
+Added in Windows 10, next major version. Returns the last user release ID on the device.
+
+Value type is string. Supported operation is Get.
+
**.../****_PackageFamilyName_**
Optional. Package family name (PFN) of the app. There is one for each PFN on the device when reporting inventory. These items are rooted under their signing origin.
@@ -222,8 +254,6 @@ Required. Architecture of installed package. Value type is string.
> [!Note]
> Not applicable to XAP files.
-
-
Supported operation is Get.
**.../*PackageFamilyName*/*PackageFullName*/InstallLocation**
@@ -231,7 +261,6 @@ Required. Install location of the app on the device. Value type is string.
> [!Note]
> Not applicable to XAP files.
-
Supported operation is Get.
diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md
index fe58f406bd..cb7ad9e1c9 100644
--- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md
+++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 07/23/2018
+ms.date: 07/27/2018
---
# EnterpriseModernAppManagement DDF
@@ -580,7 +580,7 @@ The XML below is for Windows 10, next major version.
- ReleaseId
+ ReleaseManagementId
@@ -642,7 +642,7 @@ The XML below is for Windows 10, next major version.
- ReleaseId
+ ReleaseManagementId
diff --git a/windows/client-management/mdm/hotspot-csp.md b/windows/client-management/mdm/hotspot-csp.md
index 87aa4a054e..65c36b6e0d 100644
--- a/windows/client-management/mdm/hotspot-csp.md
+++ b/windows/client-management/mdm/hotspot-csp.md
@@ -27,7 +27,7 @@ The following diagram shows the HotSpot configuration service provider managemen
-**Enabled**
+**Enabled**
Required. Specifies whether to enable Internet sharing on the device. The default is false.
If this is initially set to false, the feature is turned off and the Internet sharing screen is removed from Settings so that the user cannot access it. Configuration changes or connection sharing state changes will not be possible.
@@ -36,7 +36,7 @@ When this is set to true, the Internet sharing screen is added to Settings, thou
This setting can be provisioned over the air, but it may require a reboot if Settings was open when this was enabled for the first time.
-**DedicatedConnections**
+**DedicatedConnections**
Optional. Specifies the semicolon separated list of Connection Manager cellular connections that Internet sharing will use as the public connections.
By default, any available connection will be used as a public connection. However, this node allows a mobile operator to specify one or more connection names to use as public connections.
@@ -51,7 +51,7 @@ If the specified connections do not exist, Internet sharing will not start becau
If the Internet sharing service is already in a sharing state, setting this node will not take effect until sharing is stopped and restarted.
-**TetheringNAIConnection**
+**TetheringNAIConnection**
Optional. Specifies the CDMA TetheringNAI Connection Manager cellular connection that Internet sharing will use as a public connection.
If a CDMA mobile operator requires using a Tethering NAI during Internet sharing, they must use the [CM\_CellularEntries configuration service provider](cm-cellularentries-csp.md) to provision a TetheringNAI connection and then specify the provisioned connection in this node.
@@ -66,63 +66,63 @@ If the specified connections do not exist, Internet sharing will not start becau
If the Internet sharing service is already in a sharing state, setting this node will not take effect until sharing is stopped and restarted.
-**MaxUsers**
+**MaxUsers**
Optional. Specifies the maximum number of simultaneous users that can be connected to a device while in a sharing state. The value must be between 1 and 8 inclusive. The default value is 5.
If the Internet sharing service is already in a sharing state, setting this node will not take effect until sharing is stopped and restarted.
-**MaxBluetoothUsers**
+**MaxBluetoothUsers**
Optional. Specifies the maximum number of simultaneous Bluetooth users that can be connected to a device while sharing over Bluetooth. The value must be between 1 and 7 inclusive. The default value is 7.
-**MOHelpNumber**
+**MOHelpNumber**
Optional. A mobile operator–specified device number that is displayed to the user when the Internet sharing service fails to start. The user interface displays a message informing the user that they can call the specified number for help.
-**MOInfoLink**
+**MOInfoLink**
Optional. A mobile operator–specified HTTP link that is displayed to the user when Internet sharing is disabled or the device is not entitled. The user interface displays a message informing the user that they can visit the specified link for more information about how to enable the feature.
-**MOAppLink**
+**MOAppLink**
Optional. A Windows device application link that points to a preinstalled application, provided by the mobile operator, that will help a user to subscribe to the mobile operator’s Internet sharing service when Internet sharing is not provisioned or entitlement fails. The general format for the link is `app://MOapp`.
-**MOHelpMessage**
+**MOHelpMessage**
Optional. Reference to a localized string, provided by the mobile operator, that is displayed when Internet sharing is not enabled due to entitlement failure. The node takes a language-neutral registry value string, which has the following form:
`@,-`
-Where `` is the path to the resource dll that contains the string and `` is the string identifier. For more information on language-neutral string resource registry values, see [Using Registry String Redirection](http://msdn.microsoft.com/library/windows/desktop/dd374120.aspx) on MSDN.
+Where `` is the path to the resource dll that contains the string and `` is the string identifier. For more information on language-neutral string resource registry values, see [Using Registry String Redirection](https://msdn.microsoft.com/library/windows/desktop/dd374120.aspx) on MSDN.
> **Note** MOAppLink is required to use the MOHelpMessage setting.
-**EntitlementRequired**
+**EntitlementRequired**
Optional. Specifies whether the device requires an entitlement check to determine if Internet sharing should be enabled. This node is set to a Boolean value. The default value is **True**.
By default the Internet sharing service will check entitlement every time an attempt is made to enable Internet sharing. Internet sharing should be set to **False** for carrier-unlocked devices.
-**EntitlementDll**
+**EntitlementDll**
Required if `EntitlementRequired` is set to true. The path to the entitlement DLL used to make entitlement checks that verify that the device is entitled to use the Internet sharing service on a mobile operator’s network. The value is a string that represents a valid file system path to the entitlement DLL. By default, the Internet sharing service fails entitlement checks if this setting is missing or empty. For more information, see [Creating an Entitlement DLL](#creating-entitlement-dll) later in this topic.
-**EntitlementInterval**
+**EntitlementInterval**
Optional. The time interval, in seconds, between entitlement checks. The default value is 86,400 seconds (24 hours).
If a periodic entitlement check fails, Internet sharing is automatically disabled.
-**PeerlessTimeout**
+**PeerlessTimeout**
Optional. The time-out period, in minutes, after which Internet sharing should automatically turn off if there are no longer any active clients. This node can be set to any value between 1 and 120 inclusive. A value of 0 is not supported. The default value is 5 minutes.
A reboot may be required before changes to this node take effect.
-**PublicConnectionTimeout**
+**PublicConnectionTimeout**
Optional. The time-out value, in minutes, after which Internet sharing is automatically turned off if a cellular connection is not available. This node can be set to any value between 1 and 60 inclusive. The default value is 20 minutes. A time-out is required, so a value of 0 is not supported.
Changes to this node require a reboot.
-**MinWifiKeyLength**
+**MinWifiKeyLength**
> **Important** This parm is no longer supported for Windows Phone 8.1. The enforced minimum allowed length of the Wi-Fi key is 8.
-**MinWifiSSIDLength**
+**MinWifiSSIDLength**
> **Important** This parm is no longer supported for Windows Phone 8.1. The enforced minimum allowed length of the Wi-Fi SSID is 1.
diff --git a/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png b/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png
index 6c5472995b..b33a9020ec 100644
Binary files a/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png and b/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png differ
diff --git a/windows/client-management/mdm/index.md b/windows/client-management/mdm/index.md
index 350fa8e7f2..71c4e0aa6f 100644
--- a/windows/client-management/mdm/index.md
+++ b/windows/client-management/mdm/index.md
@@ -23,7 +23,7 @@ There are two parts to the Windows 10 management component:
- The enrollment client, which enrolls and configures the device to communicate with the enterprise management server.
- The management client, which periodically synchronizes with the management server to check for updates and apply the latest policies set by IT.
-Third-party MDM servers can manage Windows 10 by using the MDM protocol. The built-in management client is able to communicate with a third-party server proxy that supports the protocols outlined in this document to perform enterprise management tasks. The third-party server will have the same consistent first-party user experience for enrollment, which also provides simplicity for Windows 10 users. MDM servers do not need to create or download a client to manage Windows 10. For details about the MDM protocols, see [\[MS-MDM\]: Mobile Device Management Protocol](http://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347).
+Third-party MDM servers can manage Windows 10 by using the MDM protocol. The built-in management client is able to communicate with a third-party server proxy that supports the protocols outlined in this document to perform enterprise management tasks. The third-party server will have the same consistent first-party user experience for enrollment, which also provides simplicity for Windows 10 users. MDM servers do not need to create or download a client to manage Windows 10. For details about the MDM protocols, see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347).
## Learn about device enrollment
diff --git a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md
index 933ae47c17..22cbf8519f 100644
--- a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md
+++ b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md
@@ -72,14 +72,14 @@ The Store for Business services rely on Azure Active Directory for authenticatio
To learn more about Azure AD and how to register your application within Azure AD, here are some topics to get you started:
- Adding an application to Azure Active Directory - [Azure Active Directory integration with MDM](azure-active-directory-integration-with-mdm.md)
-- Accessing other Web applications and configuring your application to access other APIs - [Integrating Applications with Azure Active Directory](http://go.microsoft.com/fwlink/p/?LinkId=623021)
-- Authenticating to the Store for Business services via Azure AD - [Authentication Scenarios for Azure Active Directory](http://go.microsoft.com/fwlink/p/?LinkId=623023)
+- Accessing other Web applications and configuring your application to access other APIs - [Integrating Applications with Azure Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=623021)
+- Authenticating to the Store for Business services via Azure AD - [Authentication Scenarios for Azure Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=623023)
-For code samples, see [Microsoft Azure Active Directory Samples and Documentation](http://go.microsoft.com/fwlink/p/?LinkId=623024) in GitHub. Patterns are very similar to [Daemon-DotNet](http://go.microsoft.com/fwlink/p/?LinkId=623025) and [ConsoleApp-GraphAPI-DotNet](http://go.microsoft.com/fwlink/p/?LinkId=623026).
+For code samples, see [Microsoft Azure Active Directory Samples and Documentation](https://go.microsoft.com/fwlink/p/?LinkId=623024) in GitHub. Patterns are very similar to [Daemon-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=623025) and [ConsoleApp-GraphAPI-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=623026).
## Configure your Azure AD application
-Here are the steps to configure your Azure AD app. For additional information, see [Integrating Applications with Azure Active Directory](http://go.microsoft.com/fwlink/p/?LinkId=623021):
+Here are the steps to configure your Azure AD app. For additional information, see [Integrating Applications with Azure Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=623021):
1. Log into Microsoft Azure Management Portal (https:manage.windowsazure.com)
2. Go to the Active Directory module.
@@ -104,7 +104,7 @@ Here are the steps to configure your Azure AD app. For additional information, s
-9. Specify whether your app is multi-tenant or single tenant. For more information, see [Integrating Applications with Azure Active Directory](http://go.microsoft.com/fwlink/p/?LinkId=623021).
+9. Specify whether your app is multi-tenant or single tenant. For more information, see [Integrating Applications with Azure Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=623021).
diff --git a/windows/client-management/mdm/mobile-device-enrollment.md b/windows/client-management/mdm/mobile-device-enrollment.md
index 7b07a5a2d0..75b369db78 100644
--- a/windows/client-management/mdm/mobile-device-enrollment.md
+++ b/windows/client-management/mdm/mobile-device-enrollment.md
@@ -32,20 +32,20 @@ The enrollment process includes the following steps:
## Enrollment protocol
-There are a number of changes made to the enrollment protocol to better support a variety of scenarios across all platforms. For detailed information about the mobile device enrollment protocol, see [\[MS-MDM\]: Mobile Device Management Protocol](http://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347).
+There are a number of changes made to the enrollment protocol to better support a variety of scenarios across all platforms. For detailed information about the mobile device enrollment protocol, see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347).
The enrollment process involves the following steps:
-**Discovery request**
+**Discovery request**
The discovery request is a simple HTTP post call that returns XML over HTTP. The returned XML includes the authentication URL, the management service URL, and the user credential type.
-**Certificate enrollment policy**
-The certificate enrollment policy configuration is an implementation of the MS-XCEP protocol, which is described in \[MS-XCEP\]: X.509 Certificate Enrollment Policy Protocol Specification. Section 4 of the specification provides an example of the policy request and response. The X.509 Certificate Enrollment Policy Protocol is a minimal messaging protocol that includes a single client request message (GetPolicies) with a matching server response message (GetPoliciesResponse). For more information, see [\[MS-XCEP\]: X.509 Certificate Enrollment Policy Protocol](http://go.microsoft.com/fwlink/p/?LinkId=619345)
+**Certificate enrollment policy**
+The certificate enrollment policy configuration is an implementation of the MS-XCEP protocol, which is described in \[MS-XCEP\]: X.509 Certificate Enrollment Policy Protocol Specification. Section 4 of the specification provides an example of the policy request and response. The X.509 Certificate Enrollment Policy Protocol is a minimal messaging protocol that includes a single client request message (GetPolicies) with a matching server response message (GetPoliciesResponse). For more information, see [\[MS-XCEP\]: X.509 Certificate Enrollment Policy Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619345)
-**Certificate enrollment**
+**Certificate enrollment**
The certificate enrollment is an implementation of the MS-WSTEP protocol.
-**Management configuration**
+**Management configuration**
The server sends provisioning XML that contains a server certificate (for SSL server authentication), a client certificate issued by enterprise CA, DM client bootstrap information (for the client to communicate with the management server), an enterprise application token (for the user to install enterprise applications), and the link to download the Company Hub application.
The following topics describe the end-to-end enrollment process using various authentication methods:
diff --git a/windows/client-management/mdm/networkproxy-csp.md b/windows/client-management/mdm/networkproxy-csp.md
index fcc6d7386e..563f13334a 100644
--- a/windows/client-management/mdm/networkproxy-csp.md
+++ b/windows/client-management/mdm/networkproxy-csp.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 08/08/2018
+ms.date: 08/29/2018
---
# NetworkProxy CSP
@@ -31,44 +31,53 @@ The following diagram shows the NetworkProxy configuration service provider in t
**./Vendor/MSFT/NetworkProxy**
-The root node for the NetworkProxy configuration service provider..
+The root node for the NetworkProxy configuration service provider..
**ProxySettingsPerUser**
Added in Windows 10, version 1803. When set to 0, it enables proxy configuration as global, machine wide.
+Supported operations are Add, Get, Replace, and Delete.
+
> [!Note]
> Per user proxy configuration setting is not supported.
**AutoDetect**
-Automatically detect settings. If enabled, the system tries to find the path to a PAC script.
-Valid values:
+Automatically detect settings. If enabled, the system tries to find the path to a PAC script.
+
+Valid values:
0 - Disabled
1 (default) - Enabled
-The data type is int. Supported operations are Get and Replace.
+
+The data type is int. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported.
**SetupScriptUrl**
-Address to the PAC script you want to use.
-The data type is string. Supported operations are Get and Replace.
+Address to the PAC script you want to use.
+
+The data type is string. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported.
**ProxyServer**
-Node for configuring a static proxy for Ethernet and Wi-Fi connections. The same proxy server is used for all protocols - including HTTP, HTTPS, FTP, and SOCKS. These settings do not apply to VPN connections.
-Supported operation is Get.
+Node for configuring a static proxy for Ethernet and Wi-Fi connections. The same proxy server is used for all protocols - including HTTP, HTTPS, FTP, and SOCKS. These settings do not apply to VPN connections.
+
+Supported operation is Get.
**ProxyAddress**
-Address to the proxy server. Specify an address in the format <server>[“:”<port>].
-The data type is string. Supported operations are Get and Replace.
+Address to the proxy server. Specify an address in the format <server>[“:”<port>].
+
+The data type is string. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported.
**Exceptions**
-Addresses that should not use the proxy server. The system will not use the proxy server for addresses beginning with what is specified in this node. Use semicolons (;) to separate entries.
-The data type is string. Supported operations are Get and Replace.
+Addresses that should not use the proxy server. The system will not use the proxy server for addresses beginning with what is specified in this node. Use semicolons (;) to separate entries.
+
+The data type is string. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported.
**UseProxyForLocalAddresses**
-Specifies whether the proxy server should be used for local (intranet) addresses.
-Valid values:
+Specifies whether the proxy server should be used for local (intranet) addresses.
+Valid values:
0 (default) - Do not use proxy server for local addresses
1 - Use proxy server for local addresses
-The data type is int. Supported operations are Get and Replace.
+
+The data type is int. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported.
diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
index 1234f5199b..d02371d2dc 100644
--- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
+++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
@@ -10,7 +10,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 08/14/2018
+ms.date: 08/27/2018
---
# What's new in MDM enrollment and management
@@ -18,7 +18,7 @@ ms.date: 08/14/2018
This topic provides information about what's new and breaking changes in Windows 10 mobile device management (MDM) enrollment and management experience across all Windows 10 devices.
-For details about Microsoft mobile device management protocols for Windows 10 see [\[MS-MDM\]: Mobile Device Management Protocol](http://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347).
+For details about Microsoft mobile device management protocols for Windows 10 see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347).
## In this section
@@ -108,7 +108,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
Custom header for generic alert
The MDM-GenericAlert is a new custom header that hosts one or more alert information provided in the http messages sent by the device to the server during an OMA DM session. The generic alert is sent if the session is triggered by the device due to one or more critical or fatal alerts. Here is alert format:
MDM-GenericAlert: <AlertType1><AlertType2>
-
If present, the MDM-GenericAlert is presented in every the outgoing MDM message in the same OMA DM session. For more information about generic alerts, see section 8.7 in the OMA Device Management Protocol, Approved Version 1.2.1 in this [OMA website](http://go.microsoft.com/fwlink/p/?LinkId=267526).
+
If present, the MDM-GenericAlert is presented in every the outgoing MDM message in the same OMA DM session. For more information about generic alerts, see section 8.7 in the OMA Device Management Protocol, Approved Version 1.2.1 in this [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526).
Alert message for slow client response
@@ -846,7 +846,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
-
[Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
+
[Download all the DDF files for Windows 10, version 1703](https://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)
Added a zip file containing the DDF XML files of the CSPs. The link to the download is available in the DDF topics of various CSPs.
@@ -1025,7 +1025,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
Security/RequireDeviceEncrption - updated to show it is supported in desktop.
@@ -1349,7 +1349,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
Added a new CSP in Windows 10, version 1803.
-
[MDM Migration Analysis Too (MMAT)](http://aka.ms/mmat)
+
[MDM Migration Analysis Too (MMAT)](https://aka.ms/mmat)
Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.
@@ -1389,7 +1389,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
Browser/AllowSideloadingOfExtensions
Browser/AllowTabPreloading
Browser/AllowWebContentOnNewTabPage
-
Browser/ConfigureFavoritesBar
+
Browser/ConfigureFavoritesBar
Browser/ConfigureHomeButton
Browser/ConfigureKioskMode
Browser/ConfigureKioskResetAfterIdleTimeout
@@ -1419,6 +1419,11 @@ For details about Microsoft mobile device management protocols for Windows 10 s
@@ -1457,7 +1462,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
[BitLocker CSP](bitlocker-csp.md)
-
Added a new node AllowStandardUserEncryption in Windows 10, next major version.
+
Added a new node AllowStandardUserEncryption in Windows 10, next major version. Added support for Windows 10 Pro.
[DevDetail CSP](devdetail-csp.md)
@@ -1613,15 +1618,15 @@ The following XML sample explains the properties for the EAP TLS XML including c
00
-
+
-
+
13
-
+
true
@@ -1644,7 +1649,7 @@ The following XML sample explains the properties for the EAP TLS XML including c
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
-
+
@@ -1652,15 +1657,15 @@ The following XML sample explains the properties for the EAP TLS XML including c
- ContostoITEKU
+ ContostoITEKU
- 1.3.6.1.4.1.311.42.1.15
+ 1.3.6.1.4.1.311.42.1.15
- ContostoITEKU
+ ContostoITEKU
@@ -1682,16 +1687,16 @@ The following XML sample explains the properties for the EAP TLS XML including c
true
-
+
-
+
-
@@ -1768,6 +1773,10 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
+
[BitLocker CSP](bitlocker-csp.md)
+
Added support for Windows 10 Pro starting in the next major version.
+
+
[Office CSP](office-csp.md)
Added FinalStatus setting in Windows 10, next major version.
@@ -1798,7 +1807,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
Browser/AllowSideloadingOfExtensions
Browser/AllowTabPreloading
Browser/AllowWebContentOnNewTabPage
-
Browser/ConfigureFavoritesBar
+
Browser/ConfigureFavoritesBar
Browser/ConfigureHomeButton
Browser/ConfigureKioskMode
Browser/ConfigureKioskResetAfterIdleTimeout
@@ -1814,6 +1823,11 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
Privacy/AllowCrossDeviceClipboard
Privacy/DisablePrivacyExperience
Privacy/UploadUserActivities
+
System/AllowDeviceNameInDiagnosticData
+
System/ConfigureMicrosoft365UploadEndpoint
+
System/DisableDeviceDelete
+
System/DisableDiagnosticDataViewer
+
Storage/RemovableDiskDenyWriteAccess
Update/UpdateNotificationLevel
Start/DisableContextMenus - added in Windows 10, version 1803.
@@ -1990,8 +2004,8 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
[Policy DDF file](policy-ddf-file.md)
Updated the DDF files in the Windows 10 version 1703 and 1709.
-
[Download the Policy DDF file for Windows 10, version 1709](http://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml)
-
[Download the Policy DDF file for Windows 10, version 1703](http://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml)
+
[Download the Policy DDF file for Windows 10, version 1709](https://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml)
+
[Download the Policy DDF file for Windows 10, version 1703](https://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml)
@@ -2031,7 +2045,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
Added a new CSP in Windows 10, version 1803.
-
[MDM Migration Analysis Too (MMAT)](http://aka.ms/mmat)
+
[MDM Migration Analysis Too (MMAT)](https://aka.ms/mmat)
Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.
@@ -2237,26 +2251,26 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
Added the following policies the were added in Windows 10, version 1709
@@ -2598,7 +2612,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
[Policy DDF file](policy-ddf-file.md)
-
Added another Policy DDF file [download](http://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) for the 8C release of Windows 10, version 1607, which added the following policies:
+
Added another Policy DDF file [download](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) for the 8C release of Windows 10, version 1607, which added the following policies:
Browser/AllowMicrosoftCompatibilityList
Update/DisableDualScan
@@ -2617,25 +2631,25 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
@@ -2664,10 +2678,10 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
## FAQ
-**Can there be more than 1 MDM server to enroll and manage devices in Windows 10?**
+**Can there be more than 1 MDM server to enroll and manage devices in Windows 10?**
No. Only one MDM is allowed.
-**How do I set the maximum number of Azure Active Directory joined devices per user?**
+**How do I set the maximum number of Azure Active Directory joined devices per user?**
1. Login to the portal as tenant admin: https://manage.windowsazure.com.
2. Click Active Directory on the left pane.
3. Choose your tenant.
@@ -2677,10 +2691,10 @@ No. Only one MDM is allowed.
-**What is dmwappushsvc?**
+**What is dmwappushsvc?**
-Entry | Description
---------------- | --------------------
+Entry | Description
+--------------- | --------------------
What is dmwappushsvc? | It is a Windows service that ships in Windows 10 operating system as a part of the windows management platform. It is used internally by the operating system as a queue for categorizing and processing all WAP messages, which include Windows management messages, MMS, NabSync, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. |
What data is handled by dmwappushsvc? | It is a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further: MMS, NabSync, SI/SL. |
How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc). However, since this is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to do this. |
diff --git a/windows/client-management/mdm/oma-dm-protocol-support.md b/windows/client-management/mdm/oma-dm-protocol-support.md
index acfda5630f..c0369b83bb 100644
--- a/windows/client-management/mdm/oma-dm-protocol-support.md
+++ b/windows/client-management/mdm/oma-dm-protocol-support.md
@@ -13,7 +13,7 @@ ms.date: 06/26/2017
# OMA DM protocol support
-The OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. This topic describes the OMA DM functionality that the DM client supports in general. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](http://go.microsoft.com/fwlink/p/?LinkId=267526).
+The OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. This topic describes the OMA DM functionality that the DM client supports in general. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526).
## In this topic
@@ -62,7 +62,7 @@ The following table shows the OMA DM standards that Windows uses.
DM protocol commands
-
The following list shows the commands that are used by the device. For further information about the OMA DM command elements, see "SyncML Representation Protocol Device Management Usage (OMA-SyncML-DMRepPro-V1_1_2-20030613-A)" available from the [OMA website](http://go.microsoft.com/fwlink/p/?LinkId=267526).
+
The following list shows the commands that are used by the device. For further information about the OMA DM command elements, see "SyncML Representation Protocol Device Management Usage (OMA-SyncML-DMRepPro-V1_1_2-20030613-A)" available from the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526).
Add (Implicit Add supported)
Alert (DM alert): Generic alert (1226) is used by enterprise management client when the user triggers an MDM unenrollment action from the device or when a CSP finishes some asynchronous actions. Device alert (1224) is used to notify the server some device triggered event.
@@ -121,7 +121,7 @@ The following table shows the OMA DM standards that Windows uses.
Provisioning Files
-
Provisioning XML must be well formed and follow the definition in [SyncML Representation Protocol](http://go.microsoft.com/fwlink/p/?LinkId=526905) specification.
+
Provisioning XML must be well formed and follow the definition in [SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905) specification.
If an XML element that is not a valid OMA DM command is under SyncBody, the status code 400 is returned for that element.
Note
@@ -133,7 +133,7 @@ The following table shows the OMA DM standards that Windows uses.
WBXML support
-
Windows supports sending and receiving SyncML in both XML format and encoded WBXML format. This is configurable by using the DEFAULTENCODING node under the w7 APPLICATION characteristic during enrollment. For more information about WBXML encoding, see section 8 of the [SyncML Representation Protocol](http://go.microsoft.com/fwlink/p/?LinkId=526905) specification.
+
Windows supports sending and receiving SyncML in both XML format and encoded WBXML format. This is configurable by using the DEFAULTENCODING node under the w7 APPLICATION characteristic during enrollment. For more information about WBXML encoding, see section 8 of the [SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905) specification.
Handling of large objects
@@ -146,7 +146,7 @@ The following table shows the OMA DM standards that Windows uses.
## OMA DM protocol common elements
-Common elements are used by other OMA DM element types. The following table lists the OMA DM common elements used to configure the devices. For more information about OMA DM common elements, see "SyncML Representation Protocol Device Management Usage" (OMA-SyncML-DMRepPro-V1\_1\_2-20030613-A) available from the [OMA website](http://go.microsoft.com/fwlink/p/?LinkId=526900).
+Common elements are used by other OMA DM element types. The following table lists the OMA DM common elements used to configure the devices. For more information about OMA DM common elements, see "SyncML Representation Protocol Device Management Usage" (OMA-SyncML-DMRepPro-V1\_1\_2-20030613-A) available from the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=526900).
@@ -303,13 +303,13 @@ The following table shows the sequence of events during a typical DM session.
-The step numbers in the table do not represent message identification numbers (MsgID). All messages from the server must have a MsgID that is unique within the session, starting at 1 for the first message, and increasing by an increment of 1 for each additional message. For more information about MsgID and OMA SyncML protocol, see "OMA Device Management Representation Protocol" (OMA-TS-DM\_RepPro-V1\_2-20070209-A) available from the [OMA website](http://go.microsoft.com/fwlink/p/?LinkId=526900).
+The step numbers in the table do not represent message identification numbers (MsgID). All messages from the server must have a MsgID that is unique within the session, starting at 1 for the first message, and increasing by an increment of 1 for each additional message. For more information about MsgID and OMA SyncML protocol, see "OMA Device Management Representation Protocol" (OMA-TS-DM\_RepPro-V1\_2-20070209-A) available from the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=526900).
During OMA DM application level mutual authentication, if the device response code to Cred element in the server request is 212, no further authentication is needed for the remainder of the DM session. In the case of the MD5 authentication, the Chal element can be returned. Then the next nonce in Chal must be used for the MD5 digest when the next DM session is started.
If a request includes credentials and the response code to the request is 200, the same credential must be sent within the next request. If the Chal element is included and the MD5 authentication is required, a new digest is created by using the next nonce via the Chal element for next request.
-For more information about Basic or MD5 client authentication, MD5 server authentication, MD5 hash, and MD5 nonce, see the OMA Device Management Security specification (OMA-TS-DM\_Security-V1\_2\_1-20080617-A), authentication response code handling and step-by-step samples in OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](http://go.microsoft.com/fwlink/p/?LinkId=526900).
+For more information about Basic or MD5 client authentication, MD5 server authentication, MD5 hash, and MD5 nonce, see the OMA Device Management Security specification (OMA-TS-DM\_Security-V1\_2\_1-20080617-A), authentication response code handling and step-by-step samples in OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=526900).
## User targeted vs. Device targeted configuration
@@ -348,7 +348,7 @@ The following LocURL shows a per device CSP node configuration: **./device/vendo
## SyncML response status codes
-When using SyncML in OMA DM, there are standard response status codes that are returned. The following table lists the common SyncML response status codes you are likely to see. For more information about SyncML response status codes, see section 10 of the [SyncML Representation Protocol](http://go.microsoft.com/fwlink/p/?LinkId=526905) specification.
+When using SyncML in OMA DM, there are standard response status codes that are returned. The following table lists the common SyncML response status codes you are likely to see. For more information about SyncML response status codes, see section 10 of the [SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905) specification.
| Status code | Description |
|-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md
index 1184e33d18..f636ec9c6d 100644
--- a/windows/client-management/mdm/policy-configuration-service-provider.md
+++ b/windows/client-management/mdm/policy-configuration-service-provider.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 08/17/2018
+ms.date: 08/24/2018
---
# Policy CSP
@@ -3106,6 +3106,9 @@ The following diagram shows the Policy configuration service provider in tree fo
@@ -4839,12 +4854,16 @@ The following diagram shows the Policy configuration service provider in tree fo
- [Storage/AllowDiskHealthModelUpdates](./policy-csp-storage.md#storage-allowdiskhealthmodelupdates)
- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices)
- [System/AllowBuildPreview](./policy-csp-system.md#system-allowbuildpreview)
+- [System/AllowDeviceNameInDiagnosticData](./policy-csp-system.md#system-allowdevicenameindiagnosticdata)
- [System/AllowFontProviders](./policy-csp-system.md#system-allowfontproviders)
- [System/AllowLocation](./policy-csp-system.md#system-allowlocation)
- [System/AllowTelemetry](./policy-csp-system.md#system-allowtelemetry)
- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization)
+- [System/ConfigureMicrosoft365UploadEndpoint](./policy-csp-system.md#system-configuremicrosoft365uploadendpoint)
- [System/ConfigureTelemetryOptInChangeNotification](./policy-csp-system.md#system-configuretelemetryoptinchangenotification)
- [System/ConfigureTelemetryOptInSettingsUx](./policy-csp-system.md#system-configuretelemetryoptinsettingsux)
+- [System/DisableDeviceDelete](./policy-csp-system.md#system-disabledevicedelete)
+- [System/DisableDiagnosticDataViewer](./policy-csp-system.md#system-disablediagnosticdataviewer)
- [System/DisableEnterpriseAuthProxy](./policy-csp-system.md#system-disableenterpriseauthproxy)
- [System/DisableOneDriveFileSync](./policy-csp-system.md#system-disableonedrivefilesync)
- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore)
diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md
index 592beedb9a..f73ed9e092 100644
--- a/windows/client-management/mdm/policy-csp-bluetooth.md
+++ b/windows/client-management/mdm/policy-csp-bluetooth.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 08/08/2018
+ms.date: 08/30/2018
---
# Policy CSP - Bluetooth
@@ -243,7 +243,7 @@ Added in Windows 10, version 1803. This policy allows the IT admin to block user
The following list shows the supported values:
- 0 - Disallow. Block users on these managed devices from using Swift Pair and other proximity based scenarios
-- 1 - Allow. Allow users on these managed devices to use Swift Pair and other proximity based scenarios
+- 1 - Allow (default). Allow users on these managed devices to use Swift Pair and other proximity based scenarios
diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md
index efc80528fb..624f92fed0 100644
--- a/windows/client-management/mdm/policy-csp-browser.md
+++ b/windows/client-management/mdm/policy-csp-browser.md
@@ -2201,7 +2201,7 @@ Supported values:
- If it’s one of many apps, Microsoft Edge runs as normal.
**1**:
-- • If it’s a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can’t minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking “End session.” You can configure Microsoft Edge to restart after a period of inactivity by using the “Configure kiosk reset after idle timeout” policy. _**For single-app public browsing:**_ If you do not configure the Configure kiosk reset after idle timeout policy and you enable this policy, Microsoft Edge kiosk resets after 5 minutes of idle time.
+- If it’s a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can’t minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking “End session.” You can configure Microsoft Edge to restart after a period of inactivity by using the “Configure kiosk reset after idle timeout” policy. _**For single-app public browsing:**_ If you do not configure the Configure kiosk reset after idle timeout policy and you enable this policy, Microsoft Edge kiosk resets after 5 minutes of idle time.
- If it’s one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can’t customize Microsoft Edge.
diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md
index c3369e756d..ab5ac2d009 100644
--- a/windows/client-management/mdm/policy-csp-experience.md
+++ b/windows/client-management/mdm/policy-csp-experience.md
@@ -18,7 +18,7 @@ ms.date: 07/30/2018
-## Experience policies
+## Experience policies
@@ -139,13 +139,13 @@ ms.date: 07/30/2018
Allows history of clipboard items to be stored in memory.
-Value type is integer. Supported values:
+Value type is integer. Supported values:
- 0 - Not allowed
- 1 - Allowed (default)
-ADMX Info:
+ADMX Info:
- GP English name: *Allow Clipboard History*
- GP name: *AllowClipboardHistory*
- GP path: *System/OS Policies*
@@ -159,7 +159,7 @@ ADMX Info:
-**Validation procedure**
+**Validation procedure**
1. Configure Experiences/AllowClipboardHistory to 0.
1. Open Notepad (or any editor app), select a text, and copy it to the clipboard.
@@ -173,7 +173,7 @@ ADMX Info:
-**Experience/AllowCopyPaste**
+**Experience/AllowCopyPaste**
@@ -228,7 +228,7 @@ The following list shows the supported values:
-**Experience/AllowCortana**
+**Experience/AllowCortana**
@@ -269,7 +269,7 @@ Most restricted value is 0.
-ADMX Info:
+ADMX Info:
- GP English name: *Allow Cortana*
- GP name: *AllowCortana*
- GP path: *Windows Components/Search*
@@ -288,7 +288,7 @@ The following list shows the supported values:
-**Experience/AllowDeviceDiscovery**
+**Experience/AllowDeviceDiscovery**
@@ -342,7 +342,7 @@ The following list shows the supported values:
-**Experience/AllowFindMyDevice**
+**Experience/AllowFindMyDevice**
@@ -385,7 +385,7 @@ When Find My Device is off, the device and its location are not registered and t
-ADMX Info:
+ADMX Info:
- GP English name: *Turn On/Off Find My Device*
- GP name: *FindMy_AllowFindMyDeviceConfig*
- GP path: *Windows Components/Find My Device*
@@ -404,7 +404,7 @@ The following list shows the supported values:
-**Experience/AllowManualMDMUnenrollment**
+**Experience/AllowManualMDMUnenrollment**
@@ -460,7 +460,7 @@ The following list shows the supported values:
-**Experience/AllowSIMErrorDialogPromptWhenNoSIM**
+**Experience/AllowSIMErrorDialogPromptWhenNoSIM**
@@ -514,7 +514,7 @@ The following list shows the supported values:
-**Experience/AllowSaveAsOfOfficeFiles**
+**Experience/AllowSaveAsOfOfficeFiles**
[Scope](./policy-configuration-service-provider.md#policy-scope):
@@ -534,7 +534,7 @@ This policy is deprecated.
-**Experience/AllowScreenCapture**
+**Experience/AllowScreenCapture**
@@ -590,7 +590,7 @@ The following list shows the supported values:
-**Experience/AllowSharingOfOfficeFiles**
+**Experience/AllowSharingOfOfficeFiles**
[Scope](./policy-configuration-service-provider.md#policy-scope):
@@ -610,7 +610,7 @@ This policy is deprecated.
-**Experience/AllowSyncMySettings**
+**Experience/AllowSyncMySettings**
@@ -645,7 +645,7 @@ This policy is deprecated.
-Allows or disallows all Windows sync settings on the device. For information about what settings are sync'ed, see [About sync setting on Windows 10 devices](http://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices).
+Allows or disallows all Windows sync settings on the device. For information about what settings are sync'ed, see [About sync setting on Windows 10 devices](https://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices).
@@ -660,7 +660,7 @@ The following list shows the supported values:
-**Experience/AllowTailoredExperiencesWithDiagnosticData**
+**Experience/AllowTailoredExperiencesWithDiagnosticData**
@@ -708,7 +708,7 @@ Most restricted value is 0.
-ADMX Info:
+ADMX Info:
- GP English name: *Do not use diagnostic data for tailored experiences*
- GP name: *DisableTailoredExperiencesWithDiagnosticData*
- GP path: *Windows Components/Cloud Content*
@@ -727,7 +727,7 @@ The following list shows the supported values:
-**Experience/AllowTaskSwitcher**
+**Experience/AllowTaskSwitcher**
@@ -781,7 +781,7 @@ The following list shows the supported values:
-**Experience/AllowThirdPartySuggestionsInWindowsSpotlight**
+**Experience/AllowThirdPartySuggestionsInWindowsSpotlight**
@@ -824,7 +824,7 @@ Specifies whether to allow app and content suggestions from third-party software
-ADMX Info:
+ADMX Info:
- GP English name: *Do not suggest third-party content in Windows spotlight*
- GP name: *DisableThirdPartySuggestions*
- GP path: *Windows Components/Cloud Content*
@@ -843,7 +843,7 @@ The following list shows the supported values:
-**Experience/AllowVoiceRecording**
+**Experience/AllowVoiceRecording**
@@ -899,7 +899,7 @@ The following list shows the supported values:
-**Experience/AllowWindowsConsumerFeatures**
+**Experience/AllowWindowsConsumerFeatures**
@@ -944,7 +944,7 @@ Most restricted value is 0.
-ADMX Info:
+ADMX Info:
- GP English name: *Turn off Microsoft consumer experiences*
- GP name: *DisableWindowsConsumerFeatures*
- GP path: *Windows Components/Cloud Content*
@@ -963,7 +963,7 @@ The following list shows the supported values:
-**Experience/AllowWindowsSpotlight**
+**Experience/AllowWindowsSpotlight**
@@ -1008,7 +1008,7 @@ Most restricted value is 0.
-ADMX Info:
+ADMX Info:
- GP English name: *Turn off all Windows spotlight features*
- GP name: *DisableWindowsSpotlightFeatures*
- GP path: *Windows Components/Cloud Content*
@@ -1027,7 +1027,7 @@ The following list shows the supported values:
-**Experience/AllowWindowsSpotlightOnActionCenter**
+**Experience/AllowWindowsSpotlightOnActionCenter**
@@ -1071,7 +1071,7 @@ Most restricted value is 0.
-ADMX Info:
+ADMX Info:
- GP English name: *Turn off Windows Spotlight on Action Center*
- GP name: *DisableWindowsSpotlightOnActionCenter*
- GP path: *Windows Components/Cloud Content*
@@ -1090,7 +1090,7 @@ The following list shows the supported values:
-**Experience/AllowWindowsSpotlightOnSettings**
+**Experience/AllowWindowsSpotlightOnSettings**
@@ -1125,7 +1125,7 @@ The following list shows the supported values:
-Added in Windows 10, version 1803. This policy allows IT admins to turn off Suggestions in Settings app. These suggestions from Microsoft may show after each OS clean install, upgrade or an on-going basis to help users discover apps/features on Windows or across devices, to make thier experience productive.
+Added in Windows 10, version 1803. This policy allows IT admins to turn off Suggestions in Settings app. These suggestions from Microsoft may show after each OS clean install, upgrade or an on-going basis to help users discover apps/features on Windows or across devices, to make thier experience productive.
- User setting is under Settings -> Privacy -> General -> Show me suggested content in Settings app.
- User Setting is changeable on a per user basis.
@@ -1133,7 +1133,7 @@ Added in Windows 10, version 1803. This policy allows IT admins to turn off Sugg
-ADMX Info:
+ADMX Info:
- GP English name: *Turn off Windows Spotlight on Settings*
- GP name: *DisableWindowsSpotlightOnSettings*
- GP path: *Windows Components/Cloud Content*
@@ -1152,7 +1152,7 @@ The following list shows the supported values:
-**Experience/AllowWindowsSpotlightWindowsWelcomeExperience**
+**Experience/AllowWindowsSpotlightWindowsWelcomeExperience**
@@ -1190,14 +1190,14 @@ The following list shows the supported values:
> [!NOTE]
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
-Added in Windows 10, version 1703. This policy setting lets you turn off the Windows spotlight Windows welcome experience feature.
+Added in Windows 10, version 1703. This policy setting lets you turn off the Windows spotlight Windows welcome experience feature.
The Windows welcome experience feature introduces onboard users to Windows; for example, launching Microsoft Edge with a webpage that highlights new features. If you enable this policy, the Windows welcome experience will no longer be displayed when there are updates and changes to Windows and its apps. If you disable or do not configure this policy, the Windows welcome experience will be launched to inform onboard users about what's new, changed, and suggested.
Most restricted value is 0.
-ADMX Info:
+ADMX Info:
- GP English name: *Turn off the Windows Welcome Experience*
- GP name: *DisableWindowsSpotlightWindowsWelcomeExperience*
- GP path: *Windows Components/Cloud Content*
@@ -1216,7 +1216,7 @@ The following list shows the supported values:
-**Experience/AllowWindowsTips**
+**Experience/AllowWindowsTips**
@@ -1255,7 +1255,7 @@ Enables or disables Windows Tips / soft landing.
-ADMX Info:
+ADMX Info:
- GP English name: *Do not show Windows tips*
- GP name: *DisableSoftLanding*
- GP path: *Windows Components/Cloud Content*
@@ -1274,7 +1274,7 @@ The following list shows the supported values:
-**Experience/ConfigureWindowsSpotlightOnLockScreen**
+**Experience/ConfigureWindowsSpotlightOnLockScreen**
@@ -1317,7 +1317,7 @@ Allows IT admins to specify whether spotlight should be used on the user's lock
-ADMX Info:
+ADMX Info:
- GP English name: *Configure Windows spotlight on lock screen*
- GP name: *ConfigureWindowsSpotlight*
- GP path: *Windows Components/Cloud Content*
@@ -1337,7 +1337,7 @@ The following list shows the supported values:
-**Experience/DoNotShowFeedbackNotifications**
+**Experience/DoNotShowFeedbackNotifications**
@@ -1380,7 +1380,7 @@ If you disable or do not configure this policy setting, users can control how of
-ADMX Info:
+ADMX Info:
- GP English name: *Do not show feedback notifications*
- GP name: *DoNotShowFeedbackNotifications*
- GP path: *Data Collection and Preview Builds*
@@ -1399,7 +1399,7 @@ The following list shows the supported values:
-**Experience/DoNotSyncBrowserSettings**
+**Experience/DoNotSyncBrowserSettings**
@@ -1436,12 +1436,12 @@ The following list shows the supported values:
[!INCLUDE [do-not-sync-browser-settings-shortdesc](../../../browsers/edge/shortdesc/do-not-sync-browser-settings-shortdesc.md)]
-Related policy:
+Related policy:
[PreventUsersFromTurningOnBrowserSyncing](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#experience-preventusersfromturningonbrowsersyncing)
-ADMX Info:
+ADMX Info:
- GP English name: *Do not sync browser settings*
- GP name: *DisableWebBrowserSettingSync*
- GP path: *Windows Components/Sync your settings*
@@ -1449,17 +1449,17 @@ ADMX Info:
-Supported values:
+Supported values:
- 0 (default) - Allowed/turned on. The "browser" group syncs automatically between user’s devices and lets users to make changes.
- 2 - Prevented/turned off. The "browser" group does not use the _Sync your Settings_ option.
-_**Sync the browser settings automatically**_
+_**Sync the browser settings automatically**_
Set both **DoNotSyncBrowserSettings** and **PreventUsersFromTurningOnBrowserSyncing** to 0 (Allowed/turned on).
-_**Prevent syncing of browser settings and prevent users from turning it on**_
+_**Prevent syncing of browser settings and prevent users from turning it on**_
1. Set **DoNotSyncBrowserSettings** to 2 (Prevented/turned off).
2. Set **PreventUsersFromTurningOnBrowserSyncing** to 1 (Prevented/turned off).
@@ -1485,7 +1485,7 @@ _**Turn syncing off by default but don’t disable**_
-**Experience/PreventUsersFromTurningOnBrowserSyncing**
+**Experience/PreventUsersFromTurningOnBrowserSyncing**
@@ -1522,13 +1522,13 @@ _**Turn syncing off by default but don’t disable**_
[!INCLUDE [prevent-users-to-turn-on-browser-syncing-shortdesc](../../../browsers/edge/shortdesc/prevent-users-to-turn-on-browser-syncing-shortdesc.md)]
-Related policy:
+Related policy:
[DoNotSyncBrowserSettings](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#experience-donotsyncbrowsersetting)
-ADMX Info:
+ADMX Info:
- GP English name: *Prevent users from turning on browser syncing*
- GP name: *PreventUsersFromTurningOnBrowserSyncing*
- GP path: *Windows Components/Sync your settings*
@@ -1536,17 +1536,17 @@ ADMX Info:
-Supported values:
+Supported values:
- 0 - Allowed/turned on. Users can sync the browser settings.
- 1 (default) - Prevented/turned off.
-_**Sync the browser settings automatically**_
+_**Sync the browser settings automatically**_
Set both **DoNotSyncBrowserSettings** and **PreventUsersFromTurningOnBrowserSyncing** to 0 (Allowed/turned on).
-_**Prevent syncing of browser settings and prevent users from turning it on**_
+_**Prevent syncing of browser settings and prevent users from turning it on**_
1. Set **DoNotSyncBrowserSettings** to 2 (Prevented/turned off).
2. Set **PreventUsersFromTurningOnBrowserSyncing** to 1 (Prevented/turned off).
@@ -1561,7 +1561,7 @@ _**Prevent syncing of browser settings and let users turn on syncing**_
-Validation procedure:
+Validation procedure:
1. Select **More > Settings**.
1. See if the setting is enabled or disabled based on your selection.
diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md
index 1d41637f5b..e2bc67b21b 100644
--- a/windows/client-management/mdm/policy-csp-restrictedgroups.md
+++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md
@@ -114,8 +114,8 @@ Here is an example:
```
-
-
+
+
```
diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md
index a88b2464f6..5886443c5d 100644
--- a/windows/client-management/mdm/policy-csp-settings.md
+++ b/windows/client-management/mdm/policy-csp-settings.md
@@ -793,7 +793,7 @@ The following list shows the supported values:
-Added in Windows 10, version 1703. Allows IT Admins to either prevent specific pages in the System Settings app from being visible or accessible, or to do so for all pages except those specified. The mode will be specified by the policy string beginning with either the string "showonly:" or "hide:". Pages are identified by a shortened version of their already published URIs, which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:foo", the page identifier used in the policy will be just "foo". Multiple page identifiers are separated by semicolons.
+Added in Windows 10, version 1703. Allows IT Admins to either prevent specific pages in the System Settings app from being visible or accessible, or to do so for all pages except those specified. The mode will be specified by the policy string beginning with either the string "showonly:" or "hide:". Pages are identified by a shortened version of their already published URIs, which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:bluetooth", the page identifier used in the policy will be just "bluetooth". Multiple page identifiers are separated by semicolons.
The following example illustrates a policy that would allow access only to the about and bluetooth pages, which have URI "ms-settings:about" and "ms-settings:bluetooth" respectively:
@@ -807,17 +807,17 @@ The format of the PageVisibilityList value is as follows:
- There are two variants: one that shows only the given pages and one which hides the given pages.
- The first variant starts with the string "showonly:" and the second with the string "hide:".
- Following the variant identifier is a semicolon-delimited list of page identifiers, which must not have any extra whitespace.
-- Each page identifier is the ms-settings:xyz URI for the page, minus the ms-settings: prefix, so the identifier for the page with URI "ms-settings:wi-fi" would be just "wi-fi".
+- Each page identifier is the ms-settings:xyz URI for the page, minus the ms-settings: prefix, so the identifier for the page with URI "ms-settings:network-wifi" would be just "network-wifi".
The default value for this setting is an empty string, which is interpreted as show everything.
-Example 1, specifies that only the wifi and bluetooth pages should be shown (they have URIs ms-settings:wi-fi and ms-settings:bluetooth). All other pages (and the categories they're in) will be hidden:
+Example 1, specifies that only the wifi and bluetooth pages should be shown (they have URIs ms-settings:network-wifi and ms-settings:bluetooth). All other pages (and the categories they're in) will be hidden:
-showonly:wi-fi;bluetooth
+showonly:network-wifi;bluetooth
Example 2, specifies that the wifi page should not be shown:
-hide:wifi
+hide:network-wifi
diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md
index 45727b2535..9284052651 100644
--- a/windows/client-management/mdm/policy-csp-storage.md
+++ b/windows/client-management/mdm/policy-csp-storage.md
@@ -1,164 +1,235 @@
----
-title: Policy CSP - Storage
-description: Policy CSP - Storage
-ms.author: maricia
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-author: MariciaAlforque
-ms.date: 03/12/2018
----
-
-# Policy CSP - Storage
-
-
-
-
-
-
-## Storage policies
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Added in Windows 10, version 1709. Allows disk health model updates.
-
-
-
-Value type is integer.
-
-
-
-ADMX Info:
-- GP English name: *Allow downloading updates to the Disk Failure Prediction Model*
-- GP name: *SH_AllowDiskHealthModelUpdates*
-- GP path: *System/Storage Health*
-- GP ADMX file name: *StorageHealth.admx*
-
-
-
-The following list shows the supported values:
-
-- 0 - Do not allow
-- 1 (default) - Allow
-
-
-
-
-
-
-
-**Storage/EnhancedStorageDevices**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-This policy setting configures whether or not Windows will activate an Enhanced Storage device.
-
-If you enable this policy setting, Windows will not activate unactivated Enhanced Storage devices.
-
-If you disable or do not configure this policy setting, Windows will activate unactivated Enhanced Storage devices.
-
-
-> [!TIP]
-> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
-
-> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
-
-> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
-
-ADMX Info:
-- GP English name: *Do not allow Windows to activate Enhanced Storage devices*
-- GP name: *TCGSecurityActivationDisabled*
-- GP path: *System/Enhanced Storage Access*
-- GP ADMX file name: *enhancedstorage.admx*
-
-
-
-
-
-Footnote:
-
-- 1 - Added in Windows 10, version 1607.
-- 2 - Added in Windows 10, version 1703.
-- 3 - Added in Windows 10, version 1709.
-- 4 - Added in Windows 10, version 1803.
-
-
-
+---
+title: Policy CSP - Storage
+description: Policy CSP - Storage
+ms.author: maricia
+ms.topic: article
+ms.prod: w10
+ms.technology: windows
+author: MariciaAlforque
+ms.date: 08/27/2018
+---
+
+# Policy CSP - Storage
+
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
+
+
+
+
+## Storage policies
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, version 1709. Allows disk health model updates.
+
+
+
+Value type is integer.
+
+
+
+ADMX Info:
+- GP English name: *Allow downloading updates to the Disk Failure Prediction Model*
+- GP name: *SH_AllowDiskHealthModelUpdates*
+- GP path: *System/Storage Health*
+- GP ADMX file name: *StorageHealth.admx*
+
+
+
+The following list shows the supported values:
+
+- 0 - Do not allow
+- 1 (default) - Allow
+
+
+
+
+
+
+
+**Storage/EnhancedStorageDevices**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy setting configures whether or not Windows will activate an Enhanced Storage device.
+
+If you enable this policy setting, Windows will not activate unactivated Enhanced Storage devices.
+
+If you disable or do not configure this policy setting, Windows will activate unactivated Enhanced Storage devices.
+
+
+> [!TIP]
+> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
+
+> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
+
+> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
+
+
+ADMX Info:
+- GP English name: *Do not allow Windows to activate Enhanced Storage devices*
+- GP name: *TCGSecurityActivationDisabled*
+- GP path: *System/Enhanced Storage Access*
+- GP ADMX file name: *enhancedstorage.admx*
+
+
+
+
+
+
+
+**Storage/RemovableDiskDenyWriteAccess**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
5
+
5
+
5
+
5
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+If you enable this policy setting, write access is denied to this removable storage class. If you disable or do not configure this policy setting, write access is allowed to this removable storage class. Note: To require that users write data to BitLocker-protected storage, enable the policy setting "Deny write access to drives not protected by BitLocker," which is located in "Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives."
+
+Supported values:
+- 0 - Disable
+- 1 - Enable
+
+
+
+ADMX Info:
+- GP English name: *Removable Disks: Deny write access*
+- GP name: *RemovableDisks_DenyWrite_Access_2*
+- GP element: *RemovableDisks_DenyWrite_Access_2*
+- GP path: *System/Removable Storage Access*
+- GP ADMX file name: *RemovableStorage.admx*
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Footnote:
+
+- 1 - Added in Windows 10, version 1607.
+- 2 - Added in Windows 10, version 1703.
+- 3 - Added in Windows 10, version 1709.
+- 4 - Added in Windows 10, version 1803.
+- 5 - Added in the next major release of Windows 10.
+
+
+
diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md
index 63649af40c..77421bcad4 100644
--- a/windows/client-management/mdm/policy-csp-system.md
+++ b/windows/client-management/mdm/policy-csp-system.md
@@ -1,1198 +1,1443 @@
----
-title: Policy CSP - System
-description: Policy CSP - System
-ms.author: maricia
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-author: MariciaAlforque
-ms.date: 07/30/2018
----
-
-# Policy CSP - System
-
-> [!WARNING]
-> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-
-
-
-
-
-## System policies
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy setting applies only to devices running Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education, Windows 10 Mobile, and Windows 10 Mobile Enterprise.
-
-
-This policy setting determines whether users can access the Insider build controls in the Advanced Options for Windows Update. These controls are located under "Get Insider builds," and enable users to make their devices available for downloading and installing Windows preview software.
-
-If you enable or do not configure this policy setting, users can download and install Windows preview software on their devices. If you disable this policy setting, the item "Get Insider builds" will be unavailable.
-
-
-
-ADMX Info:
-- GP English name: *Toggle user control over Insider builds*
-- GP name: *AllowBuildPreview*
-- GP path: *Data Collection and Preview Builds*
-- GP ADMX file name: *AllowBuildPreview.admx*
-
-
-
-The following list shows the supported values:
-
-- 0 – Not allowed. The item "Get Insider builds" is unavailable, users are unable to make their devices available for preview software.
-- 1 – Allowed. Users can make their devices available for downloading and installing preview software.
-- 2 (default) – Not configured. Users can make their devices available for downloading and installing preview software.
-
-
-
-
-
-
-
-**System/AllowEmbeddedMode**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Specifies whether set general purpose device to be in embedded mode.
-
-Most restricted value is 0.
-
-
-
-The following list shows the supported values:
-
-- 0 (default) – Not allowed.
-- 1 – Allowed.
-
-
-
-
-
-
-
-**System/AllowExperimentation**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-> [!NOTE]
-> This policy is not supported in Windows 10, version 1607.
-
-This policy setting determines the level that Microsoft can experiment with the product to study user preferences or device behavior.
-
-
-Most restricted value is 0.
-
-
-
-The following list shows the supported values:
-
-- 0 – Disabled.
-- 1 (default) – Permits Microsoft to configure device settings only.
-- 2 – Allows Microsoft to conduct full experimentations.
-
-
-
-
-
-
-
-**System/AllowFontProviders**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
2
-
2
-
2
-
2
-
2
-
2
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Added in Windows 10, version 1703. Boolean policy setting that determines whether Windows is allowed to download fonts and font catalog data from an online font provider. If you enable this setting, Windows periodically queries an online font provider to determine whether a new font catalog is available. Windows may also download font data if needed to format or render text. If you disable this policy setting, Windows does not connect to an online font provider and only enumerates locally-installed fonts.
-
-This MDM setting corresponds to the EnableFontProviders Group Policy setting. If both the Group Policy and the MDM settings are configured, the group policy setting takes precedence. If neither is configured, the behavior depends on a DisableFontProviders registry value. In server editions, this registry value is set to 1 by default, so the default behavior is false (disabled). In all other editions, the registry value is not set by default, so the default behavior is true (enabled).
-
-This setting is used by lower-level components for text display and fond handling and has not direct effect on web browsers, which may download web fonts used in web content.
-
-> [!Note]
-> Reboot is required after setting the policy; alternatively you can stop and restart the FontCache service.
-
-
-
-ADMX Info:
-- GP English name: *Enable Font Providers*
-- GP name: *EnableFontProviders*
-- GP path: *Network/Fonts*
-- GP ADMX file name: *GroupPolicy.admx*
-
-
-
-The following list shows the supported values:
-
-- 0 - false - No traffic to fs.microsoft.com and only locally-installed fonts are available.
-- 1 - true (default) - There may be network traffic to fs.microsoft.com and downloadable fonts are available to apps that support them.
-
-
-
-To verify if System/AllowFontProviders is set to true:
-
-- After a client machine is rebooted, check whether there is any network traffic from client machine to fs.microsoft.com.
-
-
-
-
-
-
-
-**System/AllowLocation**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Specifies whether to allow app access to the Location service.
-
-
-Most restricted value is 0.
-
-While the policy is set to 0 (Force Location Off) or 2 (Force Location On), any Location service call from an app would trigger the value set by this policy.
-
-When switching the policy back from 0 (Force Location Off) or 2 (Force Location On) to 1 (User Control), the app reverts to its original Location service setting.
-
-For example, an app's original Location setting is Off. The administrator then sets the **AllowLocation** policy to 2 (Force Location On.) The Location service starts working for that app, overriding the original setting. Later, if the administrator switches the **AllowLocation** policy back to 1 (User Control), the app will revert to using its original setting of Off.
-
-
-
-ADMX Info:
-- GP English name: *Turn off location*
-- GP name: *DisableLocation_2*
-- GP path: *Windows Components/Location and Sensors*
-- GP ADMX file name: *Sensors.admx*
-
-
-
-The following list shows the supported values:
-
-- 0 – Force Location Off. All Location Privacy settings are toggled off and greyed out. Users cannot change the settings, and no apps are allowed access to the Location service, including Cortana and Search.
-- 1 (default) – Location service is allowed. The user has control and can change Location Privacy settings on or off.
-- 2 – Force Location On. All Location Privacy settings are toggled on and greyed out. Users cannot change the settings and all consent permissions will be automatically suppressed.
-
-
-
-
-
-
-
-**System/AllowStorageCard**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Controls whether the user is allowed to use the storage card for device storage. This setting prevents programmatic access to the storage card.
-
-Most restricted value is 0.
-
-
-
-The following list shows the supported values:
-
-- 0 – SD card use is not allowed and USB drives are disabled. This setting does not prevent programmatic access to the storage card.
-- 1 (default) – Allow a storage card.
-
-
-
-
-
-
-
-**System/AllowTelemetry**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * User
-> * Device
-
-
-
-
-
-Allow the device to send diagnostic and usage telemetry data, such as Watson.
-
-The following tables describe the supported values:
-
-Windows 8.1 Values:
-
-- 0 - Not allowed.
-- 1 – Allowed, except for Secondary Data Requests.
-- 2 (default) – Allowed.
-
-
-
-Windows 10 Values:
-
-- 0 – Security. Information that is required to help keep Windows more secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
- Note: This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016. Using this setting on other devices is equivalent to setting the value of 1.
-- 1 – Basic. Basic device info, including: quality-related data, app compatibility, app usage data, and data from the Security level.
-- 2 – Enhanced. Additional insights, including: how Windows, Windows Server, System Center, and apps are used, how they perform, advanced reliability data, and data from both the Basic and the Security levels.
-- 3 – Full. All data necessary to identify and help to fix problems, plus data from the Security, Basic, and Enhanced levels.
-
-
-
-
-> [!IMPORTANT]
-> If you are using Windows 8.1 MDM server and set a value of 0 using the legacy AllowTelemetry policy on a Windows 10 Mobile device, then the value is not respected and the telemetry level is silently set to level 1.
-
-
-Most restricted value is 0.
-
-
-
-ADMX Info:
-- GP English name: *Allow Telemetry*
-- GP name: *AllowTelemetry*
-- GP element: *AllowTelemetry*
-- GP path: *Data Collection and Preview Builds*
-- GP ADMX file name: *DataCollection.admx*
-
-
-
-
-
-
-
-**System/AllowUserToResetPhone**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Specifies whether to allow the user to factory reset the phone by using control panel and hardware key combination.
-
-Most restricted value is 0.
-
-
-
-The following list shows the supported values:
-orted values:
-
-- 0 – Not allowed.
-- 1 (default) – Allowed to reset to factory default settings.
-
-
-
-
-
-
-
-**System/BootStartDriverInitialization**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-This policy setting allows you to specify which boot-start drivers are initialized based on a classification determined by an Early Launch Antimalware boot-start driver. The Early Launch Antimalware boot-start driver can return the following classifications for each boot-start driver:
-- Good: The driver has been signed and has not been tampered with.
-- Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized.
-- Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver.
-- Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot-start driver.
-
-If you enable this policy setting you will be able to choose which boot-start drivers to initialize the next time the computer is started.
-
-If you disable or do not configure this policy setting, the boot start drivers determined to be Good, Unknown or Bad but Boot Critical are initialized and the initialization of drivers determined to be Bad is skipped.
-
-If your malware detection application does not include an Early Launch Antimalware boot-start driver or if your Early Launch Antimalware boot-start driver has been disabled, this setting has no effect and all boot-start drivers are initialized.
-
-
-> [!TIP]
-> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
-
-> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
-
-> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
-
-ADMX Info:
-- GP English name: *Boot-Start Driver Initialization Policy*
-- GP name: *POL_DriverLoadPolicy_Name*
-- GP path: *System/Early Launch Antimalware*
-- GP ADMX file name: *earlylauncham.admx*
-
-
-
-
-
-
-
-**System/ConfigureTelemetryOptInChangeNotification**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
4
-
4
-
4
-
4
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-This policy setting determines whether a device shows notifications about telemetry levels to people on first logon or when changes occur in Settings.
-If you set this policy setting to "Disable telemetry change notifications", telemetry level notifications stop appearing.
-If you set this policy setting to "Enable telemetry change notifications" or don't configure this policy setting, telemetry notifications appear at first logon and when changes occur in Settings.
-
-
-
-ADMX Info:
-- GP English name: *Configure telemetry opt-in change notifications.*
-- GP name: *ConfigureTelemetryOptInChangeNotification*
-- GP element: *ConfigureTelemetryOptInChangeNotification*
-- GP path: *Data Collection and Preview Builds*
-- GP ADMX file name: *DataCollection.admx*
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-**System/ConfigureTelemetryOptInSettingsUx**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
4
-
4
-
4
-
4
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-This policy setting determines whether people can change their own telemetry levels in Settings. This setting should be used in conjunction with the Allow Telemetry settings.
-
-If you set this policy setting to "Disable Telemetry opt-in Settings", telemetry levels are disabled in Settings, preventing people from changing them.
-
-If you set this policy setting to "Enable Telemetry opt-in Setings" or don't configure this policy setting, people can change their own telemetry levels in Settings.
-
-Note:
-Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit.
-
-
-
-ADMX Info:
-- GP English name: *Configure telemetry opt-in setting user interface.*
-- GP name: *ConfigureTelemetryOptInSettingsUx*
-- GP element: *ConfigureTelemetryOptInSettingsUx*
-- GP path: *Data Collection and Preview Builds*
-- GP ADMX file name: *DataCollection.admx*
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-**System/DisableEnterpriseAuthProxy**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
3
-
3
-
3
-
3
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy.
-
-
-
-ADMX Info:
-- GP English name: *Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service*
-- GP name: *DisableEnterpriseAuthProxy*
-- GP element: *DisableEnterpriseAuthProxy*
-- GP path: *Data Collection and Preview Builds*
-- GP ADMX file name: *DataCollection.admx*
-
-
-
-
-
-
-
-**System/DisableOneDriveFileSync**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
2
-
2
-
2
-
2
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Added in Windows 10, version 1703. Allows IT Admins to prevent apps and features from working with files on OneDrive. If you enable this policy setting:
-
-* Users cannot access OneDrive from the OneDrive app or file picker.
-* Microsoft Store apps cannot access OneDrive using the WinRT API.
-* OneDrive does not appear in the navigation pane in File Explorer.
-* OneDrive files are not kept in sync with the cloud.
-* Users cannot automatically upload photos and videos from the camera roll folder.
-
-If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage.
-
-
-
-ADMX Info:
-- GP English name: *Prevent the usage of OneDrive for file storage*
-- GP name: *PreventOnedriveFileSync*
-- GP path: *Windows Components/OneDrive*
-- GP ADMX file name: *SkyDrive.admx*
-
-
-
-The following list shows the supported values:
-
-- 0 (default) – False (sync enabled).
-- 1 – True (sync disabled).
-
-
-
-To validate on Desktop, do the following:
-
-1. Enable policy.
-2. Restart machine.
-3. Verify that OneDrive.exe is not running in Task Manager.
-
-
-
-
-
-
-
-**System/DisableSystemRestore**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Allows you to disable System Restore.
-
-This policy setting allows you to turn off System Restore.
-
-System Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files. By default, System Restore is turned on for the boot volume.
-
-If you enable this policy setting, System Restore is turned off, and the System Restore Wizard cannot be accessed. The option to configure System Restore or create a restore point through System Protection is also disabled.
-
-If you disable or do not configure this policy setting, users can perform System Restore and configure System Restore settings through System Protection.
-
-Also, see the "Turn off System Restore configuration" policy setting. If the "Turn off System Restore" policy setting is disabled or not configured, the "Turn off System Restore configuration" policy setting is used to determine whether the option to configure System Restore is available.
-
-
-> [!TIP]
-> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
-
-> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
-
-> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
-
-
-ADMX Info:
-- GP English name: *Turn off System Restore*
-- GP name: *SR_DisableSR*
-- GP path: *System/System Restore*
-- GP ADMX file name: *systemrestore.admx*
-
-
-
-
-
-
-
-**System/FeedbackHubAlwaysSaveDiagnosticsLocally**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
4
-
4
-
4
-
4
-
4
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Added in Windows 10, version 1803. When filing feedback in the Feedback Hub, diagnostic logs are collected for certain types of feedback. We now offer the option for users to save it locally, in addition to sending it to Microsoft. This policy will allow enterprises to mandate that all diagnostics are saved locally for use in internal investigations.
-
-
-
-The following list shows the supported values:
-
-- 0 (default) - False. The Feedback Hub will not always save a local copy of diagnostics that may be created when a feedback is submitted. The user will have the option to do so.
-- 1 - True. The Feedback Hub should always save a local copy of diagnostics that may be created when a feedback is submitted.
-
-
-
-
-
-
-
-**System/LimitEnhancedDiagnosticDataWindowsAnalytics**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
3
-
3
-
3
-
3
-
3
-
3
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-This policy setting, in combination with the System/AllowTelemetry
- policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services.
-
-To enable this behavior you must complete two steps:
-
-
Enable this policy setting
-
Set Allow Telemetry to level 2 (Enhanced)
-
-
-When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented here: [Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics](https://go.microsoft.com/fwlink/?linkid=847594).
-
-Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level telemetry data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft.
-
-If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy.
-
-
-
-ADMX Info:
-- GP English name: *Limit Enhanced diagnostic data to the minimum required by Windows Analytics*
-- GP name: *LimitEnhancedDiagnosticDataWindowsAnalytics*
-- GP element: *LimitEnhancedDiagnosticDataWindowsAnalytics*
-- GP path: *Data Collection and Preview Builds*
-- GP ADMX file name: *DataCollection.admx*
-
-
-
-
-
-
-
-**System/TelemetryProxy**
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
Mobile Enterprise
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Allows you to specify the fully qualified domain name (FQDN) or IP address of a proxy server to forward Connected User Experiences and Telemetry requests. The format for this setting is *<server>:<port>*. The connection is made over a Secure Sockets Layer (SSL) connection. If the named proxy fails, or if there is no proxy specified when this policy is enabled, the Connected User Experiences and Telemetry data will not be transmitted and will remain on the local device.
-
-If you disable or do not configure this policy setting, Connected User Experiences and Telemetry will go to Microsoft using the default proxy configuration.
-
-
-
-ADMX Info:
-- GP English name: *Configure Connected User Experiences and Telemetry*
-- GP name: *TelemetryProxy*
-- GP element: *TelemetryProxyName*
-- GP path: *Data Collection and Preview Builds*
-- GP ADMX file name: *DataCollection.admx*
-
-
-
-
-
-Footnote:
-
-- 1 - Added in Windows 10, version 1607.
-- 2 - Added in Windows 10, version 1703.
-- 3 - Added in Windows 10, version 1709.
-- 4 - Added in Windows 10, version 1803.
-- 5 - Added in the next major release of Windows 10.
-
-
-
-
-
+---
+title: Policy CSP - System
+description: Policy CSP - System
+ms.author: maricia
+ms.topic: article
+ms.prod: w10
+ms.technology: windows
+author: MariciaAlforque
+ms.date: 08/24/2018
+---
+
+# Policy CSP - System
+
+> [!WARNING]
+> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
+
+
+
+
+
+## System policies
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+> [!NOTE]
+> This policy setting applies only to devices running Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education, Windows 10 Mobile, and Windows 10 Mobile Enterprise.
+
+
+This policy setting determines whether users can access the Insider build controls in the Advanced Options for Windows Update. These controls are located under "Get Insider builds," and enable users to make their devices available for downloading and installing Windows preview software.
+
+If you enable or do not configure this policy setting, users can download and install Windows preview software on their devices. If you disable this policy setting, the item "Get Insider builds" will be unavailable.
+
+
+
+ADMX Info:
+- GP English name: *Toggle user control over Insider builds*
+- GP name: *AllowBuildPreview*
+- GP path: *Data Collection and Preview Builds*
+- GP ADMX file name: *AllowBuildPreview.admx*
+
+
+
+The following list shows the supported values:
+
+- 0 – Not allowed. The item "Get Insider builds" is unavailable, users are unable to make their devices available for preview software.
+- 1 – Allowed. Users can make their devices available for downloading and installing preview software.
+- 2 (default) – Not configured. Users can make their devices available for downloading and installing preview software.
+
+
+
+
+
+
+
+**System/AllowDeviceNameInDiagnosticData**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
5
+
5
+
5
+
5
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy allows the device name to be sent to Microsoft as part of Windows diagnostic data. If you disable or do not configure this policy setting, then device name will not be sent to Microsoft as part of Windows diagnostic data.
+
+
+
+ADMX Info:
+- GP English name: *Allow device name to be sent in Windows diagnostic data*
+- GP name: *AllowDeviceNameInDiagnosticData*
+- GP element: *AllowDeviceNameInDiagnosticData*
+- GP path: *Data Collection and Preview Builds*
+- GP ADMX file name: *DataCollection.admx*
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+**System/AllowEmbeddedMode**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Specifies whether set general purpose device to be in embedded mode.
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
+
+- 0 (default) – Not allowed.
+- 1 – Allowed.
+
+
+
+
+
+
+
+**System/AllowExperimentation**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+> [!NOTE]
+> This policy is not supported in Windows 10, version 1607.
+
+This policy setting determines the level that Microsoft can experiment with the product to study user preferences or device behavior.
+
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
+
+- 0 – Disabled.
+- 1 (default) – Permits Microsoft to configure device settings only.
+- 2 – Allows Microsoft to conduct full experimentations.
+
+
+
+
+
+
+
+**System/AllowFontProviders**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
2
+
2
+
2
+
2
+
2
+
2
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, version 1703. Boolean policy setting that determines whether Windows is allowed to download fonts and font catalog data from an online font provider. If you enable this setting, Windows periodically queries an online font provider to determine whether a new font catalog is available. Windows may also download font data if needed to format or render text. If you disable this policy setting, Windows does not connect to an online font provider and only enumerates locally-installed fonts.
+
+This MDM setting corresponds to the EnableFontProviders Group Policy setting. If both the Group Policy and the MDM settings are configured, the group policy setting takes precedence. If neither is configured, the behavior depends on a DisableFontProviders registry value. In server editions, this registry value is set to 1 by default, so the default behavior is false (disabled). In all other editions, the registry value is not set by default, so the default behavior is true (enabled).
+
+This setting is used by lower-level components for text display and fond handling and has not direct effect on web browsers, which may download web fonts used in web content.
+
+> [!Note]
+> Reboot is required after setting the policy; alternatively you can stop and restart the FontCache service.
+
+
+
+ADMX Info:
+- GP English name: *Enable Font Providers*
+- GP name: *EnableFontProviders*
+- GP path: *Network/Fonts*
+- GP ADMX file name: *GroupPolicy.admx*
+
+
+
+The following list shows the supported values:
+
+- 0 - false - No traffic to fs.microsoft.com and only locally-installed fonts are available.
+- 1 - true (default) - There may be network traffic to fs.microsoft.com and downloadable fonts are available to apps that support them.
+
+
+
+To verify if System/AllowFontProviders is set to true:
+
+- After a client machine is rebooted, check whether there is any network traffic from client machine to fs.microsoft.com.
+
+
+
+
+
+
+
+**System/AllowLocation**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Specifies whether to allow app access to the Location service.
+
+
+Most restricted value is 0.
+
+While the policy is set to 0 (Force Location Off) or 2 (Force Location On), any Location service call from an app would trigger the value set by this policy.
+
+When switching the policy back from 0 (Force Location Off) or 2 (Force Location On) to 1 (User Control), the app reverts to its original Location service setting.
+
+For example, an app's original Location setting is Off. The administrator then sets the **AllowLocation** policy to 2 (Force Location On.) The Location service starts working for that app, overriding the original setting. Later, if the administrator switches the **AllowLocation** policy back to 1 (User Control), the app will revert to using its original setting of Off.
+
+
+
+ADMX Info:
+- GP English name: *Turn off location*
+- GP name: *DisableLocation_2*
+- GP path: *Windows Components/Location and Sensors*
+- GP ADMX file name: *Sensors.admx*
+
+
+
+The following list shows the supported values:
+
+- 0 – Force Location Off. All Location Privacy settings are toggled off and greyed out. Users cannot change the settings, and no apps are allowed access to the Location service, including Cortana and Search.
+- 1 (default) – Location service is allowed. The user has control and can change Location Privacy settings on or off.
+- 2 – Force Location On. All Location Privacy settings are toggled on and greyed out. Users cannot change the settings and all consent permissions will be automatically suppressed.
+
+
+
+
+
+
+
+**System/AllowStorageCard**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Controls whether the user is allowed to use the storage card for device storage. This setting prevents programmatic access to the storage card.
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
+
+- 0 – SD card use is not allowed and USB drives are disabled. This setting does not prevent programmatic access to the storage card.
+- 1 (default) – Allow a storage card.
+
+
+
+
+
+
+
+**System/AllowTelemetry**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * User
+> * Device
+
+
+
+
+
+Allow the device to send diagnostic and usage telemetry data, such as Watson.
+
+The following tables describe the supported values:
+
+Windows 8.1 Values:
+
+- 0 - Not allowed.
+- 1 – Allowed, except for Secondary Data Requests.
+- 2 (default) – Allowed.
+
+
+
+Windows 10 Values:
+
+- 0 – Security. Information that is required to help keep Windows more secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
+ Note: This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016. Using this setting on other devices is equivalent to setting the value of 1.
+- 1 – Basic. Basic device info, including: quality-related data, app compatibility, app usage data, and data from the Security level.
+- 2 – Enhanced. Additional insights, including: how Windows, Windows Server, System Center, and apps are used, how they perform, advanced reliability data, and data from both the Basic and the Security levels.
+- 3 – Full. All data necessary to identify and help to fix problems, plus data from the Security, Basic, and Enhanced levels.
+
+
+
+
+> [!IMPORTANT]
+> If you are using Windows 8.1 MDM server and set a value of 0 using the legacy AllowTelemetry policy on a Windows 10 Mobile device, then the value is not respected and the telemetry level is silently set to level 1.
+
+
+Most restricted value is 0.
+
+
+
+ADMX Info:
+- GP English name: *Allow Telemetry*
+- GP name: *AllowTelemetry*
+- GP element: *AllowTelemetry*
+- GP path: *Data Collection and Preview Builds*
+- GP ADMX file name: *DataCollection.admx*
+
+
+
+
+
+
+
+**System/AllowUserToResetPhone**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Specifies whether to allow the user to factory reset the phone by using control panel and hardware key combination.
+
+Most restricted value is 0.
+
+
+
+The following list shows the supported values:
+orted values:
+
+- 0 – Not allowed.
+- 1 (default) – Allowed to reset to factory default settings.
+
+
+
+
+
+
+
+**System/BootStartDriverInitialization**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy setting allows you to specify which boot-start drivers are initialized based on a classification determined by an Early Launch Antimalware boot-start driver. The Early Launch Antimalware boot-start driver can return the following classifications for each boot-start driver:
+- Good: The driver has been signed and has not been tampered with.
+- Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized.
+- Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver.
+- Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot-start driver.
+
+If you enable this policy setting you will be able to choose which boot-start drivers to initialize the next time the computer is started.
+
+If you disable or do not configure this policy setting, the boot start drivers determined to be Good, Unknown or Bad but Boot Critical are initialized and the initialization of drivers determined to be Bad is skipped.
+
+If your malware detection application does not include an Early Launch Antimalware boot-start driver or if your Early Launch Antimalware boot-start driver has been disabled, this setting has no effect and all boot-start drivers are initialized.
+
+
+> [!TIP]
+> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
+
+> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
+
+> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
+
+
+ADMX Info:
+- GP English name: *Boot-Start Driver Initialization Policy*
+- GP name: *POL_DriverLoadPolicy_Name*
+- GP path: *System/Early Launch Antimalware*
+- GP ADMX file name: *earlylauncham.admx*
+
+
+
+
+
+
+
+**System/ConfigureMicrosoft365UploadEndpoint**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
5
+
5
+
5
+
5
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy sets the upload endpoint for this device’s diagnostic data as part of the Microsoft 365 Update Readiness program.
+
+If your organization is participating in the program and has been instructed to configure a custom upload endpoint, then use this setting to define that endpoint.
+
+The value for this setting will be provided by Microsoft as part of the onboarding process for the program.
+
+Value type is string.
+
+
+ADMX Info:
+- GP English name: *Configure Microsoft 365 Update Readiness upload endpoint*
+- GP name: *ConfigureMicrosoft365UploadEndpoint*
+- GP element: *ConfigureMicrosoft365UploadEndpoint*
+- GP path: *Data Collection and Preview Builds*
+- GP ADMX file name: *DataCollection.admx*
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+**System/ConfigureTelemetryOptInChangeNotification**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy setting determines whether a device shows notifications about telemetry levels to people on first logon or when changes occur in Settings.
+If you set this policy setting to "Disable telemetry change notifications", telemetry level notifications stop appearing.
+If you set this policy setting to "Enable telemetry change notifications" or don't configure this policy setting, telemetry notifications appear at first logon and when changes occur in Settings.
+
+
+
+ADMX Info:
+- GP English name: *Configure telemetry opt-in change notifications.*
+- GP name: *ConfigureTelemetryOptInChangeNotification*
+- GP element: *ConfigureTelemetryOptInChangeNotification*
+- GP path: *Data Collection and Preview Builds*
+- GP ADMX file name: *DataCollection.admx*
+
+
+
+
+
+
+
+**System/ConfigureTelemetryOptInSettingsUx**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy setting determines whether people can change their own telemetry levels in Settings. This setting should be used in conjunction with the Allow Telemetry settings.
+
+If you set this policy setting to "Disable Telemetry opt-in Settings", telemetry levels are disabled in Settings, preventing people from changing them.
+
+If you set this policy setting to "Enable Telemetry opt-in Setings" or don't configure this policy setting, people can change their own telemetry levels in Settings.
+
+Note:
+Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit.
+
+
+
+ADMX Info:
+- GP English name: *Configure telemetry opt-in setting user interface.*
+- GP name: *ConfigureTelemetryOptInSettingsUx*
+- GP element: *ConfigureTelemetryOptInSettingsUx*
+- GP path: *Data Collection and Preview Builds*
+- GP ADMX file name: *DataCollection.admx*
+
+
+
+
+
+
+
+**System/DisableDeviceDelete**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
5
+
5
+
5
+
5
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy setting controls whether the Delete diagnostic data button is enabled in Diagnostic & Feedback Settings page.
+If you enable this policy setting, the Delete diagnostic data button will be disabled in Settings page, preventing the deletion of diagnostic data collected by Microsoft from the device.
+If you disable or don't configure this policy setting, the Delete diagnostic data button will be enabled in Settings page, which allows people to erase all diagnostic data collected by Microsoft from that device.
+
+
+
+ADMX Info:
+- GP English name: *Disable deleting diagnostic data *
+- GP name: *DisableDeviceDelete*
+- GP element: *DisableDeviceDelete*
+- GP path: *Data Collection and Preview Builds*
+- GP ADMX file name: *DataCollection.admx*
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+**System/DisableDiagnosticDataViewer**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
5
+
5
+
5
+
5
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy setting controls whether users can enable and launch the Diagnostic Data Viewer from the Diagnostic & Feedback Settings page.
+If you enable this policy setting, the Diagnostic Data Viewer will not be enabled in Settings page, and it will prevent the viewer from showing diagnostic data collected by Microsoft from the device.
+If you disable or don't configure this policy setting, the Diagnostic Data Viewer will be enabled in Settings page.
+
+
+
+ADMX Info:
+- GP English name: *Disable diagnostic data viewer. *
+- GP name: *DisableDiagnosticDataViewer*
+- GP element: *DisableDiagnosticDataViewer*
+- GP path: *Data Collection and Preview Builds*
+- GP ADMX file name: *DataCollection.admx*
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+**System/DisableEnterpriseAuthProxy**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
3
+
3
+
3
+
3
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy.
+
+
+
+ADMX Info:
+- GP English name: *Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service*
+- GP name: *DisableEnterpriseAuthProxy*
+- GP element: *DisableEnterpriseAuthProxy*
+- GP path: *Data Collection and Preview Builds*
+- GP ADMX file name: *DataCollection.admx*
+
+
+
+
+
+
+
+**System/DisableOneDriveFileSync**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
2
+
2
+
2
+
2
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, version 1703. Allows IT Admins to prevent apps and features from working with files on OneDrive. If you enable this policy setting:
+
+* Users cannot access OneDrive from the OneDrive app or file picker.
+* Microsoft Store apps cannot access OneDrive using the WinRT API.
+* OneDrive does not appear in the navigation pane in File Explorer.
+* OneDrive files are not kept in sync with the cloud.
+* Users cannot automatically upload photos and videos from the camera roll folder.
+
+If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage.
+
+
+
+ADMX Info:
+- GP English name: *Prevent the usage of OneDrive for file storage*
+- GP name: *PreventOnedriveFileSync*
+- GP path: *Windows Components/OneDrive*
+- GP ADMX file name: *SkyDrive.admx*
+
+
+
+The following list shows the supported values:
+
+- 0 (default) – False (sync enabled).
+- 1 – True (sync disabled).
+
+
+
+To validate on Desktop, do the following:
+
+1. Enable policy.
+2. Restart machine.
+3. Verify that OneDrive.exe is not running in Task Manager.
+
+
+
+
+
+
+
+**System/DisableSystemRestore**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Allows you to disable System Restore.
+
+This policy setting allows you to turn off System Restore.
+
+System Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files. By default, System Restore is turned on for the boot volume.
+
+If you enable this policy setting, System Restore is turned off, and the System Restore Wizard cannot be accessed. The option to configure System Restore or create a restore point through System Protection is also disabled.
+
+If you disable or do not configure this policy setting, users can perform System Restore and configure System Restore settings through System Protection.
+
+Also, see the "Turn off System Restore configuration" policy setting. If the "Turn off System Restore" policy setting is disabled or not configured, the "Turn off System Restore configuration" policy setting is used to determine whether the option to configure System Restore is available.
+
+
+> [!TIP]
+> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
+
+> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
+
+> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
+
+
+ADMX Info:
+- GP English name: *Turn off System Restore*
+- GP name: *SR_DisableSR*
+- GP path: *System/System Restore*
+- GP ADMX file name: *systemrestore.admx*
+
+
+
+
+
+
+
+**System/FeedbackHubAlwaysSaveDiagnosticsLocally**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
4
+
4
+
4
+
4
+
4
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Added in Windows 10, version 1803. When filing feedback in the Feedback Hub, diagnostic logs are collected for certain types of feedback. We now offer the option for users to save it locally, in addition to sending it to Microsoft. This policy will allow enterprises to mandate that all diagnostics are saved locally for use in internal investigations.
+
+
+
+The following list shows the supported values:
+
+- 0 (default) - False. The Feedback Hub will not always save a local copy of diagnostics that may be created when a feedback is submitted. The user will have the option to do so.
+- 1 - True. The Feedback Hub should always save a local copy of diagnostics that may be created when a feedback is submitted.
+
+
+
+
+
+
+
+**System/LimitEnhancedDiagnosticDataWindowsAnalytics**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
3
+
3
+
3
+
3
+
3
+
3
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy setting, in combination with the System/AllowTelemetry
+ policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services.
+
+To enable this behavior you must complete two steps:
+
+
Enable this policy setting
+
Set Allow Telemetry to level 2 (Enhanced)
+
+
+When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented here: [Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics](https://go.microsoft.com/fwlink/?linkid=847594).
+
+Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level telemetry data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft.
+
+If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy.
+
+
+
+ADMX Info:
+- GP English name: *Limit Enhanced diagnostic data to the minimum required by Windows Analytics*
+- GP name: *LimitEnhancedDiagnosticDataWindowsAnalytics*
+- GP element: *LimitEnhancedDiagnosticDataWindowsAnalytics*
+- GP path: *Data Collection and Preview Builds*
+- GP ADMX file name: *DataCollection.admx*
+
+
+
+
+
+
+
+**System/TelemetryProxy**
+
+
+
+
+
Home
+
Pro
+
Business
+
Enterprise
+
Education
+
Mobile
+
Mobile Enterprise
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Allows you to specify the fully qualified domain name (FQDN) or IP address of a proxy server to forward Connected User Experiences and Telemetry requests. The format for this setting is *<server>:<port>*. The connection is made over a Secure Sockets Layer (SSL) connection. If the named proxy fails, or if there is no proxy specified when this policy is enabled, the Connected User Experiences and Telemetry data will not be transmitted and will remain on the local device.
+
+If you disable or do not configure this policy setting, Connected User Experiences and Telemetry will go to Microsoft using the default proxy configuration.
+
+
+
+ADMX Info:
+- GP English name: *Configure Connected User Experiences and Telemetry*
+- GP name: *TelemetryProxy*
+- GP element: *TelemetryProxyName*
+- GP path: *Data Collection and Preview Builds*
+- GP ADMX file name: *DataCollection.admx*
+
+
+
+
+
+Footnote:
+
+- 1 - Added in Windows 10, version 1607.
+- 2 - Added in Windows 10, version 1703.
+- 3 - Added in Windows 10, version 1709.
+- 4 - Added in Windows 10, version 1803.
+- 5 - Added in the next major release of Windows 10.
+
+
+
diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md
index df68eeee47..80185310fd 100644
--- a/windows/client-management/mdm/policy-csp-update.md
+++ b/windows/client-management/mdm/policy-csp-update.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 08/10/2018
+ms.date: 08/29/2018
---
# Policy CSP - Update
@@ -715,6 +715,8 @@ The following list shows the supported values:
For Quality Updates, this policy specifies the deadline in days before automatically executing a scheduled restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart is scheduled.
+The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks.
+
Value type is integer. Default is 7 days.
Supported values range: 2-30.
@@ -781,6 +783,8 @@ ADMX Info:
For Feature Updates, this policy specifies the deadline in days before automatically executing a scheduled restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart is scheduled.
+The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks.
+
Value type is integer. Default is 7 days.
Supported values range: 2-30.
@@ -1503,6 +1507,11 @@ The following list shows the supported values:
For Quality Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period.
+The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks.
+
+> [!Note]
+> If Update/EngagedDeadline is the only policy set (Update/EngagedRestartTransitionSchedule and Update/EngagedRestartSnoozeSchedule are not set), the behavior goes from reboot required -> engaged behavior -> forced reboot after deadline is reached with a 3-day snooze period.
+
Value type is integer. Default is 14.
Supported value range: 2 - 30.
@@ -1757,11 +1766,11 @@ ADMX Info:
-For Quality Updates, this policy specifies the timing before transitioning from Auto restarts scheduled_outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending.
+For Quality Updates, this policy specifies the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending.
-Value type is integer.
+Value type is integer. Default value is 7 days.
-Supported value range: 0 - 30.
+Supported value range: 0 - 30.
If you disable or do not configure this policy, the default behaviors will be used.
@@ -1822,7 +1831,7 @@ ADMX Info:
For Feature Updates, this policy specifies the timing before transitioning from Auto restarts scheduled_outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending.
-Value type is integer.
+Value type is integer. Default value is 7 days.
Supported value range: 0 - 30.
@@ -3324,6 +3333,8 @@ ADMX Info:
Added in Windows 10, version 1703. For devices in a cart, this policy skips all restart checks to ensure that the reboot will happen at ScheduledInstallTime.
+When you set this policy along with Update/ActiveHoursStart, Update/ActiveHoursEnd, and ShareCartPC, it will defer all the update processes (scan, download, install, and reboot) to a time after Active Hours. After a buffer period after ActiveHoursEnd, the device will wake up several times to complete the processes. All processes are blocked before ActiveHoursStart.
+
ADMX Info:
diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md
index d841e29aa4..2cb51a98c1 100644
--- a/windows/client-management/mdm/policy-ddf-file.md
+++ b/windows/client-management/mdm/policy-ddf-file.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 08/09/2018
+ms.date: 08/29/2018
---
# Policy DDF file
@@ -19,11 +19,12 @@ This topic shows the OMA DM device description framework (DDF) for the **Policy*
You can download the DDF files from the links below:
-- [Download the Policy DDF file for Windows 10, version 1803](http://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all.xml)
-- [Download the Policy DDF file for Windows 10, version 1709](http://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml)
-- [Download the Policy DDF file for Windows 10, version 1703](http://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml)
-- [Download the Policy DDF file for Windows 10, version 1607](http://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607.xml)
-- [Download the Policy DDF file for Windows 10, version 1607 release 8C](http://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml)
+- [Download the Policy DDF file for Windows 10, version 1803](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all.xml)
+- [Download the Policy DDF file for Windows 10, version 1803 release C](http://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all_1809C_release.xml)
+- [Download the Policy DDF file for Windows 10, version 1709](https://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml)
+- [Download the Policy DDF file for Windows 10, version 1703](https://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml)
+- [Download the Policy DDF file for Windows 10, version 1607](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607.xml)
+- [Download the Policy DDF file for Windows 10, version 1607 release 8C](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml)
- [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download)
The XML below is the DDF for Windows 10, next major version.
@@ -27216,7 +27217,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor
- You can configure Microsoft Edge, when enabled, to prevent the "browser" group from using the Sync your Settings option to sync information, such as history and favorites, between user's devices. If you want syncing turned off by default in Microsoft Edge but not disabled, enable the Allow users to turn browser syncing on policy. If disabled or not configured, the Sync your Settings options are turned on in Microsoft Edge by default, and configurable by the user.
+ You can configure Microsoft Edge, when enabled, to prevent the "browser" group from using the Sync your Settings option to sync information, such as history and favorites, between user's devices. If you want syncing turned off by default in Microsoft Edge but not disabled, enable the Allow users to turn browser syncing on policy. If disabled or not configured, the Sync your Settings options are turned on in Microsoft Edge by default, and configurable by the user.
Related policy: PreventUsersFromTurningOnBrowserSyncing
0 (default) = allow syncing, 2 = disable syncing
@@ -33473,7 +33474,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor
Devices joined to Azure Active Directory in a hybrid environment need to interact with Active Directory Domain Controllers, but they lack the built-in ability to find a Domain Controller that a domain-joined device has. This can cause failures when such a device needs to resolve an AAD UPN into an Active Directory Principal.
-
+
This parameter adds a list of domains that an Azure Active Directory joined device should attempt to contact if it is otherwise unable to resolve a UPN to a principal.
@@ -33861,7 +33862,7 @@ If you disable or do not configure this policy (recommended), users will be able
Notes
If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password.
-Disabling the Administrator account can become a maintenance issue under certain circumstances.
+Disabling the Administrator account can become a maintenance issue under certain circumstances.
Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled.
@@ -34351,7 +34352,7 @@ The options are:
No Action
Lock Workstation
Force Logoff
- Disconnect if a Remote Desktop Services session
+ Disconnect if a Remote Desktop Services session
If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session.
@@ -35373,7 +35374,7 @@ This policy setting controls the behavior of all User Account Control (UAC) poli
The options are:
-• Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode.
+• Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode.
• Disabled: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced.
@@ -44744,7 +44745,7 @@ Caution: If a Restricted Groups policy is applied, any current member not on the
- Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Caution: Assigning this user right can be a security risk. Only assign this user right to trusted users. Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist.
+ Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Caution: Assigning this user right can be a security risk. Only assign this user right to trusted users. Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist.
1) The access token that is being impersonated is for this user.
2) The user, in this logon session, created the access token by logging on to the network with explicit credentials.
3) The requested level is less than Impersonate, such as Anonymous or Identify.
@@ -47063,11 +47064,11 @@ Because of these factors, users do not usually need this user right. Warning: If
-
-
-
-
-
+
+
+
+
+
]]>
@@ -55083,7 +55084,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor
0
- You can configure Microsoft Edge, when enabled, to prevent the "browser" group from using the Sync your Settings option to sync information, such as history and favorites, between user's devices. If you want syncing turned off by default in Microsoft Edge but not disabled, enable the Allow users to turn browser syncing on policy. If disabled or not configured, the Sync your Settings options are turned on in Microsoft Edge by default, and configurable by the user.
+ You can configure Microsoft Edge, when enabled, to prevent the "browser" group from using the Sync your Settings option to sync information, such as history and favorites, between user's devices. If you want syncing turned off by default in Microsoft Edge but not disabled, enable the Allow users to turn browser syncing on policy. If disabled or not configured, the Sync your Settings options are turned on in Microsoft Edge by default, and configurable by the user.
Related policy: PreventUsersFromTurningOnBrowserSyncing
0 (default) = allow syncing, 2 = disable syncing
@@ -62092,7 +62093,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor
Devices joined to Azure Active Directory in a hybrid environment need to interact with Active Directory Domain Controllers, but they lack the built-in ability to find a Domain Controller that a domain-joined device has. This can cause failures when such a device needs to resolve an AAD UPN into an Active Directory Principal.
-
+
This parameter adds a list of domains that an Azure Active Directory joined device should attempt to contact if it is otherwise unable to resolve a UPN to a principal.
@@ -62490,7 +62491,7 @@ If you disable or do not configure this policy (recommended), users will be able
Notes
If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password.
-Disabling the Administrator account can become a maintenance issue under certain circumstances.
+Disabling the Administrator account can become a maintenance issue under certain circumstances.
Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled.
@@ -63023,7 +63024,7 @@ The options are:
No Action
Lock Workstation
Force Logoff
- Disconnect if a Remote Desktop Services session
+ Disconnect if a Remote Desktop Services session
If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session.
@@ -64126,7 +64127,7 @@ This policy setting controls the behavior of all User Account Control (UAC) poli
The options are:
-• Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode.
+• Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode.
• Disabled: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced.
@@ -74443,7 +74444,7 @@ Caution: If a Restricted Groups policy is applied, any current member not on the
- Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Caution: Assigning this user right can be a security risk. Only assign this user right to trusted users. Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist.
+ Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Caution: Assigning this user right can be a security risk. Only assign this user right to trusted users. Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist.
1) The access token that is being impersonated is for this user.
2) The user, in this logon session, created the access token by logging on to the network with explicit credentials.
3) The requested level is less than Impersonate, such as Anonymous or Identify.
diff --git a/windows/client-management/mdm/push-notification-windows-mdm.md b/windows/client-management/mdm/push-notification-windows-mdm.md
index 40aae74dbe..e8db3d3e21 100644
--- a/windows/client-management/mdm/push-notification-windows-mdm.md
+++ b/windows/client-management/mdm/push-notification-windows-mdm.md
@@ -16,13 +16,13 @@ ms.date: 09/22/2017
# Push notification support for device management
-The [DMClient CSP](dmclient-csp.md) supports the ability to configure push-initiated device management sessions. Using the [Windows Notification Services (WNS)](http://go.microsoft.com/fwlink/p/?linkid=528800), a management server can request a device to establish a management session with the server through a push notification. A device is configured to support push by the management server by providing the device with a PFN for an application. Once the device is configured, it registers a persistent connection with the WNS cloud (Battery Sense and Data Sense conditions permitting).
+The [DMClient CSP](dmclient-csp.md) supports the ability to configure push-initiated device management sessions. Using the [Windows Notification Services (WNS)](https://go.microsoft.com/fwlink/p/?linkid=528800), a management server can request a device to establish a management session with the server through a push notification. A device is configured to support push by the management server by providing the device with a PFN for an application. Once the device is configured, it registers a persistent connection with the WNS cloud (Battery Sense and Data Sense conditions permitting).
To initiate a device management session, the management server must first authenticate with WNS using its SID and client secret. Once authenticated, the server receives a token that it can use to initiate a raw push notification for any ChannelURI. When the management server wants to initiate a device management session with a device, it can utilize its token and the device ChannelURI and begin communicating with the device.
For more information about how to get push credentials (SID and client secret) and PFN to use in WNS, see [Get WNS credentials and PFN for MDM push notification](#get-wns-credentials-and-pfn-for-mdm-push-notification).
-Because a device may not always be connected to the internet, WNS supports caching notifications for delivery to the device once it reconnects. To ensure your notification is cached for delivery, set the X-WNS-Cache-Policy header to Cache. Additionally, if the server wants to send a time-bound raw push notification, the server can use the X-WNS-TTL header that will provide WNS with a time-to-live binding so that the notification will expire after the time has passed. For more information, see [Raw notification overview (Windows Runtime apps)](http://go.microsoft.com/fwlink/p/?LinkId=733254).
+Because a device may not always be connected to the internet, WNS supports caching notifications for delivery to the device once it reconnects. To ensure your notification is cached for delivery, set the X-WNS-Cache-Policy header to Cache. Additionally, if the server wants to send a time-bound raw push notification, the server can use the X-WNS-TTL header that will provide WNS with a time-to-live binding so that the notification will expire after the time has passed. For more information, see [Raw notification overview (Windows Runtime apps)](https://go.microsoft.com/fwlink/p/?LinkId=733254).
Note the following restrictions related to push notifications and WNS:
diff --git a/windows/client-management/mdm/remotelock-csp.md b/windows/client-management/mdm/remotelock-csp.md
index 0511301b25..6a45bb2c9a 100644
--- a/windows/client-management/mdm/remotelock-csp.md
+++ b/windows/client-management/mdm/remotelock-csp.md
@@ -15,7 +15,7 @@ ms.date: 06/26/2017
The RemoteLock CSP supports the ability to lock a device that has a PIN set on the device or reset the PIN on a device that may or may not have a PIN set.
-> [!Note]
+> [!Note]
> The RemoteLock CSP is only supported in Windows 10 Mobile.
@@ -23,11 +23,11 @@ The following diagram shows the RemoteLock configuration service provider in a t
-**./Vendor/MSFT/RemoteLock**
+**./Vendor/MSFT/RemoteLock**
Defines the root node for the RemoteLock configuration service provider.
-**Lock**
-Required. The setting accepts requests to lock the device screen. The device screen will lock immediately if a PIN has been set. If no PIN is set, the lock request is ignored and the OMA DM (405) Forbidden error is returned over the management channel. All OMA DM errors are listed [here](http://go.microsoft.com/fwlink/p/?LinkId=522607) in the protocol specification. The supported operations are Get and Exec.
+**Lock**
+Required. The setting accepts requests to lock the device screen. The device screen will lock immediately if a PIN has been set. If no PIN is set, the lock request is ignored and the OMA DM (405) Forbidden error is returned over the management channel. All OMA DM errors are listed [here](https://go.microsoft.com/fwlink/p/?LinkId=522607) in the protocol specification. The supported operations are Get and Exec.
@@ -63,10 +63,10 @@ Required. The setting accepts requests to lock the device screen. The device scr
-**LockAndResetPIN**
+**LockAndResetPIN**
This setting can be used to lock and reset the PIN on the device. It is used in conjunction with the NewPINValue node. After the **Exec** operation is called successfully on this node, the previous PIN will no longer work and cannot be recovered. The supported operation is Exec.
-This node will return the following status. All OMA DM errors are listed [here](http://go.microsoft.com/fwlink/p/?LinkId=522607) in the protocol specification.
+This node will return the following status. All OMA DM errors are listed [here](https://go.microsoft.com/fwlink/p/?LinkId=522607) in the protocol specification.
@@ -95,13 +95,13 @@ This node will return the following status. All OMA DM errors are listed [here](
-**LockAndRecoverPIN**
+**LockAndRecoverPIN**
Added in Windows 10, version 1703. This setting performs a similar function to the LockAndResetPIN node. With LockAndResetPIN any Windows Hello keys associated with the PIN gets deleted, but with LockAndRecoverPIN those keys are saved. After the Exec operation is called successfully on this setting, the new PIN can be retrieved from the NewPINValue setting. The previous PIN will no longer work.
Executing this node requires a ticket from the Microsoft credential reset service. Additionally, the execution of this setting is only supported when the [EnablePinRecovery](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/passportforwork-csp#tenantid-policies-enablepinrecovery) policy is set on the client.
-**NewPINValue**
+**NewPINValue**
This setting contains the PIN after Exec has been called on /RemoteLock/LockAndResetPIN or /RemoteLock/LockAndRecoverPin. If LockAndResetPIN or LockAndResetPIN has never been called, the value will be null. If Get is called on this node after a successful Exec call on /RemoteLock/LockAndResetPIN or /RemoteLock/LockAndRecoverPin, then the new PIN will be provided. If another Get command is called on this node, the value will be null. If you need to reset the PIN again, then another LockAndResetPIN Exec can be communicated to the device to generate a new PIN. The PIN value will conform to the minimum PIN complexity requirements of the merged policies that are set on the device. If no PIN policy has been set on the device, the generated PIN will conform to the default policy of the device.
The data type returned is a string.
@@ -117,12 +117,12 @@ Initiate a remote lock of the device.
``` syntax
- 1
-
-
- ./Vendor/MSFT/RemoteLock/Lock
-
-
+ 1
+
+
+ ./Vendor/MSFT/RemoteLock/Lock
+
+
```
@@ -130,22 +130,22 @@ Initiate a remote lock and PIN reset of the device. To successfully retrieve the
``` syntax
- 1
+ 1
- 2
-
-
- ./Vendor/MSFT/RemoteLock/LockAndResetPIN
-
-
+ 2
+
+
+ ./Vendor/MSFT/RemoteLock/LockAndResetPIN
+
+
- 3
-
-
- ./Vendor/MSFT/RemoteLock/NewPINValue
-
-
+ 3
+
+
+ ./Vendor/MSFT/RemoteLock/NewPINValue
+
+
```
diff --git a/windows/client-management/mdm/server-requirements-windows-mdm.md b/windows/client-management/mdm/server-requirements-windows-mdm.md
index cbbeeaeccb..862a062eba 100644
--- a/windows/client-management/mdm/server-requirements-windows-mdm.md
+++ b/windows/client-management/mdm/server-requirements-windows-mdm.md
@@ -27,7 +27,7 @@ The following list shows the general server requirements for using OMA DM to man
- The MD5 binary nonce is send over XML B64 encoded format, but the octal form of the binary data should be used when the service calculates the hash.
- For more information about Basic or MD5 client authentication, MD5 hash, and MD5 nonce, see the OMA Device Management Security specification (OMA-TS-DM\_Security-V1\_2\_1-20080617-A), available from the [OMA website](http://go.microsoft.com/fwlink/p/?LinkId=526900).
+ For more information about Basic or MD5 client authentication, MD5 hash, and MD5 nonce, see the OMA Device Management Security specification (OMA-TS-DM\_Security-V1\_2\_1-20080617-A), available from the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=526900).
- The server must support HTTPS.
diff --git a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md
index dd67204515..31e9f26469 100644
--- a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md
+++ b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md
@@ -14,7 +14,7 @@ ms.date: 06/26/2017
OMA DM commands are transmitted between the server and the client device in messages. A message can contain one or more commands. For a list of commands supported, see the table in [OMA DM protocol support](oma-dm-protocol-support.md).
-A DM message is an XML document. The structure and content of the document is defined in the OMA DM Representation Protocol (OMA-SyncML-DevInfo-DTD-V1\_1\_2-20030505-D.dtd) available from the [OMA website](http://go.microsoft.com/fwlink/p/?LinkId=526900).
+A DM message is an XML document. The structure and content of the document is defined in the OMA DM Representation Protocol (OMA-SyncML-DevInfo-DTD-V1\_1\_2-20030505-D.dtd) available from the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=526900).
Each message is composed of a header, specified by the SyncHdr element, and a message body, specified by the SyncBody element.
@@ -49,7 +49,7 @@ The following table shows the OMA DM versions that are supported.
## File format
-The following example shows the general structure of the XML document sent by the server using OMA DM version 1.2.1 for demonstration purposes only. The initial XML packages exchanged between client and server could contain additional XML tags. For a detailed description and samples for those packages, see the [OMA Device Management Protocol 1.2.1](http://go.microsoft.com/fwlink/p/?LinkId=526902) specification.
+The following example shows the general structure of the XML document sent by the server using OMA DM version 1.2.1 for demonstration purposes only. The initial XML packages exchanged between client and server could contain additional XML tags. For a detailed description and samples for those packages, see the [OMA Device Management Protocol 1.2.1](https://go.microsoft.com/fwlink/p/?LinkId=526902) specification.
``` syntax
@@ -76,7 +76,7 @@ The following example shows the general structure of the XML document sent by th
-
+
diff --git a/windows/client-management/mdm/update-csp.md b/windows/client-management/mdm/update-csp.md
index 837be49e57..4b82f8c477 100644
--- a/windows/client-management/mdm/update-csp.md
+++ b/windows/client-management/mdm/update-csp.md
@@ -18,12 +18,12 @@ The following diagram shows the Update configuration service provider in tree fo
-**Update**
+**Update**
The root node.
Supported operation is Get.
-**ApprovedUpdates**
+**ApprovedUpdates**
Node for update approvals and EULA acceptance on behalf of the end-user.
> [!NOTE]
@@ -38,10 +38,10 @@ The following diagram shows the Update configuration service provider in tree fo
Supported operations are Get and Add.
-**ApprovedUpdates/****_Approved Update Guid_**
+**ApprovedUpdates/****_Approved Update Guid_**
Specifies the update GUID.
-
To auto-approve a class of updates, you can specify the [Update Classifications](http://go.microsoft.com/fwlink/p/?LinkId=526723) GUIDs. We strongly recommend to always specify the DefinitionsUpdates classification (E0789628-CE08-4437-BE74-2495B842F43B), which are used for anti-malware signatures. There are released periodically (several times a day). Some businesses may also want to auto-approve security updates to get them deployed quickly.
+
To auto-approve a class of updates, you can specify the [Update Classifications](https://go.microsoft.com/fwlink/p/?LinkId=526723) GUIDs. We strongly recommend to always specify the DefinitionsUpdates classification (E0789628-CE08-4437-BE74-2495B842F43B), which are used for anti-malware signatures. There are released periodically (several times a day). Some businesses may also want to auto-approve security updates to get them deployed quickly.
Supported operations are Get and Add.
@@ -50,62 +50,62 @@ The following diagram shows the Update configuration service provider in tree fo
./Vendor/MSFT/Update/ApprovedUpdates/%7ba317dafe-baf4-453f-b232-a7075efae36e%7d
-**ApprovedUpdates/*Approved Update Guid*/ApprovedTime**
+**ApprovedUpdates/*Approved Update Guid*/ApprovedTime**
Specifies the time the update gets approved.
Supported operations are Get and Add.
-**FailedUpdates**
+**FailedUpdates**
Specifies the approved updates that failed to install on a device.
Supported operation is Get.
-**FailedUpdates/****_Failed Update Guid_**
+**FailedUpdates/****_Failed Update Guid_**
Update identifier field of the UpdateIdentity GUID that represent an update that failed to download or install.
Supported operation is Get.
-**FailedUpdates/*Failed Update Guid*/HResult**
+**FailedUpdates/*Failed Update Guid*/HResult**
The update failure error code.
Supported operation is Get.
-**FailedUpdates/*Failed Update Guid*/Status**
+**FailedUpdates/*Failed Update Guid*/Status**
Specifies the failed update status (for example, download, install).
Supported operation is Get.
-**FailedUpdates/*Failed Update Guid*/RevisionNumber**
+**FailedUpdates/*Failed Update Guid*/RevisionNumber**
Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update.
Supported operation is Get.
-**InstalledUpdates**
+**InstalledUpdates**
The updates that are installed on the device.
Supported operation is Get.
-**InstalledUpdates/****_Installed Update Guid_**
+**InstalledUpdates/****_Installed Update Guid_**
UpdateIDs that represent the updates installed on a device.
Supported operation is Get.
-**InstalledUpdates/*Installed Update Guid*/RevisionNumber**
+**InstalledUpdates/*Installed Update Guid*/RevisionNumber**
Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update.
Supported operation is Get.
-**InstallableUpdates**
+**InstallableUpdates**
The updates that are applicable and not yet installed on the device. This includes updates that are not yet approved.
Supported operation is Get.
-**InstallableUpdates/****_Installable Update Guid_**
+**InstallableUpdates/****_Installable Update Guid_**
Update identifiers that represent the updates applicable and not installed on a device.
Supported operation is Get.
-**InstallableUpdates/*Installable Update Guid*/Type**
+**InstallableUpdates/*Installable Update Guid*/Type**
The UpdateClassification value of the update. Valid values are:
- 0 - None
@@ -114,71 +114,71 @@ The following diagram shows the Update configuration service provider in tree fo
Supported operation is Get.
-**InstallableUpdates/*Installable Update Guid*/RevisionNumber**
+**InstallableUpdates/*Installable Update Guid*/RevisionNumber**
The revision number for the update that must be passed in server to server sync to get the metadata for the update.
Supported operation is Get.
-**PendingRebootUpdates**
+**PendingRebootUpdates**
The updates that require a reboot to complete the update session.
Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update.
Supported operation is Get.
-**LastSuccessfulScanTime**
+**LastSuccessfulScanTime**
The last successful scan time.
Supported operation is Get.
-**DeferUpgrade**
+**DeferUpgrade**
Upgrades deferred until the next period.
Supported operation is Get.
-**Rollback**
+**Rollback**
Added in Windows 10, version 1803. Node for the rollback operations.
-**Rollback/QualityUpdate**
-Added in Windows 10, version 1803. Roll back latest Quality Update, if the machine meets the following conditions:
+**Rollback/QualityUpdate**
+Added in Windows 10, version 1803. Roll back latest Quality Update, if the machine meets the following conditions:
- Condition 1: Device must be Windows Update for Business Connected
- Condition 2: Device must be in a Paused State
- Condition 3: Device must have the Latest Quality Update installed on the device (Current State)
-
+
If the conditions are not true, the device will not Roll Back the Latest Quality Update.
-**Rollback/FeatureUpdate**
-Added in Windows 10, version 1803. Roll Back Latest Feature Update, if the machine meets the following conditions:
+**Rollback/FeatureUpdate**
+Added in Windows 10, version 1803. Roll Back Latest Feature Update, if the machine meets the following conditions:
- Condition 1: Device must be Windows Update for Business Connnected
- Condition 2: Device must be in Paused State
- Condition 3: Device must have the Latest Feature Update Installed on the device (Current State)
-- Condition 4: Machine should be within the uninstall period
+- Condition 4: Machine should be within the uninstall period
-> [!Note]
+> [!Note]
> This only works for Semi Annual Channel Targeted devices.
If the conditions are not true, the device will not Roll Back the Latest Feature Update.
-
-**Rollback/QualityUpdateStatus**
-Added in Windows 10, version 1803. Returns the result of last RollBack QualityUpdate operation.
-**Rollback/FeatureUpdateStatus**
+**Rollback/QualityUpdateStatus**
+Added in Windows 10, version 1803. Returns the result of last RollBack QualityUpdate operation.
+
+**Rollback/FeatureUpdateStatus**
Added in Windows 10, version 1803. Returns the result of last RollBack FeatureUpdate operation.
## Related topics
diff --git a/windows/client-management/mdm/vpn-csp.md b/windows/client-management/mdm/vpn-csp.md
index 010d58563c..ef49ec3a51 100644
--- a/windows/client-management/mdm/vpn-csp.md
+++ b/windows/client-management/mdm/vpn-csp.md
@@ -13,7 +13,7 @@ ms.date: 04/02/2017
# VPN CSP
-The VPN configuration service provider allows the MDM server to configure the VPN profile of the device. Windows 10 supports both IKEv2 VPN and SSL VPN profiles. For information about IKEv2, see [Configure IKEv2-based Remote Access](http://technet.microsoft.com/library/ff687731%28v=ws.10%29.aspx).
+The VPN configuration service provider allows the MDM server to configure the VPN profile of the device. Windows 10 supports both IKEv2 VPN and SSL VPN profiles. For information about IKEv2, see [Configure IKEv2-based Remote Access](https://technet.microsoft.com/library/ff687731%28v=ws.10%29.aspx).
> **Note** The VPN CSP is deprecated in Windows 10 and it only supported in Windows 10 Mobile for backward compatibility. Use [VPNv2 CSP](vpnv2-csp.md) instead.
@@ -33,29 +33,29 @@ The following diagram shows the VPN configuration service provider in tree forma
-***ProfileName***
+***ProfileName***
Unique alpha numeric Identifier for the profile. The profile name must not include a forward slash (/).
Value type is chr. Supported operations include Get, Add, Replace, and Delete.
-**Server**
+**Server**
Required. Public or routable IP address or DNS name for the VPN gateway server farm. It can point to the external IP of a gateway or a virtual IP for a server farm.
Supported operations are Get, Add, and Replace.
Value type is chr. Some examples are 208.23.45.130 or vpn.contoso.com.
-**TunnelType**
+**TunnelType**
Optional, but required when deploying a 3rd party IKEv2 VPN profile. Only a value of IKEv2 is supported for this release.
Value type is chr. Supported operations are Get and Add.
-**ThirdParty**
+**ThirdParty**
Optional, but required if deploying 3rd party SSL-VPN plugin profile. Defines a group of setting applied to SSL-VPN profile provisioning.
Supported operations are Get and Add.
-**ThirdParty/Name**
+**ThirdParty/Name**
Required when ThirdParty is defined for SSL-VPN profile provisioning.
Value type is chr. Supported operations are Get and Add.
@@ -70,32 +70,32 @@ Valid values:
- Checkpoint Mobile VPN
-**ThirdParty/AppID**
+**ThirdParty/AppID**
Optional, but required when deploying a 3rd party SSL-VPN plugin app from a private enterprise storefront. This is the ProductID associated with the store application. The client will use this ProductID to ensure that only the enterprise approved plugin is initialized.
Value type is chr. Supported operations are Get, Add, Replace, and Delete.
-**ThirdParty/CustomStoreURL**
+**ThirdParty/CustomStoreURL**
Optional, but required if an enterprise is deploying a 3rd party SSL-VPN plugin app from the private enterprise storefront. This node specifies the URL of the 3rd party SSL-VPN plugin app.
Value type is chr. Supported operations are Get, Add, Replace, and Delete.
-**ThirdParty/CustomConfiguration**
+**ThirdParty/CustomConfiguration**
Optional. This is an HTML encoded XML blob for SSL-VPN plugin specific configuration that is deployed to the device to make it available for SSL-VPN plugins.
Value type is char. Supported operations are Get, Add, Replace, and Delete.
-**RoleOrGroup**
+**RoleOrGroup**
Not Implemented. Optional.
Value type is char. Supported operations are Get, Add, Delete, and Replace.
-**Authentication**
+**Authentication**
Optional node for ThirdParty VPN profiles, but required for IKEv2. This is a collection of configuration objects to ensure that the correct authentication policy is used on the device based on the chosen TunnelType.
Supported operations are Get and Add.
-**Authentication/Method**
+**Authentication/Method**
Required for IKEv2 profiles and optional for third party profiles. This specifies the authentication provider to use for VPN client authentication. Only the EAP method is supported for IKEv2 profiles.
Supported operations are Get and Add.
@@ -106,12 +106,12 @@ Value type is chr.
-**Authentication/Certificate**
+**Authentication/Certificate**
Optional node. A collection of nodes that enables simpler authentication experiences for end users when using VPN. This and its subnodes should not be used for IKEv2 profiles.
Supported operations are Get and Add.
-**Authentication/Certificate/Issuer**
+**Authentication/Certificate/Issuer**
Optional. Filters out the installed certificates with private keys stored in registry or TPM. This can be used in conjunction with EKU for more granular filtering.
Value type is chr. Supported operations are Get, Add, Delete, and Replace.
@@ -120,7 +120,7 @@ Value type is chr. Supported operations are Get, Add, Delete, and Replace.
-**Authentication/Certificate/EKU**
+**Authentication/Certificate/EKU**
Optional. This Extended Key Usage (EKU) element is used to filter out the installed certificates with private keys stored in the registry or TPM. You can use this in conjunction with ISSUER for a more granular filtering.
Value type is chr. Supported operations are Get, Add, Delete, and Replace.
@@ -129,38 +129,38 @@ Value type is chr. Supported operations are Get, Add, Delete, and Replace.
-**Authentication/Certificate/CacheLifeTimeForProtectedCert**
+**Authentication/Certificate/CacheLifeTimeForProtectedCert**
Not Implemented. Optional.
Value type is int. Supported operations are Get, Add, Replace, and Delete.
-**Authentication/EAP**
-Required when IKEv2 is selected. Defines the EAP blob to be used for IKEv2 authentication. You can use EAP-MSCHAPv2 or EAP-TLS. EAP blob is HTML encoded XML as defined in EAP Host Config schemas. You can find the schemas in [Microsoft EAP MsChapV2 Schema](http://go.microsoft.com/fwlink/p/?LinkId=523885) and [Microsoft EAP TLS Schema](http://go.microsoft.com/fwlink/p/?LinkId=523884).
+**Authentication/EAP**
+Required when IKEv2 is selected. Defines the EAP blob to be used for IKEv2 authentication. You can use EAP-MSCHAPv2 or EAP-TLS. EAP blob is HTML encoded XML as defined in EAP Host Config schemas. You can find the schemas in [Microsoft EAP MsChapV2 Schema](https://go.microsoft.com/fwlink/p/?LinkId=523885) and [Microsoft EAP TLS Schema](https://go.microsoft.com/fwlink/p/?LinkId=523884).
Supported operations are Get, Add, and Replace.
Value type is chr.
-**Proxy**
+**Proxy**
Optional node. A collection of configuration objects to enable a post-connect proxy support for VPN. The proxy defined for this profile will be applied when this profile is active and connected.
Supported operations are Add, Delete, and Replace.
-**Proxy/Manual/Server**
+**Proxy/Manual/Server**
Optional. Set this element together with PORT. The value is the proxy server address as a fully qualified hostname or an IP address, for example, proxy.constoso.com.
Supported operations are Get, Add, Replace, and Delete.
Value type is chr.
-**Proxy/Manual/Port**
+**Proxy/Manual/Port**
Optional. Set this element together with Server. The value is the proxy server port number in the range of 1-65535, for example, 8080.
Supported operations are Get, Add, Replace, and Delete.
Value type is int.
-**Proxy/BypassForLocal**
+**Proxy/BypassForLocal**
Optional. When this setting is enabled, any web requests to resources in the intranet zone will not be sent to the proxy. When this is false, the setting should be disabled and all requests should go to the proxy. When this is true, the setting is enabled and intranet requests will not go to the proxy.
Supported operations are Get, Add, Replace, and Delete.
@@ -169,10 +169,10 @@ Value type is bool.
Default is False.
-**SecuredResources**
+**SecuredResources**
Optional node. A collection of configuration objects that define the inclusion resource lists for what can be secured over VPN. Allowed lists are applied only when Policies/SplitTunnel element is set to True. VPN exclusions are not supported..
-**SecuredResources/AppAllowedList/AppAllowedList**
+**SecuredResources/AppAllowedList/AppAllowedList**
Optional. Specifies one or more ProductIDs for the enterprise line of business applications built for Windows. When this element is defined, then all traffic sourced from specified apps will be secured over VPN (assuming protected networks defined allows access). They will not be able to connect directly bypassing the VPN connection. When the profile is auto-triggered, VPN is triggered automatically by these apps.
Supported operations are Get, Add, Replace and Delete.
@@ -181,7 +181,7 @@ Value type is chr.
Examples are {F05DC613-E223-40AD-ABA9-CCCE04277CD9} and ContosoApp.ContosoCorp\_jlsnulm3s397u.
-**SecuredResources/NetworkAllowedList/NetworkAllowedList**
+**SecuredResources/NetworkAllowedList/NetworkAllowedList**
Optional, but required when Policies/SplitTunnel is set to true for IKEv2 profile. Specifies one or more IP ranges that you want secured over VPN. Applications connecting to protected resources that match this list will be secured over VPN. Otherwise, they’ll continue to connect directly. The IP ranges are defined in the format 10.0.0.0/8. When the profile is auto-triggered, the VPN is triggered automatically by these protected networks.
Supported operations are Get, Add, Replace, and Delete.
@@ -190,7 +190,7 @@ Value type is chr.
An example is 172.31.0.0/16.
-**SecuredResources/NameSpaceAllowedList/NameSpaceAllowedList**
+**SecuredResources/NameSpaceAllowedList/NameSpaceAllowedList**
Optional. Specifies one or more namespaces that you want secured over VPN. All requests to the specified namespaces are secured over VPN. Applications connecting to namespaces are secured over VPN. Otherwise, they’ll continue to connect directly. Namespaces are defined in the format \*.corp.contoso.com. Restrictions such as \* or \*.\* or \*.com.\* are not allowed. NetworkAllowedList is required for IKEv2 profiles for routing the traffic correctly over split tunnel.
Supported operations are Get, Add, Replace, and Delete.
@@ -199,7 +199,7 @@ Value type is chr.
An example is \*.corp.contoso.com.
-**SecuredResources/ExcluddedAppList/ExcludedAppList**
+**SecuredResources/ExcluddedAppList/ExcludedAppList**
Optional. Specifies one or more ProductIDs for enterprise line of business applications built for Windows. When the element is defined, these apps will never use VPN. They will connect directly and bypass the VPN connection.
Supported operations are Get, Add, Replace, and Delete.
@@ -208,7 +208,7 @@ Value type is chr.
Examples are {F05DC613-E223-40AD-ABA9-CCCE04277CD9} and ContosoApp.ContosoCorp\_jlsnulm3s397u.
-**SecuredResources/ExcludedNetworkList/ExcludedNetworkList**
+**SecuredResources/ExcludedNetworkList/ExcludedNetworkList**
Optional. Specifies one or more IP addresses that will never use VPN. Any app connecting to the configured excluded IP list will use the internet directly and bypass VPN. Values are defined in the format 10.0.0.0/8.
Supported operations are Get, Add, Replace, and Delete.
@@ -217,7 +217,7 @@ Value type is chr.
An example is 172.31.0.0/16.
-**SecuredResources/ExcludedNameSpaceList/ExcludedNameSpaceList**
+**SecuredResources/ExcludedNameSpaceList/ExcludedNameSpaceList**
Optional. Specifies one or more namespaces of hosts that will never use VPN. Any app connecting to the configured excluded host list will use the internet and bypass VPN. Restrictions such as \* or \*.\* or \*.com.\* are not allowed.
Supported operations are Get, Add, Replace, and Delete.
@@ -226,7 +226,7 @@ Value type is chr.
An example is \*.corp.contoso.com.
-**SecuredResources/DNSSuffixSearchList/DNSSuffixSearchList**
+**SecuredResources/DNSSuffixSearchList/DNSSuffixSearchList**
Optional. Specifies one or many DNS suffixes that will be appended to shortname URLs for DNS resolution and connectivity.
Supported operations are Get, Add, Replace, and Delete.
@@ -235,10 +235,10 @@ Value type is chr.
An example is .corp.contoso.com.
-**Policies**
+**Policies**
Optional node. A collection of configuration objects you can use to enforce profile-specific restrictions.
-**Policies/SplitTunnel**
+**Policies/SplitTunnel**
Optional. When this is False, all traffic goes to the VPN gateway in force tunnel mode. When this is True, only the specific traffic to defined secured resources goes to the VPN gateway.
Supported operations are Get, Add, Replace, and Delete.
@@ -247,7 +247,7 @@ Value type is bool.
Default value is True.
-**Policies/ByPassForLocal**
+**Policies/ByPassForLocal**
Optional. When this setting is True, requests to local resources that are available on the same Wi-Fi network as the VPN client can bypass the VPN. For example, if enterprise policy for VPN requires force tunnel for VPN, but enterprise intends to allow the remote user to connect locally to media center in their home, then this option should be set to True. The user can bypass VPN for local subnet traffic. When this is set to False, the setting is disabled and no subnet exceptions are allowed.
Supported operations are Get, Add, Replace, and Delete.
@@ -256,7 +256,7 @@ Value type is bool.
Default value is False.
-**Policies/TrustedNetworkDetection**
+**Policies/TrustedNetworkDetection**
Optional. When this setting is set to True, the VPN cannot connect when the user is on their corporate wireless network where protected resources are directly accessible to the device. When this is False, the VPN connects over corporate wireless network. This node has a dependency on the DNSSuffix node setting to detect the corporate wireless network.
Supported operations are Get, Add, Replace, and Delete.
@@ -265,7 +265,7 @@ Value type is bool.
Default value is False.
-**Policies/ConnectionType**
+**Policies/ConnectionType**
Optional. Valid values are:
- Triggering: A VPN automatically connects as applications require connectivity to protected resources. The life cycle of the VPN is based on applications using the VPN. Recommended setting for optimizing usage of power resources.
@@ -278,7 +278,7 @@ Value type is chr.
Default value is Triggering.
-**DNSSuffix**
+**DNSSuffix**
Optional, but it is required to set the specific DNS suffix of the primary connection. Supported operations are Get, Add, Delete, and Replace.
Value type is chr.
diff --git a/windows/client-management/mdm/w4-application-csp.md b/windows/client-management/mdm/w4-application-csp.md
index 03b49e0560..7ed090af21 100644
--- a/windows/client-management/mdm/w4-application-csp.md
+++ b/windows/client-management/mdm/w4-application-csp.md
@@ -25,10 +25,10 @@ The following diagram shows the configuration service provider in tree format as
-**APPID**
+**APPID**
Required. This parameter takes a string value. The only supported value for configuring MMS is "w4".
-**NAME**
+**NAME**
Optional. Specifies a user–readable application identity. This parameter is also used to define part of the registry path for the APPLICATION parameters.
This parameter takes a string value. The possible values to configure the NAME parameter are:
@@ -45,15 +45,15 @@ If no value is specified, the registry location will default to <unnamed>.
If `Name` is greater than 40 characters, it will be truncated to 40 characters.
-**TO-PROXY**
+**TO-PROXY**
Required. Specifies one logical proxy with a matching PROXY-ID. It is only possible to refer to proxies defined within the same provisioning file. Only one proxy can be listed.
The TO-PROXY value must be set to the value of the PROXY ID in PXLOGICAL that defines the MMS specific-proxy.
-**TO-NAPID**
+**TO-NAPID**
Required. Specifies the network access point identification name (NAPID) defined in the provisioning file. This parameter takes a string value. It is only possible to refer to network access points defined within the same provisioning file (except if the INTERNET attribute is set in the NAPDEF characteristic). For more information about the NAPDEF characteristic, see [NAPDEF configuration service provider](napdef-csp.md).
-**ADDR**
+**ADDR**
Required. Specifies the address of the MMS application server, as a string. The possible values to configure the ADDR parameter are:
- A Uniform Resource Identifier (URI)
@@ -62,7 +62,7 @@ Required. Specifies the address of the MMS application server, as a string. The
- A fully qualified Internet domain name
-**MS**
+**MS**
Optional. The maximum authorized size, in KB, for multimedia content. This parameter takes a numeric value in string format. If the value is not a number, or is less than or equal to 10, it will be ignored and outgoing MMS will not be resized.
## Remarks
@@ -72,7 +72,7 @@ Windows Phone MMS does not support user–selectable profiles. While multiple MM
If provisioning XML is received for a profile with an existing name, the values in that profile will be overwritten with the new values.
-For more information about the parameters used by the w4 APPLICATION configuration service provider and how they are used, see the OMA MMS Conformance Document (OMA-TS-MMS-CONF-V1\_3-20051027-C) available from the [OMA website](http://go.microsoft.com/fwlink/p/?LinkId=526900).
+For more information about the parameters used by the w4 APPLICATION configuration service provider and how they are used, see the OMA MMS Conformance Document (OMA-TS-MMS-CONF-V1\_3-20051027-C) available from the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=526900).
## Related topics
diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md
index 708ac76bd8..ef75fa6755 100644
--- a/windows/client-management/mdm/wifi-csp.md
+++ b/windows/client-management/mdm/wifi-csp.md
@@ -33,23 +33,23 @@ The following image shows the WiFi configuration service provider in tree format
The following list shows the characteristics and parameters.
-**Device or User profile**
+**Device or User profile**
For user profile, use ./User/Vendor/MSFT/Wifi path and for device profile, use ./Device/Vendor/MSFT/Wifi path.
-**Profile**
+**Profile**
Identifies the Wi-Fi network configuration. Each Wi-Fi network configuration is represented by a profile object. This network profile includes all the information required for the device to connect to that network – for example, the SSID, authentication and encryption methods and passphrase in case of WEP or WPA2 networks.
Supported operation is Get.
-***<SSID>***
+***<SSID>***
Specifies the name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII. The SSID is added when the WlanXML node is added. When the SSID node is deleted, then all the subnodes are also deleted.
SSID is the name of network you are connecting to, while Profile name is the name of the Profile which contains the WiFi settings information. If the Profile name is not set right in the MDM SyncML, as per the information in the WiFi settings XML, it could lead to some unexpected errors. For example, <LocURI>./Vendor/MSFT/WiFi/Profile/<*MUST BE NAME OF PROFILE AS PER WIFI XML*>/WlanXml</LocURI>.
The supported operations are Add, Get, Delete, and Replace.
-**WlanXML**
-The XML that describes the network configuration and follows the [WLAN\_profile Schema](http://go.microsoft.com/fwlink/p/?LinkId=325608) on MSDN.
+**WlanXML**
+The XML that describes the network configuration and follows the [WLAN\_profile Schema](https://go.microsoft.com/fwlink/p/?LinkId=325608) on MSDN.
Supported operations are Get, Add, Delete, and Replace.
@@ -57,13 +57,13 @@ Value type is chr.
The profile XML must be escaped, as shown in the examples below.
-If it exists in the blob, the **keyType** and **protected** elements must come before **keyMaterial**, as shown in the example in [WPA2-Personal Profile Sample](http://go.microsoft.com/fwlink/p/?LinkId=523870).
+If it exists in the blob, the **keyType** and **protected** elements must come before **keyMaterial**, as shown in the example in [WPA2-Personal Profile Sample](https://go.microsoft.com/fwlink/p/?LinkId=523870).
-> **Note** If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the Wi-Fi profile, you can do so by specifying this through the EapHostConfig portion of the WlanXML. For more information, see [EAP configuration](http://go.microsoft.com/fwlink/p/?LinkId=618963).
+> **Note** If you need to specify other advanced conditions, such as specifying criteria for certificates that can be used by the Wi-Fi profile, you can do so by specifying this through the EapHostConfig portion of the WlanXML. For more information, see [EAP configuration](https://go.microsoft.com/fwlink/p/?LinkId=618963).
The supported operations are Add, Get, Delete, and Replace.
-**Proxy**
+**Proxy**
Optional. Specifies the configuration of the network proxy. A proxy server host and port can be specified per connection for Windows 10 Mobile. This proxy configuration is only supported in Windows 10 Mobile. Using this configuration in Windows 10 for desktop editions will result in failure.
The format is *host:port*, where host can be one of the following:
@@ -76,7 +76,7 @@ If it is an IPvFuture address, then it must be specified as an IP literal as "\[
Supported operations are Get, Add, Delete, and Replace.
-**DisableInternetConnectivityChecks**
+**DisableInternetConnectivityChecks**
Added in Windows 10, version 1511.Optional. Disable the internet connectivity check for the profile.
Value type is chr.
@@ -86,23 +86,23 @@ Value type is chr.
Supported operations are Get, Add, Delete, and Replace.
-**ProxyPacUrl**
+**ProxyPacUrl**
Added in Windows 10, version 1607. Optional. Specifies the value of the URL to the Proxy auto-config (PAC) file location. This proxy configuration is only supported in Windows 10 Mobile.
Value type is chr, e.g. http://www.contoso.com/wpad.dat.
-**ProxyWPAD**
+**ProxyWPAD**
Added in Windows 10, version 1607. Optional. When set to true it enables Web Proxy Auto-Discovery Protocol (WPAD) for proxy lookup.This proxy configuration is only supported in Windows 10 Mobile.
Value type is bool.
-**WiFiCost**
+**WiFiCost**
Added in Windows 10, next major version. Optional. This policy sets the cost of WLAN connection for the Wi-Fi profile. Default behaviour: Unrestricted.
-Supported values:
+Supported values:
- 1 - Unrestricted - unlimited connection
-- 2 - Fixed - capacity constraints up to a certain data limit
+- 2 - Fixed - capacity constraints up to a certain data limit
- 3 - Variable - paid on per byte basic
Supported operations are Add, Get, Replace and Delete. Value type is integer.
@@ -156,28 +156,28 @@ The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwor
The following example shows how to query Wi-Fi profiles installed on an MDM server.
``` syntax
-
- 301
-
-
- ./Vendor/MSFT/WiFi/Profile
-
-
+
+ 301
+
+
+ ./Vendor/MSFT/WiFi/Profile
+
+
```
The following example shows the response.
``` syntax
-
- 3
- 1
+
+ 3
+ 1301
-
- ./Vendor/MSFT/WiFi/Profile
- node
- TestWLAN1/TestWLAN2
-
+
+ ./Vendor/MSFT/WiFi/Profile
+ node
+ TestWLAN1/TestWLAN2
+
```
diff --git a/windows/client-management/mdm/windows-mdm-enterprise-settings.md b/windows/client-management/mdm/windows-mdm-enterprise-settings.md
index 0035d1b6dc..c33b128242 100644
--- a/windows/client-management/mdm/windows-mdm-enterprise-settings.md
+++ b/windows/client-management/mdm/windows-mdm-enterprise-settings.md
@@ -15,7 +15,7 @@ ms.date: 06/26/2017
# Enterprise settings, policies, and app management
-The actual management interaction between the device and server is done via the DM client. The DM client communicates with the enterprise management server via DM v1.2 SyncML syntax. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](http://go.microsoft.com/fwlink/p/?LinkId=267526).
+The actual management interaction between the device and server is done via the DM client. The DM client communicates with the enterprise management server via DM v1.2 SyncML syntax. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526).
Windows currently supports one MDM server. The DM client that is configured via the enrollment process is granted access to enterprise related settings. Enterprise MDM settings are exposed via various configuration service providers to the DM client. For the list of available configuration service providers, see [Configuration service provider reference](configuration-service-provider-reference.md).
diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md
index 6f359562af..965fbb8a81 100644
--- a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md
+++ b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 08/02/2018
+ms.date: 09/10/2018
---
# WindowsDefenderApplicationGuard CSP
@@ -14,7 +14,7 @@ ms.date: 08/02/2018
> [!WARNING]
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
-The WindowsDefenderApplicationGuard configuration service provider (CSP) is used by the enterprise to configure the settings in the Application Guard. This CSP was added in Windows 10, version 1709.
+The WindowsDefenderApplicationGuard configuration service provider (CSP) is used by the enterprise to configure the settings in Windows Defender Application Guard. This CSP was added in Windows 10, version 1709.
The following diagram shows the WindowsDefenderApplicationGuard configuration service provider in tree format.
@@ -132,12 +132,12 @@ If you disable or don't configure this policy, applications inside Windows Defen
**Status**
Returns bitmask that indicates status of Application Guard installation and pre-requisites on the device. Value type is integer. Supported operation is Get.
-Bit 0 - Set to 1 when WDAG is enabled into enterprise manage mode
-Bit 1 - Set to 1 when the client machine is Hyper-V capable
-Bit 2 - Set to 1 when the client machine has a valid OS license and SKU
-Bit 3 - Set to 1 when WDAG installed on the client machine
-Bit 4 - Set to 1 when required Network Isolation Policies are configured
-Bit 5 - Set to 1 when the client machine meets minimum hardware requirements
+- Bit 0 - Set to 1 when WDAG is enabled into enterprise manage mode
+- Bit 1 - Set to 1 when the client machine is Hyper-V capable
+- Bit 2 - Set to 1 when the client machine has a valid OS license and SKU
+- Bit 3 - Set to 1 when WDAG installed on the client machine
+- Bit 4 - Set to 1 when required Network Isolation Policies are configured
+- Bit 5 - Set to 1 when the client machine meets minimum hardware requirements
**InstallWindowsDefenderApplicationGuard**
Initiates remote installation of Application Guard feature. Supported operations are Get and Execute.
diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md
index dfda523b86..4a94da5c31 100644
--- a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md
+++ b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 08/02/2018
+ms.date: 09/10/2018
---
# WindowsDefenderApplicationGuard DDF file
@@ -20,7 +20,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic
This XML is for Windows 10, next major version.
-``` syntax
+```xml
Device enrollment
*Applies to: Corporate and personal devices*
-The way in which personal and corporate devices are enrolled into an MDM system differs. Your operations team should consider these differences when determining which approach is best for mobile workers in your organization.
+The way in which personal and corporate devices are enrolled into an MDM system differs. Your operations team should consider these differences when determining which approach is best for mobile workers in your organization.
**Device initialization and enrollment considerations**
@@ -80,16 +80,16 @@ The way in which personal and corporate devices are enrolled into an MDM system
In the Out-of-the-Box Experience (OOBE), the first time the employee starts the device, they are requested to add a cloud identity to the device.
The primary identity on the device is a personal identity. Personal devices are initiated with a Microsoft Account (MSA), which uses a personal email address.
The primary identity on the device is an organizational identity. Corporate devices are initialized with an organizational account (account@corporatedomain.ext).
-Initialization of a device with a corporate account is unique to Windows 10. No other mobile platform currently offers this capability. The default option is to use an Azure Active Directory organizational identity.
+Initialization of a device with a corporate account is unique to Windows 10. No other mobile platform currently offers this capability. The default option is to use an Azure Active Directory organizational identity.
Skipping the account setup in OOBE will result in the creation of a local account. The only option to add a cloud account later is to add an MSA, putting this device into a personal device deployment scenario. To start over, the device will have to be reset.
-
Device Enrollment
+
Device Enrollment
Enrolling devices in an MDM system helps control and protect corporate data while keeping workers productive.
Device enrollment can be initiated by employees. They can add an Azure account as a secondary account to the Windows 10 Mobile device. Provided the MDM system is registered with your Azure AD, the device is automatically enrolled in the MDM system when the user adds an Azure AD account as a secondary account (MSA+AAD+MDM). If your organization does not have Azure AD, the employee’s device will automatically be enrolled into your organization’s MDM system (MSA+MDM).
-MDM enrollment can also be initiated with a provisioning package. This option enables IT to offer easy-to-use self-service enrollment of personal devices. Provisioning is currently only supported for MDM-only enrollment (MSA+MDM).
+MDM enrollment can also be initiated with a provisioning package. This option enables IT to offer easy-to-use self-service enrollment of personal devices. Provisioning is currently only supported for MDM-only enrollment (MSA+MDM).
The user initiates MDM enrollment by joining the device to the Azure AD instance of their organization. The device is automatically enrolled in the MDM system when the device registers in Azure AD. This requires your MDM system to be registered with your Azure AD (AAD+MDM).
@@ -98,15 +98,15 @@ MDM enrollment can also be initiated with a provisioning package. This option en
**Recommendation:** Microsoft recommends Azure AD registration and automatic MDM enrollment for corporate devices (AAD+MDM) and personal devices (MSA+AAD+MDM). This requires Azure AD Premium.
-### Identity management
+### Identity management
*Applies to: Corporate and personal devices*
-Employees can use only one account to initialize a device so it’s imperative that your organization controls which account is enabled first. The account chosen will determine who controls the device and influence your management capabilities.
+Employees can use only one account to initialize a device so it’s imperative that your organization controls which account is enabled first. The account chosen will determine who controls the device and influence your management capabilities.
->**Note:** Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, etc. Both an [MSA](https://www.microsoft.com/en-us/account/) and an [Azure AD account](https://www.microsoft.com/en-us/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) give access to these services.
+>**Note:** Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, etc. Both an [MSA](https://www.microsoft.com/en-us/account/) and an [Azure AD account](https://www.microsoft.com/en-us/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) give access to these services.
-The following table describes the impact of identity choice on device management characteristics of the personal and corporate device scenarios.
+The following table describes the impact of identity choice on device management characteristics of the personal and corporate device scenarios.
**Identity choice considerations for device management**
@@ -135,10 +135,10 @@ The following table describes the impact of identity choice on device management
Credential management
Employees sign in to the device with Microsoft Account credentials.
-Users cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft account.
+Users cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft account.
-
Employees sign in to the device with Azure AD credentials.
-IT can block the addition of a personal identity, such as an MSA or Google Account. IT controls all devices access policies, without limitations.
+
Employees sign in to the device with Azure AD credentials.
+IT can block the addition of a personal identity, such as an MSA or Google Account. IT controls all devices access policies, without limitations.
@@ -178,16 +178,16 @@ IT can block the addition of a personal identity, such as an MSA or Google Accou
For both personal and corporate deployment scenarios, an MDM system is the essential infrastructure required to deploy and manage Windows 10 Mobile devices. An Azure AD premium subscription is recommended as an identity provider and required to support certain capabilities. Windows 10 Mobile allows you to have a pure cloud-based infrastructure or a hybrid infrastructure that combines Azure AD identity management with an on-premises management system to manage devices. Microsoft now also supports a pure on-premises solution to manage Windows 10 Mobile devices with [Configuration Manager](https://technet.microsoft.com/en-us/library/mt627908.aspx).
-**Azure Active Directory**
-Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid identity solution. Organizations that use Microsoft Office 365 or Intune are already using Azure AD, which has three editions: Free Basic, and Premium (see [Azure Active Directory editions](http://azure.microsoft.com/en-us/documentation/articles/active-directory-editions/)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state.
+**Azure Active Directory**
+Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid identity solution. Organizations that use Microsoft Office 365 or Intune are already using Azure AD, which has three editions: Free Basic, and Premium (see [Azure Active Directory editions](https://azure.microsoft.com/en-us/documentation/articles/active-directory-editions/)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state.
**Mobile Device Management**
-Microsoft [Intune](http://www.microsoft.com/en-us/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution.
-You can also integrate Intune with Configuration Manager to gain a single console for managing all devices in the cloud and on premises, mobile or PC. For more information, see [Manage Mobile Devices with Configuration Manager and Microsoft Intune](http://technet.microsoft.com/en-us/library/jj884158.aspx). For guidance on choosing between a stand-alone Intune installation and Intune integrated with System Center Configuration Manager, see Choose between Intune by itself or integrating Intune with System Center Configuration Manager.
-Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. MDM providers that support Windows 10 Mobile currently include: AirWatch, Citrix, MobileIron, SOTI, Blackberry and others. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](http://azure.microsoft.com/en-us/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account.
+Microsoft [Intune](https://www.microsoft.com/en-us/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution.
+You can also integrate Intune with Configuration Manager to gain a single console for managing all devices in the cloud and on premises, mobile or PC. For more information, see [Manage Mobile Devices with Configuration Manager and Microsoft Intune](https://technet.microsoft.com/en-us/library/jj884158.aspx). For guidance on choosing between a stand-alone Intune installation and Intune integrated with System Center Configuration Manager, see Choose between Intune by itself or integrating Intune with System Center Configuration Manager.
+Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. MDM providers that support Windows 10 Mobile currently include: AirWatch, Citrix, MobileIron, SOTI, Blackberry and others. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/en-us/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account.
>**Note:** Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365.
-In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](http://technet.microsoft.com/en-us/library/ms.o365.cc.devicepolicy.aspx).
+In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](https://technet.microsoft.com/en-us/library/ms.o365.cc.devicepolicy.aspx).
**Cloud services**
On mobile devices that run Windows 10 Mobile, users can easily connect to cloud services that provide user notifications and collect diagnostic and usage data. Windows 10 Mobile enables organizations to manage how devices consume these cloud services.
@@ -200,23 +200,23 @@ However, there is an exception to this behavior. In Windows 10 Mobile, the Alway
For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](/windows/device-security/windows-10-mobile-security-guide).
**Windows Update for Business**
-Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates.
+Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates.
**Microsoft Store for Business**
-The Microsoft Store for Business is the place where IT administrators can find, acquire, manage, and distribute apps to Windows 10 devices. This includes both internal line-of-business (LOB) apps, as well as commercially available third-party apps.
+The Microsoft Store for Business is the place where IT administrators can find, acquire, manage, and distribute apps to Windows 10 devices. This includes both internal line-of-business (LOB) apps, as well as commercially available third-party apps.
## Configure
MDM administrators can define and implement policy settings on any personal or corporate device enrolled in an MDM system. What configuration settings you use will differ based on the deployment scenario, and corporate devices will offer IT the broadest range of control.
->**Note:** This guide helps IT professionals understand management options available for the Windows 10 Mobile OS. Please consult your MDM system documentation to understand how these policies are enabled by your MDM vendor.
-Not all MDM systems support every setting described in this guide. Some support custom policies through OMA-URI XML files. See [Microsoft Intune support for Custom Policies](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#custom-uri-settings-for-windows-10-devices). Naming conventions may also vary among MDM vendors.
+>**Note:** This guide helps IT professionals understand management options available for the Windows 10 Mobile OS. Please consult your MDM system documentation to understand how these policies are enabled by your MDM vendor.
+Not all MDM systems support every setting described in this guide. Some support custom policies through OMA-URI XML files. See [Microsoft Intune support for Custom Policies](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#custom-uri-settings-for-windows-10-devices). Naming conventions may also vary among MDM vendors.
### Account profile
*Applies to: Corporate devices*
-Enforcing what accounts employees can use on a corporate device is important for avoiding data leaks and protecting privacy. Limiting the device to just one account controlled by the organization will reduce the risk of a data breach. However, you can choose to allow employees to add a personal Microsoft Account or other consumer email accounts.
+Enforcing what accounts employees can use on a corporate device is important for avoiding data leaks and protecting privacy. Limiting the device to just one account controlled by the organization will reduce the risk of a data breach. However, you can choose to allow employees to add a personal Microsoft Account or other consumer email accounts.
- **Allow Microsoft Account** Specifies whether users are allowed to add a Microsoft Account to the device and use this account to authenticate to cloud services, such as purchasing apps in Microsoft Store, Xbox, or Groove.
- **Allow Adding Non-Microsoft Accounts** Specifies whether users are allowed to add email accounts other than Microsoft accounts.
@@ -225,22 +225,22 @@ Enforcing what accounts employees can use on a corporate device is important for
*Applies to: Corporate and personal devices*
-Email and associated calendar and contacts are the primary apps that users access on their smartphones. Configuring them properly is key to the success of any mobility program. In both corporate and personal device deployment scenarios, these email account settings get deployed immediately after enrollment. Using your corporate MDM system, you can define corporate email account profiles, deploy them to devices, and manage inbox policies.
+Email and associated calendar and contacts are the primary apps that users access on their smartphones. Configuring them properly is key to the success of any mobility program. In both corporate and personal device deployment scenarios, these email account settings get deployed immediately after enrollment. Using your corporate MDM system, you can define corporate email account profiles, deploy them to devices, and manage inbox policies.
- Most corporate email systems leverage **Exchange ActiveSync (EAS)**. For more details on configuring EAS email profiles, see the [ActiveSync CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920017(v=vs.85).aspx).
-- **Simple Mail Transfer Protocol (SMTP)** email accounts can also be configured with your MDM system. For more detailed information on SMTP email profile configuration, see the [Email CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904953(v=vs.85).aspx). Microsoft Intune does not currently support the creation of an SMTP email profile.
+- **Simple Mail Transfer Protocol (SMTP)** email accounts can also be configured with your MDM system. For more detailed information on SMTP email profile configuration, see the [Email CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904953(v=vs.85).aspx). Microsoft Intune does not currently support the creation of an SMTP email profile.
### Device Lock restrictions
*Applies to: Corporate and personal devices*
-It’s common practice to protect a device that contains corporate information with a passcode when it is not in use. As a best practice, Microsoft recommends that you implement a device lock policy for Windows 10 Mobile devices for securing apps and data. You can use a complex password or numeric PIN to lock devices. Introduced with Windows 10, [Windows Hello](http://windows.microsoft.com/en-us/windows-10/getstarted-what-is-hello) allows you to use a PIN, a companion device (like Microsoft band), or biometrics to validate your identity to unlock Windows 10 Mobile devices.
+It’s common practice to protect a device that contains corporate information with a passcode when it is not in use. As a best practice, Microsoft recommends that you implement a device lock policy for Windows 10 Mobile devices for securing apps and data. You can use a complex password or numeric PIN to lock devices. Introduced with Windows 10, [Windows Hello](https://windows.microsoft.com/en-us/windows-10/getstarted-what-is-hello) allows you to use a PIN, a companion device (like Microsoft band), or biometrics to validate your identity to unlock Windows 10 Mobile devices.
->**Note:** When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics.
+>**Note:** When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics.
To use Windows Hello with biometrics, specialized hardware, including fingerprint reader, illuminated IR sensor, or other biometric sensors is required. Hardware based protection of the Windows Hello credentials requires TPM 1.2 or greater; if no TPM exists or is configured, credentials/keys protection will be software-based.
Companion devices must be paired with Windows 10 PC’s via Bluetooth. To use a Windows Hello companion device that enables the user to roam with their Windows Hello credentials requires Pro or Enterprise edition on the Windows 10 PC being signed into.
-Most of the device lock restriction policies have been available via ActiveSync and MDM since Windows Phone 7 and are still available today for Windows 10 Mobile. If you are deploying Windows 10 devices in a personal device deployment scenario, these settings would apply.
+Most of the device lock restriction policies have been available via ActiveSync and MDM since Windows Phone 7 and are still available today for Windows 10 Mobile. If you are deploying Windows 10 devices in a personal device deployment scenario, these settings would apply.
- **Device Password Enabled** Specifies whether users are required to use a device lock password.
- **Allow Simple Device Password** Whether users can use a simple password (e.g., 1111 or 1234).
@@ -257,9 +257,9 @@ Most of the device lock restriction policies have been available via ActiveSync
Settings related to Windows Hello would be important device lock settings to configure if you are deploying devices using the corporate deployment scenario.
Microsoft made it a requirement for all users to create a numeric passcode as part of Azure AD Join. This policy default requires users to select a four-digit passcode, but this can be configured with an AAD-registered MDM system to whatever passcode complexity your organization desires. If you are using Azure AD with an automatic MDM enrollment mechanism, these policy settings are automatically applied during device enrollment.
-You will notice that some of the settings are very similar, specifically those related to passcode length, history, expiration, and complexity. If you set the policy in multiple places, both policies will be applied, with the strongest policy retained. Read [PassportForWork CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn987099(v=vs.85).aspx), [DeviceLock CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904945(v=vs.85).aspx) (Windows Phone 8.1), and [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#DeviceLock_AllowIdleReturnWithoutPassword) for more detailed information.
+You will notice that some of the settings are very similar, specifically those related to passcode length, history, expiration, and complexity. If you set the policy in multiple places, both policies will be applied, with the strongest policy retained. Read [PassportForWork CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn987099(v=vs.85).aspx), [DeviceLock CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904945(v=vs.85).aspx) (Windows Phone 8.1), and [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#DeviceLock_AllowIdleReturnWithoutPassword) for more detailed information.
-### Prevent changing of settings
+### Prevent changing of settings
*Applies to: Corporate devices*
@@ -276,11 +276,11 @@ Employees are usually allowed to change certain personal device settings that yo
*Applies to: Corporate devices*
-Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi Fi. You can use hardware restrictions to control the availability of these features.
+Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi Fi. You can use hardware restrictions to control the availability of these features.
The following lists the MDM settings that Windows 10 Mobile supports to configure hardware restrictions.
->**Note:** Some of these hardware restrictions provide connectivity and assist in data protection.
+>**Note:** Some of these hardware restrictions provide connectivity and assist in data protection.
- **Allow NFC:** Whether the NFC radio is enabled
- **Allow USB Connection:** Whether the USB connection is enabled (doesn’t affect USB charging)
@@ -295,12 +295,12 @@ The following lists the MDM settings that Windows 10 Mobile supports to configur
- **Allow Voice Recording:** Whether the user can use the microphone to create voice recordings
- **Allow Location:** Whether the device can use the GPS sensor or other methods to determine location so applications can use location information
-### Certificates
+### Certificates
*Applies to: Personal and corporate devices*
-Certificates help improve security by providing account authentication, Wi Fi authentication, VPN encryption, and SSL encryption of web content. Although users can manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates throughout their entire lifecycle – from enrollment through renewal and revocation.
-To install certificates manually, you can post them on Microsoft Edge website or send them directly via email, which is ideal for testing purposes.
+Certificates help improve security by providing account authentication, Wi Fi authentication, VPN encryption, and SSL encryption of web content. Although users can manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates throughout their entire lifecycle – from enrollment through renewal and revocation.
+To install certificates manually, you can post them on Microsoft Edge website or send them directly via email, which is ideal for testing purposes.
Using SCEP and MDM systems, certificate management is completely transparent and requires no user intervention, helping improve user productivity, and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device (as long as the MDM system supports the Simple Certificate Enrollment Protocol (SCEP) or Personal Information Exchange (PFX)). The MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired.
In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. The table below lists the Windows 10 Mobile PFX certificate deployment settings.
Get more detailed information about MDM certificate management in the [Client Certificate Install CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920023(v=vs.85).aspx) and [Install digital certificates on Windows 10 Mobile](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile).
@@ -342,7 +342,7 @@ You can create multiple Wi-Fi profiles in your MDM system. The below table lists
- **Proxy auto-configuration URL** A URL that specifies the proxy auto-configuration file
- **Enable Web Proxy Auto-Discovery Protocol (WPAD)** Specifies whether WPAD is enabled
-In addition, you can set a few device wide Wi-Fi settings.
+In addition, you can set a few device wide Wi-Fi settings.
- **Allow Auto Connect to Wi Fi Sense Hotspots** Whether the device will automatically detect and connect to Wi-Fi networks
- **Allow Manual Wi-Fi Configuration** Whether the user can manually configure Wi-Fi settings
- **Allow Wi-Fi** Whether the Wi-Fi hardware is enabled
@@ -356,23 +356,23 @@ Get more detailed information about Wi-Fi connection profile settings in the [Wi
*Applies to: Corporate devices*
An Access Point Name (APN) defines network paths for cellular data connectivity. Typically, you define just one APN for a device in collaboration with a mobile operator, but you can define multiple APNs if your company uses multiple mobile operators.
-An APN provides a private connection to the corporate network that is unavailable to other companies on the mobile operator network.
+An APN provides a private connection to the corporate network that is unavailable to other companies on the mobile operator network.
You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. The following lists the MDM settings that Windows 10 Mobile supports for APN profiles.
-- **APN name** The APN name
+- **APN name** The APN name
- *IP connection type* The IP connection type; set to one of the following values:
- IPv4 only
- IPv6 only
- IPv4 and IPv6 concurrently
- - IPv6 with IPv4 provided by 46xlat
-- **LTE attached** Whether the APN should be attached as part of an LTE Attach
+ - IPv6 with IPv4 provided by 46xlat
+- **LTE attached** Whether the APN should be attached as part of an LTE Attach
- **APN class ID** The globally unique identifier that defines the APN class to the modem
- **APN authentication type** The APN authentication type; set to one of the following values:
- None
- Auto
- PAP
- CHAP
- - MSCHAPv2
+ - MSCHAPv2
- **User name** The user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type
- **Password** The password for the user account specified in User name
- **Integrated circuit card ID** The integrated circuit card ID associated with the cellular connection profile
@@ -396,7 +396,7 @@ The below lists the Windows 10 Mobile settings for managing APN proxy settings f
- **User Name** Specifies the username used to connect to the proxy
- **Password** Specifies the password used to connect to the proxy
- **Server** Specifies the name of the proxy server
-- **Proxy connection type** The proxy connection type, supporting: Null proxy, HTTP, WAP, SOCKS4
+- **Proxy connection type** The proxy connection type, supporting: Null proxy, HTTP, WAP, SOCKS4
- **Port** The port number of the proxy connection
For more details on proxy settings, see [CM_ProxyEntries CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn914762(v=vs.85).aspx).
@@ -407,17 +407,17 @@ For more details on proxy settings, see [CM_ProxyEntries CSP](https://msdn.micro
Organizations often use a VPN to control access to apps and resources on their company’s intranet. In addition to native Microsoft Point to Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and Internet Key Exchange Protocol version 2 (IKEv2) VPNs, Windows 10 Mobile supports SSL VPN connections, which require a downloadable plugin from the Microsoft Store and are specific to the VPN vendor of your choice. These plugins work like apps and can be installed directly from the Microsoft Store using your MDM system (see App Management).
-You can create and provision multiple VPN connection profiles and then deploy them to managed devices that run Windows 10 Mobile.
+You can create and provision multiple VPN connection profiles and then deploy them to managed devices that run Windows 10 Mobile.
To create a VPN profile that uses native Windows 10 Mobile VPN protocols (such as IKEv2, PPTP, or L2TP), you can use the following settings:
- **VPN Servers** The VPN server for the VPN profile
-- **Routing policy type** The type of routing policy the VPN profile uses can be set to one of the following values:
+- **Routing policy type** The type of routing policy the VPN profile uses can be set to one of the following values:
- Split tunnel. Only network traffic destined to the intranet goes through the VPN connection
- Force tunnel. All traffic goes through the VPN connection
- **Tunneling protocol type** The tunneling protocol used for VPN profiles that use native Windows 10 Mobile VPN protocols can be one the following values: PPTP, L2TP, IKEv2, Automatic
- **User authentication method** The user authentication method for the VPN connection can have a value of EAP or MSChapv2 (Windows 10 Mobile does not support the value MSChapv2 for IKEv2-based VPN connections)
- **Machine certificate** The machine certificate used for IKEv2-based VPN connections
-- **EAP configuration** To create a single sign-on experience for VPN users using certificate authentication, you need to create an Extensible Authentication Protocol (EAP) configuration XML file and include it in the VPN profile
+- **EAP configuration** To create a single sign-on experience for VPN users using certificate authentication, you need to create an Extensible Authentication Protocol (EAP) configuration XML file and include it in the VPN profile
- **L2tpPsk** The pre-shared key used for an L2TP connection
- **Cryptography Suite** Enable the selection of cryptographic suite attributes used for IPsec tunneling
@@ -447,7 +447,7 @@ In addition, you can specify per VPN Profile:
- It can never be disconnected.
- If the VPN profile is not connected, the user has no network connectivity.
- No other VPN profiles can be connected or modified.
-- **ProfileXML** In case your MDM system does not support all the VPN settings you want to configure, you can create an XML file that defines the VPN profile you want to apply to all the fields you require.
+- **ProfileXML** In case your MDM system does not support all the VPN settings you want to configure, you can create an XML file that defines the VPN profile you want to apply to all the fields you require.
For more details about VPN profiles, see the [VPNv2 CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn914776(v=vs.85).aspx)
@@ -464,7 +464,7 @@ Protecting the apps and data stored on a device is critical to device security.
Windows 10 Mobile also has the ability to install apps on a secure digital (SD) card. The operating system stores apps on a partition specifically designated for that purpose. This feature is always on so you don’t need to set a policy explicitly to enable it.
-The SD card is uniquely paired with a device. No other devices can see the apps or data on the encrypted partition, but they can access the data stored on the unencrypted partition of the SD card, such as music or photos. This gives users the flexibility to use an SD card while still protecting the confidential apps and data on it.
+The SD card is uniquely paired with a device. No other devices can see the apps or data on the encrypted partition, but they can access the data stored on the unencrypted partition of the SD card, such as music or photos. This gives users the flexibility to use an SD card while still protecting the confidential apps and data on it.
You can disable the **Allow Storage Card** setting if you wish to prevent users from using SD cards entirely. If you choose not to encrypt storage, you can help protect your corporate apps and data by using the Restrict app data to the system volume and Restrict apps to the system volume settings. These help ensure that users cannot copy your apps and data to SD cards.
@@ -487,50 +487,50 @@ Here is a list of MDM storage management settings that Windows 10 Mobile provide
*Applies to: Corporate and personal devices*
-User productivity on mobile devices is often driven by apps.
+User productivity on mobile devices is often driven by apps.
-Windows 10 makes it possible to develop apps that work seamlessly across multiple devices using the Universal Windows Platform (UWP) for Windows apps. UWP converges the application platform for all devices running Windows 10 so that apps run without modification on all editions of Windows 10. This saves developers both time and resources, helping deliver apps to mobile users more quickly and efficiently. This write-once, run-anywhere model also boosts user productivity by providing a consistent, familiar app experience on any device type.
+Windows 10 makes it possible to develop apps that work seamlessly across multiple devices using the Universal Windows Platform (UWP) for Windows apps. UWP converges the application platform for all devices running Windows 10 so that apps run without modification on all editions of Windows 10. This saves developers both time and resources, helping deliver apps to mobile users more quickly and efficiently. This write-once, run-anywhere model also boosts user productivity by providing a consistent, familiar app experience on any device type.
For compatibility with existing apps, Windows Phone 8.1 apps still run on Windows 10 Mobile devices, easing the migration to the newest platform. Microsoft recommend migrating your apps to UWP to take full advantage of the improvements in Windows 10 Mobile. In addition, bridges have been developed to easily and quickly update existing Windows Phone 8.1 (Silverlight) and iOS apps to the UWP.
-Microsoft also made it easier for organizations to license and purchase UWP apps via Microsoft Store for Business and deploy them to employee devices using the Microsoft Store, or an MDM system, that can be integrated with the Microsoft Store for Business. Putting apps into the hands of mobile workers is critical, but you also need an efficient way to ensure those apps comply with corporate policies for data security.
+Microsoft also made it easier for organizations to license and purchase UWP apps via Microsoft Store for Business and deploy them to employee devices using the Microsoft Store, or an MDM system, that can be integrated with the Microsoft Store for Business. Putting apps into the hands of mobile workers is critical, but you also need an efficient way to ensure those apps comply with corporate policies for data security.
-To learn more about Universal Windows apps, see the [Guide to Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/en-us/library/windows/apps/dn894631.aspx) for additional information, or take this [Quick Start Challenge: Universal Windows Apps in Visual Studio](https://mva.microsoft.com/en-US/training-courses/quick-start-challenge-universal-windows-apps-in-visual-studio-14477?l=Be2FMfgmB_505192797). Also, see [Porting apps to Windows 10](https://msdn.microsoft.com/en-us/windows/uwp/porting/index).
+To learn more about Universal Windows apps, see the [Guide to Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/en-us/library/windows/apps/dn894631.aspx) for additional information, or take this [Quick Start Challenge: Universal Windows Apps in Visual Studio](https://mva.microsoft.com/en-US/training-courses/quick-start-challenge-universal-windows-apps-in-visual-studio-14477?l=Be2FMfgmB_505192797). Also, see [Porting apps to Windows 10](https://msdn.microsoft.com/en-us/windows/uwp/porting/index).
### Microsoft Store for Business: Sourcing the right app
*Applies to: Corporate and personal devices*
-The first step in app management is to obtain the apps your users need. You can develop your own apps or source your apps from the Microsoft Store. With Windows Phone 8.1, an MSA was needed to acquire and install apps from the Microsoft Store. With the Microsoft Store for Business, Microsoft enables organizations to acquire apps for employees from a private store with the Microsoft Store, without the need for MSAs on Windows 10 devices.
+The first step in app management is to obtain the apps your users need. You can develop your own apps or source your apps from the Microsoft Store. With Windows Phone 8.1, an MSA was needed to acquire and install apps from the Microsoft Store. With the Microsoft Store for Business, Microsoft enables organizations to acquire apps for employees from a private store with the Microsoft Store, without the need for MSAs on Windows 10 devices.
-Microsoft Store for Business is a web portal that allows IT administrators to find, acquire, manage, and distribute apps to Windows 10 devices.
+Microsoft Store for Business is a web portal that allows IT administrators to find, acquire, manage, and distribute apps to Windows 10 devices.
Azure AD authenticated managers have access to Microsoft Store for Business functionality and settings, and store managers can create a private category of apps that are specific and private to their organization. (You can get more details about what specific Azure AD accounts have access to Microsoft Store for Business here). Microsoft Store for Business enables organizations to purchase app licenses for their organization and make apps available to their employees. In addition to commercially available apps, your developers can publish line-of-business (LOB) apps to Microsoft Store for Business by request. You can also integrate their Microsoft Store for Business subscriptions with their MDM systems, so the MDM system can distribute and manage apps from Microsoft Store for Business.
-Microsoft Store for Business supports app distribution under two licensing models: online and offline.
+Microsoft Store for Business supports app distribution under two licensing models: online and offline.
The online model (store-managed) is the recommended method, and supports both personal device and corporate device management scenarios. To install online apps, the device must have Internet access at the time of installation. On corporate devices, an employee can be authenticated with an Azure AD account to install online apps. On personal devices, an employee must register their device with Azure AD to be able to install corporate licensed online apps.
-Corporate device users will find company licensed apps in the Store app on their phone in a private catalog. When an MDM system is associated with the Store for Business, IT administrators can present Store apps within the MDM system app catalog where users can find and install their desired apps. IT administrators can also push required apps directly to employee devices without the employee’s intervention.
+Corporate device users will find company licensed apps in the Store app on their phone in a private catalog. When an MDM system is associated with the Store for Business, IT administrators can present Store apps within the MDM system app catalog where users can find and install their desired apps. IT administrators can also push required apps directly to employee devices without the employee’s intervention.
Employees with personal devices can install apps licensed by their organization using the Store app on their device. They can use either the Azure AD account or Microsoft Account within the Store app if they wish to purchase personal apps. If you allow employees with corporate devices to add a secondary Microsoft Account (MSA), the Store app on the device provides a unified method for installing personal and corporate apps.
-Online licensed apps do not need to be transferred or downloaded from the Microsoft Store to the MDM system to be distributed and managed. When an employee chooses a company-owned app, it will automatically be installed from the cloud. Also, apps will be automatically updated when a new version is available or can be removed if needed. When an app is removed from a device by the MDM system or the user, Microsoft Store for Business reclaims the license so it can be used for another user or on another device.
+Online licensed apps do not need to be transferred or downloaded from the Microsoft Store to the MDM system to be distributed and managed. When an employee chooses a company-owned app, it will automatically be installed from the cloud. Also, apps will be automatically updated when a new version is available or can be removed if needed. When an app is removed from a device by the MDM system or the user, Microsoft Store for Business reclaims the license so it can be used for another user or on another device.
-To distribute an app offline (organization-managed), the app must be downloaded from the Microsoft Store for Business. This can be accomplished in the Microsoft Store for Business portal by an authorized administrator. Offline licensing requires the app developer to opt-in to the licensing model, as the Microsoft Store is no longer able to track licenses for the developer. If the app developer doesn’t allow download of the app from Microsoft Store, then you must obtain the files directly from the developer or use the online licensing method.
+To distribute an app offline (organization-managed), the app must be downloaded from the Microsoft Store for Business. This can be accomplished in the Microsoft Store for Business portal by an authorized administrator. Offline licensing requires the app developer to opt-in to the licensing model, as the Microsoft Store is no longer able to track licenses for the developer. If the app developer doesn’t allow download of the app from Microsoft Store, then you must obtain the files directly from the developer or use the online licensing method.
To install acquired Microsoft Store or LOB apps offline on a Windows 10 Mobile device, IT administrators can use an MDM system. The MDM system distributes the app packages that you downloaded from Microsoft Store (also called sideloading) to Windows 10 Mobile devices. Support for offline app distribution depends on the MDM system you are using, so consult your MDM vendor documentation for details. You can fully automate the app deployment process so that no user intervention is required.
Microsoft Store apps or LOB apps that have been uploaded to the Microsoft Store for Business are automatically trusted on all Windows devices, as they are cryptographically signed with Microsoft Store certificates. LOB apps that are uploaded to the Microsoft Store for Business are private to your organization and are never visible to other companies or consumers. If you do not want to upload your LOB apps, you have to establish trust for the app on your devices. To establish this trust, you’ll need to generate a signing certificate with your Public Key Infrastructure and add your chain of trust to the trusted certificates on the device (see the certificates section). You can install up to 20 self-signed LOB apps per device with Windows 10 Mobile. To install more than 20 apps on a device, you can purchase a signing certificate from a trusted public Certificate Authority, or upgrade your devices to Windows 10 Mobile Enterprise edition.
-Learn more about the [Microsoft Store for Business](/microsoft-store/index).
+Learn more about the [Microsoft Store for Business](/microsoft-store/index).
### Managing apps
*Applies to: Corporate devices*
-IT administrators can control which apps are allowed to be installed on Windows 10 Mobile devices and how they should be kept up-to-date.
+IT administrators can control which apps are allowed to be installed on Windows 10 Mobile devices and how they should be kept up-to-date.
-Windows 10 Mobile includes AppLocker, which enables administrators to create allow or disallow (sometimes also called whitelist/blacklist) lists of apps from the Microsoft Store. This capability extends to built-in apps, as well, such as Xbox, Groove, text messaging, email, and calendar, etc. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. However, it is not always an easy approach to find a balance between what employees need or request and security concerns. Creating allow or disallow lists also requires keeping up with the changing app landscape in the Microsoft Store.
+Windows 10 Mobile includes AppLocker, which enables administrators to create allow or disallow (sometimes also called whitelist/blacklist) lists of apps from the Microsoft Store. This capability extends to built-in apps, as well, such as Xbox, Groove, text messaging, email, and calendar, etc. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. However, it is not always an easy approach to find a balance between what employees need or request and security concerns. Creating allow or disallow lists also requires keeping up with the changing app landscape in the Microsoft Store.
For more details, see [AppLocker CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920019(v=vs.85).aspx).
@@ -540,13 +540,13 @@ In addition to controlling which apps are allowed, IT professionals can also imp
- **Allow App Store Auto Update** Whether automatic updates of apps from Microsoft Store are allowed.
- **Allow Developer Unlock** Whether developer unlock is allowed.
- **Allow Shared User App Data** Whether multiple users of the same app can share data.
-- **Allow Store** Whether Microsoft Store app is allowed to run. This will completely block the user from installing apps from the Store, but will still allow app distribution through an MDM system.
+- **Allow Store** Whether Microsoft Store app is allowed to run. This will completely block the user from installing apps from the Store, but will still allow app distribution through an MDM system.
- **Application Restrictions** An XML blob that defines the app restrictions for a device. The XML blob can contain an app allow or deny list. You can allow or deny apps based on their app ID or publisher. See AppLocker above.
- **Disable Store Originated Apps** Disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded before the policy was applied.
- **Require Private Store Only** Whether the private store is exclusively available to users in the Store app on the device. If enabled, only the private store is available. If disabled, the retail catalog and private store are both available.
- **Restrict App Data to System Volume** Whether app data is allowed only on the system drive or can be stored on an SD card.
- **Restrict App to System Volume** Whether app installation is allowed only to the system drive or can be installed on an SD card.
-- **Start screen layout** An XML blob used to configure the Start screen (see [Start layout for Windows 10 Mobile](http://msdn.microsoft.com/en-us/library/windows/hardware/mt171093(v=vs.85).aspx) for more information).
+- **Start screen layout** An XML blob used to configure the Start screen (see [Start layout for Windows 10 Mobile](https://msdn.microsoft.com/en-us/library/windows/hardware/mt171093(v=vs.85).aspx) for more information).
Find more details on application management options in the [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#ApplicationManagement_AllowAllTrustedApps)
@@ -554,16 +554,16 @@ Find more details on application management options in the [Policy CSP](https://
*Applies to: Corporate and personal devices*
-One of the biggest challenges in protecting corporate information on mobile devices is keeping that data separate from personal data. Most solutions available to create this data separation require users to login in with a separate username and password to a container that stores all corporate apps and data, an experience that degrades user productivity.
+One of the biggest challenges in protecting corporate information on mobile devices is keeping that data separate from personal data. Most solutions available to create this data separation require users to login in with a separate username and password to a container that stores all corporate apps and data, an experience that degrades user productivity.
-Windows 10 Mobile includes Windows Information Protection to transparently keep corporate data protected and personal data private. It automatically tags personal and corporate data and applies policies for those apps that can access data classified as corporate. This includes when data is at rest on local or removable storage. Because corporate data is always protected, users cannot copy it to public locations like social media or personal email.
+Windows 10 Mobile includes Windows Information Protection to transparently keep corporate data protected and personal data private. It automatically tags personal and corporate data and applies policies for those apps that can access data classified as corporate. This includes when data is at rest on local or removable storage. Because corporate data is always protected, users cannot copy it to public locations like social media or personal email.
-Windows Information Protection works with all apps, which are classified into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on policies. Corporate data will be encrypted at all times and attempts to copy/paste or share this information with non-corporate apps or users will fail. Unenlightened apps consider all data corporate and encrypt everything by default.
+Windows Information Protection works with all apps, which are classified into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on policies. Corporate data will be encrypted at all times and attempts to copy/paste or share this information with non-corporate apps or users will fail. Unenlightened apps consider all data corporate and encrypt everything by default.
-Any app developed on the UWA platform can be enlightened. Microsoft has made a concerted effort to enlighten several of its most popular apps, including:
+Any app developed on the UWA platform can be enlightened. Microsoft has made a concerted effort to enlighten several of its most popular apps, including:
- Microsoft Edge
- Microsoft People
-- Mobile Office apps (Word, Excel, PowerPoint, and OneNote)
+- Mobile Office apps (Word, Excel, PowerPoint, and OneNote)
- Outlook Mail and Calendar
- Microsoft Photos
- Microsoft OneDrive
@@ -571,28 +571,28 @@ Any app developed on the UWA platform can be enlightened. Microsoft has made a c
- Microsoft Movies & TV
- Microsoft Messaging
-The following table lists the settings that can be configured for Windows Information Protection:
+The following table lists the settings that can be configured for Windows Information Protection:
- **Enforcement level*** Set the enforcement level for information protection:
- Off (no protection)
- Silent mode (encrypt and audit only)
- Override mode (encrypt, prompt, and audit)
- Block mode (encrypt, block, and audit)
-- **Enterprise protected domain names*** A list of domains used by the enterprise for its user identities. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected.
-- **Allow user decryption** Allows the user to decrypt files. If not allowed, the user will not be able to remove protection from enterprise content through the OS or app user experience.
-- **Require protection under lock configuration** Specifies whether the protection under lock feature (also known as encrypt under PIN) should be configured.
-- **Data recovery certificate*** Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent (DRA) certificate for encrypting file system (EFS), only delivered through MDM instead of Group Policy.
-- **Revoke on unenroll** Whether to revoke the information protection keys when a device unenrolls from the management service.
-- **RMS template ID for information protection** Allows the IT admin to configure the details about who has access to RMS-protected files and for how long.
+- **Enterprise protected domain names*** A list of domains used by the enterprise for its user identities. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected.
+- **Allow user decryption** Allows the user to decrypt files. If not allowed, the user will not be able to remove protection from enterprise content through the OS or app user experience.
+- **Require protection under lock configuration** Specifies whether the protection under lock feature (also known as encrypt under PIN) should be configured.
+- **Data recovery certificate*** Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent (DRA) certificate for encrypting file system (EFS), only delivered through MDM instead of Group Policy.
+- **Revoke on unenroll** Whether to revoke the information protection keys when a device unenrolls from the management service.
+- **RMS template ID for information protection** Allows the IT admin to configure the details about who has access to RMS-protected files and for how long.
- **Allow Azure RMS for information protection** Specifies whether to allow Azure RMS encryption for information protection.
- **Show information protection icons** Determines whether overlays are added to icons for information protection secured files in web browser and enterprise-only app tiles in the Start menu.
-- **Status** A read-only bit mask that indicates the current state of information protection on the device. The MDM service can use this value to determine the current overall state of information protection.
+- **Status** A read-only bit mask that indicates the current state of information protection on the device. The MDM service can use this value to determine the current overall state of information protection.
- **Enterprise IP Range*** The enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected.
- **Enterprise Network Domain Names*** the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected.
- **Enterprise Cloud Resources** A list of Enterprise resource domains hosted in the cloud that need to be protected.
>**Note:** * Are mandatory Windows Information Protection policies. To make Windows Information Protection functional, AppLocker and network isolation settings - specifically Enterprise IP Range and Enterprise Network Domain Names – must be configured. This defines the source of all corporate data that needs protection and also ensures data written to these locations won’t be encrypted by the user’s encryption key (so that others in the company can access it.
-For more information on Windows Information Protection, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634(v=vs.85).aspx) and the following in-depth article series [Protect your enterprise data using Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip).
+For more information on Windows Information Protection, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634(v=vs.85).aspx) and the following in-depth article series [Protect your enterprise data using Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip).
### Managing user activities
@@ -615,7 +615,7 @@ On corporate devices, some user activities expose corporate data to unnecessary
- **Enable Offline Maps Auto Update** Disables the automatic download and update of map data
- **Allow Offline Maps Download Over Metered Connection** Allows the download and update of map data over metered connections
-You can find more details on the experience settings in Policy CSP.
+You can find more details on the experience settings in Policy CSP.
### Microsoft Edge
@@ -639,7 +639,7 @@ The following settings for Microsoft Edge on Windows 10 Mobile can be managed.
## Manage
-In enterprise IT environments, the need for security and cost control must be balanced against the desire to provide users with the latest technologies. Since cyberattacks have become an everyday occurrence, it is important to properly maintain the state of your Windows 10 Mobile devices. IT needs to control configuration settings, keeping them from drifting out of compliance, as well as enforce which devices can access internal applications. Windows 10 Mobile delivers the mobile operations management capabilities necessary to ensure that devices are in compliance with corporate policy.
+In enterprise IT environments, the need for security and cost control must be balanced against the desire to provide users with the latest technologies. Since cyberattacks have become an everyday occurrence, it is important to properly maintain the state of your Windows 10 Mobile devices. IT needs to control configuration settings, keeping them from drifting out of compliance, as well as enforce which devices can access internal applications. Windows 10 Mobile delivers the mobile operations management capabilities necessary to ensure that devices are in compliance with corporate policy.
### Servicing options
@@ -647,7 +647,7 @@ In enterprise IT environments, the need for security and cost control must be ba
*Applies to: Corporate and personal devices*
-Microsoft has streamlined the Windows product engineering and release cycle so new features, experiences, and functionality demanded by the market can be delivered more quickly than ever before. Microsoft plans to deliver two Feature Updates per year (12-month period). Feature Updates establish a Current Branch or CB, and have an associated version.
+Microsoft has streamlined the Windows product engineering and release cycle so new features, experiences, and functionality demanded by the market can be delivered more quickly than ever before. Microsoft plans to deliver two Feature Updates per year (12-month period). Feature Updates establish a Current Branch or CB, and have an associated version.
@@ -663,27 +663,27 @@ Microsoft has streamlined the Windows product engineering and release cycle so n
Current Branch
-
1511
+
1511
November 2015
Current Branch for Business
-
1511
+
1511
March 2016
Current Branch
-
1607
+
1607
July 2016
-Microsoft will also deliver and install monthly updates for security and stability directly to Windows 10 Mobile devices. These Quality Updates, released under Microsoft control via Windows Update, are available for all devices running Windows 10 Mobile. Windows 10 Mobile devices consume Feature Updates and Quality Updates as part of the same standard update process.
+Microsoft will also deliver and install monthly updates for security and stability directly to Windows 10 Mobile devices. These Quality Updates, released under Microsoft control via Windows Update, are available for all devices running Windows 10 Mobile. Windows 10 Mobile devices consume Feature Updates and Quality Updates as part of the same standard update process.
-Quality Updates are usually smaller than Feature Updates, but the installation process and experience is very similar, though larger updates will take more time to install. Enterprise customers can manage the update experience and process on Windows 10 Mobile devices using an MDM system, after upgrading the devices to Enterprise edition. In most cases, policies to manage the update process will apply to both feature and quality updates.
+Quality Updates are usually smaller than Feature Updates, but the installation process and experience is very similar, though larger updates will take more time to install. Enterprise customers can manage the update experience and process on Windows 10 Mobile devices using an MDM system, after upgrading the devices to Enterprise edition. In most cases, policies to manage the update process will apply to both feature and quality updates.
-Microsoft aspires to update Windows 10 Mobile devices with the latest updates automatically and without being disruptive for all customers. Out-of-the-box, a Windows 10 Mobile device will Auto Scan for available updates. However, depending on the device’s network and power status, update methods and timing will vary.
+Microsoft aspires to update Windows 10 Mobile devices with the latest updates automatically and without being disruptive for all customers. Out-of-the-box, a Windows 10 Mobile device will Auto Scan for available updates. However, depending on the device’s network and power status, update methods and timing will vary.
@@ -706,26 +706,26 @@ Microsoft aspires to update Windows 10 Mobile devices with the latest updates au
Wi-Fi
Device is connected to a personal or corporate Wi-Fi network (no data charges)
-
Yes
+
Yes
Yes/td>
-
Yes
-
Yes – outside of Active Hours (forced restart after 7 days if user postpones restart)
+
Yes
+
Yes – outside of Active Hours (forced restart after 7 days if user postpones restart)
Cellular
Device is only connected to a cellular network (standard data charges apply)
-
Will skip a daily scan if scan was successfully completed in the last 5 days
+
Will skip a daily scan if scan was successfully completed in the last 5 days
Will only occur if update package is small and does not exceed the mobile operator data limit.
-
Yes
-
Idem
+
Yes
+
Idem
Cellular -- Roaming
Device is only connected to a cellular network and roaming charges apply
-
No
No
-
No
-
Idem
+
No
+
No
+
Idem
@@ -734,10 +734,10 @@ Microsoft aspires to update Windows 10 Mobile devices with the latest updates au
*Applies to: Corporate and Personal devices*
-Microsoft publishes new feature updates for Windows 10 and Windows 10 Mobile on a regular basis. The [Windows release information page](https://technet.microsoft.com/en-us/windows/release-info) is designed to help you determine if your devices are current with the latest Windows 10 feature and quality updates. The release information published on this page, covers both Windows 10 for PCs and Windows 10 Mobile. In addition, the [Windows update history page](http://windows.microsoft.com/en-us/windows-10/update-history-windows-10) helps you understand what these updates are about.
+Microsoft publishes new feature updates for Windows 10 and Windows 10 Mobile on a regular basis. The [Windows release information page](https://technet.microsoft.com/en-us/windows/release-info) is designed to help you determine if your devices are current with the latest Windows 10 feature and quality updates. The release information published on this page, covers both Windows 10 for PCs and Windows 10 Mobile. In addition, the [Windows update history page](https://windows.microsoft.com/en-us/windows-10/update-history-windows-10) helps you understand what these updates are about.
->**Note:**
-We invite IT Professionals to participate in the Windows Insider Program to test updates before they are officially released to make Windows 10 Mobile even better. If you find any issues, please send us feedback via the Feedback Hub
+>**Note:**
+We invite IT Professionals to participate in the Windows Insider Program to test updates before they are officially released to make Windows 10 Mobile even better. If you find any issues, please send us feedback via the Feedback Hub
**Windows as a Service**
@@ -745,7 +745,7 @@ We invite IT Professionals to participate in the Windows Insider Program to test
Microsoft created a new way to deliver and install updates to Windows 10 Mobile directly to devices without Mobile Operator approval. This capability helps to simplify update deployments and ongoing management, broadens the base of employees who can be kept current with the latest Windows features and experiences, and lowers total cost of ownership for organizations who no longer have to manage updates to keep devices secure.
-Update availability depends on what servicing option you choose for the device. These servicing options are outlined in the chart below:
+Update availability depends on what servicing option you choose for the device. These servicing options are outlined in the chart below:
@@ -766,23 +766,23 @@ Update availability depends on what servicing option you choose for the device.
Windows Insider Builds
As appropriate during development cycle, released to Windows Insiders only
-
Variable, until the next Insider build is released to Windows Insiders
+
Variable, until the next Insider build is released to Windows Insiders
Allows Insiders to test new feature and application compatibility before a Feature Update is released/td>
Mobile
Current Branch (CB)
Immediately after the Feature Update is published to Windows Update by Microsoft
-
Microsoft typically releases two Feature Updates per 12-month period (approximately every four months, though it can potentially be longer)
+
Microsoft typically releases two Feature Updates per 12-month period (approximately every four months, though it can potentially be longer)
Makes new features available to users as soon as possible
-
Mobile & Mobile Enterprise
+
Mobile & Mobile Enterprise
Current Branch for Business (CBB)
A minimum of four months after the corresponding Feature Update is first published to Windows Update by Microsoft
-
A minimum of four months, though it potentially can be longerNo
+
A minimum of four months, though it potentially can be longerNo
Provides additional time to test new feature before deployment
-
Mobile Enterprise only
+
Mobile Enterprise only
@@ -791,12 +791,12 @@ Update availability depends on what servicing option you choose for the device.
*Applies to: Corporate devices*
-While Windows 10 Mobile provides updates directly to user devices from Windows Update, there are many organizations that want to track, test, and schedule updates to corporate devices. To support these requirements, we created the Windows 10 Mobile Enterprise edition.
+While Windows 10 Mobile provides updates directly to user devices from Windows Update, there are many organizations that want to track, test, and schedule updates to corporate devices. To support these requirements, we created the Windows 10 Mobile Enterprise edition.
Upgrading to Windows 10 Mobile Enterprise edition provides additional device and app management capabilities for organizations that want to:
-- **Defer, approve and deploy feature and quality updates:** Windows 10 Mobile devices get updates directly from Windows Update. If you want to curate updates prior to deploying them, an upgrade to Windows 10 Mobile Enterprise edition is required. Once Enterprise edition is enabled, the phone can be set to the Current Branch for Business servicing option, giving IT additional time to test updates before they are released.
+- **Defer, approve and deploy feature and quality updates:** Windows 10 Mobile devices get updates directly from Windows Update. If you want to curate updates prior to deploying them, an upgrade to Windows 10 Mobile Enterprise edition is required. Once Enterprise edition is enabled, the phone can be set to the Current Branch for Business servicing option, giving IT additional time to test updates before they are released.
- **Deploy an unlimited number of self-signed LOB apps to a single device:** To use an MDM system to deploy LOB apps directly to devices, you must cryptographically sign the software packages with a code signing certificate that your organization’s certificate authority (CA) generates. You can deploy a maximum of 20 self-signed LOB apps to a Windows 10 Mobile device. To deploy more than 20 self-signed LOB apps, Windows 10 Mobile Enterprise is required.
-- **Set the diagnostic data level:** Microsoft collects diagnostic data to help keep Windows devices secure and to help Microsoft improve the quality of Windows and Microsoft services. An upgrade to Windows 10 Mobile Enterprise edition is required to set the diagnostic data level so that only diagnostic information required to keep devices secured is gathered.
+- **Set the diagnostic data level:** Microsoft collects diagnostic data to help keep Windows devices secure and to help Microsoft improve the quality of Windows and Microsoft services. An upgrade to Windows 10 Mobile Enterprise edition is required to set the diagnostic data level so that only diagnostic information required to keep devices secured is gathered.
To learn more about diagnostic, see [Configure Windows diagnostic data in your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization).
@@ -804,25 +804,25 @@ To activate Windows 10 Mobile Enterprise, use your MDM system or a provisioning
Details on updating a device to Enterprise edition with [WindowsLicensing CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904983(v=vs.85).aspx)
->**Recommendation:** Microsoft recommends using Enterprise edition only on corporate devices. Once a device has been upgraded, it cannot be downgraded. Even a device wipe or reset will not remove the enterprise license from personal devices.
+>**Recommendation:** Microsoft recommends using Enterprise edition only on corporate devices. Once a device has been upgraded, it cannot be downgraded. Even a device wipe or reset will not remove the enterprise license from personal devices.
**Deferring and Approving Updates with MDM**
*Applies to: Corporate devices with Enterprise edition*
-Once a device is upgraded to Windows 10 Mobile Enterprise edition, you can manage devices that receive updates from Windows Update (or Windows Update for Business) with a set of update policies.
+Once a device is upgraded to Windows 10 Mobile Enterprise edition, you can manage devices that receive updates from Windows Update (or Windows Update for Business) with a set of update policies.
-To control Feature Updates, you will need to move your devices to the Current Branch for Business (CBB) servicing option. A device that subscribes to CBB will wait for the next CBB to be published by Microsoft Update. While the device will wait for Feature Updates until the next CBB, Quality Updates will still be received by the device.
+To control Feature Updates, you will need to move your devices to the Current Branch for Business (CBB) servicing option. A device that subscribes to CBB will wait for the next CBB to be published by Microsoft Update. While the device will wait for Feature Updates until the next CBB, Quality Updates will still be received by the device.
-To control monthly Quality Update additional deferral policies, need to be set to your desired deferral period. When Quality Updates are available for your Windows 10 Mobile devices from Windows Update, these updates will not install until your deferral period lapses. This gives IT Professionals some time to test the impact of the updates on devices and apps.
+To control monthly Quality Update additional deferral policies, need to be set to your desired deferral period. When Quality Updates are available for your Windows 10 Mobile devices from Windows Update, these updates will not install until your deferral period lapses. This gives IT Professionals some time to test the impact of the updates on devices and apps.
-Before updates are distributed and installed, you may want to test them for issues or application compatibility. IT pros have the ability require updates to be approved. This enables the MDM administrator to select and approve specific updates to be installed on a device and accept the EULA associated with the update on behalf of the user. Please remember that on Windows 10 Mobile all updates are packaged as a “OS updates” and never as individual fixes.
+Before updates are distributed and installed, you may want to test them for issues or application compatibility. IT pros have the ability require updates to be approved. This enables the MDM administrator to select and approve specific updates to be installed on a device and accept the EULA associated with the update on behalf of the user. Please remember that on Windows 10 Mobile all updates are packaged as a “OS updates” and never as individual fixes.
-You may want to choose to handle Quality Updates and Feature Updates in the same way and not wait for the next CBB to be released to your devices. This streamlines the release of updates using the same process for approval and release. You can apply different deferral period by type of update. In version 1607 Microsoft added additional policy settings to enable more granularity to control over updates.
+You may want to choose to handle Quality Updates and Feature Updates in the same way and not wait for the next CBB to be released to your devices. This streamlines the release of updates using the same process for approval and release. You can apply different deferral period by type of update. In version 1607 Microsoft added additional policy settings to enable more granularity to control over updates.
-Once updates are being deployed to your devices, you may want to pause the rollout of updates to enterprise devices.
-For example, after you start rolling out a quality update, certain phone models are adversely impacted or users are reporting a specific LOB app is not connecting and updating a database. Problems can occur that did not surface during initial testing.
-IT professionals can pause updates to investigate and remediate unexpected issues.
+Once updates are being deployed to your devices, you may want to pause the rollout of updates to enterprise devices.
+For example, after you start rolling out a quality update, certain phone models are adversely impacted or users are reporting a specific LOB app is not connecting and updating a database. Problems can occur that did not surface during initial testing.
+IT professionals can pause updates to investigate and remediate unexpected issues.
The following table summarizes applicable update policy settings by version of Windows 10 Mobile. All policy settings are backward compatible, and will be maintained in future Feature Updates. Consult the documentation of your MDM system to understand support for these settings in your MDM.
@@ -859,20 +859,20 @@ Defer Feature and Quality Updates for up to 30 days.
Approve Updates
RequireUpdateApproval
-
+
RequireUpdateApproval
-
-
+
+
Pause Update rollout once an approved update is being deployed, pausing the rollout of the update.
PauseDeferrals
-Pause Feature Updates for up to 35 days
+Pause Feature Updates for up to 35 days
PauseQualityUpdates
-Pause Feature Updates for up to 35 days
+Pause Feature Updates for up to 35 days
@@ -881,33 +881,33 @@ Pause Feature Updates for up to 35 days
*Applies to: Corporate devices with Enterprise edition*
-Set update client experience with [Allowautomaticupdate](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_AllowAutoUpdate) policy for your employees. This allows the IT Pro to influence the way the update client on the devices behaves when scanning, downloading, and installing updates.
+Set update client experience with [Allowautomaticupdate](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_AllowAutoUpdate) policy for your employees. This allows the IT Pro to influence the way the update client on the devices behaves when scanning, downloading, and installing updates.
-This can include:
+This can include:
- Notifying users prior to downloading updates.
- Automatically downloading updates, and then notifying users to schedule a restart (this is the default behavior if this policy is not configured).
- Automatically downloading and restarting devices with user notification.
- Automatically downloading and restarting devices at a specified time.
- Automatically downloading and restarting devices without user interaction.
-- Turning off automatic updates. This option should be used only for systems under regulatory compliance. The device will not receive any updates.
+- Turning off automatic updates. This option should be used only for systems under regulatory compliance. The device will not receive any updates.
-In addition, in version 1607, you can configure when the update is applied to the employee device to ensure updates installs or reboots don’t interrupt business or worker productivity. Update installs and reboots can be scheduled [outside of active hours](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ActiveHoursEnd) (supported values are 0-23, where 0 is 12am, 1 is 1am, etc.) or on a specific what [day of the week](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ScheduledInstallDay) (supported values are 0-7, where 0 is every day, 1 is Sunday, 2 is Monday, etc.).
+In addition, in version 1607, you can configure when the update is applied to the employee device to ensure updates installs or reboots don’t interrupt business or worker productivity. Update installs and reboots can be scheduled [outside of active hours](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ActiveHoursEnd) (supported values are 0-23, where 0 is 12am, 1 is 1am, etc.) or on a specific what [day of the week](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ScheduledInstallDay) (supported values are 0-7, where 0 is every day, 1 is Sunday, 2 is Monday, etc.).
**Managing the source of updates with MDM**
*Applies to: Corporate devices with Enterprise edition*
-Although Windows 10 Enterprise enables IT administrators to defer installation of new updates from Windows Update, enterprises may also want additional control over update processes. With this in mind, Microsoft created Windows Update for Business. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates. If you are using a MDM system, the use of Windows Update for Business is not a requirement, as you can manage these features from your MDM system.
+Although Windows 10 Enterprise enables IT administrators to defer installation of new updates from Windows Update, enterprises may also want additional control over update processes. With this in mind, Microsoft created Windows Update for Business. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates. If you are using a MDM system, the use of Windows Update for Business is not a requirement, as you can manage these features from your MDM system.
-Learn more about [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb).
+Learn more about [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb).
-IT administrators can specify where the device gets updates from with AllowUpdateService. This could be Microsoft Update, Windows Update for Business, or Windows Server Update Services (WSUS.
+IT administrators can specify where the device gets updates from with AllowUpdateService. This could be Microsoft Update, Windows Update for Business, or Windows Server Update Services (WSUS.
**Managing Updates with Windows Update Server**
*Applies to: Corporate devices with Enterprise edition*
-When using WSUS, set **UpdateServiceUrl** to allow the device to check for updates from a WSUS server instead of Windows Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet, usually handheld devices used for task completion, or other Windows IoT devices.
+When using WSUS, set **UpdateServiceUrl** to allow the device to check for updates from a WSUS server instead of Windows Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet, usually handheld devices used for task completion, or other Windows IoT devices.
Learn more about [managing updates with Windows Server Update Services (WSUS)](https://technet.microsoft.com/en-us/windowsserver/bb332157.aspx)
@@ -915,46 +915,46 @@ Learn more about [managing updates with Windows Server Update Services (WSUS)](h
*Applies to: Personal and corporate devices*
-In addition to configuring how Windows 10 Mobile Enterprise obtains updates, the MDM administrator can query devices for Windows 10 Mobile update information so that update status can be checked against a list of approved updates.
+In addition to configuring how Windows 10 Mobile Enterprise obtains updates, the MDM administrator can query devices for Windows 10 Mobile update information so that update status can be checked against a list of approved updates.
The device update status query provides an overview of:
-- Installed updates: A list of updates that are installed on the device.
-- Installable updates: A list of updates that are available for installation.
+- Installed updates: A list of updates that are installed on the device.
+- Installable updates: A list of updates that are available for installation.
- Failed updates: A list of updates that failed during installation, including indication of why the update failed.
-- Pending reboot: A list of updates that require a restart to complete update installation.
-- Last successful scan time: The last time a successful update scan was completed.
-- Defer upgrade: Whether the upgrade is deferred until the next update cycle.
+- Pending reboot: A list of updates that require a restart to complete update installation.
+- Last successful scan time: The last time a successful update scan was completed.
+- Defer upgrade: Whether the upgrade is deferred until the next update cycle.
-### Device health
+### Device health
*Applies to: Personal and corporate devices*
-Device Health Attestation (DHA) is another line of defense that is new to Windows 10 Mobile. It can be used to remotely detect devices that lack a secure configuration or have vulnerabilities that could allow them to be easily exploited by sophisticated attacks.
+Device Health Attestation (DHA) is another line of defense that is new to Windows 10 Mobile. It can be used to remotely detect devices that lack a secure configuration or have vulnerabilities that could allow them to be easily exploited by sophisticated attacks.
-Windows 10 Mobile makes it easy to integrate with Microsoft Intune or third-party MDM solutions for an overall view of device health and compliance. Using these solutions together, you can detect jailbroken devices, monitor device compliance, generate compliance reports, alert users or administrators to issues, initiate corrective action, and manage conditional access to resources like Office 365 or VPN.
+Windows 10 Mobile makes it easy to integrate with Microsoft Intune or third-party MDM solutions for an overall view of device health and compliance. Using these solutions together, you can detect jailbroken devices, monitor device compliance, generate compliance reports, alert users or administrators to issues, initiate corrective action, and manage conditional access to resources like Office 365 or VPN.
-The first version of Device Health Attestation (DHA) was released in June 2015 for Windows 10 devices that supported TPM 2.0 and operated in an enterprise cloud-based topology. In the Windows 10 anniversary release, Device Health Attestation (DHA) capabilities are extended to legacy devices that support TPM 1.2, hybrid, and on-premises environments that have access to the Internet or operate in an air-gapped network.
+The first version of Device Health Attestation (DHA) was released in June 2015 for Windows 10 devices that supported TPM 2.0 and operated in an enterprise cloud-based topology. In the Windows 10 anniversary release, Device Health Attestation (DHA) capabilities are extended to legacy devices that support TPM 1.2, hybrid, and on-premises environments that have access to the Internet or operate in an air-gapped network.
-The health attestation feature is based on Open Mobile Alliance (OMA) standards. IT managers can use DHA to validate devices that:
+The health attestation feature is based on Open Mobile Alliance (OMA) standards. IT managers can use DHA to validate devices that:
- Run Windows 10 operating system (mobile phone or PC)
-- Support Trusted Module Platform (TPM 1.2 or 2.0) in discrete of firmware format
+- Support Trusted Module Platform (TPM 1.2 or 2.0) in discrete of firmware format
- Are managed by a DHA-enabled device management solution (Intune or third-party MDM)
-- Operate in cloud, hybrid, on-premises, and BYOD scenarios
+- Operate in cloud, hybrid, on-premises, and BYOD scenarios
DHA-enabled device management solutions help IT managers create a unified security bar across all managed Windows 10 Mobile devices. This allows IT managers to:
- Collect hardware attested data (highly assured) data remotely
- Monitor device health compliance and detect devices that are vulnerable or could be exploited by sophisticated attacks
-- Take actions against potentially compromised devices, such as:
+- Take actions against potentially compromised devices, such as:
- Trigger corrective actions remotely so offending device is inaccessible (lock, wipe, or brick the device)
- Prevent the device from getting access to high-value assets (conditional access)
- Trigger further investigation and monitoring (route the device to a honeypot for further monitoring)
-- Simply alert the user or the admin to fix the issue
+- Simply alert the user or the admin to fix the issue
>**Note:** Windows Device Health Attestation Service can be used for conditional access scenarios which may be enabled by Mobile Device Management solutions (e.g.: Microsoft Intune) and other types of management systems (e.g.: SCCM) purchased separately.
For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](/windows/device-security/windows-10-mobile-security-guide).
-Thisis a lists of attributes that are supported by DHA and can trigger the corrective actions mentioned above.
+Thisis a lists of attributes that are supported by DHA and can trigger the corrective actions mentioned above.
- **Attestation Identity Key (AIK) present** Indicates that an AIK is present (i.e., the device can be trusted more than a device without an AIK).
- **Data Execution Prevention (DEP) enabled** Whether a DEP policy is enabled for the device, indicating that the device can be trusted more than a device without a DEP policy.
- **BitLocker status** BitLocker helps protect the storage on the device. A device with BitLocker can be trusted more than a device without BitLocker.
@@ -969,17 +969,17 @@ Thisis a lists of attributes that are supported by DHA and can trigger the corre
- **Secure Boot Configuration Policy (SBCP) present** Whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash.
- **Boot cycle whitelist** The view of the host platform between boot cycles as defined by the manufacturer compared to a published whitelist. A device that complies with the whitelist is more trustworthy (secure) than a device that is noncompliant.
-**Example scenario**
+**Example scenario**
-Windows 10 mobile has protective measures that work together and integrate with Microsoft Intune or third-party Mobile Device Management (MDM) solutions. IT administrators can monitor and verify compliance to ensure corporate resources are protected end-to–end with the security and trust rooted in the physical hardware of the device.
+Windows 10 mobile has protective measures that work together and integrate with Microsoft Intune or third-party Mobile Device Management (MDM) solutions. IT administrators can monitor and verify compliance to ensure corporate resources are protected end-to–end with the security and trust rooted in the physical hardware of the device.
Here is what occurs when a smartphone is turned on:
1. Windows 10 Secure Boot protects the boot sequence, enables the device to boot into a defined and trusted configuration, and loads a factory trusted boot loader.
2. Windows 10 Trusted Boot takes control, verifies the digital signature of the Windows kernel, and the components are loaded and executed during the Windows startup process.
-3. In parallel to Steps 1 and 2, Windows 10 Mobile TPM (Trusted Platform Modules – measured boot) runs independently in a hardware-protected security zone (isolated from boot execution path monitors boot activities) to create an integrity protected and tamper evident audit trail - signed with a secret that is only accessible by TPM.
-4. Devices managed by a DHA-enabled MDM solution send a copy of this audit trail to Microsoft Health Attestation Service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel.
-5. Microsoft HAS reviews the audit trails, issues an encrypted/signed report, and forwards it to the device.
-6. IT managers can use a DHA-enabled MDM solution to review the report in a protected, tamper-resistant and tamper-evident communication channel. They can assess if a device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with security needs and enterprise policies.
+3. In parallel to Steps 1 and 2, Windows 10 Mobile TPM (Trusted Platform Modules – measured boot) runs independently in a hardware-protected security zone (isolated from boot execution path monitors boot activities) to create an integrity protected and tamper evident audit trail - signed with a secret that is only accessible by TPM.
+4. Devices managed by a DHA-enabled MDM solution send a copy of this audit trail to Microsoft Health Attestation Service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel.
+5. Microsoft HAS reviews the audit trails, issues an encrypted/signed report, and forwards it to the device.
+6. IT managers can use a DHA-enabled MDM solution to review the report in a protected, tamper-resistant and tamper-evident communication channel. They can assess if a device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with security needs and enterprise policies.
### Asset reporting
@@ -1012,7 +1012,7 @@ The following list shows examples of the Windows 10 Mobile software and hardware
*Applies to: Corporate devices with Windows 10 Mobile Enterprise edition*
-Microsoft uses diagnostics, performance, and usage data from Windows devices to help inform decisions and focus efforts to provide the most robust and valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Diagnostic data helps keep Windows devices healthy, improve the operating system, and personalize features and services.
+Microsoft uses diagnostics, performance, and usage data from Windows devices to help inform decisions and focus efforts to provide the most robust and valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Diagnostic data helps keep Windows devices healthy, improve the operating system, and personalize features and services.
You can control the level of data that diagnostic data systems collect. To configure devices, specify one of these levels in the Allow Telemetry setting with your MDM system.
@@ -1030,7 +1030,7 @@ The remote assistance features in Windows 10 Mobile help resolve issues that use
- **Remote ring** Support personnel can remotely make devices ring. This ability can help users locate misplaced devices and, in conjunction with the Remote Lock feature, help ensure that unauthorized users are unable to access the device if they find it.
- **Remote find** Support personnel can remotely locate a device on a map, which helps identify the geographic location of the device. Remote find parameters can be configured via phone settings (see table below). The remote find feature returns the most current latitude, longitude, and altitude of the device.
-**Remote assistance policies**
+**Remote assistance policies**
- **Desired location accuracy** The desired accuracy as a radius value in meters; has a value between 1 and 1,000 meters
- **Maximum remote find** Maximum length of time in minutes that the server will accept a successful remote find; has a value between 0 and 1,000 minutes
- **Remote find timeout** The number of seconds devices should wait for a remote find to finish; has a value between 0 and 1,800 seconds
@@ -1045,17 +1045,17 @@ These remote management features help organizations reduce the IT effort require
Device retirement is the last phase of the device lifecycle, which in today’s business environment averages about 18 months. After that time period, employees want the productivity and performance improvements that come with the latest hardware. It’s important that devices being replaced with newer models are securely retired since you don’t want any company data to remain on discarded devices that could compromise the confidentiality of your data. This is typically not a problem with corporate devices, but it can be more challenging in a personal device scenario. You need to be able to selectively wipe all corporate data without impacting personal apps and data on the device. IT also needs a way to adequately support users who need to wipe devices that are lost or stolen.
-Windows 10 Mobile IT supports device retirement in both personal and corporate scenarios, allowing IT to be confident that corporate data remains confidential and user privacy is protected.
+Windows 10 Mobile IT supports device retirement in both personal and corporate scenarios, allowing IT to be confident that corporate data remains confidential and user privacy is protected.
>**Note:** All these MDM capabilities are in addition to the device’s software and hardware factory reset features, which employees can use to restore devices to their factory configuration.
-**Personal devices:** Windows 10 mobile supports the USA regulatory requirements for a “kill switch” in case your phone is lost or stolen. Reset protection is a free service on account.microsoft.com that helps ensure that the phone cannot be easily reset and reused. All you need to do to turn on **Reset Protection** is sign in with your Microsoft account and accept the recommended settings. To manually turn it on, you can find it under Settings > Updates & security > Find my phone. At this point, Reset Protection is only available with an MSA, not with Azure AD account. It is also only available in the USA and not in other regions of the world.
+**Personal devices:** Windows 10 mobile supports the USA regulatory requirements for a “kill switch” in case your phone is lost or stolen. Reset protection is a free service on account.microsoft.com that helps ensure that the phone cannot be easily reset and reused. All you need to do to turn on **Reset Protection** is sign in with your Microsoft account and accept the recommended settings. To manually turn it on, you can find it under Settings > Updates & security > Find my phone. At this point, Reset Protection is only available with an MSA, not with Azure AD account. It is also only available in the USA and not in other regions of the world.
-If you choose to completely wipe a device when lost or when an employee leaves the company, make sure you obtain consent from the user and follow any local legislation that protects the user’s personal data.
+If you choose to completely wipe a device when lost or when an employee leaves the company, make sure you obtain consent from the user and follow any local legislation that protects the user’s personal data.
-A better option than wiping the entire device is to use Windows Information Protection to clean corporate-only data from a personal device. As explained in the Apps chapter, all corporate data will be tagged and when the device is unenrolled from your MDM system of your choice, all enterprise encrypted data, apps, settings and profiles will immediately be removed from the device without affecting the employee’s existing personal data. A user can initiate unenrollment via the settings screen or unenrollment action can be taken by IT from within the MDM management console. Unenrollment is a management event and will be reported to the MDM system.
+A better option than wiping the entire device is to use Windows Information Protection to clean corporate-only data from a personal device. As explained in the Apps chapter, all corporate data will be tagged and when the device is unenrolled from your MDM system of your choice, all enterprise encrypted data, apps, settings and profiles will immediately be removed from the device without affecting the employee’s existing personal data. A user can initiate unenrollment via the settings screen or unenrollment action can be taken by IT from within the MDM management console. Unenrollment is a management event and will be reported to the MDM system.
-**Corporate device:** You can certainly remotely expire the user’s encryption key in case of device theft, but please remember that that will also make the encrypted data on other Windows devices unreadable for the user. A better approach for retiring a discarded or lost device is to execute a full device wipe. The help desk or device users can initiate a full device wipe. When the wipe is complete, Windows 10 Mobile returns the device to a clean state and restarts the OOBE process.
+**Corporate device:** You can certainly remotely expire the user’s encryption key in case of device theft, but please remember that that will also make the encrypted data on other Windows devices unreadable for the user. A better approach for retiring a discarded or lost device is to execute a full device wipe. The help desk or device users can initiate a full device wipe. When the wipe is complete, Windows 10 Mobile returns the device to a clean state and restarts the OOBE process.
**Settings for personal or corporate device retirement**
- **Allow manual MDM unenrollment** Whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system)
diff --git a/windows/client-management/windows-10-support-solutions.md b/windows/client-management/windows-10-support-solutions.md
index 553e805d78..c212eae7d8 100644
--- a/windows/client-management/windows-10-support-solutions.md
+++ b/windows/client-management/windows-10-support-solutions.md
@@ -13,7 +13,7 @@ ms.date: 11/08/2017
Microsoft regularly releases both updates and solutions for Windows 10. To ensure your computers can receive future updates, including security updates, it's important to keep them updated. Check out the following links for a complete list of released updates:
-- [Windows 10 Version 1703 update history](https://support.microsoft.com/help/4018124/)
+- [Windows 10 Version 1703 update history](https://support.microsoft.com/help/4018124/)
- [Windows 10 Version 1607 update history](https://support.microsoft.com/help/4000825/)
- [Windows 10 Version 1511 update history](https://support.microsoft.com/help/4000824/)
@@ -58,6 +58,6 @@ These are the top Microsoft Support solutions for the most common issues experie
## Solutions related to wireless networking and 802.1X authentication
-- [Windows 10 devices can't connect to an 802.1X environment](http://support.microsoft.com/kb/3121002)
-- [Windows 10 wireless connection displays "Limited" status](http://support.microsoft.com/kb/3114149)
-- [Computer that has VPN software installed can't detect wireless network after upgrading to Windows 10](http://support.microsoft.com/kb/3084164)
+- [Windows 10 devices can't connect to an 802.1X environment](https://support.microsoft.com/kb/3121002)
+- [Windows 10 wireless connection displays "Limited" status](https://support.microsoft.com/kb/3114149)
+- [Computer that has VPN software installed can't detect wireless network after upgrading to Windows 10](https://support.microsoft.com/kb/3084164)
diff --git a/windows/client-management/windows-libraries.md b/windows/client-management/windows-libraries.md
index a52e6a2d6f..10f9efd44b 100644
--- a/windows/client-management/windows-libraries.md
+++ b/windows/client-management/windows-libraries.md
@@ -39,11 +39,11 @@ Administrators can configure and control Windows libraries in the following ways
The following is important information about libraries you may need to understand to successfully manage your enterprise.
-### Library Contents
+### Library Contents
Including a folder in a library does not physically move or change the storage location of the files or folders; the library is a view into those folders. However, users interacting with files in a library are copying, moving, and deleting the files themselves, not copies of these files.
-### Default Libraries and Known Folders
+### Default Libraries and Known Folders
The default libraries include:
- Documents
@@ -51,18 +51,18 @@ The default libraries include:
- Pictures
- Videos
-Libraries are built upon the legacy known folders (such as My Documents, My Pictures, and My Music) that users are familiar with. These known folders are automatically included in the default libraries and set as the default save location. That is, when users drag, copy, or save a file to the Documents library, the file is moved, copied, or saved to the My Documents folder. Administrators and users can change the default save-to location.
+Libraries are built upon the legacy known folders (such as My Documents, My Pictures, and My Music) that users are familiar with. These known folders are automatically included in the default libraries and set as the default save location. That is, when users drag, copy, or save a file to the Documents library, the file is moved, copied, or saved to the My Documents folder. Administrators and users can change the default save-to location.
-### Hiding Default Libraries
+### Hiding Default Libraries
Users or administrators can hide or delete the default libraries, though the libraries node in the Navigation pane cannot be hidden or deleted. Hiding a default library is preferable to deleting it, as applications like Windows Media Player rely on the default libraries and will re-create them if they do not exist on the computer. See [How to Hide Default Libraries](https://technet.microsoft.com/library/d44c78e0-08ef-4e91-935a-a6f43716e37d#BKMK_HideDefaultLibraries) for instructions.
-### Default Save Locations for Libraries
+### Default Save Locations for Libraries
Each library has a default save location. Files are saved or copied to this location if the user chooses to save or copy a file to a library, rather than a specific location within the library. Known folders are the default save locations; however, users can select a different save location.
If the user removes the default save location from a library, the next location is automatically selected as the new default save location. If the library is empty of locations or if all included locations cannot be saved to, then the save operation fails.
-### Indexing Requirements and “Basic” Libraries
+### Indexing Requirements and “Basic” Libraries
Certain library features depend on the contents of the libraries being indexed. Library locations must be available for local indexing or be indexed in a manner conforming to the Windows Indexing Protocol. If indexing is not enabled for one or more locations within a library, the entire library reverts to basic functionality:
- No support for metadata browsing via **Arrange By** views.
@@ -77,11 +77,11 @@ For instructions on enabling indexing, see [How to Enable Indexing of Library Lo
If your environment does not support caching files locally, you should enable the [Turn off Windows Libraries features that rely on indexed file](https://technet.microsoft.com/library/faaefdad-6e12-419a-b714-6a7bb60f6773#WS_TurnOffWindowsLibraries) data Group Policy. This makes all libraries basic. For further information, see [Group Policy for Windows Search, Browse, and Organize](https://technet.microsoft.com/library/dd744697.aspx).
-### Folder Redirection
+### Folder Redirection
While library files themselves cannot be redirected, you can redirect known folders included in libraries by using [Folder Redirection](https://technet.microsoft.com/library/hh848267.aspx). For example, you can redirect the “My Documents” folder, which is included in the default Documents library. When redirecting known folders, you should make sure that the destination is either indexed or always available offline in order to maintain full library functionality. In both cases, the files for the destination folder are indexed and supported in libraries. These settings are configured on the server side.
-### Supported storage locations
+### Supported storage locations
The following table show which locations are supported in Windows libraries.
@@ -95,11 +95,11 @@ The following table show which locations are supported in Windows libraries.
\* For shares that are indexed on a departmental server, Windows Search works well in workgroups or on a domain server that has similar characteristics to a workgroup server. For example, Windows Search works well on a single share departmental server with the following characteristics:
- Expected maximum load is four concurrent query requests.
-- Expected indexing corpus is a maximum of one million documents.
+- Expected indexing corpus is a maximum of one million documents.
- Users directly access the server. That is, the server is not made available through DFS Namespaces.
- Users are not redirected to another server in case of failure. That is, server clusters are not used.
-### Library Attributes
+### Library Attributes
The following library attributes can be modified within Windows Explorer, the Library Management dialog, or the Library Description file (*.library-ms):
- Name
@@ -109,9 +109,9 @@ The following library attributes can be modified within Windows Explorer, the Li
The library icon can be modified by the administrator or user by directly editing the Library Description schema file.
-See the [Library Description Schema](http://go.microsoft.com/fwlink/?LinkId=159581) topic on MSDN for information on creating Library Description files.
+See the [Library Description Schema](https://go.microsoft.com/fwlink/?LinkId=159581) topic on MSDN for information on creating Library Description files.
-## See also
+## See also
### Concepts
diff --git a/windows/configuration/TOC.md b/windows/configuration/TOC.md
index bd3c68055c..074ce81e51 100644
--- a/windows/configuration/TOC.md
+++ b/windows/configuration/TOC.md
@@ -28,7 +28,7 @@
## [Configure cellular settings for tablets and PCs](provisioning-apn.md)
## [Configure Start, taskbar, and lock screen](start-taskbar-lockscreen.md)
### [Configure Windows Spotlight on the lock screen](windows-spotlight.md)
-### [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](manage-tips-and-suggestions.md)
+### [Manage Windows 10 and Microsoft Store tips, "fun facts", and suggestions](manage-tips-and-suggestions.md)
### [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md)
#### [Configure Windows 10 taskbar](configure-windows-10-taskbar.md)
#### [Customize and export Start layout](customize-and-export-start-layout.md)
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-crm.md b/windows/configuration/cortana-at-work/cortana-at-work-crm.md
index 010c42f839..e0aaf35780 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-crm.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-crm.md
@@ -19,12 +19,12 @@ ms.date: 10/05/2017
Cortana integration is a Preview feature that's available for your test or dev environment, starting with the CRM Online 2016 Update. If you decide to use this Preview feature, you'll need to turn in on and accept the license terms. After that, your salespeople will get proactive insights from Cortana on important CRM activities, including sales leads, accounts, and opportunities; presenting the most relevant info at any given time. This can even include getting company-specific news that surfaces when the person is meeting with a representative from another company.
>[!NOTE]
->For more info about Dynamics CRM integration, how to turn on Cortana, and how to provide feedback, see [Preview feature: Set up Cortana integration](http://go.microsoft.com/fwlink/p/?LinkId=746819).
+>For more info about Dynamics CRM integration, how to turn on Cortana, and how to provide feedback, see [Preview feature: Set up Cortana integration](https://go.microsoft.com/fwlink/p/?LinkId=746819).
## Turn on Cortana with Dynamics CRM in your organization
-You must be a CRM administrator to turn on and use Preview features. For more info about what Preview features are and how to use them, see [What are Preview features and how do I enable them](http://go.microsoft.com/fwlink/p/?LinkId=746817)?
+You must be a CRM administrator to turn on and use Preview features. For more info about what Preview features are and how to use them, see [What are Preview features and how do I enable them](https://go.microsoft.com/fwlink/p/?LinkId=746817)?
**To turn on Cortana with Dynamics CRM**
@@ -46,7 +46,7 @@ You must tell your employees to turn on Cortana, before they’ll be able to use
2. Click on **Connected Services**, click **Dynamics CRM**, and then click **Connect**.
-
+
The employee can also disconnect by clicking **Disconnect** from the **Dynamics CRM** screen.
## Turn off Cortana with Dynamics CRM
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-feedback.md b/windows/configuration/cortana-at-work/cortana-at-work-feedback.md
index a646a2dcb0..81736973f3 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-feedback.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-feedback.md
@@ -19,6 +19,6 @@ ms.date: 10/05/2017
We ask that you report bugs and issues. To provide feedback, you can click the **Feedback** icon in the Cortana window. When you send this form to Microsoft it also includes troubleshooting info, in case you run into problems.
-
-If you don't want to use the feedback tool in Cortana, you can add feedback through the general Windows Insider Program feedback app. For info about the feedback app, see [How to use Windows Insider Preview – Updates and feedback](http://windows.microsoft.com/en-us/windows/preview-updates-feedback-pc).
+
+If you don't want to use the feedback tool in Cortana, you can add feedback through the general Windows Insider Program feedback app. For info about the feedback app, see [How to use Windows Insider Preview – Updates and feedback](https://windows.microsoft.com/en-us/windows/preview-updates-feedback-pc).
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-o365.md b/windows/configuration/cortana-at-work/cortana-at-work-o365.md
index 0e837d83f8..c4417fdad9 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-o365.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-o365.md
@@ -25,7 +25,7 @@ But Cortana works even harder when she connects to Office 365, helping employees
We’re continuing to add more and more capabilities to Cortana so she can become even more helpful with your productivity-related tasks, such as emailing, scheduling, and other tasks that are important to help you be successful.
>[!NOTE]
->For a quick review of the frequently asked questions about Cortana and Office 365 integration, see the blog post, [An early look at Cortana integration with Office 365](http://go.microsoft.com/fwlink/p/?LinkId=717379).
+>For a quick review of the frequently asked questions about Cortana and Office 365 integration, see the blog post, [An early look at Cortana integration with Office 365](https://go.microsoft.com/fwlink/p/?LinkId=717379).
## Before you begin
There are a few things to be aware of before you start using Cortana with Office 365 in your organization.
@@ -34,9 +34,9 @@ There are a few things to be aware of before you start using Cortana with Office
- **Azure Active Directory (Azure AD) account.** Before your employees can use Cortana in your org, they must be logged in using their Azure AD account through Cortana’s notebook. They must also authorize Cortana to access Office 365 on their behalf.
-- **Office 365 Trust Center.** Cortana isn't a service covered by the Office 365 Trust Center. [Learn more about how Cortana treats your data](http://go.microsoft.com/fwlink/p/?LinkId=536419).
+- **Office 365 Trust Center.** Cortana isn't a service covered by the Office 365 Trust Center. [Learn more about how Cortana treats your data](https://go.microsoft.com/fwlink/p/?LinkId=536419).
-- **Troubleshooting tips.** If you run into issues, check out these [troubleshooting tips](http://go.microsoft.com/fwlink/p/?LinkId=620763).
+- **Troubleshooting tips.** If you run into issues, check out these [troubleshooting tips](https://go.microsoft.com/fwlink/p/?LinkId=620763).
## Turn on Cortana with Office 365 on employees’ devices
You must tell your employees to turn on Cortana before they’ll be able to use it with Office 365.
@@ -48,14 +48,14 @@ You must tell your employees to turn on Cortana before they’ll be able to use
2. Click on **Connected Services**, click **Office 365**, and then click **Connect**.
-
+
The employee can also disconnect by clicking **Disconnect** from the **Office 365** screen.
## Turn off Cortana with Office 365
Cortana can only access data in your Office 365 org when it’s turned on. If you don’t want Cortana to access your corporate data, you can turn it off in the Office 365 admin center.
**To turn off Cortana with Office 365**
-1. [Sign in to Office 365](http://www.office.com/signin) using your Azure AD account.
+1. [Sign in to Office 365](https://www.office.com/signin) using your Azure AD account.
2. Go to the [Office 365 admin center](https://support.office.com/article/Office-365-admin-center-58537702-d421-4d02-8141-e128e3703547).
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-overview.md b/windows/configuration/cortana-at-work/cortana-at-work-overview.md
index 3221620058..78e5022926 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-overview.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-overview.md
@@ -17,7 +17,7 @@ ms.date: 10/05/2017
- Windows 10 Mobile, version 1703
## Who is Cortana?
-Cortana is Microsoft’s personal digital assistant, who helps busy people get things done, even while at work.
+Cortana is Microsoft’s personal digital assistant, who helps busy people get things done, even while at work.
Cortana has powerful configuration options, specifically optimized for your business. By signing in with an Azure Active Directory (Azure AD) account, your employees can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work.
Using Azure AD also means that you can remove an employee’s profile (for example, when an employee leaves your organization) while respecting Windows Information Protection (WIP) policies and ignoring enterprise content, such as emails, calendar items, and people lists that are marked as enterprise data.
@@ -50,15 +50,15 @@ Cortana requires the following hardware and software to successfully run the inc
Your organization must have an Azure AD tenant and your employees’ devices must all be Azure AD-joined for Cortana to work properly. For info about what an Azure AD tenant is, how to get your devices joined, and other Azure AD maintenance info, see [What is an Azure AD directory?](https://msdn.microsoft.com/library/azure/jj573650.aspx)
## Cortana and privacy
-We understand that there are some questions about Cortana and your organization’s privacy, including concerns about what info is collected by Cortana, where the info is saved, how to manage what data is collected, how to turn Cortana off, how to opt completely out of data collection, and what info is shared with other Microsoft apps and services. For more details about these concerns, see the [Cortana, Search, and privacy: FAQ](http://windows.microsoft.com/windows-10/cortana-privacy-faq) topic.
+We understand that there are some questions about Cortana and your organization’s privacy, including concerns about what info is collected by Cortana, where the info is saved, how to manage what data is collected, how to turn Cortana off, how to opt completely out of data collection, and what info is shared with other Microsoft apps and services. For more details about these concerns, see the [Cortana, Search, and privacy: FAQ](https://windows.microsoft.com/windows-10/cortana-privacy-faq) topic.
Cortana is covered under the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and [Microsoft Services Agreement](https://www.microsoft.com/en-us/servicesagreement).
## See also
-- [What is Cortana?](http://go.microsoft.com/fwlink/p/?LinkId=746818)
+- [What is Cortana?](https://go.microsoft.com/fwlink/p/?LinkId=746818)
-- [Cortana and Windows](http://go.microsoft.com/fwlink/?LinkId=717384)
+- [Cortana and Windows](https://go.microsoft.com/fwlink/?LinkId=717384)
- [Known issues for Windows Desktop Search and Cortana in Windows 10](https://support.microsoft.com/help/3206883/known-issues-for-windows-desktop-search-and-cortana-in-windows-10)
-- [Cortana for developers](http://go.microsoft.com/fwlink/?LinkId=717385)
+- [Cortana for developers](https://go.microsoft.com/fwlink/?LinkId=717385)
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md
index 6a00068066..950452b167 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md
@@ -17,7 +17,7 @@ ms.date: 10/05/2017
- Windows 10 Mobile
>[!NOTE]
->For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkId=717380) topic, located in the configuration service provider reference topics. For specific info about how to set, manage, and use each of these Group Policies to configure Cortana in your enterprise, see the [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=717381).
+>For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkId=717380) topic, located in the configuration service provider reference topics. For specific info about how to set, manage, and use each of these Group Policies to configure Cortana in your enterprise, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=717381).
|Group policy |MDM policy |Description |
|-------------|-----------|------------|
@@ -41,4 +41,4 @@ ms.date: 10/05/2017
-
+
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md
index 14f64e2e91..d03fac5bee 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md
@@ -30,30 +30,30 @@ To enable voice commands in Cortana
Cortana can perform actions on apps in the foreground (taking focus from Cortana) or in the background (allowing Cortana to keep focus). We recommend that you decide where an action should happen, based on what your voice command is intended to do. For example, if your voice command requires employee input, it’s best for that to happen in the foreground. However, if the app only uses basic commands and doesn’t require interaction, it can happen in the background.
- - **Start Cortana with focus on your app, using specific voice-enabled statements.** [Activate a foreground app with voice commands through Cortana](https://docs.microsoft.com/cortana/voicecommands/launch-a-foreground-app-with-voice-commands-in-cortana).
+ - **Start Cortana with focus on your app, using specific voice-enabled statements.** [Activate a foreground app with voice commands through Cortana](https://docs.microsoft.com/en-us/cortana/voice-commands/launch-a-foreground-app-with-voice-commands-in-cortana).
- - **Start Cortana removing focus from your app, using specific voice-enabled statements.** [Activate a background app in Cortana using voice commands](https://docs.microsoft.com/cortana/voicecommands/launch-a-background-app-with-voice-commands-in-cortana).
+ - **Start Cortana removing focus from your app, using specific voice-enabled statements.** [Activate a background app in Cortana using voice commands](https://docs.microsoft.com/en-us/cortana/voice-commands/launch-a-background-app-with-voice-commands-in-cortana).
2. **Install the VCD file on employees' devices**. You can use System Center Configuration Manager or Microsoft Intune to deploy and install the VCD file on your employees' devices, the same way you deploy and install any other package in your organization.
## Test scenario: Use voice commands in a Microsoft Store app
While these aren't line-of-business apps, we've worked to make sure to implement a VCD file, allowing you to test how the functionality works with Cortana in your organization.
-**To get a Microsoft Store app**
+**To get a Microsoft Store app**
1. Go to the Microsoft Store, scroll down to the **Collections** area, click **Show All**, and then click **Better with Cortana**.
2. Click **Uber**, and then click **Install**.
3. Open Uber, create an account or sign in, and then close the app.
-**To set up the app with Cortana**
+**To set up the app with Cortana**
1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon.
2. Click on **Connected Services**, click **Uber**, and then click **Connect**.
-
-**To use the voice-enabled commands with Cortana**
+
+**To use the voice-enabled commands with Cortana**
1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box).
2. Say _Uber get me a taxi_.
@@ -61,4 +61,4 @@ While these aren't line-of-business apps, we've worked to make sure to implement
Cortana changes, letting you provide your trip details for Uber.
## See also
-- [Cortana for developers](http://go.microsoft.com/fwlink/?LinkId=717385)
\ No newline at end of file
+- [Cortana for developers](https://go.microsoft.com/fwlink/?LinkId=717385)
diff --git a/windows/configuration/manage-tips-and-suggestions.md b/windows/configuration/manage-tips-and-suggestions.md
index 4f327eb125..0c704c06f5 100644
--- a/windows/configuration/manage-tips-and-suggestions.md
+++ b/windows/configuration/manage-tips-and-suggestions.md
@@ -1,5 +1,5 @@
---
-title: Manage Windows 10 and Microsoft Store tips, tricks, and suggestions (Windows 10)
+title: Manage Windows 10 and Microsoft Store tips, fun facts, and suggestions (Windows 10)
description: Windows 10 provides organizations with various options to manage user experiences to provide a consistent and predictable experience for employees.
keywords: ["device management"]
ms.prod: w10
@@ -13,7 +13,7 @@ ms.localizationpriority: medium
ms.date: 09/20/2017
---
-# Manage Windows 10 and Microsoft Store tips, tricks, and suggestions
+# Manage Windows 10 and Microsoft Store tips, "fun facts", and suggestions
**Applies to**
@@ -21,7 +21,7 @@ ms.date: 09/20/2017
- Windows 10
-Since its inception, Windows 10 has included a number of user experience features that provide useful tips, tricks, and suggestions as you use Windows, as well as app suggestions from the Microsoft Store. These features are designed to help people get the most out of their Windows 10 experience by, for example, sharing new features, providing more details on the features they use, or sharing content available in the Microsoft Store. Examples of such user experiences include:
+Since its inception, Windows 10 has included a number of user experience features that provide useful tips, "fun facts", and suggestions as you use Windows, as well as app suggestions from the Microsoft Store. These features are designed to help people get the most out of their Windows 10 experience by, for example, sharing new features, providing more details on the features they use, or sharing content available in the Microsoft Store. Examples of such user experiences include:
* **Windows Spotlight on the lock screen**. Daily updated images on the lock screen that can include additional facts and tips in “hotspots” that are revealed on hover.
@@ -34,11 +34,11 @@ Since its inception, Windows 10 has included a number of user experience feature
* **Microsoft account notifications**. For users who have a connected Microsoft account, toast notifications about their account like parental control notifications or subscription expiration.
>[!TIP]
-> On all Windows desktop editions, users can directly enable and disable Windows 10 tips, tricks, and suggestions and Microsoft Store suggestions. For example, users are able to select personal photos for the lock screen as opposed to the images provided by Microsoft, or turn off tips, tricks, or suggestions as they use Windows.
+> On all Windows desktop editions, users can directly enable and disable Windows 10 tips, "fun facts", and suggestions and Microsoft Store suggestions. For example, users are able to select personal photos for the lock screen as opposed to the images provided by Microsoft, or turn off tips, "fun facts", or suggestions as they use Windows.
Windows 10, version 1607 (also known as the Anniversary Update), provides organizations the ability to centrally manage the type of content provided by these features through Group Policy or mobile device management (MDM). The following table describes how administrators can manage suggestions and tips in Windows 10 commercial and education editions.
-## Options available to manage Windows 10 tips and tricks and Microsoft Store suggestions
+## Options available to manage Windows 10 tips and "fun facts" and Microsoft Store suggestions
| Windows 10 edition | Disable |Show Microsoft apps only | Show Microsoft and popular third-party apps |
| --- | --- | --- | --- |
diff --git a/windows/configuration/ue-v/uev-application-template-schema-reference.md b/windows/configuration/ue-v/uev-application-template-schema-reference.md
index 7ee8769a77..a4e36a5bce 100644
--- a/windows/configuration/ue-v/uev-application-template-schema-reference.md
+++ b/windows/configuration/ue-v/uev-application-template-schema-reference.md
@@ -74,34 +74,34 @@ UE-V uses the http://schemas.microsoft.com/UserExperienceVirtualization/2012/Set
These are the data types for the UE-V application template schema.
-**GUID**
+**GUID**
GUID describes a standard globally unique identifier regular expression in the form "\\{\[a-fA-F0-9\]{8}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{12}\\}". This is used in the Filesetting\\Root\\KnownFolder element to verify the formatting of well-known folders.
-**FilenameString**
+**FilenameString**
FilenameString refers to the file name of a process to be monitored. Its values are restricted by the regex \[^\\\\\\?\\\*\\|<>/:\]+, (that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon characters).
-**IDString**
+**IDString**
IDString refers to the ID value of Application elements, SettingsLocationTemplate, and Common elements (used to describe application suites that share common settings). It is restricted by the same regex as FilenameString (\[^\\\\\\?\\\*\\|<>/:\]+).
-**TemplateVersion**
+**TemplateVersion**
TemplateVersion is an integer value used to describe the revision of the settings location template. Its value may range from 0 to 2147483647.
-**Empty**
+**Empty**
Empty refers to a null value. This is used in Process\\ShellProcess to indicate that there is no process to monitor. This value should not be used in any application templates.
-**Author**
+**Author**
The Author data type is a complex type that identifies the author of a template. It contains two child elements: **Name** and **Email**. Within the Author data type, the Name element is mandatory while the Email element is optional. This type is described in more detail under the SettingsLocationTemplate element.
-**Range**
+**Range**
Range defines an integer class consisting of two child elements: **Minimum** and **Maximum**. This data type is implemented in the ProcessVersion data type. If specified, both Minimum and Maximum values must be included.
-**ProcessVersion**
+**ProcessVersion**
ProcessVersion defines a type with four child elements: **Major**, **Minor**, **Build**, and **Patch**. This data type is used by the Process element to populate its ProductVersion and FileVersion values. The data for this type is a Range value. The Major child element is mandatory and the others are optional.
-**Architecture**
+**Architecture**
Architecture enumerates two possible values: **Win32** and **Win64**. These values are used to specify process architecture.
-**Process**
+**Process**
The Process data type is a container used to describe processes to be monitored by UE-V. It contains six child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. This table details each element’s respective data type:
@@ -151,26 +151,26 @@ The Process data type is a container used to describe processes to be monitored
-**Processes**
+**Processes**
The Processes data type represents a container for a collection of one or more Process elements. Two child elements are supported in the Processes sequence type: **Process** and **ShellProcess**. Process is an element of type Process and ShellProcess is of data type Empty. At least one item must be identified in the sequence.
-**Path**
+**Path**
Path is consumed by RegistrySetting and FileSetting to refer to registry and file paths. This element supports two optional attributes: **Recursive** and **DeleteIfNotFound**. Both values are set to default=”False”.
Recursive indicates that the path and all subfolders are included for file settings or that all child registry keys are included for registry settings. In both cases, all items at the current level are included in the data captured. For a FileSettings object, all files within the specified folder are included in the data captured by UE-V but folders are not included. For registry paths, all values in the current path are captured but child registry keys are not captured. In both cases, care should be taken to avoid capturing large data sets or large numbers of items.
The DeleteIfNotFound attribute removes the setting from the user’s settings storage path data. This may be desirable in cases where removing these settings from the package will save a large amount of disk space on the settings storage path file server.
-**FileMask**
+**FileMask**
FileMask specifies only certain file types for the folder that is defined by Path. For example, Path might be `C:\users\username\files` and FileMask could be `*.txt` to include only text files.
-**RegistrySetting**
+**RegistrySetting**
RegistrySetting represents a container for registry keys and values and the associated desired behavior on the part of the UE-V service. Four child elements are defined within this type: **Path**, **Name**, **Exclude**, and a sequence of the values **Path** and **Name**.
-**FileSetting**
+**FileSetting**
FileSetting contains parameters associated with files and files paths. Four child elements are defined: **Root**, **Path**, **FileMask**, and **Exclude**. Root is mandatory and the others are optional.
-**Settings**
+**Settings**
Settings is a container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings described earlier. In addition, it can also contain the following child elements with behaviors described:
@@ -266,7 +266,7 @@ This value is queried to determine if a new version of a template should be appl
**Type: String**
-Author identifies the creator of the settings location template. Two optional child elements are supported: **Name** and **Email**. Both attributes are optional, but, if the Email child element is specified, it must be accompanied by the Name element. Author refers to the full name of the contact for the settings location template, and email should refer to an email address for the author. We recommend that you include this information in templates published publicly, for example, on the [UE-V Template Gallery](http://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V).
+Author identifies the creator of the settings location template. Two optional child elements are supported: **Name** and **Email**. Both attributes are optional, but, if the Email child element is specified, it must be accompanied by the Name element. Author refers to the full name of the contact for the settings location template, and email should refer to an email address for the author. We recommend that you include this information in templates published publicly, for example, on the [UE-V Template Gallery](https://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V).
### Processes and Process Element
@@ -373,7 +373,7 @@ For example, in a suited application, it might be useful to provide reminders ab
``` syntax
-
+
MyApplication.exeMy Application Main Engine
@@ -671,7 +671,7 @@ Here is the SettingsLocationTemplate.xsd file showing its elements, child elemen
-
+
@@ -708,7 +708,7 @@ Here is the SettingsLocationTemplate.xsd file showing its elements, child elemen
-
+
diff --git a/windows/configuration/ue-v/uev-release-notes-1607.md b/windows/configuration/ue-v/uev-release-notes-1607.md
index c9e9108115..ab756d30d5 100644
--- a/windows/configuration/ue-v/uev-release-notes-1607.md
+++ b/windows/configuration/ue-v/uev-release-notes-1607.md
@@ -20,9 +20,9 @@ This topic includes information required to successfully install and use UE-V th
In previous versions of UE-V, users could select which of their customized application settings to synchronize with the Company Settings Center, a user interface that was available on user devices. Additionally, administrators could configure the Company Settings Center to include a link to support resources so that users could easily get support on virtualized settings-related issues.
-With the release of Windows 10, version 1607, the Company Settings Center was removed and users can no longer manage their synchronized settings.
+With the release of Windows 10, version 1607, the Company Settings Center was removed and users can no longer manage their synchronized settings.
-Administrators can still define which user-customized application settings can synchronize (roam) with Group Policy or Windows PowerShell.
+Administrators can still define which user-customized application settings can synchronize (roam) with Group Policy or Windows PowerShell.
**Note** With the removal of the Company Settings Center, the following group policies are no longer applicable:
@@ -95,24 +95,24 @@ Operating system settings for Narrator and currency characters specific to the l
WORKAROUND: None
-## Hotfixes and Knowledge Base articles for UE-V
+## Hotfixes and Knowledge Base articles for UE-V
This section contains hotfixes and KB articles for UE-V.
| KB Article | Title | Link |
|------------|---------|--------|
-| 3018608 | UE-V - TemplateConsole.exe crashes when UE-V WMI classes are missing | [support.microsoft.com/kb/3018608](http://support.microsoft.com/kb/3018608) |
-| 2903501 | UE-V: User Experience Virtualization (UE-V) compatibility with user profiles | [support.microsoft.com/kb/2903501](http://support.microsoft.com/kb/2903501) |
-| 2770042 | UE-V Registry Settings | [support.microsoft.com/kb/2770042](http://support.microsoft.com/kb/2770042) |
-| 2847017 | Internet Explorer settings replicated by UE-V | [support.microsoft.com/kb/2847017](http://support.microsoft.com/kb/2847017) |
-| 2769631 | How to repair a corrupted UE-V install | [support.microsoft.com/kb/2769631](http://support.microsoft.com/kb/2769631) |
-| 2850989 | Migrating MAPI profiles with Microsoft UE-V is not supported | [support.microsoft.com/kb/2850989](http://support.microsoft.com/kb/2850989) |
-| 2769586 | UE-V roams empty folders and registry keys | [support.microsoft.com/kb/2769586](http://support.microsoft.com/kb/2769586) |
-| 2782997 | How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V) | [support.microsoft.com/kb/2782997](http://support.microsoft.com/kb/2782997) |
-| 2769570 | UE-V does not update the theme on RDS or VDI sessions | [support.microsoft.com/kb/2769570](http://support.microsoft.com/kb/2769570) |
-| 2850582 | How To Use Microsoft User Experience Virtualization With App-V Applications | [support.microsoft.com/kb/2850582](http://support.microsoft.com/kb/2850582) |
-| 3041879 | Current file versions for Microsoft User Experience Virtualization | [support.microsoft.com/kb/3041879](http://support.microsoft.com/kb/3041879) |
-| 2843592 | Information on User Experience Virtualization and High Availability | [support.microsoft.com/kb/2843592](http://support.microsoft.com/kb/2843592) |
+| 3018608 | UE-V - TemplateConsole.exe crashes when UE-V WMI classes are missing | [support.microsoft.com/kb/3018608](https://support.microsoft.com/kb/3018608) |
+| 2903501 | UE-V: User Experience Virtualization (UE-V) compatibility with user profiles | [support.microsoft.com/kb/2903501](https://support.microsoft.com/kb/2903501) |
+| 2770042 | UE-V Registry Settings | [support.microsoft.com/kb/2770042](https://support.microsoft.com/kb/2770042) |
+| 2847017 | Internet Explorer settings replicated by UE-V | [support.microsoft.com/kb/2847017](https://support.microsoft.com/kb/2847017) |
+| 2769631 | How to repair a corrupted UE-V install | [support.microsoft.com/kb/2769631](https://support.microsoft.com/kb/2769631) |
+| 2850989 | Migrating MAPI profiles with Microsoft UE-V is not supported | [support.microsoft.com/kb/2850989](https://support.microsoft.com/kb/2850989) |
+| 2769586 | UE-V roams empty folders and registry keys | [support.microsoft.com/kb/2769586](https://support.microsoft.com/kb/2769586) |
+| 2782997 | How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V) | [support.microsoft.com/kb/2782997](https://support.microsoft.com/kb/2782997) |
+| 2769570 | UE-V does not update the theme on RDS or VDI sessions | [support.microsoft.com/kb/2769570](https://support.microsoft.com/kb/2769570) |
+| 2850582 | How To Use Microsoft User Experience Virtualization With App-V Applications | [support.microsoft.com/kb/2850582](https://support.microsoft.com/kb/2850582) |
+| 3041879 | Current file versions for Microsoft User Experience Virtualization | [support.microsoft.com/kb/3041879](https://support.microsoft.com/kb/3041879) |
+| 2843592 | Information on User Experience Virtualization and High Availability | [support.microsoft.com/kb/2843592](https://support.microsoft.com/kb/2843592) |
## Have a suggestion for UE-V?
diff --git a/windows/configuration/ue-v/uev-troubleshooting.md b/windows/configuration/ue-v/uev-troubleshooting.md
index c84d8f3603..fcc4cb1fa3 100644
--- a/windows/configuration/ue-v/uev-troubleshooting.md
+++ b/windows/configuration/ue-v/uev-troubleshooting.md
@@ -18,9 +18,9 @@ ms.date: 04/19/2017
For information that can help with troubleshooting UE-V for Windows 10, see:
-- [UE-V FAQ Wiki](http://social.technet.microsoft.com/wiki/contents/articles/35333.ue-v-important-changes-in-ue-v-functionality-after-the-windows-10-anniversary-update.aspx)
+- [UE-V FAQ Wiki](https://social.technet.microsoft.com/wiki/contents/articles/35333.ue-v-important-changes-in-ue-v-functionality-after-the-windows-10-anniversary-update.aspx)
-- [UE-V: List of Microsoft Support Knowledge Base Articles](http://social.technet.microsoft.com/wiki/contents/articles/14271.ue-v-list-of-microsoft-support-knowledge-base-articles.aspx)
+- [UE-V: List of Microsoft Support Knowledge Base Articles](https://social.technet.microsoft.com/wiki/contents/articles/14271.ue-v-list-of-microsoft-support-knowledge-base-articles.aspx)
- [User Experience Virtualization Release Notes](uev-release-notes-1607.md)
diff --git a/windows/configuration/wcd/wcd-accounts.md b/windows/configuration/wcd/wcd-accounts.md
index db8812512d..a9f4434dfb 100644
--- a/windows/configuration/wcd/wcd-accounts.md
+++ b/windows/configuration/wcd/wcd-accounts.md
@@ -43,7 +43,7 @@ Specifies the settings you can configure when joining a device to a domain, incl
| --- | --- | --- |
| Account | string | Account to use to join computer to domain |
| AccountOU | Enter the full path for the organizational unit. For example: OU=testOU,DC=domain,DC=Domain,DC=com. | Name of organizational unit for the computer account |
-| ComputerName | Specify a unique name for the domain-joined computers using %RAND:x%, where x is an integer less than 15 digits long, or using %SERIAL% characters in the name.ComputerName is a string with a maximum length of 15 bytes of content:- ComputerName can use ASCII characters (1 byte each) and/or multi-byte characters such as Kanji, so long as you do not exceed 15 bytes of content.- ComputerName cannot use spaces or any of the following characters: \{ | \} ~ \[ \\ \] ^ ' : ; < = > ? @ ! " \# $ % ` \( \) + / . , \* &, or contain any spaces.- ComputerName cannot use some non-standard characters, such as emoji.Computer names that cannot be validated through the DnsValidateName function cannot be used, for example, computer names that only contain numbers (0-9). For more information, see the [DnsValidateName function](http://go.microsoft.com/fwlink/?LinkId=257040). | Specifies the name of the Windows device (computer name on PCs) |
+| ComputerName | Specify a unique name for the domain-joined computers using %RAND:x%, where x is an integer less than 15 digits long, or using %SERIAL% characters in the name.ComputerName is a string with a maximum length of 15 bytes of content:- ComputerName can use ASCII characters (1 byte each) and/or multi-byte characters such as Kanji, so long as you do not exceed 15 bytes of content.- ComputerName cannot use spaces or any of the following characters: \{ | \} ~ \[ \\ \] ^ ' : ; < = > ? @ ! " \# $ % ` \( \) + / . , \* &, or contain any spaces.- ComputerName cannot use some non-standard characters, such as emoji.Computer names that cannot be validated through the DnsValidateName function cannot be used, for example, computer names that only contain numbers (0-9). For more information, see the [DnsValidateName function](https://go.microsoft.com/fwlink/?LinkId=257040). | Specifies the name of the Windows device (computer name on PCs) |
| DomainName | string (cannot be empty) | Specify the name of the domain that the device will join |
| Password | string (cannot be empty) | Corresponds to the password of the user account that's authorized to join the computer account to the domain. |
diff --git a/windows/configuration/windows-10-start-layout-options-and-policies.md b/windows/configuration/windows-10-start-layout-options-and-policies.md
index 54b19bb5d6..d51cb7fd9d 100644
--- a/windows/configuration/windows-10-start-layout-options-and-policies.md
+++ b/windows/configuration/windows-10-start-layout-options-and-policies.md
@@ -20,7 +20,7 @@ ms.date: 06/19/2018
- Windows 10
-> **Looking for consumer information?** See [Customize the Start menu](http://windows.microsoft.com/windows-10/getstarted-see-whats-on-the-menu)
+> **Looking for consumer information?** See [Customize the Start menu](https://windows.microsoft.com/windows-10/getstarted-see-whats-on-the-menu)
Organizations might want to deploy a customized Start and taskbar configuration to devices running Windows 10 Pro, Enterprise, or Education. A standard, customized Start layout can be useful on devices that are common to multiple users and devices that are locked down for specialized purposes. Configuring the taskbar allows the organization to pin useful apps for their employees and to remove apps that are pinned by default.
@@ -77,7 +77,7 @@ There are three categories of apps that might be pinned to a taskbar:
>[!NOTE]
>We recommend using [the layoutmodification.xml method](configure-windows-10-taskbar.md) to configure taskbar options, rather than the earlier method of using [TaskbarLinks](https://go.microsoft.com/fwlink/p/?LinkId=761230) in an unattended Windows setup file.
-
+
The following example shows how apps will be pinned - Windows default apps to the left (blue circle), apps pinned by the user in the center (orange triangle), and apps that you pin using XML to the right (green square).
@@ -101,14 +101,14 @@ In a clean install, if you apply a taskbar layout, only the apps that you specif
### Taskbar configuration applied to Windows 10 upgrades
-When a device is upgraded to Windows 10, apps will be pinned to the taskbar already. Some apps may have been pinned to the taskbar by a user, and others may have been pinned to the taskbar through a customized base image or by using Windows Unattend setup.
+When a device is upgraded to Windows 10, apps will be pinned to the taskbar already. Some apps may have been pinned to the taskbar by a user, and others may have been pinned to the taskbar through a customized base image or by using Windows Unattend setup.
The new taskbar layout for upgrades to Windows 10, version 1607 or later, will apply the following behavior:
* If the user pinned the app to the taskbar, those pinned apps remain and new apps will be added to the right.
* If the user didn't pin the app (it was pinned during installation or by policy) and the app is not in updated layout file, the app will be unpinned.
* If the user didn't pin the app and the app is in the updated layout file, the app will be pinned to the right.
* New apps specified in updated layout file are pinned to right of user's pinned apps.
-
+
[Learn how to configure Windows 10 taskbar](configure-windows-10-taskbar.md).
## Start layout configuration errors
@@ -118,7 +118,7 @@ If your Start layout customization is not applied as expected, open **Event View
- **Event 22** is logged when the xml is malformed, meaning the specified file simply isn’t valid xml. This can occur if the file has extra spaces or unexpected characters, or if the file is not saved in the UTF8 format.
- **Event 64** is logged when the xml is valid, but has unexpected values. This can happen when the desired configuration is not understood or source is not found such as a missing or misspelled .lnk.
-
+
## Related topics
diff --git a/windows/configuration/windows-spotlight.md b/windows/configuration/windows-spotlight.md
index 09a31768aa..aaf7da1a9a 100644
--- a/windows/configuration/windows-spotlight.md
+++ b/windows/configuration/windows-spotlight.md
@@ -58,15 +58,18 @@ To turn off Windows Spotlight locally, go to **Settings** > **Personalization
Windows Spotlight is enabled by default. Windows 10 provides Group Policy and mobile device management (MDM) settings to help you manage Windows Spotlight on enterprise computers.
+>[!NOTE]
+>These policies are in the **User Configuration \Policies\Administrative Templates\Windows Components\Cloud Content** path in the Group Policy Management Console, and in the **User Configuration \Administrative Templates\Windows Components\Cloud Content** path in the Local Group Policy Editor.
+
| Group Policy | MDM | Description | Applies to |
| --- | --- | --- | --- |
-| **User Configuration\Administrative Templates\Windows Components\Cloud Content\Do not suggest third-party content in Windows spotlight** | **Experience/Allow ThirdParty Suggestions In Windows Spotlight** | Enables enterprises to restrict suggestions to Microsoft apps and services | Windows 10 Pro, Enterprise, and Education, version 1607 and later |
-| **User Configuration\Administrative Templates\Windows Components\Cloud Content\Turn off all Windows Spotlight features** | **Experience/Allow Windows Spotlight** | Enables enterprises to completely disable all Windows Spotlight features in a single setting | Windows 10 Enterprise and Education, version 1607 and later |
-| **User Configuration\Administrative Templates\Windows Components\Cloud Content\Configure Spotlight on lock screen** | **Experience/Configure Windows Spotlight On Lock Screen** | Specifically controls the use of the dynamic Windows Spotlight image on the lock screen, and can be enabled or disabled | Windows 10 Enterprise and Education, version 1607 and later |
-| **Administrative Templates \ Windows Components \ Cloud Content \ Turn off the Windows Spotlight on Action Center** | **Experience/Allow Windows Spotlight On Action Center** | Turn off Suggestions from Microsoft that show after each clean install, upgrade, or on an on-going basis to introduce users to what is new or changed | Windows 10 Enterprise and Education, version 1703 |
-| **User Configuration \ Administrative Templates \ Windows Components \ Cloud Content \ Do not use diagnostic data for tailored experiences** | **Experience/Allow Tailored Experiences With Diagnostic Data** | Prevent Windows from using diagnostic data to provide tailored experiences to the user | Windows 10 Pro, Enterprise, and Education, version 1703 |
-| **User Configuration \ Administrative Templates \ Windows Components \ Cloud Content \ Turn off the Windows Welcome Experience** | **Experience/Allow Windows Spotlight Windows Welcome Experience** | Turn off the Windows Spotlight Windows Welcome experience which helps introduce users to Windows, such as launching Microsoft Edge with a web page highlighting new features | Windows 10 Enterprise and Education, version 1703 |
-**User Configuration \ Administrative Templates \ Windows Components \ Cloud Content \ Turn off the Windows Spotlight on Settings** | **Experience/Allow Windows Spotlight on Settings** | Turn off the Windows Spotlight in the Settings app. | Windows 10 Enterprise and Education, version 1803 |
+| **Do not suggest third-party content in Windows spotlight** | **Experience/Allow ThirdParty Suggestions In Windows Spotlight** | Enables enterprises to restrict suggestions to Microsoft apps and services | Windows 10 Pro, Enterprise, and Education, version 1607 and later |
+| **Turn off all Windows Spotlight features** | **Experience/Allow Windows Spotlight** | Enables enterprises to completely disable all Windows Spotlight features in a single setting | Windows 10 Enterprise and Education, version 1607 and later |
+| **Configure Spotlight on lock screen** | **Experience/Configure Windows Spotlight On Lock Screen** | Specifically controls the use of the dynamic Windows Spotlight image on the lock screen, and can be enabled or disabled | Windows 10 Enterprise and Education, version 1607 and later |
+| **Turn off the Windows Spotlight on Action Center** | **Experience/Allow Windows Spotlight On Action Center** | Turn off Suggestions from Microsoft that show after each clean install, upgrade, or on an on-going basis to introduce users to what is new or changed | Windows 10 Enterprise and Education, version 1703 |
+| **Do not use diagnostic data for tailored experiences** | **Experience/Allow Tailored Experiences With Diagnostic Data** | Prevent Windows from using diagnostic data to provide tailored experiences to the user | Windows 10 Pro, Enterprise, and Education, version 1703 |
+| **Turn off the Windows Welcome Experience** | **Experience/Allow Windows Spotlight Windows Welcome Experience** | Turn off the Windows Spotlight Windows Welcome experience which helps introduce users to Windows, such as launching Microsoft Edge with a web page highlighting new features | Windows 10 Enterprise and Education, version 1703 |
+**Turn off the Windows Spotlight on Settings** | **Experience/Allow Windows Spotlight on Settings** | Turn off the Windows Spotlight in the Settings app. | Windows 10 Enterprise and Education, version 1803 |
diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md
index f2c43e0b7a..57d548abf9 100644
--- a/windows/deployment/deploy-enterprise-licenses.md
+++ b/windows/deployment/deploy-enterprise-licenses.md
@@ -60,7 +60,7 @@ You probably have on-premises Active Directory Domain Services (AD DS) domains.
You might ask why you need to synchronize these identities. The answer is so that users will have a *single identity* that they can use to access their on-premises apps and cloud services that use Azure AD (such as Windows 10 Enterprise E3 or E5). This means that users can use their existing credentials to sign in to Azure AD and access the cloud services that you provide and manage for them.
-**Figure 1** illustrates the integration between the on-premises AD DS domain with Azure AD. [Microsoft Azure Active Directory Connect](http://www.microsoft.com/en-us/download/details.aspx?id=47594) (Azure AD Connect) is responsible for synchronization of identities between the on-premises AD DS domain and Azure AD. Azure AD Connect is a service that you can install on-premises or in a virtual machine in Azure.
+**Figure 1** illustrates the integration between the on-premises AD DS domain with Azure AD. [Microsoft Azure Active Directory Connect](https://www.microsoft.com/en-us/download/details.aspx?id=47594) (Azure AD Connect) is responsible for synchronization of identities between the on-premises AD DS domain and Azure AD. Azure AD Connect is a service that you can install on-premises or in a virtual machine in Azure.
@@ -68,7 +68,7 @@ You might ask why you need to synchronize these identities. The answer is so tha
For more information about integrating on-premises AD DS domains with Azure AD, see the following resources:
-- [Integrating your on-premises identities with Azure Active Directory](http://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/)
+- [Integrating your on-premises identities with Azure Active Directory](https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/)
- [Azure AD + Domain Join + Windows 10](https://blogs.technet.microsoft.com/enterprisemobility/2016/02/17/azure-ad-domain-join-windows-10/)
## Preparing for deployment: reviewing requirements
@@ -89,8 +89,8 @@ The following methods are available to assign licenses:
3. You can assign licenses by uploading a spreadsheet.
-4. A per-user [PowerShell scripted method](http://social.technet.microsoft.com/wiki/contents/articles/15905.how-to-use-powershell-to-automatically-assign-licenses-to-your-office-365-users.aspx) of assigning licenses is available.
-5. Organizations can use synchronized [AD groups](https://ronnydejong.com/2015/03/04/assign-ems-licenses-based-on-local-active-directory-group-membership/) to automatically assign licenses.
+4. A per-user [PowerShell scripted method](https://social.technet.microsoft.com/wiki/contents/articles/15905.how-to-use-powershell-to-automatically-assign-licenses-to-your-office-365-users.aspx) of assigning licenses is available.
+5. Organizations can use synchronized [AD groups](https://ronnydejong.com/2015/03/04/assign-ems-licenses-based-on-local-active-directory-group-membership/) to automatically assign licenses.
## Explore the upgrade experience
@@ -105,19 +105,19 @@ Users can join a Windows 10 Pro device to Azure AD the first time they start the
1. During the initial setup, on the **Who owns this PC?** page, select **My organization**, and then click **Next**, as illustrated in **Figure 2**.
-
+
**Figure 2. The “Who owns this PC?” page in initial Windows 10 setup**
2. On the **Choose how you’ll connect** page, select **Join Azure AD**, and then click **Next**, as illustrated in **Figure 3**.
-
+
**Figure 3. The “Choose how you’ll connect” page in initial Windows 10 setup**
3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 4**.
-
+
**Figure 4. The “Let’s get you signed in” page in initial Windows 10 setup**
Now the device is Azure AD joined to the company’s subscription.
@@ -130,19 +130,19 @@ Now the device is Azure AD joined to the company’s subscription.
1. Go to **Settings > Accounts > Access work or school**, as illustrated in **Figure 5**.
-
+
**Figure 5. Connect to work or school configuration in Settings**
2. In **Set up a work or school account**, click **Join this device to Azure Active Directory**, as illustrated in **Figure 6**.
-
+
**Figure 6. Set up a work or school account**
3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 7**.
-
+
**Figure 7. The “Let’s get you signed in” dialog box**
Now the device is Azure AD joined to the company’s subscription.
@@ -157,7 +157,7 @@ Now the device is Azure AD joined to the company’s subscription.
**Figure 7a - Windows 10 Pro activation in Settings**
-Windows 10 Pro activation is required before Enterprise E3 or E5 can be enabled (Windows 10, versions 1703 and 1709 only).
+Windows 10 Pro activation is required before Enterprise E3 or E5 can be enabled (Windows 10, versions 1703 and 1709 only).
### Step 3: Sign in using Azure AD account
diff --git a/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md b/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md
index b326586cf3..ffe112508b 100644
--- a/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md
+++ b/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md
@@ -19,7 +19,7 @@ ms.date: 07/27/2017
- Windows 10 versions 1507, 1511
>[!IMPORTANT]
->For instructions to deploy the most recent version of Windows 10 with Configuration Manager, see [Scenarios to deploy enterprise operating systems with System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems).
+>For instructions to deploy the most recent version of Windows 10 with Configuration Manager, see [Scenarios to deploy enterprise operating systems with System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems).
>Configuration Manager 2012 and 2012 R2 provide support for Windows 10 versions 1507 and 1511 only. Later versions of Windows 10 require an updated Configuration Manager release. For a list of Configuration Manager versions and the corresponding Windows 10 client versions that are supported, see [Support for Windows 10 for System Center Configuration Manager](https://docs.microsoft.com/sccm/core/plan-design/configs/support-for-windows-10).
If you have Microsoft System Center 2012 R2 Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. This topic will show you how to set up Configuration Manager for operating system deployment and how to integrate Configuration Manager with the Microsoft Deployment Toolkit (MDT).
@@ -97,7 +97,7 @@ Operating system deployment with Configuration Manager is part of the normal sof
- [Deploy Windows To Go in your organization](../deploy-windows-to-go.md)
-- [Sideload Windows Store apps](http://technet.microsoft.com/library/dn613831.aspx)
+- [Sideload Windows Store apps](https://technet.microsoft.com/library/dn613831.aspx)
- [Windows ADK for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=526803)
diff --git a/windows/deployment/deploy-windows-to-go.md b/windows/deployment/deploy-windows-to-go.md
index 8557a2883c..2e2da9aa71 100644
--- a/windows/deployment/deploy-windows-to-go.md
+++ b/windows/deployment/deploy-windows-to-go.md
@@ -21,7 +21,7 @@ ms.date: 04/19/2017
This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment.
>[!NOTE]
->This topic includes sample Windows PowerShell cmdlets that you can use to automate some of the procedures described. For more information, see [Using Cmdlets](http://go.microsoft.com/fwlink/p/?linkid=230693).
+>This topic includes sample Windows PowerShell cmdlets that you can use to automate some of the procedures described. For more information, see [Using Cmdlets](https://go.microsoft.com/fwlink/p/?linkid=230693).
## Deployment tips
@@ -62,7 +62,7 @@ In this step we are creating the operating system image that will be used on the
3. Verify that the .wim file location (which can be a network share, a DVD , or a USB drive) is accessible and that it contains a valid Windows 10 Enterprise or Windows 10 Education image that has been generalized using sysprep. Many environments can use the same image for both Windows To Go and desktop deployments.
>[!NOTE]
- >For more information about .wim files, see [Windows System Image Manager (Windows SIM) Technical Reference](http://go.microsoft.com/fwlink/p/?LinkId=619150). For more information about using sysprep, see [Sysprep Overview](http://go.microsoft.com/fwlink/p/?LinkId=619151).
+ >For more information about .wim files, see [Windows System Image Manager (Windows SIM) Technical Reference](https://go.microsoft.com/fwlink/p/?LinkId=619150). For more information about using sysprep, see [Sysprep Overview](https://go.microsoft.com/fwlink/p/?LinkId=619151).
4. Using Cortana, search for **Windows To Go** and then press **Enter**. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. The **Windows To Go Creator Wizard** opens.
@@ -107,15 +107,15 @@ The following Windows PowerShell cmdlet or cmdlets perform the same function as
$Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot }
#Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase.
- #
+ #
# To skip the confirmation prompt, append –confirm:$False
- Clear-Disk –InputObject $Disk[0] -RemoveData
+ Clear-Disk –InputObject $Disk[0] -RemoveData
- # This command initializes a new MBR disk
+ # This command initializes a new MBR disk
Initialize-Disk –InputObject $Disk[0] -PartitionStyle MBR
# This command creates a 350 MB system partition
- $SystemPartition = New-Partition –InputObject $Disk[0] -Size (350MB) -IsActive
+ $SystemPartition = New-Partition –InputObject $Disk[0] -Size (350MB) -IsActive
# This formats the volume with a FAT32 Filesystem
# To skip the confirmation dialog, append –Confirm:$False
@@ -139,10 +139,10 @@ The following Windows PowerShell cmdlet or cmdlets perform the same function as
>[!TIP]
>The index number must be set correctly to a valid Enterprise image in the .WIM file.
-
+
``` syntax
#The WIM file must contain a sysprep generalized image.
- dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\
+ dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\
```
4. Now use the [bcdboot](https://go.microsoft.com/fwlink/p/?LinkId=619163) command line tool to move the necessary boot components to the system partition on the disk. This helps ensure that the boot components, operating system versions, and architectures match. The `/f ALL` parameter indicates that boot components for UEFI and BIOS should be placed on the system partition of the disk. The following example illustrates this step:
@@ -198,21 +198,21 @@ The following Windows PowerShell cmdlet or cmdlets perform the same function as
truetrue
-
+
```
@@ -293,7 +293,7 @@ Making sure that Windows To Go workspaces are effective when used off premises i
1. Start the host computer and sign in using a user account with privileges to add workstations to the domain and then run the following command from an elevated command prompt replacing the example placeholder parameters (denoted by <>) with the ones applicable for your environment:
``` syntax
- djoin /provision /domain /machine /certtemplate /policynames /savefile /reuse
+ djoin /provision /domain /machine /certtemplate /policynames /savefile /reuse
```
>[!NOTE]
@@ -311,15 +311,15 @@ Making sure that Windows To Go workspaces are effective when used off premises i
$Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot }
#Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase.
- #
+ #
# To skip the confirmation prompt, append –confirm:$False
- Clear-Disk –InputObject $Disk[0] -RemoveData
+ Clear-Disk –InputObject $Disk[0] -RemoveData
- # This command initializes a new MBR disk
+ # This command initializes a new MBR disk
Initialize-Disk –InputObject $Disk[0] -PartitionStyle MBR
# This command creates a 350 MB system partition
- $SystemPartition = New-Partition –InputObject $Disk[0] -Size (350MB) -IsActive
+ $SystemPartition = New-Partition –InputObject $Disk[0] -Size (350MB) -IsActive
# This formats the volume with a FAT32 Filesystem
# To skip the confirmation dialog, append –Confirm:$False
@@ -344,16 +344,16 @@ Making sure that Windows To Go workspaces are effective when used off premises i
>[!TIP]
>The index number must be set correctly to a valid Enterprise image in the .WIM file.
-
+
``` syntax
#The WIM file must contain a sysprep generalized image.
- dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\
+ dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\
```
6. After those commands have completed, run the following command:
``` syntax
- djoin /requestodj /loadfile C:\example\path\domainmetadatafile /windowspath W:\Windows
+ djoin /requestodj /loadfile C:\example\path\domainmetadatafile /windowspath W:\Windows
```
7. Next, we will need to edit the unattend.xml file to configure the first run (OOBE) settings. In this example we are hiding the Microsoft Software License Terms (EULA) page, configuring automatic updates to install important and recommended updates automatically, and identifying this workspace as part of a private office network. You can use other OOBE settings that you have configured for your organization if desired. For more information about the OOBE settings, see [OOBE](https://go.microsoft.com/fwlink/p/?LinkId=619172):
@@ -364,9 +364,9 @@ Making sure that Windows To Go workspaces are effective when used off premises i
true
@@ -377,9 +377,9 @@ Making sure that Windows To Go workspaces are effective when used off premises i
true
@@ -388,7 +388,7 @@ Making sure that Windows To Go workspaces are effective when used off premises i
Work
-
+
```
@@ -457,15 +457,15 @@ BitLocker recovery keys are the keys that can be used to unlock a BitLocker prot
$Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot }
#Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase.
- #
+ #
# To skip the confirmation prompt, append –confirm:$False
- Clear-Disk –InputObject $Disk[0] -RemoveData
+ Clear-Disk –InputObject $Disk[0] -RemoveData
- # This command initializes a new MBR disk
+ # This command initializes a new MBR disk
Initialize-Disk –InputObject $Disk[0] -PartitionStyle MBR
# This command creates a 350 MB system partition
- $SystemPartition = New-Partition –InputObject $Disk[0] -Size (350MB) -IsActive
+ $SystemPartition = New-Partition –InputObject $Disk[0] -Size (350MB) -IsActive
# This formats the volume with a FAT32 Filesystem
# To skip the confirmation dialog, append –Confirm:$False
@@ -484,15 +484,15 @@ BitLocker recovery keys are the keys that can be used to unlock a BitLocker prot
# This command toggles the NODEFAULTDRIVELETTER flag on the partition which prevents drive letters being assigned to either partition when inserted into a different computer.
Set-Partition -InputObject $OSPartition -NoDefaultDriveLetter $TRUE
```
-
+
Next you need to apply the operating system image that you want to use with Windows To Go to the operating system partition you just created on the disk (this may take 30 minutes or longer, depending on the size of the image and the speed of your USB connection). The following command shows how this can be accomplished using the [Deployment Image Servicing and Management](https://go.microsoft.com/fwlink/p/?LinkId=619161) command-line tool (DISM):
-
+
>[!TIP]
>The index number must be set correctly to a valid Enterprise image in the .WIM file.
-
+
``` syntax
#The WIM file must contain a sysprep generalized image.
- dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\
+ dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\
```
5. In the same PowerShell session use the following cmdlet to add a recovery key to the drive:
@@ -515,10 +515,10 @@ BitLocker recovery keys are the keys that can be used to unlock a BitLocker prot
``` syntax
# Create a variable to store the password
- $spwd = ConvertTo-SecureString -String -AsplainText –Force
- Enable-BitLocker W: -PasswordProtector $spwd
+ $spwd = ConvertTo-SecureString -String -AsplainText –Force
+ Enable-BitLocker W: -PasswordProtector $spwd
```
-
+
>[!WARNING]
>To have BitLocker only encrypt used space on the disk append the parameter `–UsedSpaceOnly` to the `Enable-BitLocker` cmdlet. As data is added to the drive BitLocker will encrypt additional space. Using this parameter will speed up the preparation process as a smaller percentage of the disk will require encryption. If you are in a time critical situation where you cannot wait for encryption to complete you can also safely remove the Windows To Go drive during the encryption process. The next time the drive is inserted in a computer it will request the BitLocker password. Once the password is supplied, the encryption process will continue. If you do this, make sure your users know that BitLocker encryption is still in process and that they will be able to use the workspace while the encryption completes in the background.
@@ -526,7 +526,7 @@ BitLocker recovery keys are the keys that can be used to unlock a BitLocker prot
>[!WARNING]
>If the **Choose how BitLocker-protected removable data drives can be recovered** Group Policy setting has been configured to back up recovery information to Active Directory Domain Services, the recovery information for the drive will be stored under the account of the host computer used to apply the recovery key.
-
+
If you want to have the recovery information stored under the account of the Windows To Go workspace you can turn BitLocker from within the Windows To Go workspace using the BitLocker Setup Wizard from the BitLocker Control Panel item as described in [To enable BitLocker after distribution](#enable-bitlocker).
9. Safely remove the Windows To Go drive.
@@ -585,9 +585,9 @@ The sample script creates an unattend file that streamlines the deployment proce
>[!TIP]
>To get online help for any Windows PowerShell cmdlet, whether or not it is installed locally type the following cmdlet, replacing <cmdlet-name> with the name of the cmdlet you want to see the help for:
-
+
>`Get-Help -Online`
-
+
>This command causes Windows PowerShell to open the online version of the help topic in your default Internet browser.
#### Windows To Go multiple drive provisioning sample script
@@ -775,14 +775,14 @@ param (
Set-Content $unattendFile $fileContent
#return the file object
- $unattendFile
+ $unattendFile
}
Function CreateRegistryPolicyFile {
$saveFileLocaiton = "" + (get-location) + "\registry.pol"
- $policyFile = New-Object MS.PolicyFileEditor.PolicyFile
+ $policyFile = New-Object MS.PolicyFileEditor.PolicyFile
$policyFile.SetDWORDValue("Software\Policies\Microsoft\FVE", "UseAdvancedStartup", 1)
$policyFile.SetDWORDValue("Software\Policies\Microsoft\FVE", "EnableBDEWithNoTPM", 1)
$policyFile.SetDWORDValue("Software\Policies\Microsoft\FVE", "UseTPM", 2)
@@ -790,7 +790,7 @@ Function CreateRegistryPolicyFile {
$policyFile.SetDWORDValue("Software\Policies\Microsoft\FVE", "UseTPMKey", 2)
$policyFile.SetDWORDValue("Software\Policies\Microsoft\FVE", "UseTPMKeyPIN", 2)
$policyFile.SetDWORDValue("Software\Policies\Microsoft\FVE", "OSEnablePrebootInputProtectorsOnSlates", 1)
- $policyFile.SaveFile($saveFileLocaiton)
+ $policyFile.SaveFile($saveFileLocaiton)
$saveFileLocaiton
}
@@ -815,7 +815,7 @@ else{
$starttime = get-date
#Add type information for modifing the Registy Policy file
-Add-Type -TypeDefinition $Source -Language CSharp
+Add-Type -TypeDefinition $Source -Language CSharp
#Create helper files
$unattendFile = CreateUnattendFile -Arch $Arch
@@ -870,10 +870,10 @@ foreach ($disk in $Disks)
Format-Volume -NewFileSystemLabel "UFD-Windows" -FileSystem NTFS -Partition $OSPartition -confirm:$False | Out-Null
-#The No default drive letter prevents other computers from displaying contents of the drive when connected as a Data drive.
+#The No default drive letter prevents other computers from displaying contents of the drive when connected as a Data drive.
Set-Partition -InputObject $OSPartition -NoDefaultDriveLetter $TRUE
- Set-Partition -InputObject $SystemPartition -NewDriveLetter $SystemDriveLetter
- Set-Partition -InputObject $OSPartition -NewDriveLetter $OSDriveLetter
+ Set-Partition -InputObject $SystemPartition -NewDriveLetter $SystemDriveLetter
+ Set-Partition -InputObject $OSPartition -NewDriveLetter $OSDriveLetter
dism /apply-image /index:1 /applydir:${OSDriveLetter}:\ /imagefile:$InstallWIMPath
if (!$?){
@@ -889,7 +889,7 @@ foreach ($disk in $Disks)
md ${OSDriveLetter}:\windows\System32\GroupPolicy\Machine | out-null
copy $policyFilePath ${OSDriveLetter}:\windows\System32\GroupPolicy\Machine
-#modify the registry of the image to set SanPolicy. This is also where you could set the default
+#modify the registry of the image to set SanPolicy. This is also where you could set the default
#keyboard type for USB keyboards.
write-output "Modify SAN Policy"
reg load HKLM\PW-System ${OSDriveLetter}:\Windows\System32\config\SYSTEM > info.log
@@ -911,10 +911,10 @@ foreach ($disk in $Disks)
#>
if ($DomainName)
{
-#using get-random, we will create a random computer name for the drive.
+#using get-random, we will create a random computer name for the drive.
$suffix = Get-Random
$computername = "wtg-" + $suffix
- djoin /provision /domain $DomainName /savefile ${OSDriveLetter}:\tempBLOB.bin /reuse /machine $computername
+ djoin /provision /domain $DomainName /savefile ${OSDriveLetter}:\tempBLOB.bin /reuse /machine $computername
djoin /requestodj /loadfile ${OSDriveLetter}:\tempBLOB.bin /windowspath ${OSDriveLetter}:\windows > info.log
del ${OSDriveLetter}:\tempBLOB.bin
@@ -934,7 +934,7 @@ foreach ($disk in $Disks)
{
write-output "Flush Cache not supported, Be sure to safely remove the WTG device."
}
-
+
} -ArgumentList @($installWIMPath, $unattendFile, $disk, $driveLetters[$driveIndex-1][0], $driveLetters[$driveIndex][0], $DomainName, $registryPolFilePath)
}
@@ -970,9 +970,9 @@ In the PowerShell provisioning script, after the image has been applied, you can
``` syntax
reg load HKLM\WTG-Keyboard ${OSDriveLetter}:\Windows\System32\config\SYSTEM > info.log
reg add HKLM\WTG-Keyboard\ControlSet001\Services\i8042prt\Parameters /v LayerDriver /d JPN:kbd106dll /t REG_SZ /f
- reg add HKLM\WTG-Keyboard\ControlSet001\Services\i8042prt\Parameters /v OverrideKeyboardIdentifier /d PCAT_106KEY /t REG_SZ /f
+ reg add HKLM\WTG-Keyboard\ControlSet001\Services\i8042prt\Parameters /v OverrideKeyboardIdentifier /d PCAT_106KEY /t REG_SZ /f
reg add HKLM\WTG-Keyboard\ControlSet001\Services\i8042prt\Parameters /v OverrideKeyboardSubtype /d 2 /t REG_DWORD /f
- reg add HKLM\WTG-Keyboard\ControlSet001\Services\i8042prt\Parameters /v OverrideKeyboardType /d 7 /t REG_DWORD /f
+ reg add HKLM\WTG-Keyboard\ControlSet001\Services\i8042prt\Parameters /v OverrideKeyboardType /d 7 /t REG_DWORD /f
reg unload HKLM\WTG-Keyboard
```
diff --git a/windows/deployment/planning/windows-10-enterprise-faq-itpro.md b/windows/deployment/planning/windows-10-enterprise-faq-itpro.md
index d7cda9357a..b79237a3e1 100644
--- a/windows/deployment/planning/windows-10-enterprise-faq-itpro.md
+++ b/windows/deployment/planning/windows-10-enterprise-faq-itpro.md
@@ -6,7 +6,7 @@ ms.prod: w10
ms.mktglfcycl: plan
ms.localizationpriority: medium
ms.sitesec: library
-author:
+author:
ms.date: 08/18/2017
---
@@ -58,7 +58,7 @@ Many existing Win32 and Win64 applications already run reliably on Windows 10 wi
### Which deployment tools support Windows 10?
Updated versions of Microsoft deployment tools, including MDT, Configuration Manager, and the Windows Assessment and Deployment Kit (Windows ADK) have been released to support Windows 10.
-- [MDT](http://www.microsoft.com/mdt) is Microsoft’s recommended collection of tools, processes, and guidance for automating desktop and server deployment.
+- [MDT](https://www.microsoft.com/mdt) is Microsoft’s recommended collection of tools, processes, and guidance for automating desktop and server deployment.
- Configuration Manager simplifies the deployment and management of Windows 10. If you are not currently using Configuration Manager, you can download a free 180-day trial of [System Center Configuration Manager and Endpoint Protection (current branch)](https://www.microsoft.com/evalcenter/evaluate-system-center-configuration-manager-and-endpoint-protection) from the TechNet Evaluation Center.
- The [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#winADK) has tools that allow you to customize Windows images for large-scale deployment, and test system quality and performance. You can download the latest version of the Windows ADK for Windows 10 from the Hardware Dev Center.
@@ -100,9 +100,9 @@ For more information on pros and cons for these tools, see [Servicing Tools](/wi
### Where can I find information about new features and changes in Windows 10 Enterprise?
-For an overview of the new enterprise features in Windows 10 Enterprise, see [What's new in Windows 10](https://technet.microsoft.com/itpro/windows/whats-new/index) and [What's new in Windows 10, version 1703](/windows/whats-new/whats-new-windows-10-version-1703) in the Docs library.
+For an overview of the new enterprise features in Windows 10 Enterprise, see [What's new in Windows 10](https://technet.microsoft.com/itpro/windows/whats-new/index) and [What's new in Windows 10, version 1703](/windows/whats-new/whats-new-windows-10-version-1703) in the Docs library.
-Another place to track the latest information about new features of interest to IT professionals is the [Windows for IT Pros blog](https://blogs.technet.microsoft.com/windowsitpro/). Here you’ll find announcements of new features, information on updates to the Windows servicing model, and details about the latest resources to help you more easily deploy and manage Windows 10.
+Another place to track the latest information about new features of interest to IT professionals is the [Windows for IT Pros blog](https://blogs.technet.microsoft.com/windowsitpro/). Here you’ll find announcements of new features, information on updates to the Windows servicing model, and details about the latest resources to help you more easily deploy and manage Windows 10.
To find out which version of Windows 10 is right for your organization, you can also [compare Windows editions](https://www.microsoft.com/WindowsForBusiness/Compare).
@@ -124,6 +124,6 @@ The desktop experience in Windows 10 has been improved to provide a better exper
Use the following resources for additional information about Windows 10.
- If you are an IT professional or if you have a question about administering, managing, or deploying Windows 10 in your organization or business, visit the [Windows 10 IT Professional forums](https://social.technet.microsoft.com/forums/home?category=windows10itpro) on TechNet.
-- If you are an end user or if you have a question about using Windows 10, visit the [Windows 10 forums on Microsoft Community](http://answers.microsoft.com/windows/forum/windows_10).
+- If you are an end user or if you have a question about using Windows 10, visit the [Windows 10 forums on Microsoft Community](https://answers.microsoft.com/windows/forum/windows_10).
- If you are a developer or if you have a question about making apps for Windows 10, visit the [Windows Desktop Development forums](https://social.msdn.microsoft.com/forums/en-us/home?category=windowsdesktopdev) or [Windows and Windows phone apps forums](https://social.msdn.microsoft.com/forums/en-us/home?category=windowsapps) on MSDN.
- If you have a question about Internet Explorer, visit the [Internet Explorer forums](https://social.technet.microsoft.com/forums/ie/en-us/home) on TechNet.
\ No newline at end of file
diff --git a/windows/deployment/update/change-history-for-update-windows-10.md b/windows/deployment/update/change-history-for-update-windows-10.md
index e76b08389c..9e529d5f34 100644
--- a/windows/deployment/update/change-history-for-update-windows-10.md
+++ b/windows/deployment/update/change-history-for-update-windows-10.md
@@ -6,7 +6,7 @@ ms.mktglfcycl: manage
ms.sitesec: library
author: DaniHalfin
ms.author: daniha
-ms.date: 10/17/2017
+ms.date: 09/05/2019
---
# Change history for Update Windows 10
@@ -38,6 +38,5 @@ All topics were updated to reflect the new [naming changes](waas-overview.md#nam
## RELEASE: Windows 10, version 1703
The topics in this library have been updated for Windows 10, version 1703 (also known as the Creators Update). The following new topics have been added:
-* [Windows Insider Program for Business](waas-windows-insider-for-business.md)
-* [Windows Insider Program for Business using Azure Active Directory](waas-windows-insider-for-business-aad.md)
-* [Windows Insider Program for Business Frequently Asked Questions](waas-windows-insider-for-business-faq.md)
\ No newline at end of file
+* [Windows Insider Program for Business](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-get-started)
+* [Windows Insider Program for Business](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-register)
diff --git a/windows/deployment/update/device-health-monitor.md b/windows/deployment/update/device-health-monitor.md
index e8341b6fea..42e88d5675 100644
--- a/windows/deployment/update/device-health-monitor.md
+++ b/windows/deployment/update/device-health-monitor.md
@@ -18,7 +18,7 @@ ms.author: jaimeo
Device Health is the newest Windows Analytics solution that complements the existing Upgrade Readiness and Update Compliance solutions by providing IT with reports on some common problems the end users might experience so they can be proactively remediated, thus saving support calls and improving end-user productivity.
-Like Upgrade Readiness and Update Compliance, Device Health is a solution built within Operations Management Suite (OMS), a cloud-based monitoring and automation service that has a flexible servicing subscription based on data usage and retention. This release is free for customers to try and will not incur charges on your OMS workspace for its use. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/).
+Like Upgrade Readiness and Update Compliance, Device Health is a solution built within Operations Management Suite (OMS), a cloud-based monitoring and automation service that has a flexible servicing subscription based on data usage and retention. This release is free for customers to try and will not incur charges on your OMS workspace for its use. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/).
Device Health uses Windows diagnostic data that is part of all Windows 10 devices. If you have already employed Upgrade Readiness or Update Compliance solutions, all you need to do is select Device Health from the OMS solution gallery and add it to your OMS workspace. Device Health requires enhanced diagnostic data, so you might need to implement this policy if you've not already done so.
@@ -47,11 +47,11 @@ Use of Windows Analytics Device Health requires one of the following licenses:
- Windows VDA E3 or E5 per-device or per-user subscription
-You don't have to install Windows 10 Enterprise on a per-device basis--you just need enough of the above licenses for the number of devices using Device Health.
+You don't have to install Windows 10 Enterprise on a per-device basis--you just need enough of the above licenses for the number of devices using Device Health.
## Device Health architecture
-
+
The Device Health architecture and data flow is summarized by the following five-step process:
diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md
index 47523a44c6..2719e89d62 100644
--- a/windows/deployment/update/update-compliance-monitor.md
+++ b/windows/deployment/update/update-compliance-monitor.md
@@ -18,9 +18,9 @@ ms.localizationpriority: medium
With Windows 10, organizations need to change the way they approach monitoring and deploying updates. Update Compliance is a powerful set of tools that enable organizations to monitor and track all important aspects of the new servicing strategy from Microsoft: [Windows as a Service](waas-overview.md).
-Update Compliance is a solution built within Operations Management Suite (OMS), a cloud-based monitoring and automation service which has a flexible servicing subscription based off data usage/retention. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/documentation/articles/operations-management-suite-overview/).
+Update Compliance is a solution built within Operations Management Suite (OMS), a cloud-based monitoring and automation service which has a flexible servicing subscription based off data usage/retention. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/documentation/articles/operations-management-suite-overview/).
-Update Compliance uses the Windows diagnostic data that is part of all Windows 10 devices. It collects system data including update installation progress, Windows Update for Business (WUfB) configuration data, Windows Defender Antivirus data, and other update-specific information, and then sends this data privately to a secure cloud to be stored for analysis and usage within the solution.
+Update Compliance uses the Windows diagnostic data that is part of all Windows 10 devices. It collects system data including update installation progress, Windows Update for Business (WUfB) configuration data, Windows Defender Antivirus data, and other update-specific information, and then sends this data privately to a secure cloud to be stored for analysis and usage within the solution.
Update Compliance provides the following:
@@ -38,10 +38,10 @@ See the following topics in this guide for detailed information about configurin
Click the following link to see a video demonstrating Update Compliance features.
-[](https://www.youtube-nocookie.com/embed/1cmF5c_R8I4)
+[](https://www.youtube-nocookie.com/embed/1cmF5c_R8I4)
## Update Compliance architecture
-
+
The Update Compliance architecture and data flow is summarized by the following five-step process:
**(1)** User computers send diagnostic data to a secure Microsoft data center using the Microsoft Data Management Service.
diff --git a/windows/deployment/update/waas-overview.md b/windows/deployment/update/waas-overview.md
index d0c4ddbf52..9b07031bb6 100644
--- a/windows/deployment/update/waas-overview.md
+++ b/windows/deployment/update/waas-overview.md
@@ -8,7 +8,7 @@ ms.sitesec: library
author: Jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
-ms.date: 06/01/2018
+ms.date: 09/07/2018
---
# Overview of Windows as a service
@@ -138,9 +138,9 @@ Specialized systems—such as PCs that control medical equipment, point-of-sale
Microsoft never publishes feature updates through Windows Update on devices that run Windows 10 Enterprise LTSB. Instead, it typically offers new LTSC releases every 2–3 years, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle.
>[!NOTE]
->Windows 10 LTSB will support the currently released silicon at the time of release of the LTSB. As future silicon generations are released, support will be created through future Windows 10 LTSB releases that customers can deploy for those systems. For more information, see **Supporting the latest processor and chipsets on Windows** in [Lifecycle support policy FAQ - Windows Products](https://support.microsoft.com/help/18581/lifecycle-support-policy-faq-windows-products).
+>Windows 10 LTSB will support the currently released processors and chipsets at the time of release of the LTSB. As future CPU generations are released, support will be created through future Windows 10 LTSB releases that customers can deploy for those systems. For more information, see **Supporting the latest processor and chipsets on Windows** in [Lifecycle support policy FAQ - Windows Products](https://support.microsoft.com/help/18581/lifecycle-support-policy-faq-windows-products).
-The Long-term Servicing Channel is available only in the Windows 10 Enterprise LTSB edition. This build of Windows doesn’t contain many in-box applications, such as Microsoft Edge, Microsoft Store, Cortana (limited search capabilities remain available), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. Therefore, it’s important to remember that Microsoft has positioned the LTSC model primarily for specialized devices.
+The Long-term Servicing Channel is available only in the Windows 10 Enterprise LTSB edition. This edition of Windows doesn’t include a number of applications, such as Microsoft Edge, Microsoft Store, Cortana (though limited search capabilities remain available), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. These apps are not supported in Windows 10 Enterprise LTSB edition, even of you install by using sideloading.
>[!NOTE]
>If an organization has devices currently running Windows 10 Enterprise LTSB that it would like to change to the Semi-Annual Channel, it can make the change without losing user data. Because LTSB is its own SKU, however, an upgrade is required from Windows 10 Enterprise LTSB to Windows 10 Enterprise, which supports the Semi-Annual Channel.
diff --git a/windows/deployment/update/windows-analytics-get-started.md b/windows/deployment/update/windows-analytics-get-started.md
index 0cf9e39727..294030a5a5 100644
--- a/windows/deployment/update/windows-analytics-get-started.md
+++ b/windows/deployment/update/windows-analytics-get-started.md
@@ -26,7 +26,7 @@ If you've already done that, you're ready to enroll your devices in Windows Anal
## Copy your Commercial ID key
-Microsoft uses a unique commercial ID to map information from user computers to your OMS workspace. This should be generated for you automatically. Copy your commercial ID key in OMS and then deploy it to user computers.
+Microsoft uses a unique commercial ID to map information from user computers to your OMS workspace. This should be generated for you automatically. Copy your commercial ID key in OMS and then deploy it to user computers.
@@ -48,7 +48,7 @@ To enable data sharing, configure your proxy sever to whitelist the following en
| `https://v10.events.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for use with Windows 10, version 1803|
| `https://v10.vortex-win.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1709 or earlier |
| `https://vortex-win.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for operating systems older than Windows 10 |
-| `https://settings-win.data.microsoft.com` | Enables the compatibility update to send data to Microsoft.
+| `https://settings-win.data.microsoft.com` | Enables the compatibility update to send data to Microsoft.
| `http://adl.windows.com` | Allows the compatibility update to receive the latest compatibility data from Microsoft. |
| `https://watson.telemetry.microsoft.com` | Windows Error Reporting (WER); required for Device Health and Update Compliance AV reports. Not used by Upgrade Readiness. |
| `https://oca.telemetry.microsoft.com` | Online Crash Analysis; required for Device Health and Update Compliance AV reports. Not used by Upgrade Readiness. |
@@ -68,7 +68,7 @@ If your organization uses proxy server authentication for outbound traffic, use
- **Best option: Bypass** Configure your proxy servers to **not** require proxy authentication for traffic to the diagnostic data endpoints. This is the most comprehensive solution and it works for all versions of Windows 10.
- **User proxy authentication:** Alternatively, you can configure devices to use the logged on user's context for proxy authentication. First, update the devices to Windows 10, version 1703 or later. Then, ensure that users of the devices have proxy permission to reach the diagnostic data endpoints. This requires that the devices have console users with proxy permissions, so you couldn't use this method with headless devices.
-- **Device proxy authentication:** Another option--the most complex--is as follows: First, configure a system level proxy server on the devices. Then, configure these devices to use machine-account-based outbound proxy authentication. Finally, configure proxy servers to allow the machine accounts access to the diagnostic data endpoints.
+- **Device proxy authentication:** Another option--the most complex--is as follows: First, configure a system level proxy server on the devices. Then, configure these devices to use machine-account-based outbound proxy authentication. Finally, configure proxy servers to allow the machine accounts access to the diagnostic data endpoints.
## Deploy the compatibility update and related updates
@@ -77,13 +77,13 @@ The compatibility update scans your devices and enables application usage tracki
| **Operating System** | **Updates** |
|----------------------|-----------------------------------------------------------------------------|
| Windows 10 | Windows 10 includes the compatibility update, so you will automatically have the latest compatibility update so long as you continue to keep your Windows 10 devices up-to-date with cummulative updates. |
-| Windows 8.1 | [KB 2976978](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2976978) Performs diagnostics on the Windows 8.1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues might be encountered when the latest Windows operating system is installed. For more information about this update, see |
-| Windows 7 SP1 | [KB2952664](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2952664) Performs diagnostics on the Windows 7 SP1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues might be encountered when the latest Windows operating system is installed. For more information about this update, see |
+| Windows 8.1 | [KB 2976978](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2976978) Performs diagnostics on the Windows 8.1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues might be encountered when the latest Windows operating system is installed. For more information about this update, see |
+| Windows 7 SP1 | [KB2952664](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2952664) Performs diagnostics on the Windows 7 SP1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues might be encountered when the latest Windows operating system is installed. For more information about this update, see |
->[!IMPORTANT]
+>[!IMPORTANT]
>Restart devices after you install the compatibility updates for the first time.
->[!NOTE]
+>[!NOTE]
>We recommend you configure your update management tool to automatically install the latest version of these updates. There is a related optional update, [KB 3150513](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=3150513), which can provide updated configuration and definitions for older compatibiltiy updates. For more information about this optional update, see .
@@ -92,7 +92,7 @@ If you are planning to enable IE Site Discovery in Upgrade Readiness, you will n
| **Site discovery** | **Update** |
|----------------------|-----------------------------------------------------------------------------|
-| [Review site discovery](../upgrade/upgrade-readiness-additional-insights.md#site-discovery) | [KB3080149](http://www.catalog.update.microsoft.com/Search.aspx?q=3080149) Updates the Diagnostic and Telemetry tracking service to existing devices. This update is only necessary on Windows 7 and Windows 8.1 devices. For more information about this update, see
Install the latest [Windows Monthly Rollup](http://catalog.update.microsoft.com/v7/site/Search.aspx?q=security%20monthly%20quality%20rollup). This functionality has been included in Internet Explorer 11 starting with the July 2016 Cumulative Update. |
+| [Review site discovery](../upgrade/upgrade-readiness-additional-insights.md#site-discovery) | [KB3080149](https://www.catalog.update.microsoft.com/Search.aspx?q=3080149) Updates the Diagnostic and Telemetry tracking service to existing devices. This update is only necessary on Windows 7 and Windows 8.1 devices. For more information about this update, see
Install the latest [Windows Monthly Rollup](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=security%20monthly%20quality%20rollup). This functionality has been included in Internet Explorer 11 starting with the July 2016 Cumulative Update. |
## Set diagnostic data levels
@@ -117,21 +117,21 @@ Certain Windows Analytics features have additional settings you can use.
- For devices running Windows 10, version 1607 or earlier, Windows diagnostic data must also be set to Enhanced (see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#enhanced-level)) in order to be compatible with Windows Defender Antivirus. See the [Windows Defender Antivirus in Windows 10 and Windows Server 2016](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) for more information about enabling, configuring, and validating Windows Defender AV.
- **Device Health** is only compatible with Windows 10 desktop devices (workstations and laptops) and Windows Server 2016. The solution requires that at least the Enhanced level of diagnostic data is enabled on all devices that are intended to be displayed in the solution. In Windows 10, version 1709, a new policy was added to "limit enhanced telemetry to the minimum required by Windows Analytics". To learn more about Windows diagnostic data, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization).
-
+
- **IE site discovery** is an optional feature of Upgrade Readiness that provides an inventory of websites that are accessed by client devices using Internet Explorer on Windows 7, Windows 8.1, and Windows 10. To enable IE site discovery, make sure the required updates are installed (per previous section) and enable IE site discovery in the deployment script batch file.
## Deploying Windows Analytics at scale
-When you have completed a pilot deployment, you are ready to automate data collection and distribute the deployment script to the remaining devices in your organization.
+When you have completed a pilot deployment, you are ready to automate data collection and distribute the deployment script to the remaining devices in your organization.
### Automate data collection
-To ensure that user computers are receiving the most up-to-date data from Microsoft, we recommend that you establish the following data sharing and analysis processes:
+To ensure that user computers are receiving the most up-to-date data from Microsoft, we recommend that you establish the following data sharing and analysis processes:
- Enable automatic updates for the compatibility update and related updates. These updates include the latest application and driver issue information as we discover it during testing.
- Schedule the Upgrade Readiness deployment script to automatically run monthly. Scheduling the script ensures that full inventory is sent monthly even if devices were not connected or had low battery power at the time the system normally sends inventory. Make sure to run the production version of the script, which is lighter weight and non-interactive. The script also has a number of built-in error checks, so you can monitor the results. If you can't run the deployment script at scale, another option is to configure things centrally via Group Policy or Mobile Device Management (MDM). Although we recommend using the deployment script, both options are discussed in the sections below.
-When you run the deployment script, it initiates a full scan. The daily scheduled task to capture the changes is created when the update package is installed. For Windows 10 devices, this task is already included in the operating system. A full scan averages about 2 MB, but the scans for changes are very small. The scheduled task is named "Windows Compatibility Appraiser" and can be found in the Task Scheduler Library under Microsoft > Windows > Application Experience. Changes are invoked via the nightly scheduled task. It attempts to run around 3:00AM every day. If the system is powered off at that time, the task will run when the system is turned on.
+When you run the deployment script, it initiates a full scan. The daily scheduled task to capture the changes is created when the update package is installed. For Windows 10 devices, this task is already included in the operating system. A full scan averages about 2 MB, but the scans for changes are very small. The scheduled task is named "Windows Compatibility Appraiser" and can be found in the Task Scheduler Library under Microsoft > Windows > Application Experience. Changes are invoked via the nightly scheduled task. It attempts to run around 3:00AM every day. If the system is powered off at that time, the task will run when the system is turned on.
### Distribute the deployment script at scale
@@ -155,14 +155,14 @@ These policies are under Microsoft\Windows\DataCollection:
You can set these values by using Group Policy (in Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds) or by using Mobile Device Management (in Provider/ProviderID/CommercialID). For more information about deployment using MDM, see the [DMClient CSP](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp) topic in MDM documentation.
-The corresponding preference registry values are available in **HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection** and can be configured by the deployment script. If a given setting is configured by both preference registry settings and policy, the policy values will override. However, the **IEDataOptIn** setting is different--you can only set this with the preference registry keys:
+The corresponding preference registry values are available in **HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection** and can be configured by the deployment script. If a given setting is configured by both preference registry settings and policy, the policy values will override. However, the **IEDataOptIn** setting is different--you can only set this with the preference registry keys:
- IEOptInLevel = 0 Internet Explorer data collection is disabled
- IEOptInLevel = 1 Data collection is enabled for sites in the Local intranet + Trusted sites + Machine local zones
- IEOptInLevel = 2 Data collection is enabled for sites in the Internet + Restricted sites zones
- IEOptInLevel = 3 Data collection is enabled for all sites
-For more information about Internet Explorer Security Zones, see [About URL Security Zones](https://docs.microsoft.com/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537183(v=vs.85)).
+For more information about Internet Explorer Security Zones, see [About URL Security Zones](https://docs.microsoft.com/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537183(v=vs.85)).
### Distribution at scale without using the deployment script
diff --git a/windows/deployment/update/windows-analytics-privacy.md b/windows/deployment/update/windows-analytics-privacy.md
index 49c1fc93cc..04358b5b05 100644
--- a/windows/deployment/update/windows-analytics-privacy.md
+++ b/windows/deployment/update/windows-analytics-privacy.md
@@ -44,7 +44,7 @@ See these topics for additional background information about related privacy iss
- [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](https://docs.microsoft.com/windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields)
- [Diagnostic Data Viewer Overview](https://docs.microsoft.com/windows/configuration/diagnostic-data-viewer-overview)
- [Licensing Terms and Documentation](https://www.microsoftvolumelicensing.com/DocumentSearch.aspx?Mode=3&DocumentTypeId=31)
-- [Learn about security and privacy at Microsoft datacenters](http://www.microsoft.com/datacenters)
+- [Learn about security and privacy at Microsoft datacenters](https://www.microsoft.com/datacenters)
- [Confidence in the trusted cloud](https://azure.microsoft.com/support/trust-center/)
- [Trust Center](https://www.microsoft.com/trustcenter)
diff --git a/windows/deployment/update/windows-update-sources.md b/windows/deployment/update/windows-update-sources.md
index b87b77d354..b5f709e351 100644
--- a/windows/deployment/update/windows-update-sources.md
+++ b/windows/deployment/update/windows-update-sources.md
@@ -15,8 +15,8 @@ ms.date: 04/05/2018
Windows 10 devices can receive updates from a variety of sources, including Windows Update online, a Windows Server Update Services server, and others. To determine the source of Windows Updates currently being used on a device, follow these steps:
1. Start Windows PowerShell as an administrator
-2. Run `\$MUSM = New-Object -ComObject “Microsoft.Update.ServiceManager”`.
-3. Run `\$MUSM.Services`. Check the resulting output for the **Name** and **OffersWindowsUPdates** parameters, which you can intepret according to this table:
+2. Run `$MUSM = New-Object -ComObject “Microsoft.Update.ServiceManager”`.
+3. Run `$MUSM.Services`. Check the resulting output for the **Name** and **OffersWindowsUPdates** parameters, which you can intepret according to this table:
| Output | Interpretation |
|-----------------------------------------------------|-----------------------------------|
diff --git a/windows/deployment/upgrade/resolution-procedures.md b/windows/deployment/upgrade/resolution-procedures.md
index 18ed0fbef3..cb0bb9ff2a 100644
--- a/windows/deployment/upgrade/resolution-procedures.md
+++ b/windows/deployment/upgrade/resolution-procedures.md
@@ -25,11 +25,11 @@ ms.localizationpriority: medium
A frequently observed result code is 0xC1900101. This result code can be thrown at any stage of the upgrade process, with the exception of the downlevel phase. 0xC1900101 is a generic rollback code, and usually indicates that an incompatible driver is present. The incompatible driver can cause blue screens, system hangs, and unexpected reboots. Analysis of supplemental log files is often helpful, such as:
-- The minidump file: $Windows.~bt\Sources\Rollback\setupmem.dmp,
-- Event logs: $Windows.~bt\Sources\Rollback\*.evtx
+- The minidump file: $Windows.~bt\Sources\Rollback\setupmem.dmp,
+- Event logs: $Windows.~bt\Sources\Rollback\*.evtx
- The device install log: $Windows.~bt\Sources\Rollback\setupapi\setupapi.dev.log
-The device install log is particularly helpful if rollback occurs during the sysprep operation (extend code 0x30018). To resolve a rollback due to driver conflicts, try running setup using a minimal set of drivers and startup programs by performing a [clean boot](https://support.microsoft.com/en-us/kb/929135) before initiating the upgrade process.
+The device install log is particularly helpful if rollback occurs during the sysprep operation (extend code 0x30018). To resolve a rollback due to driver conflicts, try running setup using a minimal set of drivers and startup programs by performing a [clean boot](https://support.microsoft.com/en-us/kb/929135) before initiating the upgrade process.
See the following general troubleshooting procedures associated with a result code of 0xC1900101:
@@ -46,7 +46,7 @@ The device install log is particularly helpful if rollback occurs during the sys
Cause
Windows Setup encountered an error during the SAFE_OS with the INSTALL_RECOVERY_ENVIRONMENT operation
- This is generally caused by out-of-date drivers.
+ This is generally caused by out-of-date drivers.
@@ -72,7 +72,7 @@ The device install log is particularly helpful if rollback occurs during the sys
Cause
Windows Setup encountered an unspecified error during Wim apply in the WinPE phase.
- This is generally caused by out-of-date drivers.
+ This is generally caused by out-of-date drivers.
@@ -82,7 +82,7 @@ The device install log is particularly helpful if rollback occurs during the sys
Mitigation
Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.
Contact your hardware vendor to obtain updated device drivers.
- Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.
+ Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.
@@ -100,7 +100,7 @@ The device install log is particularly helpful if rollback occurs during the sys
Cause
A driver has caused an illegal operation.
Windows was not able to migrate the driver, resulting in a rollback of the operating system.
- This is a SafeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software.
+ This is a SafeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software.
@@ -137,7 +137,7 @@ Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory,
Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.
Contact your hardware vendor to obtain updated device drivers.
- Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.
+ Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.
@@ -178,9 +178,9 @@ Disconnect all peripheral devices that are connected to the system, except for t
Cause
A rollback occurred due to a driver configuration issue.
- Installation failed during the second boot phase while attempting the MIGRATE_DATA operation.
+ Installation failed during the second boot phase while attempting the MIGRATE_DATA operation.
- This can occur due to incompatible drivers.
+ This can occur due to incompatible drivers.
@@ -190,11 +190,11 @@ Disconnect all peripheral devices that are connected to the system, except for t
Mitigation
- Check supplemental rollback logs for a setupmem.dmp file, or event logs for any unexpected reboots or errors.
+ Check supplemental rollback logs for a setupmem.dmp file, or event logs for any unexpected reboots or errors.
Review the rollback log and determine the stop code.
The rollback log is located in the **C:\$Windows.~BT\Sources\Panther** folder. An example analysis is shown below. This example is not representative of all cases:
Info SP Crash 0x0000007E detected
- Info SP Module name :
+ Info SP Module name :
Info SP Bugcheck parameter 1 : 0xFFFFFFFFC0000005
Info SP Bugcheck parameter 2 : 0xFFFFF8015BC0036A
Info SP Bugcheck parameter 3 : 0xFFFFD000E5D23728
@@ -362,7 +362,7 @@ Disable or uninstall non-Microsoft antivirus applications, disconnect all unnece
Cause
-The installation failed during the second boot phase while attempting the MIGRATE_DATA operation.
+The installation failed during the second boot phase while attempting the MIGRATE_DATA operation.
This issue can occur due to file system, application, or driver issues.
@@ -394,7 +394,7 @@ The installation failed during the second boot phase while attempting the MIGRAT
Cause
-The installation failed in the FIRST_BOOT phase with an error during MIGRATE_DATA operation.
+The installation failed in the FIRST_BOOT phase with an error during MIGRATE_DATA operation.
@@ -405,13 +405,13 @@ The installation failed in the FIRST_BOOT phase with an error during MIGRATE_DAT
Mitigation
-[Analyze log files](log-files.md#analyze-log-files) in order to determine the files or registry entries that are blocking data migration.
+[Analyze log files](log-files.md#analyze-log-files) in order to determine the files or registry entries that are blocking data migration.
-This error can be due to a problem with user profiles. It can occur due to corrupt registry entries under **HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList** or invalid files in the **\\Users** directory.
+This error can be due to a problem with user profiles. It can occur due to corrupt registry entries under **HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList** or invalid files in the **\\Users** directory.
Note: If a previous upgrade did not complete, invalid profiles might exist in the **Windows.old\\Users** directory.
-To repair this error, ensure that deleted accounts are not still present in the Windows registry and that files under the \\Users directory are valid. Delete the invalid files or user profiles that are causing this error. The specific files and profiles that are causing the error will be recorded in the Windows setup log files.
+To repair this error, ensure that deleted accounts are not still present in the Windows registry and that files under the \\Users directory are valid. Delete the invalid files or user profiles that are causing this error. The specific files and profiles that are causing the error will be recorded in the Windows setup log files.
@@ -431,7 +431,7 @@ To repair this error, ensure that deleted accounts are not still present in the
Cause
-General failure, a device attached to the system is not functioning.
+General failure, a device attached to the system is not functioning.
@@ -508,13 +508,13 @@ This error has more than one possible cause. Attempt [quick fixes](quick-fixes.m
0x80090011
A device driver error occurred during user data migration.
-
Contact your hardware vendor and get all the device drivers updated. It is recommended to have an active internet connection during upgrade process.
+
Contact your hardware vendor and get all the device drivers updated. It is recommended to have an active internet connection during upgrade process.
Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.
0xC7700112
Failure to complete writing data to the system drive, possibly due to write access failure on the hard disk.
-
This issue is resolved in the latest version of Upgrade Assistant.
+
This issue is resolved in the latest version of Upgrade Assistant.
Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.
@@ -528,7 +528,7 @@ This error has more than one possible cause. Attempt [quick fixes](quick-fixes.m
0x80246007
The update was not downloaded successfully.
Attempt other methods of upgrading the operating system.
-Download and run the media creation tool. See [Download windows 10](https://www.microsoft.com/en-us/software-download/windows10).
+Download and run the media creation tool. See [Download windows 10](https://www.microsoft.com/en-us/software-download/windows10).
Attempt to upgrade using .ISO or USB.
**Note**: Windows 10 Enterprise isn’t available in the media creation tool. For more information, go to the [Volume Licensing Service Center](https://www.microsoft.com/licensing/servicecenter/default.aspx).
@@ -565,7 +565,7 @@ Download and run the media creation tool. See [Download windows 10](https://www.
The user has chosen to cancel because the system does not pass the compatibility scan to install the update. Setup.exe will report this error when it can upgrade the machine with user data but cannot migrate installed applications.
Incompatible software is blocking the upgrade process. Uninstall the application and try the upgrade again. See [Windows 10 Pre-Upgrade Validation using SETUP.EXE](https://blogs.technet.microsoft.com/mniehaus/2015/08/23/windows-10-pre-upgrade-validation-using-setup-exe/) for more information.
- You can also download the [Windows Assessment and Deployment Kit (ADK) for Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=526740) and install Application Compatibility Tools.
+ You can also download the [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=526740) and install Application Compatibility Tools.
@@ -584,7 +584,7 @@ Download and run the media creation tool. See [Download windows 10](https://www.
0x80240FFF
Occurs when update synchronization fails. It can occur when you are using Windows Server Update Services on its own or when it is integrated with System Center Configuration Manager. If you enable update synchronization before you install hotfix 3095113, WSUS doesn't recognize the Upgrades classification and instead treats the upgrade like a regular update.
-
You can prevent this by installing hotfix 3095113 before you enable update synchronization. However, if you have already run into this problem, do the following:
+
You can prevent this by installing hotfix 3095113 before you enable update synchronization. However, if you have already run into this problem, do the following:
Disable the Upgrades classification.
@@ -624,7 +624,7 @@ Download and run the media creation tool. See [Download windows 10](https://www.
Error Codes
Cause
Mitigation
0x80070003- 0x20007
-
This is a failure during SafeOS phase driver installation.
+
This is a failure during SafeOS phase driver installation.
[Verify device drivers](https://msdn.microsoft.com/windows/hardware/drivers/install/troubleshooting-device-and-driver-installations) on the computer, and [analyze log files](log-files.md#analyze-log-files) to determine the problem driver.
@@ -661,15 +661,15 @@ Alternatively, re-create installation media the [Media Creation Tool](https://ww
The installation failed in the SECOND_BOOT phase with an error in during MIGRATE_DATA operation. This error indicates that access was denied while attempting to migrate data.
[Analyze log files](log-files.md#analyze-log-files) to determine the data point that is reporting access denied.
0x80070004 - 0x50012
-
Windows Setup failed to open a file.
+
Windows Setup failed to open a file.
[Analyze log files](log-files.md#analyze-log-files) to determine the data point that is reporting access problems.
These errors indicate the computer does not have enough free space available to install the upgrade.
To upgrade a computer to Windows 10, it requires 16 GB of free hard drive space for a 32-bit OS, and 20 GB for a 64-bit OS. If there is not enough space, attempt to [free up drive space](https://support.microsoft.com/en-us/help/17421/windows-free-up-drive-space) before proceeding with the upgrade.
-
+
Note: If your device allows it, you can use an external USB drive for the upgrade process. Windows setup will back up the previous version of Windows to a USB external drive. The external drive must be at least 8GB (16GB is recommended). The external drive should be formatted using NTFS. Drives that are formatted in FAT32 may run into errors due to FAT32 file size limitations. USB drives are preferred over SD cards because drivers for SD cards are not migrated if the device does not support Connected Standby.
@@ -681,77 +681,77 @@ Also see the following sequential list of modern setup (mosetup) error codes wit
| Result code | Message | Description |
| --- | --- | --- |
-| 0XC1900100 | MOSETUP_E_VERSION_MISMATCH | An unexpected version of Setup Platform binaries was encountered. Please verify the package contents. |
-| 0XC1900101 | MOSETUP_E_SETUP_PLATFORM | The Setup Platform has encountered an unspecified error. |
-| 0XC1900102 | MOSETUP_E_SHUTDOWN_BLOCK | Unable to create or destroy the shutdown block message. |
-| 0XC1900103 | MOSETUP_E_COMPAT_TIMEOUT | The compatibility issues were not resolved within the required time limit. |
-| 0XC1900104 | MOSETUP_E_PROCESS_TIMEOUT | The installation process did not complete within the required time limit. |
-| 0XC1900105 | MOSETUP_E_TEST_MODE | The installation process is being used in a test environment. |
-| 0XC1900106 | MOSETUP_E_TERMINATE_PROCESS | The installation process was terminated. |
-| 0XC1900107 | MOSETUP_E_CLEANUP_PENDING | A cleanup operation from a previous installation attempt is still pending. A system reboot is required. |
-| 0XC1900108 | MOSETUP_E_REPORTING | An error has occured and the result value must be consolidated for telemetry purposes. |
-| 0XC1900109 | MOSETUP_E_COMPAT_TERMINATE | The installation process was terminated during the actionable compatibility phase. |
-| 0XC190010a | MOSETUP_E_UNKNOWN_CMD_LINE | The installation process was launched with an unknown command line argument. |
-| 0XC190010b | MOSETUP_E_INSTALL_IMAGE_NOT_FOUND | The installation image was not found. |
-| 0XC190010c | MOSETUP_E_AUTOMATION_INVALID | The provided automation information was invalid. |
-| 0XC190010d | MOSETUP_E_INVALID_CMD_LINE | The installation process was launched with an invalid command line argument. |
-| 0XC190010e | MOSETUP_E_EULA_ACCEPT_REQUIRED | The installation process requires that the user accept the license agreement. |
-| 0XC1900110 | MOSETUP_E_EULA_CANCEL | The user has chosen to cancel for license agreement. |
-| 0XC1900111 | MOSETUP_E_ADVERTISE_CANCEL | The user has chosen to cancel for advertisement. |
-| 0XC1900112 | MOSETUP_E_TARGET_DRIVE_NOT_FOUND | Could not find a target drive letter. |
-| 0XC1900113 | MOSETUP_E_EULA_DECLINED | The user has declined the license terms. |
-| 0XC190011e | MOSETUP_E_FLIGHTING_BVT | The installation process has been halted for testing purposes. |
-| 0XC190011f | MOSETUP_E_PROCESS_CRASHED | The installation process crashed. |
-| 0XC1900120 | MOSETUP_E_EULA_TIMEOUT | The user has not accepted Eula within the required time limit. |
-| 0XC1900121 | MOSETUP_E_ADVERTISE_TIMEOUT | The user has not accepted Advertisement within the required time limit. |
-| 0XC1900122 | MOSETUP_E_DOWNLOADDISKSPACE_TIMEOUT | The download diskspace issues were not resolved within the required time limit. |
-| 0XC1900123 | MOSETUP_E_INSTALLDISKSPACE_TIMEOUT | The install diskspace issues were not resolved within the required time limit. |
-| 0XC1900124 | MOSETUP_E_COMPAT_SYSREQ_TIMEOUT | The minimum requirements compatibility issues were not resolved within the required time limit. |
-| 0XC1900125 | MOSETUP_E_COMPAT_DOWNLOADREQ_TIMEOUT | The compatibility issues for download were not resolved within the required time limit. |
-| 0XC1900126 | MOSETUP_E_GATHER_OS_STATE_SIGNATURE | The GatherOsState executable has invalid signature. |
-| 0XC1900127 | MOSETUP_E_UNINSTALL_ALLOWED_ABORT | The user has chosen to abort Setup to keep Uninstall option active. |
-| 0XC1900128 | MOSETUP_E_MISSING_TASK | The install cannot continue because a required task is missing. |
+| 0XC1900100 | MOSETUP_E_VERSION_MISMATCH | An unexpected version of Setup Platform binaries was encountered. Please verify the package contents. |
+| 0XC1900101 | MOSETUP_E_SETUP_PLATFORM | The Setup Platform has encountered an unspecified error. |
+| 0XC1900102 | MOSETUP_E_SHUTDOWN_BLOCK | Unable to create or destroy the shutdown block message. |
+| 0XC1900103 | MOSETUP_E_COMPAT_TIMEOUT | The compatibility issues were not resolved within the required time limit. |
+| 0XC1900104 | MOSETUP_E_PROCESS_TIMEOUT | The installation process did not complete within the required time limit. |
+| 0XC1900105 | MOSETUP_E_TEST_MODE | The installation process is being used in a test environment. |
+| 0XC1900106 | MOSETUP_E_TERMINATE_PROCESS | The installation process was terminated. |
+| 0XC1900107 | MOSETUP_E_CLEANUP_PENDING | A cleanup operation from a previous installation attempt is still pending. A system reboot is required. |
+| 0XC1900108 | MOSETUP_E_REPORTING | An error has occured and the result value must be consolidated for telemetry purposes. |
+| 0XC1900109 | MOSETUP_E_COMPAT_TERMINATE | The installation process was terminated during the actionable compatibility phase. |
+| 0XC190010a | MOSETUP_E_UNKNOWN_CMD_LINE | The installation process was launched with an unknown command line argument. |
+| 0XC190010b | MOSETUP_E_INSTALL_IMAGE_NOT_FOUND | The installation image was not found. |
+| 0XC190010c | MOSETUP_E_AUTOMATION_INVALID | The provided automation information was invalid. |
+| 0XC190010d | MOSETUP_E_INVALID_CMD_LINE | The installation process was launched with an invalid command line argument. |
+| 0XC190010e | MOSETUP_E_EULA_ACCEPT_REQUIRED | The installation process requires that the user accept the license agreement. |
+| 0XC1900110 | MOSETUP_E_EULA_CANCEL | The user has chosen to cancel for license agreement. |
+| 0XC1900111 | MOSETUP_E_ADVERTISE_CANCEL | The user has chosen to cancel for advertisement. |
+| 0XC1900112 | MOSETUP_E_TARGET_DRIVE_NOT_FOUND | Could not find a target drive letter. |
+| 0XC1900113 | MOSETUP_E_EULA_DECLINED | The user has declined the license terms. |
+| 0XC190011e | MOSETUP_E_FLIGHTING_BVT | The installation process has been halted for testing purposes. |
+| 0XC190011f | MOSETUP_E_PROCESS_CRASHED | The installation process crashed. |
+| 0XC1900120 | MOSETUP_E_EULA_TIMEOUT | The user has not accepted Eula within the required time limit. |
+| 0XC1900121 | MOSETUP_E_ADVERTISE_TIMEOUT | The user has not accepted Advertisement within the required time limit. |
+| 0XC1900122 | MOSETUP_E_DOWNLOADDISKSPACE_TIMEOUT | The download diskspace issues were not resolved within the required time limit. |
+| 0XC1900123 | MOSETUP_E_INSTALLDISKSPACE_TIMEOUT | The install diskspace issues were not resolved within the required time limit. |
+| 0XC1900124 | MOSETUP_E_COMPAT_SYSREQ_TIMEOUT | The minimum requirements compatibility issues were not resolved within the required time limit. |
+| 0XC1900125 | MOSETUP_E_COMPAT_DOWNLOADREQ_TIMEOUT | The compatibility issues for download were not resolved within the required time limit. |
+| 0XC1900126 | MOSETUP_E_GATHER_OS_STATE_SIGNATURE | The GatherOsState executable has invalid signature. |
+| 0XC1900127 | MOSETUP_E_UNINSTALL_ALLOWED_ABORT | The user has chosen to abort Setup to keep Uninstall option active. |
+| 0XC1900128 | MOSETUP_E_MISSING_TASK | The install cannot continue because a required task is missing. |
| 0XC1900129 | MOSETUP_E_UPDATEMEDIA_REQUESTED | A more up-to-date version of setup will be launched to continue installation
-| 0XC190012f | MOSETUP_E_FINALIZE_ALREADY_REQUESTED | The install cannot continue because a finalize operation was already requested. |
-| 0XC1900130 | MOSETUP_E_INSTALL_HASH_MISSING | The install cannot continue because the instance hash was not found. |
-| 0XC1900131 | MOSETUP_E_INSTALL_HASH_MISMATCH | The install cannot continue because the instance hash does not match. |
-| 0XC19001df | MOSETUP_E_DISK_FULL | The install cannot continue because the system is out of disk space. |
-| 0XC19001e0 | MOSETUP_E_GATHER_OS_STATE_FAILED | The GatherOsState executable has failed to execute. |
-| 0XC19001e1 | MOSETUP_E_PROCESS_SUSPENDED | The installation process was suspended. |
-| 0XC19001e2 | MOSETUP_E_PREINSTALL_SCRIPT_FAILED | A preinstall script failed to execute or returned an error. |
-| 0XC19001e3 | MOSETUP_E_PRECOMMIT_SCRIPT_FAILED | A precommit script failed to execute or returned an error. |
-| 0XC19001e4 | MOSETUP_E_FAILURE_SCRIPT_FAILED | A failure script failed to execute or returned an error. |
-| 0XC19001e5 | MOSETUP_E_SCRIPT_TIMEOUT | A script exceeded the timeout limit. |
-| 0XC1900200 | MOSETUP_E_COMPAT_SYSREQ_BLOCK | The system does not pass the minimum requirements to install the update. |
-| 0XC1900201 | MOSETUP_E_COMPAT_SYSREQ_CANCEL | The user has chosen to cancel because the system does not pass the minimum requirements to install the update. |
-| 0XC1900202 | MOSETUP_E_COMPAT_DOWNLOADREQ_BLOCK | The system does not pass the minimum requirements to download the update. |
-| 0XC1900203 | MOSETUP_E_COMPAT_DOWNLOADREQ_CANCEL | The user has chosen to cancel because the system does not pass the minimum requirements to download the update. |
-| 0XC1900204 | MOSETUP_E_COMPAT_MIGCHOICE_BLOCK | The system does not pass the requirements for desired migration choice. |
-| 0XC1900205 | MOSETUP_E_COMPAT_MIGCHOICE_CANCEL | The user has chosen to cancel because the system does not pass the requirements for desired migration choice. |
-| 0XC1900206 | MOSETUP_E_COMPAT_DEVICEREQ_BLOCK | The system does not pass the device scan to install the update. |
-| 0XC1900207 | MOSETUP_E_COMPAT_DEVICEREQ_CANCEL | The user has chosen to cancel because the system does not pass the device scan to install the update. |
-| 0XC1900208 | MOSETUP_E_COMPAT_INSTALLREQ_BLOCK | The system does not pass the compat scan to install the update. |
-| 0XC1900209 | MOSETUP_E_COMPAT_INSTALLREQ_CANCEL | The user has chosen to cancel because the system does not pass the compat scan to install the update. |
-| 0XC190020a | MOSETUP_E_COMPAT_RECOVERYREQ_BLOCK | The system does not pass the minimum requirements to recover Windows. |
-| 0XC190020b | MOSETUP_E_COMPAT_RECOVERYREQ_CANCEL | The user has chosen to cancel because the system does not pass the minimum requirements to recover Windows. |
-| 0XC190020c | MOSETUP_E_DOWNLOADDISKSPACE_BLOCK | The system does not pass the diskspace requirements to download the payload. |
-| 0XC190020d | MOSETUP_E_DOWNLOADDISKSPACE_CANCEL | The user has chosen to cancel as the device does not have enough disk space to download. |
-| 0XC190020e | MOSETUP_E_INSTALLDISKSPACE_BLOCK | The system does not pass the diskspace requirements to install the payload. |
-| 0XC190020f | MOSETUP_E_INSTALLDISKSPACE_CANCEL | The user has chosen to cancel as the device does not have enough disk space to install. |
-| 0XC1900210 | MOSETUP_E_COMPAT_SCANONLY | The user has used the setup.exe command line to do scanonly, not to install the OS. |
-| 0XC1900211 | MOSETUP_E_DOWNLOAD_UNPACK_DISKSPACE_BLOCK | The system does not pass the disk space requirements to download and unpack media. |
-| 0XC1900212 | MOSETUP_E_DOWNLOAD_UNPACK_DISKSPACE_MULTIARCH_BLOCK | The system does not pass the disk space requirements to download and unpack multi-architecture media. |
-| 0XC1900213 | MOSETUP_E_NO_OFFER_FOUND | There was no offer found that matches the required criteria. |
-| 0XC1900214 | MOSETUP_E_UNSUPPORTED_VERSION | This version of the tool is not supported. |
-| 0XC1900215 | MOSETUP_E_NO_MATCHING_INSTALL_IMAGE | Could not find an install image for this system. |
-| 0XC1900216 | MOSETUP_E_ROLLBACK_PENDING | Found pending OS rollback operation. |
-| 0XC1900220 | MOSETUP_E_COMPAT_REPORT_NOT_DISPLAYED | The compatibility report cannot be displayed due to a missing system component. |
-| 0XC1900400 | MOSETUP_E_UA_VERSION_MISMATCH | An unexpected version of Update Agent client was encountered. |
-| 0XC1900401 | MOSETUP_E_UA_NO_PACKAGES_TO_DOWNLOAD | No packages to be downloaded. |
-| 0XC1900402 | MOSETUP_E_UA_UPDATE_CANNOT_BE_MERGED | No packages to be downloaded. |
-| 0XC1900403 | MOSETUP_E_UA_CORRUPT_PAYLOAD_FILES | Payload files were corrupt. |
-| 0XC1900404 | MOSETUP_E_UA_BOX_NOT_FOUND | The installation executable was not found. |
-| 0XC1900405 | MOSETUP_E_UA_BOX_CRASHED | The installation process terminated unexpectedly. |
+| 0XC190012f | MOSETUP_E_FINALIZE_ALREADY_REQUESTED | The install cannot continue because a finalize operation was already requested. |
+| 0XC1900130 | MOSETUP_E_INSTALL_HASH_MISSING | The install cannot continue because the instance hash was not found. |
+| 0XC1900131 | MOSETUP_E_INSTALL_HASH_MISMATCH | The install cannot continue because the instance hash does not match. |
+| 0XC19001df | MOSETUP_E_DISK_FULL | The install cannot continue because the system is out of disk space. |
+| 0XC19001e0 | MOSETUP_E_GATHER_OS_STATE_FAILED | The GatherOsState executable has failed to execute. |
+| 0XC19001e1 | MOSETUP_E_PROCESS_SUSPENDED | The installation process was suspended. |
+| 0XC19001e2 | MOSETUP_E_PREINSTALL_SCRIPT_FAILED | A preinstall script failed to execute or returned an error. |
+| 0XC19001e3 | MOSETUP_E_PRECOMMIT_SCRIPT_FAILED | A precommit script failed to execute or returned an error. |
+| 0XC19001e4 | MOSETUP_E_FAILURE_SCRIPT_FAILED | A failure script failed to execute or returned an error. |
+| 0XC19001e5 | MOSETUP_E_SCRIPT_TIMEOUT | A script exceeded the timeout limit. |
+| 0XC1900200 | MOSETUP_E_COMPAT_SYSREQ_BLOCK | The system does not pass the minimum requirements to install the update. |
+| 0XC1900201 | MOSETUP_E_COMPAT_SYSREQ_CANCEL | The user has chosen to cancel because the system does not pass the minimum requirements to install the update. |
+| 0XC1900202 | MOSETUP_E_COMPAT_DOWNLOADREQ_BLOCK | The system does not pass the minimum requirements to download the update. |
+| 0XC1900203 | MOSETUP_E_COMPAT_DOWNLOADREQ_CANCEL | The user has chosen to cancel because the system does not pass the minimum requirements to download the update. |
+| 0XC1900204 | MOSETUP_E_COMPAT_MIGCHOICE_BLOCK | The system does not pass the requirements for desired migration choice. |
+| 0XC1900205 | MOSETUP_E_COMPAT_MIGCHOICE_CANCEL | The user has chosen to cancel because the system does not pass the requirements for desired migration choice. |
+| 0XC1900206 | MOSETUP_E_COMPAT_DEVICEREQ_BLOCK | The system does not pass the device scan to install the update. |
+| 0XC1900207 | MOSETUP_E_COMPAT_DEVICEREQ_CANCEL | The user has chosen to cancel because the system does not pass the device scan to install the update. |
+| 0XC1900208 | MOSETUP_E_COMPAT_INSTALLREQ_BLOCK | The system does not pass the compat scan to install the update. |
+| 0XC1900209 | MOSETUP_E_COMPAT_INSTALLREQ_CANCEL | The user has chosen to cancel because the system does not pass the compat scan to install the update. |
+| 0XC190020a | MOSETUP_E_COMPAT_RECOVERYREQ_BLOCK | The system does not pass the minimum requirements to recover Windows. |
+| 0XC190020b | MOSETUP_E_COMPAT_RECOVERYREQ_CANCEL | The user has chosen to cancel because the system does not pass the minimum requirements to recover Windows. |
+| 0XC190020c | MOSETUP_E_DOWNLOADDISKSPACE_BLOCK | The system does not pass the diskspace requirements to download the payload. |
+| 0XC190020d | MOSETUP_E_DOWNLOADDISKSPACE_CANCEL | The user has chosen to cancel as the device does not have enough disk space to download. |
+| 0XC190020e | MOSETUP_E_INSTALLDISKSPACE_BLOCK | The system does not pass the diskspace requirements to install the payload. |
+| 0XC190020f | MOSETUP_E_INSTALLDISKSPACE_CANCEL | The user has chosen to cancel as the device does not have enough disk space to install. |
+| 0XC1900210 | MOSETUP_E_COMPAT_SCANONLY | The user has used the setup.exe command line to do scanonly, not to install the OS. |
+| 0XC1900211 | MOSETUP_E_DOWNLOAD_UNPACK_DISKSPACE_BLOCK | The system does not pass the disk space requirements to download and unpack media. |
+| 0XC1900212 | MOSETUP_E_DOWNLOAD_UNPACK_DISKSPACE_MULTIARCH_BLOCK | The system does not pass the disk space requirements to download and unpack multi-architecture media. |
+| 0XC1900213 | MOSETUP_E_NO_OFFER_FOUND | There was no offer found that matches the required criteria. |
+| 0XC1900214 | MOSETUP_E_UNSUPPORTED_VERSION | This version of the tool is not supported. |
+| 0XC1900215 | MOSETUP_E_NO_MATCHING_INSTALL_IMAGE | Could not find an install image for this system. |
+| 0XC1900216 | MOSETUP_E_ROLLBACK_PENDING | Found pending OS rollback operation. |
+| 0XC1900220 | MOSETUP_E_COMPAT_REPORT_NOT_DISPLAYED | The compatibility report cannot be displayed due to a missing system component. |
+| 0XC1900400 | MOSETUP_E_UA_VERSION_MISMATCH | An unexpected version of Update Agent client was encountered. |
+| 0XC1900401 | MOSETUP_E_UA_NO_PACKAGES_TO_DOWNLOAD | No packages to be downloaded. |
+| 0XC1900402 | MOSETUP_E_UA_UPDATE_CANNOT_BE_MERGED | No packages to be downloaded. |
+| 0XC1900403 | MOSETUP_E_UA_CORRUPT_PAYLOAD_FILES | Payload files were corrupt. |
+| 0XC1900404 | MOSETUP_E_UA_BOX_NOT_FOUND | The installation executable was not found. |
+| 0XC1900405 | MOSETUP_E_UA_BOX_CRASHED | The installation process terminated unexpectedly. |
## Related topics
diff --git a/windows/deployment/upgrade/upgrade-readiness-get-started.md b/windows/deployment/upgrade/upgrade-readiness-get-started.md
index 20fbf1341c..3c18dab043 100644
--- a/windows/deployment/upgrade/upgrade-readiness-get-started.md
+++ b/windows/deployment/upgrade/upgrade-readiness-get-started.md
@@ -1,7 +1,7 @@
---
title: Get started with Upgrade Readiness (Windows 10)
description: Explains how to get started with Upgrade Readiness.
-keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics,
+keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics,
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
@@ -17,7 +17,7 @@ ms.localizationpriority: medium
>[!IMPORTANT]
>**The OMS portal has been deprecated; you should start using the [Azure portal](https://portal.azure.com) instead as soon as possible.** Many experiences are the same in the two portals, but there are some key differences. See [Windows Analytics in the Azure Portal](../update/windows-analytics-azure-portal.md) for steps to use Windows Analytics in the Azure portal. For much more information about the transition from OMS to Azure, see [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition).
-This topic explains how to obtain and configure Upgrade Readiness for your organization.
+This topic explains how to obtain and configure Upgrade Readiness for your organization.
You can use Upgrade Readiness to plan and manage your upgrade project end-to-end. Upgrade Readiness works by establishing communications between computers in your organization and Microsoft. Upgrade Readiness collects computer, application, and driver data for analysis. This data is used to identify compatibility issues that can block your upgrade and to suggest fixes that are known to Microsoft.
@@ -34,13 +34,13 @@ When you are ready to begin using Upgrade Readiness, perform the following steps
3. [Enroll devices in Windows Analytics](#enroll-devices-in-windows-analytics).
4. [Use Upgrade Readiness to manage Windows Upgrades](#use-upgrade-readiness-to-manage-windows-upgrades) once your devices are enrolled.
-## Data collection and privacy
+## Data collection and privacy
To enable system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see the following topics, refer to [Frequently asked questions and troubleshooting Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-FAQ-troubleshooting), which discusses the issues and provides links to still more detailed information.
## Add Upgrade Readiness to Operations Management Suite or Azure Log Analytics
-Upgrade Readiness is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud based services for managing your on-premises and cloud environments. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/documentation/articles/operations-management-suite-overview/).
+Upgrade Readiness is offered as a solution in the Microsoft Operations Management Suite (OMS), a collection of cloud based services for managing your on-premises and cloud environments. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/documentation/articles/operations-management-suite-overview/).
>[!IMPORTANT]
>Upgrade Readiness is a free solution for Azure subscribers. When configured correctly, all data associated with the Upgrade Readiness solution are exempt from billing in both OMS and Azure. Upgrade Readiness data **do not** count toward OMS daily upload limits. The Upgrade Readiness service will ingest a full snapshot of your data into your OMS workspace on a daily basis. Each snapshot includes all of your devices that have been active within the past 30 days regardless of your OMS retention period.
diff --git a/windows/deployment/upgrade/upgrade-readiness-requirements.md b/windows/deployment/upgrade/upgrade-readiness-requirements.md
index 6e85f14d18..b1d5d0463a 100644
--- a/windows/deployment/upgrade/upgrade-readiness-requirements.md
+++ b/windows/deployment/upgrade/upgrade-readiness-requirements.md
@@ -1,7 +1,7 @@
---
title: Upgrade Readiness requirements (Windows 10)
description: Provides requirements for Upgrade Readiness.
-keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics,
+keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics,
ms.prod: w10
author: jaimeo
ms.author:
@@ -13,7 +13,7 @@ ms.localizationpriority: medium
This article introduces concepts and steps needed to get up and running with Upgrade Readiness. We recommend that you review this list of requirements before getting started as you may need to collect information, such as account credentials, and get approval from internal IT groups, such as your network security group, before you can start using Upgrade Readiness.
-## Supported upgrade paths
+## Supported upgrade paths
### Windows 7 and Windows 8.1
@@ -27,20 +27,20 @@ If you need to update user computers to Windows 7 SP1 or Windows 8.1, use Window
Note: Upgrade Readiness is designed to best support in-place upgrades. In-place upgrades do not support migrations from BIOS to UEFI or from 32-bit to 64-bit architecture. If you need to migrate computers in these scenarios, use the wipe-and-reload method. Upgrade Readiness insights are still valuable in this scenario, however, you can ignore in-place upgrade specific guidance.
-See [Windows 10 Specifications](http://www.microsoft.com/en-US/windows/windows-10-specifications) for additional information about computer system requirements.
+See [Windows 10 Specifications](https://www.microsoft.com/en-US/windows/windows-10-specifications) for additional information about computer system requirements.
### Windows 10
Keeping Windows 10 up to date involves deploying a feature update, and Upgrade Readiness tools help you prepare and plan for these Windows updates.
-The latest cumulative updates must be installed on Windows 10 computers to make sure that the required compatibility updates are installed. You can find the latest cumulative update on the [Microsoft Update Catalog](https://catalog.update.microsoft.com).
+The latest cumulative updates must be installed on Windows 10 computers to make sure that the required compatibility updates are installed. You can find the latest cumulative update on the [Microsoft Update Catalog](https://catalog.update.microsoft.com).
While Upgrade Readiness can be used to assist with updating devices from Windows 10 Long-Term Servicing Channel (LTSC) to Windows 10 Semi-Annual Channel, Upgrade Readiness does not support updates to Windows 10 LTSC. The Long-Term Servicing Channel of Windows 10 is not intended for general deployment, and does not receive feature updates, therefore it is not a supported target with Upgrade Readiness. See [Windows as a service overview](../update/waas-overview.md#long-term-servicing-channel) to understand more about LTSC.
## Operations Management Suite or Azure Log Analytics
-Upgrade Readiness is offered as a solution in Microsoft Operations Management Suite (OMS) and Azure Log Analytics, a collection of cloud based services for managing on premises and cloud computing environments. For more information about OMS, see [Operations Management Suite overview](http://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/) or the Azure [Log Analytics overview](https://azure.microsoft.com/services/log-analytics/).
+Upgrade Readiness is offered as a solution in Microsoft Operations Management Suite (OMS) and Azure Log Analytics, a collection of cloud based services for managing on premises and cloud computing environments. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/) or the Azure [Log Analytics overview](https://azure.microsoft.com/services/log-analytics/).
-If you’re already using OMS or Azure Log Analytics, you’ll find Upgrade Readiness in the Solutions Gallery. Click the **Upgrade Readiness** tile in the gallery and then click **Add** on the solution’s details page. Upgrade Readiness is now visible in your workspace.
+If you’re already using OMS or Azure Log Analytics, you’ll find Upgrade Readiness in the Solutions Gallery. Click the **Upgrade Readiness** tile in the gallery and then click **Add** on the solution’s details page. Upgrade Readiness is now visible in your workspace.
If you are not using OMS or Azure Log Analytics, go to [Log Analytics](https://azure.microsoft.com/services/log-analytics/) on Microsoft.com and select **Start free** to start the setup process. During the process, you’ll create a workspace and add the Upgrade Readiness solution to it.
diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md
index f0f9e52ba2..450da4c243 100644
--- a/windows/deployment/upgrade/windows-10-edition-upgrades.md
+++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md
@@ -20,9 +20,9 @@ ms.date: 07/06/2018
With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. For information on what edition of Windows 10 is right for you, see [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkID=690882). For a comprehensive list of all possible upgrade paths to Windows 10, see [Windows 10 upgrade paths](windows-10-upgrade-paths.md). Downgrading the edition of Windows is discussed in the [License expiration](#license-expiration) section on this page.
-For a list of operating systems that qualify for the Windows 10 Pro Upgrade or Windows 10 Enterprise Upgrade through Microsoft Volume Licensing, see [Windows 10 Qualifying Operating Systems](http://download.microsoft.com/download/2/d/1/2d14fe17-66c2-4d4c-af73-e122930b60f6/Windows10-QOS.pdf).
+For a list of operating systems that qualify for the Windows 10 Pro Upgrade or Windows 10 Enterprise Upgrade through Microsoft Volume Licensing, see [Windows 10 Qualifying Operating Systems](https://download.microsoft.com/download/2/d/1/2d14fe17-66c2-4d4c-af73-e122930b60f6/Windows10-QOS.pdf).
-The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer. **Note**: The reboot requirement for upgrading from Pro to Enterprise was removed in version 1607.
+The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer. **Note**: The reboot requirement for upgrading from Pro to Enterprise was removed in version 1607.
 (X) = not supported
 (green checkmark) = supported, reboot required
@@ -64,7 +64,7 @@ X = unsupported
> - For information about upgrade paths in Windows 10 in S mode (for Pro or Education), check out [Windows 10 Pro/Enterprise in S mode](../windows-10-pro-in-s-mode.md)
> - Each desktop edition in the table also has an N and KN SKU. These editions have had media-related functionality removed. Devices with N or KN SKUs installed can be upgraded to corresponding N or KN SKUs using the same methods.
>
-> - Due to [naming changes](https://docs.microsoft.com/en-us/windows/deployment/update/waas-overview#naming-changes) the term LTSB might still be displayed in some products. This name will change to LTSC with subsequent feature updates.
+> - Due to [naming changes](https://docs.microsoft.com/en-us/windows/deployment/update/waas-overview#naming-changes) the term LTSB might still be displayed in some products. This name will change to LTSC with subsequent feature updates.
## Upgrade using mobile device management (MDM)
- To upgrade desktop editions of Windows 10 using MDM, you'll need to enter the product key for the upgraded edition in the **UpgradeEditionWithProductKey** policy setting of the **WindowsLicensing** CSP. For more info, see [WindowsLicensing CSP](https://go.microsoft.com/fwlink/p/?LinkID=690907).
@@ -72,7 +72,7 @@ X = unsupported
- To upgrade mobile editions of Windows 10 using MDM, you'll need to enter the product key for the upgraded edition in the **UpgradeEditionWithLicense** policy setting of the **WindowsLicensing** CSP. For more info, see [WindowsLicensing CSP](https://go.microsoft.com/fwlink/p/?LinkID=690907).
## Upgrade using a provisioning package
-Use Windows Configuration Designer to create a provisioning package to upgrade a desktop edition or mobile edition of Windows 10. To get started, [install Windows Configuration Designer from the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22).
+Use Windows Configuration Designer to create a provisioning package to upgrade a desktop edition or mobile edition of Windows 10. To get started, [install Windows Configuration Designer from the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22).
- To create a provisioning package for upgrading desktop editions of Windows 10, go to **Runtime settings > EditionUpgrade > UpgradeEditionWithProductKey** in the **Available customizations** panel in Windows ICD and enter the product key for the upgraded edition.
@@ -116,7 +116,7 @@ If you do not have a product key, you can upgrade your edition of Windows 10 th
2. Click **Go to Store**.
3. Follow the on-screen instructions.
-
+
**Note** If you are a Windows 10 Home N or Windows 10 Home KN user and have trouble finding your applicable upgrade in the Microsoft Store, click [here](ms-windows-store://windowsupgrade/).
## License expiration
diff --git a/windows/deployment/upgrade/windows-10-upgrade-paths.md b/windows/deployment/upgrade/windows-10-upgrade-paths.md
index 4ca5f1bd95..166c96a39c 100644
--- a/windows/deployment/upgrade/windows-10-upgrade-paths.md
+++ b/windows/deployment/upgrade/windows-10-upgrade-paths.md
@@ -142,7 +142,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
-
Professional
+
Pro
D
✔
✔
@@ -153,7 +153,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
-
Professional Student
+
Pro Student
D
✔
✔
@@ -164,7 +164,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
-
Professional WMC
+
Pro WMC
D
✔
✔
@@ -233,7 +233,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
-
Professional
+
Pro
D
✔
✔
diff --git a/windows/deployment/usmt/usmt-overview.md b/windows/deployment/usmt/usmt-overview.md
index d07f18d62b..64dca2cedb 100644
--- a/windows/deployment/usmt/usmt-overview.md
+++ b/windows/deployment/usmt/usmt-overview.md
@@ -36,7 +36,7 @@ USMT provides the following benefits to businesses that are deploying Windows op
- Increases employee satisfaction with the migration experience.
## Limitations
-USMT is intended for administrators who are performing large-scale automated deployments. If you are only migrating the user states of a few computers, you can use [PCmover Express](http://go.microsoft.com/fwlink/?linkid=620915). PCmover Express is a tool created by Microsoft's partner, Laplink.
+USMT is intended for administrators who are performing large-scale automated deployments. If you are only migrating the user states of a few computers, you can use [PCmover Express](https://go.microsoft.com/fwlink/?linkid=620915). PCmover Express is a tool created by Microsoft's partner, Laplink.
There are some scenarios in which the use of USMT is not recommended. These include:
diff --git a/windows/deployment/usmt/usmt-requirements.md b/windows/deployment/usmt/usmt-requirements.md
index daa83b02e6..6166d21bcd 100644
--- a/windows/deployment/usmt/usmt-requirements.md
+++ b/windows/deployment/usmt/usmt-requirements.md
@@ -90,11 +90,11 @@ For more information about previous releases of the USMT tools, see [User State
## Windows PE
-- **Must use latest version of Window PE.** For example, to migrate to Windows 10, you'll need Windows PE 5.1. For more info, see [What's New in Windows PE](http://msdn.microsoft.com/library/windows/hardware/dn938350.aspx).
+- **Must use latest version of Window PE.** For example, to migrate to Windows 10, you'll need Windows PE 5.1. For more info, see [What's New in Windows PE](https://msdn.microsoft.com/library/windows/hardware/dn938350.aspx).
## Credentials
-- **Run as administrator**
+- **Run as administrator**
When manually running the **ScanState** and **LoadState** tools on Windows 7, Windows 8 or Windows 10 you must run them from an elevated command prompt to ensure that all specified users are migrated. If you do not run USMT from an elevated prompt, only the user profile that is logged on will be included in the migration.
To open an elevated command prompt:
diff --git a/windows/deployment/vda-subscription-activation.md b/windows/deployment/vda-subscription-activation.md
index 6cc67221bb..63031ebeaa 100644
--- a/windows/deployment/vda-subscription-activation.md
+++ b/windows/deployment/vda-subscription-activation.md
@@ -29,10 +29,10 @@ Deployment instructions are provided for the following scenarios:
## Activation
-### Scenario 1
+### Scenario 1
- The VM is running Windows 10, version 1803 or later.
- The VM is hosted in Azure or another [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH).
-
+
When a user with VDA rights signs in to the VM using their AAD credentials, the VM is automatically stepped-up to Enterprise and activated. There is no need to perform Windows 10 Pro activation. This eliminates the need to maintain KMS or MAK in the qualifying cloud infrastructure.
### Scenario 2
@@ -41,7 +41,7 @@ Deployment instructions are provided for the following scenarios:
[Inherited Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation#inherited-activation) is enabled. All VMs created by a user with a Windows 10 E3 or E5 license are automatically activated independent of whether a user signs in iwth a local account or using an Azure Active Directory account.
### Scenario 3
-- The VM is running Windows 10, version 1703 or 1709, or the hoster is not an authorized [QMTH](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) partner.
+- The VM is running Windows 10, version 1703 or 1709, or the hoster is not an authorized [QMTH](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) partner.
In this scenario, the underlying Windows 10 Pro license must be activated prior to Subscription Activation of Windows 10 Enterprise. Activation is accomplished using a Windows 10 Pro Generic Volume License Key (GVLK) and a Volume License KMS activation server provided by the hoster. Alternatively, a KMS activation server on your corporate network can be used if you have configured a private connection, such as [ExpressRoute](https://azure.microsoft.com/services/expressroute/) or [VPN Gateway](https://azure.microsoft.com/services/vpn-gateway/).
@@ -63,7 +63,7 @@ For examples of activation issues, see [Troubleshoot the user experience](https:
7. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd).
8. Open Windows Configuration Designer and click **Provison desktop services**.
9. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 10.
-
+
1. Under **Name**, type **Desktop AD Enrollment Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name.
- Note: You can use a different project name, but this name is also used with dism.exe in a subsequent step.
2. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**.
@@ -141,5 +141,5 @@ To create custom RDP settings for Azure:
[Windows 10 Subscription Activation](windows-10-enterprise-subscription-activation.md)
[Recommended settings for VDI desktops](https://docs.microsoft.com/windows-server/remote/remote-desktop-services/rds-vdi-recommendations)
- [Licensing the Windows Desktop for VDI Environments](http://download.microsoft.com/download/1/1/4/114A45DD-A1F7-4910-81FD-6CAF401077D0/Microsoft%20VDI%20and%20VDA%20FAQ%20v3%200.pdf)
+ [Licensing the Windows Desktop for VDI Environments](https://download.microsoft.com/download/1/1/4/114A45DD-A1F7-4910-81FD-6CAF401077D0/Microsoft%20VDI%20and%20VDA%20FAQ%20v3%200.pdf)
diff --git a/windows/deployment/volume-activation/monitor-activation-client.md b/windows/deployment/volume-activation/monitor-activation-client.md
index 14bf4f8a02..1b8d6436f4 100644
--- a/windows/deployment/volume-activation/monitor-activation-client.md
+++ b/windows/deployment/volume-activation/monitor-activation-client.md
@@ -1,7 +1,7 @@
---
title: Monitor activation (Windows 10)
ms.assetid: 264a3e86-c880-4be4-8828-bf4c839dfa26
-description:
+description:
keywords: vamt, volume activation, activation, windows activation
ms.prod: w10
ms.mktglfcycl: deploy
@@ -29,7 +29,7 @@ ms.date: 07/27/2017
You can monitor the success of the activation process for a computer running Windows 8.1 in several ways. The most popular methods include:
- Using the Volume Licensing Service Center website to track use of MAK keys.
-- Using the **Slmgr /dlv** command on a client computer or on the KMS host. (For a full list of options, see [Slmgr.vbs Options](http://technet.microsoft.com/library/ff793433.aspx).)
+- Using the **Slmgr /dlv** command on a client computer or on the KMS host. (For a full list of options, see [Slmgr.vbs Options](https://technet.microsoft.com/library/ff793433.aspx).)
- Viewing the licensing status, which is exposed through Windows Management Instrumentation (WMI); therefore, it is available to non-Microsoft or custom tools that can access WMI. (Windows PowerShell can also access WMI information.)
- Most licensing actions and events are recorded in the Event log.
- Microsoft System Center Operations Manager and the KMS Management Pack can provide insight and information to users of System Center Operations Manager.
diff --git a/windows/deployment/volume-activation/plan-for-volume-activation-client.md b/windows/deployment/volume-activation/plan-for-volume-activation-client.md
index a937437e02..d1cdff4f2f 100644
--- a/windows/deployment/volume-activation/plan-for-volume-activation-client.md
+++ b/windows/deployment/volume-activation/plan-for-volume-activation-client.md
@@ -80,7 +80,7 @@ Token-based Activation option is available for Windows 10 Enterprise LTSB editio
### Multiple activation key
-A Multiple Activation Key (MAK) is commonly used in small- or mid-sized organizations that have a volume licensing agreement, but they do not meet the requirements to operate a KMS or they prefer a simpler approach. A MAK also
+A Multiple Activation Key (MAK) is commonly used in small- or mid-sized organizations that have a volume licensing agreement, but they do not meet the requirements to operate a KMS or they prefer a simpler approach. A MAK also
allows permanent activation of computers that are isolated from the KMS or are part of an isolated network that does not have enough computers to use the KMS.
To use a MAK, the computers to be activated must have a MAK installed. The MAK is used for one-time activation with the Microsoft online hosted activation services, by telephone, or by using VAMT proxy activation.
@@ -195,7 +195,7 @@ When you create installation media or images for client computers that will be a
Installation media from Microsoft for Enterprise editions of the Windows operating system may already contain the GVLK. One GVLK is available for each type of installation. Note that the GLVK will not activate the software against Microsoft activation servers, only against a KMS or Active Directory-based activation object. In other words, the GVLK does not work unless a valid KMS host key can be found. GVLKs are the only product keys that do not need to be kept confidential.
-Typically, you will not need to manually enter a GVLK unless a computer has been activated with a MAK or a retail key and it is being converted to a KMS activation or to Active Directory-based activation. If you need to locate the GVLK for a particular client edition, see [Appendix A: KMS Client Setup Keys](http://technet.microsoft.com/library/jj612867.aspx).
+Typically, you will not need to manually enter a GVLK unless a computer has been activated with a MAK or a retail key and it is being converted to a KMS activation or to Active Directory-based activation. If you need to locate the GVLK for a particular client edition, see [Appendix A: KMS Client Setup Keys](https://technet.microsoft.com/library/jj612867.aspx).
### Multiple activation keys
diff --git a/windows/deployment/windows-10-enterprise-e3-overview.md b/windows/deployment/windows-10-enterprise-e3-overview.md
index 6ceeb3ef51..7d3667d5c6 100644
--- a/windows/deployment/windows-10-enterprise-e3-overview.md
+++ b/windows/deployment/windows-10-enterprise-e3-overview.md
@@ -38,9 +38,9 @@ When you purchase Windows 10 Enterprise E3 via a partner, you get the followin
How does the Windows 10 Enterprise E3 in CSP program compare with Microsoft Volume Licensing Agreements and Software Assurance?
-- [Microsoft Volume Licensing](http://www.microsoft.com/en-us/licensing/default.aspx) programs are broader in scope, providing organizations with access to licensing for all Microsoft products.
+- [Microsoft Volume Licensing](https://www.microsoft.com/en-us/licensing/default.aspx) programs are broader in scope, providing organizations with access to licensing for all Microsoft products.
-- [Software Assurance](http://www.microsoft.com/en-us/Licensing/licensing-programs/software-assurance-default.aspx) provides organizations with the following categories of benefits:
+- [Software Assurance](https://www.microsoft.com/en-us/Licensing/licensing-programs/software-assurance-default.aspx) provides organizations with the following categories of benefits:
- **Deployment and management**. These benefits include planning services, Microsoft Desktop Optimization (MDOP), Windows Virtual Desktop Access Rights, Windows-To-Go Rights, Windows Roaming Use Rights, Windows Thin PC, Windows RT Companion VDA Rights, and other benefits.
@@ -82,7 +82,7 @@ Windows 10 Enterprise edition has a number of features that are unavailable in
**Improved protection against persistent threats**. Credential Guard works with other technologies (e.g., Device Guard) to help provide further protection against attacks, no matter how persistent.
**Improved manageability**. Credential Guard can be managed through Group Policy, Windows Management Instrumentation (WMI), or Windows PowerShell.
-
For more information, see [Protect derived domain credentials with Credential Guard](http://technet.microsoft.com/itpro/windows/keep-secure/credential-guard).
+
For more information, see [Protect derived domain credentials with Credential Guard](https://technet.microsoft.com/itpro/windows/keep-secure/credential-guard).
\* Credential Guard requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)
@@ -154,15 +154,15 @@ You can implement Credential Guard on Windows 10 Enterprise devices by turning
- Add the virtualization-based security features by using Programs and Features or Deployment Image Servicing and Management (DISM).
- - Configure Credential Guard registry settings by using the Registry Editor or the [Device Guard and Credential Guard hardware readiness tool](http://www.microsoft.com/download/details.aspx?id=53337).
+ - Configure Credential Guard registry settings by using the Registry Editor or the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337).
You can automate these manual steps by using a management tool such as System Center Configuration Manager.
For more information about implementing Credential Guard, see the following resources:
-- [Protect derived domain credentials with Credential Guard](http://technet.microsoft.com/itpro/windows/keep-secure/credential-guard)
-- [PC OEM requirements for Device Guard and Credential Guard](http://msdn.microsoft.com/library/windows/hardware/mt767514(v=vs.85).aspx)
-- [Device Guard and Credential Guard hardware readiness tool](http://www.microsoft.com/download/details.aspx?id=53337)
+- [Protect derived domain credentials with Credential Guard](https://technet.microsoft.com/itpro/windows/keep-secure/credential-guard)
+- [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514(v=vs.85).aspx)
+- [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337)
\* *Requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)*
@@ -187,7 +187,7 @@ Now that the devices have Windows 10 Enterprise, you can implement Device Guard
For more information about implementing Device Guard, see:
- [Planning and getting started on the Device Guard deployment process](https://technet.microsoft.com/itpro/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process)
-- [Device Guard deployment guide](http://technet.microsoft.com/itpro/windows/keep-secure/device-guard-deployment-guide)
+- [Device Guard deployment guide](https://technet.microsoft.com/itpro/windows/keep-secure/device-guard-deployment-guide)
### AppLocker management
@@ -228,7 +228,7 @@ For more information about deploying UE-V, see the following resources:
- [User Experience Virtualization (UE-V) for Windows 10 overview](https://technet.microsoft.com/itpro/windows/manage/uev-for-windows)
- [Get Started with UE-V](https://technet.microsoft.com/itpro/windows/manage/uev-getting-started)
-- [Prepare a UE-V Deployment](https://technet.microsoft.com/itpro/windows/manage/uev-prepare-for-deployment)
+- [Prepare a UE-V Deployment](https://technet.microsoft.com/itpro/windows/manage/uev-prepare-for-deployment)
### Managed User Experience
@@ -238,12 +238,12 @@ The Managed User Experience feature is a set of Windows 10 Enterprise edition f
| Feature | Description |
|------------------|-----------------|
-| Start layout customization | You can deploy a customized Start layout to users in a domain. No reimaging is required, and the Start layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start layouts for different departments or organizations, with minimal management overhead. For more information on these settings, see [Customize Windows 10 Start and taskbar with Group Policy](http://technet.microsoft.com/itpro/windows/manage/customize-windows-10-start-screens-by-using-group-policy). |
-| Unbranded boot | You can suppress Windows elements that appear when Windows starts or resumes and can suppress the crash screen when Windows encounters an error from which it cannot recover. For more information on these settings, see [Unbranded Boot](http://msdn.microsoft.com/library/windows/hardware/mt571997(v=vs.85).aspx). |
-| Custom logon | You can use the Custom Logon feature to suppress Windows 10 UI elements that relate to the Welcome screen and shutdown screen. For example, you can suppress all elements of the Welcome screen UI and provide a custom logon UI. You can also suppress the Blocked Shutdown Resolver (BSDR) screen and automatically end applications while the OS waits for applications to close before a shutdown. For more information on these settings, see [Custom Logon](http://msdn.microsoft.com/library/windows/hardware/mt571990(v=vs.85).aspx). |
-| Shell launcher | Enables Assigned Access to run only a classic Windows app via Shell Launcher to replace the shell. For more information on these settings, see [Shell Launcher](http://msdn.microsoft.com/library/windows/hardware/mt571994(v=vs.85).aspx). |
-| Keyboard filter | You can use Keyboard Filter to suppress undesirable key presses or key combinations. Normally, users can use certain Windows key combinations like Ctrl+Alt+Delete or Ctrl+Shift+Tab to control a device by locking the screen or using Task Manager to close a running application. This is not desirable on devices intended for a dedicated purpose. For more information on these settings, see [Keyboard Filter](http://msdn.microsoft.com/library/windows/hardware/mt587088(v=vs.85).aspx). |
-| Unified write filter | You can use Unified Write Filter (UWF) on your device to help protect your physical storage media, including most standard writable storage types that are supported by Windows, such as physical hard disks, solid-state drives, internal USB devices, external SATA devices, and so on. You can also use UWF to make read-only media appear to the OS as a writable volume. For more information on these settings, see [Unified Write Filter](http://msdn.microsoft.com/library/windows/hardware/mt572001(v=vs.85).aspx). |
+| Start layout customization | You can deploy a customized Start layout to users in a domain. No reimaging is required, and the Start layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start layouts for different departments or organizations, with minimal management overhead. For more information on these settings, see [Customize Windows 10 Start and taskbar with Group Policy](https://technet.microsoft.com/itpro/windows/manage/customize-windows-10-start-screens-by-using-group-policy). |
+| Unbranded boot | You can suppress Windows elements that appear when Windows starts or resumes and can suppress the crash screen when Windows encounters an error from which it cannot recover. For more information on these settings, see [Unbranded Boot](https://msdn.microsoft.com/library/windows/hardware/mt571997(v=vs.85).aspx). |
+| Custom logon | You can use the Custom Logon feature to suppress Windows 10 UI elements that relate to the Welcome screen and shutdown screen. For example, you can suppress all elements of the Welcome screen UI and provide a custom logon UI. You can also suppress the Blocked Shutdown Resolver (BSDR) screen and automatically end applications while the OS waits for applications to close before a shutdown. For more information on these settings, see [Custom Logon](https://msdn.microsoft.com/library/windows/hardware/mt571990(v=vs.85).aspx). |
+| Shell launcher | Enables Assigned Access to run only a classic Windows app via Shell Launcher to replace the shell. For more information on these settings, see [Shell Launcher](https://msdn.microsoft.com/library/windows/hardware/mt571994(v=vs.85).aspx). |
+| Keyboard filter | You can use Keyboard Filter to suppress undesirable key presses or key combinations. Normally, users can use certain Windows key combinations like Ctrl+Alt+Delete or Ctrl+Shift+Tab to control a device by locking the screen or using Task Manager to close a running application. This is not desirable on devices intended for a dedicated purpose. For more information on these settings, see [Keyboard Filter](https://msdn.microsoft.com/library/windows/hardware/mt587088(v=vs.85).aspx). |
+| Unified write filter | You can use Unified Write Filter (UWF) on your device to help protect your physical storage media, including most standard writable storage types that are supported by Windows, such as physical hard disks, solid-state drives, internal USB devices, external SATA devices, and so on. You can also use UWF to make read-only media appear to the OS as a writable volume. For more information on these settings, see [Unified Write Filter](https://msdn.microsoft.com/library/windows/hardware/mt572001(v=vs.85).aspx). |
## Related topics
diff --git a/windows/deployment/windows-10-media.md b/windows/deployment/windows-10-media.md
index 8fc0be6586..5c76526147 100644
--- a/windows/deployment/windows-10-media.md
+++ b/windows/deployment/windows-10-media.md
@@ -1,5 +1,5 @@
---
-title: Windows 10 volume license media
+title: Windows 10 volume license media
description: There are specific infrastructure requirements to deploy and manage Windows 10 that should be in place prior to significant Windows 10 deployments within your organization.
keywords: deploy, upgrade, update, software, media
ms.prod: w10
@@ -17,13 +17,13 @@ author: greg-lindsay
- Windows 10
-With each release of Windows 10, volume license media is made available on the [Volume Licensing Service Center](http://www.microsoft.com/vlsc) (VLSC) and other relevant channels such as Windows Update for Business, Windows Server Update Services (WSUS), and Visual Studio Subscriptions. This topic provides a description of volume license media, and describes some of the changes that have been implemented with the current release of Windows 10.
+With each release of Windows 10, volume license media is made available on the [Volume Licensing Service Center](https://www.microsoft.com/vlsc) (VLSC) and other relevant channels such as Windows Update for Business, Windows Server Update Services (WSUS), and Visual Studio Subscriptions. This topic provides a description of volume license media, and describes some of the changes that have been implemented with the current release of Windows 10.
## Windows 10 media
To download Windows 10 installation media from the VLSC, use the product search filter to find “Windows 10.” A list of products will be displayed. The page then allows you to use your search results to download products, view keys, and view product and key descriptions.
-When you select a product, for example “Windows 10 Enterprise” or “Windows 10 Education”, you can then choose the specific release by clicking **Download** and choosing the **Download Method**, **Language**, and **Operating system Type** (bitness).
+When you select a product, for example “Windows 10 Enterprise” or “Windows 10 Education”, you can then choose the specific release by clicking **Download** and choosing the **Download Method**, **Language**, and **Operating system Type** (bitness).
>If you do not see a Windows 10 release available in the list of downloads, verify the [release date](https://technet.microsoft.com/en-us/windows/release-info.aspx).
@@ -57,8 +57,8 @@ This Semi-Annual Channel release of Windows 10 continues the Windows as a servic
### Language packs
-- **Windows 10 versions 1507 and 1511**: you can select **Windows 10 Enterprise Language Pack**, click **Download** and then select **English** and **64-bit** to see these downloads.
-- **Windows 10 1607 and later**: you must select **Multilanguage** from the drop-down list of languages.
+- **Windows 10 versions 1507 and 1511**: you can select **Windows 10 Enterprise Language Pack**, click **Download** and then select **English** and **64-bit** to see these downloads.
+- **Windows 10 1607 and later**: you must select **Multilanguage** from the drop-down list of languages.
See the following example for Windows 10, version 1709:
@@ -66,7 +66,7 @@ See the following example for Windows 10, version 1709:
### Features on demand
-[Features on demand](https://blogs.technet.microsoft.com/mniehaus/2015/08/31/adding-features-including-net-3-5-to-windows-10/) can be downloaded by searching for "**Windows 10 Enterprise Features on Demand**" and then following the same download process that is described above.
+[Features on demand](https://blogs.technet.microsoft.com/mniehaus/2015/08/31/adding-features-including-net-3-5-to-windows-10/) can be downloaded by searching for "**Windows 10 Enterprise Features on Demand**" and then following the same download process that is described above.
Features on demand is a method for adding features to your Windows 10 image that aren’t included in the base operating system image.
diff --git a/windows/deployment/windows-10-missing-fonts.md b/windows/deployment/windows-10-missing-fonts.md
index 873e4cfd56..46a39d7a66 100644
--- a/windows/deployment/windows-10-missing-fonts.md
+++ b/windows/deployment/windows-10-missing-fonts.md
@@ -35,7 +35,7 @@ If you want to use these fonts, you can enable the optional feature to add these
## Installing language-associated features via language settings:
-If you want to use the fonts from the optional feature and you know that you will want to view Web pages, edit documents, or use apps in the language associated with that feature, add that language into your user profile. You do this the Settings app.
+If you want to use the fonts from the optional feature and you know that you will want to view Web pages, edit documents, or use apps in the language associated with that feature, add that language into your user profile. You do this the Settings app.
For example, here are the steps to install the fonts associated with the Hebrew language:
@@ -93,7 +93,7 @@ Here is a comprehensive list of the font families in each of the optional featur
## Related Topics
-[Download the list of all available language FODs](http://download.microsoft.com/download/0/A/A/0AA4342D-3933-4216-A90D-3BA8392FB1D1/Windows%2010%201703%20FOD%20to%20LP%20Mapping%20Table.xlsx)
+[Download the list of all available language FODs](https://download.microsoft.com/download/0/A/A/0AA4342D-3933-4216-A90D-3BA8392FB1D1/Windows%2010%201703%20FOD%20to%20LP%20Mapping%20Table.xlsx)
[Features On Demand V2 (Capabilities)](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities#span-idrelatedtopicsspanrelated-topics)
diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md
index 859188033c..0cfd6991e5 100644
--- a/windows/deployment/windows-10-poc.md
+++ b/windows/deployment/windows-10-poc.md
@@ -26,13 +26,13 @@ The PoC deployment guides are intended to provide a demonstration of Windows 10
Approximately 3 hours are required to configure the PoC environment. You will need a Hyper-V capable computer running Windows 8.1 or later with at least 16GB of RAM. Detailed [requirements](#hardware-and-software-requirements) are provided below. You will also need to have a [Microsoft account](https://www.microsoft.com/account) to use for downloading evaluation software.
-Windows PowerShell commands are provided to set up the PoC environment quickly. You do not need to be an expert in Windows PowerShell to complete the steps in the guide, however you are required to customize some commands to your environment.
+Windows PowerShell commands are provided to set up the PoC environment quickly. You do not need to be an expert in Windows PowerShell to complete the steps in the guide, however you are required to customize some commands to your environment.
->Instructions to "type" Windows PowerShell commands provided in this guide can be followed literally by typing the commands, but the preferred method is to copy and paste these commands.
+>Instructions to "type" Windows PowerShell commands provided in this guide can be followed literally by typing the commands, but the preferred method is to copy and paste these commands.
->A Windows PowerShell window can be used to run all commands in this guide. However, when commands are specified for a command prompt, you must either type CMD at the Windows PowerShell prompt to enter the command prompt, or preface the command with "cmd /c", or if desired you can escape special characters in the command using the back-tick character (`). In most cases, the simplest thing is to type cmd and enter a command prompt, type the necessary commands, then type "exit" to return to Windows PowerShell.
+>A Windows PowerShell window can be used to run all commands in this guide. However, when commands are specified for a command prompt, you must either type CMD at the Windows PowerShell prompt to enter the command prompt, or preface the command with "cmd /c", or if desired you can escape special characters in the command using the back-tick character (`). In most cases, the simplest thing is to type cmd and enter a command prompt, type the necessary commands, then type "exit" to return to Windows PowerShell.
-Hyper-V is installed, configured and used extensively in this guide. If you are not familiar with Hyper-V, review the [terminology](#appendix-b-terminology-used-in-this-guide) used in this guide before starting.
+Hyper-V is installed, configured and used extensively in this guide. If you are not familiar with Hyper-V, review the [terminology](#appendix-b-terminology-used-in-this-guide) used in this guide before starting.
## In this guide
@@ -40,7 +40,7 @@ This guide contains instructions for three general procedures: Install Hyper-V,
After completing the instructions in this guide, you will have a PoC environment that enables you to test Windows 10 deployment procedures by following instructions in companion guides that are written to use the PoC environment. Links are provided to download trial versions of Windows Server 2012, Windows 10 Enterprise, and all deployment tools necessary to complete the lab.
-Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed.
+Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed.
@@ -65,7 +65,7 @@ Topics and procedures in this guide are summarized in the following table. An es
## Hardware and software requirements
-One computer that meets the hardware and software specifications below is required to complete the guide; A second computer is recommended to validate the upgrade process.
+One computer that meets the hardware and software specifications below is required to complete the guide; A second computer is recommended to validate the upgrade process.
- **Computer 1**: the computer you will use to run Hyper-V and host virtual machines. This computer should have 16 GB or more of installed RAM and a multi-core processor.
- **Computer 2**: a client computer from your corporate network. It is shadow-copied to create a VM that can be added to the PoC environment, enabling you to test a mirror image of a computer on your network. If you do not have a computer to use for this simulation, you can download an evaluation VHD and use it to represent this computer. Subsequent guides use this computer to simulate Windows 10 replace and refresh scenarios, so the VM is required even if you cannot create this VM using computer 2.
@@ -141,7 +141,7 @@ The lab architecture is summarized in the following diagram:
-- Computer 1 is configured to host four VMs on a private, PoC network.
+- Computer 1 is configured to host four VMs on a private, PoC network.
- Two VMs are running Windows Server 2012 R2 with required network services and tools installed.
- Two VMs are client systems: One VM is intended to mirror a host on your corporate network (computer 2) and one VM is running Windows 10 Enterprise to demonstrate the hardware replacement scenario.
@@ -164,10 +164,10 @@ The lab architecture is summarized in the following diagram:
### Verify support and install Hyper-V
-Starting with Windows 8, the host computer’s microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](http://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information.
+Starting with Windows 8, the host computer’s microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](https://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information.
1. To verify your computer supports SLAT, open an administrator command prompt, type **systeminfo**, press ENTER, and review the section displayed at the bottom of the output, next to Hyper-V Requirements. See the following example:
-
+
C:\>systeminfo
@@ -176,13 +176,13 @@ Starting with Windows 8, the host computer’s microprocessor must support secon
Virtualization Enabled In Firmware: Yes
Second Level Address Translation: Yes
Data Execution Prevention Available: Yes
-
-
- In this example, the computer supports SLAT and Hyper-V.
-
+
+
+ In this example, the computer supports SLAT and Hyper-V.
+
If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V. However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting will depend on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings.
- You can also identify Hyper-V support using [tools](https://blogs.msdn.microsoft.com/taylorb/2008/06/19/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v/) provided by the processor manufacturer, the [msinfo32](https://technet.microsoft.com/en-us/library/cc731397.aspx) tool, or you can download the [coreinfo](http://technet.microsoft.com/en-us/sysinternals/cc835722) utility and run it, as shown in the following example:
+ You can also identify Hyper-V support using [tools](https://blogs.msdn.microsoft.com/taylorb/2008/06/19/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v/) provided by the processor manufacturer, the [msinfo32](https://technet.microsoft.com/en-us/library/cc731397.aspx) tool, or you can download the [coreinfo](https://technet.microsoft.com/en-us/sysinternals/cc835722) utility and run it, as shown in the following example:
C:\>coreinfo -v
@@ -197,22 +197,22 @@ Starting with Windows 8, the host computer’s microprocessor must support secon
HYPERVISOR - Hypervisor is present
VMX * Supports Intel hardware-assisted virtualization
EPT * Supports Intel extended page tables (SLAT)
-
+
Note: A 64-bit operating system is required to run Hyper-V.
2. The Hyper-V feature is not installed by default. To install it, open an elevated Windows PowerShell window and type the following command:
-
+
This command works on all operating systems that support Hyper-V, but on Windows Server operating systems you must type an additional command to add the Hyper-V Windows PowerShell module and the Hyper-V Manager console. This command will also install Hyper-V if it isn't already installed, so if desired you can just type the following command on Windows Server 2012 or 2016 instead of using the Enable-WindowsOptionalFeature command:
-
+
When you are prompted to restart the computer, choose **Yes**. The computer might restart more than once. After installation is complete, you can open Hyper-V Manager by typing **virtmgmt.msc** at an elevated command prompt.
-
+
>Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below:
-
+
@@ -223,7 +223,7 @@ Starting with Windows 8, the host computer’s microprocessor must support secon
When you have completed installation of Hyper-V on the host computer, begin configuration of Hyper-V by downloading VHD and ISO files to the Hyper-V host. These files will be used to create the VMs used in the lab. Before you can download VHD and ISO files, you will need to register and sign in to the [TechNet Evaluation Center](https://www.microsoft.com/en-us/evalcenter/) using your Microsoft account.
-1. Create a directory on your Hyper-V host named **C:\VHD** and download a single [Windows Server 2012 R2 VHD](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2012-r2) from the TechNet Evaluation Center to the **C:\VHD** directory.
+1. Create a directory on your Hyper-V host named **C:\VHD** and download a single [Windows Server 2012 R2 VHD](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2012-r2) from the TechNet Evaluation Center to the **C:\VHD** directory.
**Important**: This guide assumes that VHDs are stored in the **C:\VHD** directory on the Hyper-V host. If you use a different directory to store VHDs, you must adjust steps in this guide appropriately.
@@ -235,14 +235,14 @@ When you have completed installation of Hyper-V on the host computer, begin conf
2. Download the file to the **C:\VHD** directory. When the download is complete, rename the VHD file that you downloaded to **2012R2-poc-1.vhd**. This is done to make the filename simple to recognize and type.
3. Copy the VHD to a second file also in the **C:\VHD** directory and name this VHD **2012R2-poc-2.vhd**.
-4. Download the [Windows 10 Enterprise ISO](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise) from the TechNet Evaluation Center to the **C:\VHD** directory on your Hyper-V host.
+4. Download the [Windows 10 Enterprise ISO](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise) from the TechNet Evaluation Center to the **C:\VHD** directory on your Hyper-V host.
- >During registration, you must specify the type, version, and language of installation media to download. In this example, a Windows 10 Enterprise, 64 bit, English ISO is chosen. You can choose a different version if desired. **Note: The evaluation version of Windows 10 does not support in-place upgrade**.
+ >During registration, you must specify the type, version, and language of installation media to download. In this example, a Windows 10 Enterprise, 64 bit, English ISO is chosen. You can choose a different version if desired. **Note: The evaluation version of Windows 10 does not support in-place upgrade**.
-5. Rename the ISO file that you downloaded to **w10-enterprise.iso**. Again, this is done so that the filename is simple to type and recognize. After completing registration you will be able to download the 3.63 GB Windows 10 Enterprise evaluation ISO.
+5. Rename the ISO file that you downloaded to **w10-enterprise.iso**. Again, this is done so that the filename is simple to type and recognize. After completing registration you will be able to download the 3.63 GB Windows 10 Enterprise evaluation ISO.
After completing these steps, you will have three files in the **C:\VHD** directory: **2012R2-poc-1.vhd**, **2012R2-poc-2.vhd**, **w10-enterprise.iso**.
-
+
The following displays the procedures described in this section, both before and after downloading files:
@@ -267,7 +267,7 @@ If you do not have a PC available to convert to VM, perform the following steps
Open the [Download virtual machines](https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/) page.
-
Under **Virtual machine**, choose **IE11 on Win7**.
+
Under **Virtual machine**, choose **IE11 on Win7**.
Under **Select platform** choose **HyperV (Windows)**.
Click **Download .zip**. The download is 3.31 GB.
Extract the zip file. Three directories are created.
@@ -279,7 +279,7 @@ If you do not have a PC available to convert to VM, perform the following steps
If you have a PC available to convert to VM (computer 2):
-1. Sign in on computer 2 using an account with Administrator privileges.
+1. Sign in on computer 2 using an account with Administrator privileges.
>Important: the account used in this step must have local administrator privileges. You can use a local computer account, or a domain account with administrative rights if domain policy allows the use of cached credentials. After converting the computer to a VM, you must be able to sign in on this VM with administrator rights while the VM is disconnected from the corporate network.
@@ -315,7 +315,7 @@ When creating a VM in Hyper-V, you must specify either generation 1 or generatio
-If the PC is running a 32-bit OS or the OS is Windows 7, it must be converted to a generation 1 VM. Otherwise, it can be converted to a generation 2 VM.
+If the PC is running a 32-bit OS or the OS is Windows 7, it must be converted to a generation 1 VM. Otherwise, it can be converted to a generation 2 VM.
- To determine the OS and architecture of a PC, type **systeminfo** at a command prompt and review the output next to **OS Name** and **System Type**.
- To determine the partition style, open a Windows PowerShell prompt on the PC and type the following command:
@@ -434,8 +434,8 @@ Notes:
>You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive.
-2. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface.
-3. Select the checkboxes next to the **C:\** and the **system reserved** (BIOS/MBR) volumes. The system volume is not assigned a drive letter, but will be displayed in the Disk2VHD tool with a volume label similar to **\\?\Volume{**. See the following example. **Important**: You must include the system volume in order to create a bootable VHD. If this volume is not displayed in the disk2vhd tool, then the computer is likely to be using the GPT partition style. For more information, see [Determine VM generation](#determine-vm-generation).
+2. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface.
+3. Select the checkboxes next to the **C:\** and the **system reserved** (BIOS/MBR) volumes. The system volume is not assigned a drive letter, but will be displayed in the Disk2VHD tool with a volume label similar to **\\?\Volume{**. See the following example. **Important**: You must include the system volume in order to create a bootable VHD. If this volume is not displayed in the disk2vhd tool, then the computer is likely to be using the GPT partition style. For more information, see [Determine VM generation](#determine-vm-generation).
4. Specify a location to save the resulting VHD or VHDX file (F:\VHD\w7.vhdx in the following example) and click **Create**. See the following example:
@@ -464,7 +464,7 @@ Notes:
This command temporarily assigns a drive letter of S to the system volume and mounts it. If the letter S is already assigned to a different volume on the computer, then choose one that is available (ex: mountvol z: /s).
-3. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface.
+3. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface.
4. Select the checkboxes next to the **C:\** and the **S:\** volumes, and clear the **Use Volume Shadow Copy checkbox**. Volume shadow copy will not work if the EFI system partition is selected.
**Important**: You must include the EFI system partition in order to create a bootable VHD. The Windows RE tools partition (shown below) is not required, but it can also be converted if desired.
@@ -491,7 +491,7 @@ Notes:
>You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive.
-2. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface.
+2. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface.
3. Select the checkbox next to the **C:\** volume and clear the checkbox next to **Use Vhdx**. Note: the system volume is not copied in this scenario, it will be added later.
4. Specify a location to save the resulting VHD file (F:\VHD\w7.vhd in the following example) and click **Create**. See the following example:
@@ -547,7 +547,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
1. Open an elevated Windows PowerShell window and type the following command to create two virtual switches named "poc-internal" and "poc-external":
>If the Hyper-V host already has an external virtual switch bound to a physical NIC, do not attempt to add a second external virtual switch. Attempting to add a second external switch will result in an error indicating that the NIC is **already bound to the Microsoft Virtual Switch protocol.** In this case, choose one of the following options:
- A) Remove the existing external virtual switch, then add the poc-external switch
+ A) Remove the existing external virtual switch, then add the poc-external switch
B) Rename the existing external switch to "poc-external"
C) Replace each instance of "poc-external" used in this guide with the name of your existing external virtual switch
If you choose B) or C), then do not run the second command below.
@@ -556,9 +556,9 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
New-VMSwitch -Name poc-internal -SwitchType Internal -Notes "PoC Network"
New-VMSwitch -Name poc-external -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name -Notes "PoC External"
-
+
**Note**: The second command above will temporarily interrupt network connectivity on the Hyper-V host.
-
+
>Since an external virtual switch is associated to a physical network adapter on the Hyper-V host, this adapter must be specified when adding the virtual switch. The previous commands automate this by filtering for active non-virtual ethernet adapters using the Get-NetAdapter cmdlet ($_.Status -eq "Up" -and !$_.Virtual). If your Hyper-V host is dual-homed with multiple active ethernet adapters, this automation will not work, and the second command above will fail. In this case, you must edit the command used to add the "poc-external" virtual switch by inserting the appropriate NetAdapterName. The NetAdapterName value corresponds to the name of the network interface you wish to use. For example, if the network interface you use on the Hyper-V host to connect to the Internet is named "Ethernet 2" then type the following command to create an external virtual switch: New-VMSwitch -Name poc-external -NetAdapterName "Ethernet 2" -Notes "PoC External"
2. At the elevated Windows PowerShell prompt, type the following command to determine the megabytes of RAM that are currently available on the Hyper-V host:
@@ -576,9 +576,9 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
2775.5
- In this example, VMs can use a maximum of 2700 MB of RAM each, to run four VMs simultaneously.
+ In this example, VMs can use a maximum of 2700 MB of RAM each, to run four VMs simultaneously.
-4. At the elevated Windows PowerShell prompt, type the following command to create two new VMs. Other VMs will be added later.
+4. At the elevated Windows PowerShell prompt, type the following command to create two new VMs. Other VMs will be added later.
>**Important**: Replace the value of 2700MB for $maxRAM in the first command below with the RAM value that you calculated in the previous step.
@@ -591,8 +591,8 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
Set-VMMemory -VMName "SRV1" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes $maxRAM -Buffer 80
Enable-VMIntegrationService -Name "Guest Service Interface" -VMName SRV1
-
- **Note**: The RAM values assigned to VMs in this step are not permanent, and can be easily increased or decreased later if needed to address performance issues.
+
+ **Note**: The RAM values assigned to VMs in this step are not permanent, and can be easily increased or decreased later if needed to address performance issues.
5. Using the same elevated Windows PowerShell prompt that was used in the previous step, type one of the following sets of commands, depending on the type of VM that was prepared in the [Determine VM generation](#determine-vm-generation) section, either generation 1, generation 2, or generation 1 with GPT.
@@ -640,7 +640,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
vmconnect localhost PC1
- The VM will automatically boot into Windows Setup. In the PC1 window:
+ The VM will automatically boot into Windows Setup. In the PC1 window:
1. Click **Next**.
2. Click **Repair your computer**.
@@ -668,7 +668,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
exit
- 7. Type the following commands to restore the OS image and boot files:
+ 7. Type the following commands to restore the OS image and boot files:
dism /Apply-Image /ImageFile:D:\c.wim /Index:1 /ApplyDir:C:\
@@ -685,7 +685,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
Set-VMDvdDrive -VMName PC1 -Path $null
-### Configure VMs
+### Configure VMs
1. At an elevated Windows PowerShell prompt on the Hyper-V host, start the first Windows Server VM and connect to it by typing the following commands:
@@ -694,8 +694,8 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
vmconnect localhost DC1
-2. Click **Next** to accept the default settings, read the license terms and click **I accept**, provide an administrator password of **pass@word1**, and click **Finish**.
-3. Click **Ctrl+Alt+Del** in the upper left corner of the virtual machine connection window, and then sign in to DC1 using the Administrator account.
+2. Click **Next** to accept the default settings, read the license terms and click **I accept**, provide an administrator password of **pass@word1**, and click **Finish**.
+3. Click **Ctrl+Alt+Del** in the upper left corner of the virtual machine connection window, and then sign in to DC1 using the Administrator account.
4. Right-click **Start**, point to **Shut down or sign out**, and click **Sign out**. The VM connection will reset and a new connection dialog box will appear enabling you to choose a custom display configuration. Select a desktop size, click **Connect** and sign in again with the local Administrator account. Note: Signing in this way ensures that [enhanced session mode](https://technet.microsoft.com/windows-server-docs/compute/hyper-v/learn-more/Use-local-resources-on-Hyper-V-virtual-machine-with-VMConnect) is enabled. It is only necessary to do this the first time you sign in to a new VM.
5. If DC1 is configured as described in this guide, it will currently be assigned an APIPA address, have a randomly generated hostname, and a single network adapter named "Ethernet." Open an elevated Windows PowerShell prompt on DC1 and type or paste the following commands to provide a new hostname and configure a static IP address and gateway:
@@ -812,11 +812,11 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
- >If the client was configured with a static address, you must change this to a dynamic one so that it can obtain a DHCP lease.
+ >If the client was configured with a static address, you must change this to a dynamic one so that it can obtain a DHCP lease.
16. When the new network adapter driver has completed installation, you will receive an alert to set a network location for the contoso.com network. Select **Work network** and then click **Close**. When you receive an alert that a restart is required, click **Restart Later**.
-17. Open an elevated Windows PowerShell prompt on PC1 and verify that the client VM has received a DHCP lease and can communicate with the consoto.com domain controller.
+17. Open an elevated Windows PowerShell prompt on PC1 and verify that the client VM has received a DHCP lease and can communicate with the consoto.com domain controller.
To open Windows PowerShell on Windows 7, click **Start**, and search for "**power**." Right-click **Windows PowerShell** and then click **Pin to Taskbar** so that it is simpler to use Windows Powershell during this lab. Click **Windows PowerShell** on the taskbar, and then type **ipconfig** at the prompt to see the client's current IP address. Also type **ping dc1.contoso.com** and **nltest /dsgetdc:contoso.com** to verify that it can reach the domain controller. See the following examples of a successful network connection:
@@ -853,7 +853,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
>If PC1 is running Windows 7, enhanced session mode might not be available, which means that you cannot copy and paste commands from the Hyper-V host to a Windows PowerShell prompt on PC1. However, it is possible to use integration services to copy a file from the Hyper-V host to a VM. The next procedure demonstrates this. If the Copy-VMFile command fails, then type the commands below at an elevated Windows PowerShell prompt on PC1 instead of saving them to a script to run remotely. If PC1 is running Windows 8 or a later operating system, you can use enhanced session mode to copy and paste these commands instead of typing them.
-18. Minimize the PC1 window and switch to the Hyper-V host computer. Open an elevated Windows PowerShell ISE window on the Hyper-V host (right-click Windows PowerShell and then click **Run ISE as Administrator**) and type the following commands in the (upper) script editor pane:
+18. Minimize the PC1 window and switch to the Hyper-V host computer. Open an elevated Windows PowerShell ISE window on the Hyper-V host (right-click Windows PowerShell and then click **Run ISE as Administrator**) and type the following commands in the (upper) script editor pane:
(Get-WmiObject Win32_ComputerSystem).UnjoinDomainOrWorkgroup($null,$null,0)
@@ -864,8 +864,8 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
Restart-Computer
- >If you do not see the script pane, click **View** and verify **Show Script Pane Top** is enabled. Click **File** and then click **New**.
-
+ >If you do not see the script pane, click **View** and verify **Show Script Pane Top** is enabled. Click **File** and then click **New**.
+
See the following example:
@@ -879,20 +879,20 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
>In order for this command to work properly, PC1 must be running the vmicguestinterface (Hyper-V Guest Service Interface) service. If this service is not enabled in this step, then the copy-VMFile command will fail. In this case, you can try updating integration services on the VM by mounting the Hyper-V Integration Services Setup (vmguest.iso), which is located in C:\Windows\System32 on Windows Server 2012 and 2012 R2 operating systems that are running the Hyper-V role service.
-
+
If the copy-vmfile command does not work and you cannot properly enable or upgrade integration services on PC1, then create the file c:\pc1.ps1 on the VM by typing the commands into this file manually. The copy-vmfile command is only used in this procedure as a demonstration of automation methods that can be used in a Hyper-V environment when enhanced session mode is not available. After typing the script file manually, be sure to save the file as a Windows PowerShell script file with the .ps1 extension and not as a text (.txt) file.
21. On PC1, type the following commands at an elevated Windows PowerShell prompt:
>The commands in this script might take a few moments to complete. If an error is displayed, check that you typed the command correctly, paying close attention to spaces. PC1 is removed from its domain in this step while not connected to the corporate network so as to ensure the computer object in the corporate domain is unaffected. PC1 is also not renamed to "PC1" in system properties so that it maintains some of its mirrored identity. However, if desired you can also rename the computer.
22. Upon completion of the script, PC1 will automatically restart. When it has restarted, sign in to the contoso.com domain using the **Switch User** option, with the **user1** account you created in step 11 of this section.
>**Important**: The settings that will be used later to migrate user data specifically select only accounts that belong to the CONTOSO domain. However, this can be changed to migrate all user accounts, or only other specified accounts. If you wish to test migration of user data and settings with accounts other than those in the CONTOSO domain, you must specify these accounts or domains when you configure the value of **ScanStateArgs** in the MDT test lab guide. This value is specifically called out when you get to that step. If you wish to only migrate CONTOSO accounts, then you can log in with the user1 account or the administrator account at this time and modify some of the files and settings for later use in migration testing.
-23. Minimize the PC1 window but do not turn it off while the second Windows Server 2012 R2 VM (SRV1) is configured. This verifies that the Hyper-V host has enough resources to run all VMs simultaneously. Next, SRV1 will be started, joined to the contoso.com domain, and configured with RRAS and DNS services.
+23. Minimize the PC1 window but do not turn it off while the second Windows Server 2012 R2 VM (SRV1) is configured. This verifies that the Hyper-V host has enough resources to run all VMs simultaneously. Next, SRV1 will be started, joined to the contoso.com domain, and configured with RRAS and DNS services.
24. On the Hyper-V host computer, at an elevated Windows PowerShell prompt, type the following commands:
@@ -948,7 +948,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
In this example, the poc-internal network interface at 192.168.0.2 is associated with the "Ethernet" interface and the Internet-facing poc-external interface is associated with the "Ethernet 2" interface. If your interfaces are different, you must adjust the commands provided in the next step appropriately to configure routing services. Also note that if the "Ethernet 2" interface has an IP address in the 192.168.0.100-105 range then it likely is getting a DHCP lease from DC1 instead of your corporate network. If this is the case, you can try removing and re-adding the second network interface from the SRV1 VM through its Hyper-V settings.
>[!TIP]
- >Sometimes a computer will have hidden, disconnected interfaces that prevent you from naming a network adapter. When you attempt to rename an adapter, you will receive an error that the adapter name already exists. These disconnected devices can be viewed in device manager by clicking **View** and then clicking **Show hidden devices**. The disconnected device can then be uninstalled, enabling you to reuse the adapter name.
+ >Sometimes a computer will have hidden, disconnected interfaces that prevent you from naming a network adapter. When you attempt to rename an adapter, you will receive an error that the adapter name already exists. These disconnected devices can be viewed in device manager by clicking **View** and then clicking **Show hidden devices**. The disconnected device can then be uninstalled, enabling you to reuse the adapter name.
31. To configure SRV1 with routing capability for the PoC network, type or paste the following commands at an elevated Windows PowerShell prompt on SRV1:
@@ -956,7 +956,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
@@ -973,8 +973,8 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
ping www.microsoft.com
- If you see "Ping request could not find host www.microsoft.com" on PC1 and DC1, but not on SRV1, then you will need to configure a server-level DNS forwarder on SRV1. To do this, open an elevated Windows PowerShell prompt on SRV1 and type the following command.
-
+ If you see "Ping request could not find host www.microsoft.com" on PC1 and DC1, but not on SRV1, then you will need to configure a server-level DNS forwarder on SRV1. To do this, open an elevated Windows PowerShell prompt on SRV1 and type the following command.
+
**Note**: This command also assumes that "Ethernet 2" is the external-facing network adapter on SRV1. If the external adapter has a different name, replace "Ethernet 2" in the command below with that name:
@@ -998,7 +998,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
Minimum = 1ms, Maximum = 3ms, Average = 2ms
-35. Verify that all three VMs can reach each other, and the Internet. See [Appendix A: Verify the configuration](#appendix-a-verify-the-configuration) for more information.
+35. Verify that all three VMs can reach each other, and the Internet. See [Appendix A: Verify the configuration](#appendix-a-verify-the-configuration) for more information.
36. Lastly, because the client computer has different hardware after copying it to a VM, its Windows activation will be invalidated and you might receive a message that you must activate Windows in 3 days. To extend this period to 30 days, type the following commands at an elevated Windows PowerShell prompt on PC1:
@@ -1032,7 +1032,7 @@ Use the following procedures to verify that the PoC environment is configured pr
**Resolve-DnsName** displays public IP address results for www.microsoft.com.
**Get-DhcpServerInDC** displays 192.168.0.1, dc1.contoso.com.
**Get-DhcpServerv4Statistics** displays 1 scope with 2 addresses in use (these belong to PC1 and the Hyper-V host).
- **ipconfig** displays a primary DNS suffix and suffix search list of contoso.com, IP address of 192.168.0.1, subnet mask of 255.255.255.0, default gateway of 192.168.0.2, and DNS server addresses of 192.168.0.1 and 192.168.0.2.
+ **ipconfig** displays a primary DNS suffix and suffix search list of contoso.com, IP address of 192.168.0.1, subnet mask of 255.255.255.0, default gateway of 192.168.0.2, and DNS server addresses of 192.168.0.1 and 192.168.0.2.
2. On SRV1, open an elevated Windows PowerShell prompt and type the following commands:
@@ -1080,7 +1080,7 @@ Use the following procedures to verify that the PoC environment is configured pr
Hyper-V host
The computer where Hyper-V is installed.
Hyper-V Manager
The user-interface console used to view and configure Hyper-V.
MBR
Master Boot Record (MBR) is a legacy hard-disk formatting scheme that limits support for newer hardware. MBR is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions. MBR is in the process of being replaced by the GPT partition format.
-
Proof of concept (PoC)
Confirmation that a process or idea works as intended. A PoC is carried out in a test environment to learn about and verify a process.
+
Proof of concept (PoC)
Confirmation that a process or idea works as intended. A PoC is carried out in a test environment to learn about and verify a process.
Shadow copy
A copy or "snapshot" of a computer at a point in time, created by the Volume Shadow Copy Service (VSS), typically for backup purposes.
Virtual machine (VM)
A VM is a virtual computer with its own operating system, running on the Hyper-V host.
Virtual switch
A virtual network connection used to connect VMs to each other and to physical network adapters on the Hyper-V host.
diff --git a/windows/deployment/windows-adk-scenarios-for-it-pros.md b/windows/deployment/windows-adk-scenarios-for-it-pros.md
index 4d4c929919..05a2b022ab 100644
--- a/windows/deployment/windows-adk-scenarios-for-it-pros.md
+++ b/windows/deployment/windows-adk-scenarios-for-it-pros.md
@@ -13,68 +13,68 @@ ms.date: 07/27/2017
# Windows ADK for Windows 10 scenarios for IT Pros
-The [Windows Assessment and Deployment Kit](https://go.microsoft.com/fwlink/p/?LinkId=526803) (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. For an overview of what's new in the Windows ADK for Windows 10, see [What's new in kits and tools](http://msdn.microsoft.com/library/windows/hardware/dn927348.aspx).
+The [Windows Assessment and Deployment Kit](https://go.microsoft.com/fwlink/p/?LinkId=526803) (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. For an overview of what's new in the Windows ADK for Windows 10, see [What's new in kits and tools](https://msdn.microsoft.com/library/windows/hardware/dn927348.aspx).
-In previous releases of Windows, the Windows ADK docs were published on both TechNet and the MSDN Hardware Dev Center. Starting with the Windows 10 release, Windows ADK documentation is available on the MSDN Hardware Dev Center. For the Windows 10 ADK reference content, see [Desktop manufacturing](http://msdn.microsoft.com/library/windows/hardware/dn938361.aspx).
+In previous releases of Windows, the Windows ADK docs were published on both TechNet and the MSDN Hardware Dev Center. Starting with the Windows 10 release, Windows ADK documentation is available on the MSDN Hardware Dev Center. For the Windows 10 ADK reference content, see [Desktop manufacturing](https://msdn.microsoft.com/library/windows/hardware/dn938361.aspx).
Here are some key scenarios that will help you find the content on the MSDN Hardware Dev Center.
### Create a Windows image using command-line tools
-[DISM](http://msdn.microsoft.com/library/windows/hardware/dn898558.aspx) is used to mount and service Windows images.
+[DISM](https://msdn.microsoft.com/library/windows/hardware/dn898558.aspx) is used to mount and service Windows images.
Here are some things you can do with DISM:
-- [Mount an offline image](http://msdn.microsoft.com/library/windows/hardware/dn938321.aspx)
-- [Add drivers to an offline image](http://msdn.microsoft.com/library/windows/hardware/dn898469.aspx)
-- [Enable or disable Windows features](http://msdn.microsoft.com/library/windows/hardware/dn898567.aspx)
-- [Add or remove packages](http://msdn.microsoft.com/library/windows/hardware/dn898481.aspx)
-- [Add language packs](http://msdn.microsoft.com/library/windows/hardware/dn898470.aspx)
-- [Add Universal Windows apps](http://msdn.microsoft.com/library/windows/hardware/dn898600.aspx)
-- [Upgrade the Windows edition](http://msdn.microsoft.com/library/windows/hardware/dn898500.aspx)
+- [Mount an offline image](https://msdn.microsoft.com/library/windows/hardware/dn938321.aspx)
+- [Add drivers to an offline image](https://msdn.microsoft.com/library/windows/hardware/dn898469.aspx)
+- [Enable or disable Windows features](https://msdn.microsoft.com/library/windows/hardware/dn898567.aspx)
+- [Add or remove packages](https://msdn.microsoft.com/library/windows/hardware/dn898481.aspx)
+- [Add language packs](https://msdn.microsoft.com/library/windows/hardware/dn898470.aspx)
+- [Add Universal Windows apps](https://msdn.microsoft.com/library/windows/hardware/dn898600.aspx)
+- [Upgrade the Windows edition](https://msdn.microsoft.com/library/windows/hardware/dn898500.aspx)
-[Sysprep](http://msdn.microsoft.com/library/windows/hardware/dn938335.aspx) prepares a Windows installation for imaging and allows you to capture a customized installation.
+[Sysprep](https://msdn.microsoft.com/library/windows/hardware/dn938335.aspx) prepares a Windows installation for imaging and allows you to capture a customized installation.
Here are some things you can do with Sysprep:
-- [Generalize a Windows installation](http://msdn.microsoft.com/library/windows/hardware/dn938334.aspx)
-- [Customize the default user profile](http://msdn.microsoft.com/library/windows/hardware/dn898521.aspx)
-- [Use answer files](http://msdn.microsoft.com/library/windows/hardware/dn938346.aspx)
+- [Generalize a Windows installation](https://msdn.microsoft.com/library/windows/hardware/dn938334.aspx)
+- [Customize the default user profile](https://msdn.microsoft.com/library/windows/hardware/dn898521.aspx)
+- [Use answer files](https://msdn.microsoft.com/library/windows/hardware/dn938346.aspx)
-[Windows PE (WinPE)](http://msdn.microsoft.com/library/windows/hardware/dn938389.aspx) is a small operating system used to boot a computer that does not have an operating system. You can boot to Windows PE and then install a new operating system, recover data, or repair an existing operating system.
+[Windows PE (WinPE)](https://msdn.microsoft.com/library/windows/hardware/dn938389.aspx) is a small operating system used to boot a computer that does not have an operating system. You can boot to Windows PE and then install a new operating system, recover data, or repair an existing operating system.
Here are ways you can create a WinPE image:
-- [Create a bootable USB drive](http://msdn.microsoft.com/library/windows/hardware/dn938386.aspx)
-- [Create a Boot CD, DVD, ISO, or VHD](http://msdn.microsoft.com/library/windows/hardware/dn938385.aspx)
+- [Create a bootable USB drive](https://msdn.microsoft.com/library/windows/hardware/dn938386.aspx)
+- [Create a Boot CD, DVD, ISO, or VHD](https://msdn.microsoft.com/library/windows/hardware/dn938385.aspx)
-[Windows Recovery Environment (Windows RE)](http://msdn.microsoft.com/library/windows/hardware/dn938364.aspx) is a recovery environment that can repair common operating system problems.
+[Windows Recovery Environment (Windows RE)](https://msdn.microsoft.com/library/windows/hardware/dn938364.aspx) is a recovery environment that can repair common operating system problems.
Here are some things you can do with Windows RE:
-- [Customize Windows RE](http://msdn.microsoft.com/library/windows/hardware/dn898523.aspx)
-- [Push-button reset](http://msdn.microsoft.com/library/windows/hardware/dn938307.aspx)
+- [Customize Windows RE](https://msdn.microsoft.com/library/windows/hardware/dn898523.aspx)
+- [Push-button reset](https://msdn.microsoft.com/library/windows/hardware/dn938307.aspx)
-[Windows System Image Manager (Windows SIM)](http://msdn.microsoft.com/library/windows/hardware/dn922445.aspx) helps you create answer files that change Windows settings and run scripts during installation.
+[Windows System Image Manager (Windows SIM)](https://msdn.microsoft.com/library/windows/hardware/dn922445.aspx) helps you create answer files that change Windows settings and run scripts during installation.
Here are some things you can do with Windows SIM:
-- [Create answer file](http://msdn.microsoft.com/library/windows/hardware/dn915085.aspx)
-- [Add a driver path to an answer file](http://msdn.microsoft.com/library/windows/hardware/dn915062.aspx)
-- [Add a package to an answer file](http://msdn.microsoft.com/library/windows/hardware/dn915066.aspx)
-- [Add a custom command to an answer file](http://msdn.microsoft.com/library/windows/hardware/dn915058.aspx)
+- [Create answer file](https://msdn.microsoft.com/library/windows/hardware/dn915085.aspx)
+- [Add a driver path to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915062.aspx)
+- [Add a package to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915066.aspx)
+- [Add a custom command to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915058.aspx)
-For a list of settings you can change, see [Unattended Windows Setup Reference](http://msdn.microsoft.com/library/windows/hardware/dn923277.aspx) on the MSDN Hardware Dev Center.
+For a list of settings you can change, see [Unattended Windows Setup Reference](https://msdn.microsoft.com/library/windows/hardware/dn923277.aspx) on the MSDN Hardware Dev Center.
### Create a Windows image using Windows ICD
-Introduced in Windows 10, [Windows Imaging and Configuration Designer (ICD)](http://msdn.microsoft.com/library/windows/hardware/dn916113.aspx) streamlines the customizing and provisioning of a Windows 10 for desktop editions (Home, Pro, Enterprise, and Education), Windows 10 Mobile, or Windows 10 IoT Core (IoT Core) image.
+Introduced in Windows 10, [Windows Imaging and Configuration Designer (ICD)](https://msdn.microsoft.com/library/windows/hardware/dn916113.aspx) streamlines the customizing and provisioning of a Windows 10 for desktop editions (Home, Pro, Enterprise, and Education), Windows 10 Mobile, or Windows 10 IoT Core (IoT Core) image.
Here are some things you can do with Windows ICD:
-- [Build and apply a provisioning package](http://msdn.microsoft.com/library/windows/hardware/dn916107.aspx)
-- [Export a provisioning package](http://msdn.microsoft.com/library/windows/hardware/dn916110.aspx)
-- [Build and deploy an image for Windows 10 for desktop editions](http://msdn.microsoft.com/library/windows/hardware/dn916105.aspx)
+- [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107.aspx)
+- [Export a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916110.aspx)
+- [Build and deploy an image for Windows 10 for desktop editions](https://msdn.microsoft.com/library/windows/hardware/dn916105.aspx)
### IT Pro Windows deployment tools
diff --git a/windows/deployment/windows-autopilot/windows-10-autopilot.md b/windows/deployment/windows-autopilot/windows-10-autopilot.md
index e73d7727a0..810bdf70be 100644
--- a/windows/deployment/windows-autopilot/windows-10-autopilot.md
+++ b/windows/deployment/windows-autopilot/windows-10-autopilot.md
@@ -24,13 +24,13 @@ This solution enables an IT department to achieve the above with little to no in
The following video shows the process of setting up Autopilot:
-
+
## Benefits of Windows Autopilot
Traditionally, IT pros spend a lot of time on building and customizing images that will later be deployed to devices with a perfectly good OS already installed on them. Windows Autopilot introduces a new approach.
-From the users' perspective, it only takes a few simple operations to make their device ready to use.
+From the users' perspective, it only takes a few simple operations to make their device ready to use.
From the IT pros' perspective, the only interaction required from the end user, is to connect to a network and to verify their credentials. Everything past that is automated.
@@ -38,7 +38,7 @@ From the IT pros' perspective, the only interaction required from the end user,
### Cloud-Driven
-The Cloud-Driven scenario enables you to pre-register devices through the Windows Autopilot Deployment Program. Your devices will be fully configured with no additional intervention required on the users' side.
+The Cloud-Driven scenario enables you to pre-register devices through the Windows Autopilot Deployment Program. Your devices will be fully configured with no additional intervention required on the users' side.
#### The Windows Autopilot Deployment Program experience
@@ -74,7 +74,7 @@ MDM enrollment ensures policies are applied, apps are installed and setting are
#### Device registration and OOBE customization
-To register devices, you will need to acquire their hardware ID and register it. We are actively working with various hardware vendors to enable them to provide the required information to you, or upload it on your behalf.
+To register devices, you will need to acquire their hardware ID and register it. We are actively working with various hardware vendors to enable them to provide the required information to you, or upload it on your behalf.
If you would like to capture that information by yourself, you can use the [Get-WindowsAutopilotInfo PowerShell script](https://www.powershellgallery.com/packages/Get-WindowsAutopilotInfo), which will generate a .csv file with the device's hardware ID.
@@ -115,7 +115,7 @@ To manage devices behind firewalls and proxy servers, the following URLs need to
* https://account.live.com
* https://signup.live.com
* https://licensing.mp.microsoft.com
-* https://licensing.md.mp.microsoft.com
+* https://licensing.md.mp.microsoft.com
* ctldl.windowsupdate.com
* download.windowsupdate.com
@@ -131,5 +131,5 @@ If you are planning to configure devices with traditional on-premises or cloud-b
### Teacher-Driven
-If you're an IT pro or a technical staff member at a school, your scenario might be simpler. The [Set Up School PCs](http://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) app can be used to quickly set up PCs for students and will get you to a productive state faster and simpler. Please see [Use the Set up School PCs app](https://docs.microsoft.com/education/windows/use-set-up-school-pcs-app) for all the details.
+If you're an IT pro or a technical staff member at a school, your scenario might be simpler. The [Set Up School PCs](https://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) app can be used to quickly set up PCs for students and will get you to a productive state faster and simpler. Please see [Use the Set up School PCs app](https://docs.microsoft.com/education/windows/use-set-up-school-pcs-app) for all the details.
diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements-licensing.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements-licensing.md
index cb4b220902..8cd71d80c3 100644
--- a/windows/deployment/windows-autopilot/windows-autopilot-requirements-licensing.md
+++ b/windows/deployment/windows-autopilot/windows-autopilot-requirements-licensing.md
@@ -18,22 +18,19 @@ ms.date: 06/01/2018
Windows Autopilot depends on specific capabilities available in Windows 10 and Azure Active Directory; it also requires an MDM service such as Microsoft Intune. These capabilities can be obtained through various editions and subscription programs:
-- Windows 10 version 1703 or higher must be used. The Professional, Professional for Education, Business, Enterprise, and Education editions are supported.
-
+- Windows 10 version 1703 or higher must be used. Supported editions are the following:
+ - Pro
+ - Pro Education
+ - Pro for Workstations
+ - Enterprise
+ - Education
- One of the following, to provide needed Azure Active Directory (automatic MDM enrollment and company branding features) and MDM functionality:
-
- Microsoft 365 Business subscriptions
-
- Microsoft 365 F1 subscriptions
-
- Microsoft 365 Enterprise E3 or E5 subscriptions, which include all Windows 10, Office 365, and EM+S features (Azure AD and Intune)
-
- Enterprise Mobility + Security E3 or E5 subscriptions, which include all needed Azure AD and Intune features
-
- Azure Active Directory Premium P1 or P2 and Intune subscriptions (or an alternative MDM service)
Additionally, the following are also recommended but not required:
-
- Office 365 ProPlus, which can be deployed easily via Intune (or other MDM services)
-
- [Windows Subscription Activation](https://docs.microsoft.com/en-us/windows/deployment/windows-10-enterprise-subscription-activation), to automatically step up devices from Windows 10 Pro to Windows 10 Enterprise
diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md
index d75aa0580e..371890febb 100644
--- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md
+++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md
@@ -1,15 +1,15 @@
---
description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level.
title: Windows 10, version 1703 basic diagnostic events and fields (Windows 10)
-keywords: privacy, diagnostic data
+keywords: privacy, telemetry
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
-ms.localizationpriority: high
-author: eross-msft
-ms.author: lizross
-ms.date: 03/13/2018
+localizationpriority: high
+author: brianlic-msft
+ms.author: brianlic
+ms.date: 09/10/2018
---
@@ -19,225 +19,22 @@ ms.date: 03/13/2018
- Windows 10, version 1703
-The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. When the level is set to Basic, it also includes the Security level information. The Basic level also helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems.
-Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. Every event generated includes common data, which collects device data. You can learn more about Windows functional and diagnostic data through these articles:
+The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Windows Store. When the level is set to Basic, it also includes the Security level information.
-- [Windows 10, version 1803 basic diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1803)
-- [Windows 10, version 1709 basic diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1709)
+The Basic level helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems.
+
+Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. Every event generated includes common data, which collects device data.
+
+You can learn more about Windows functional and diagnostic data through these articles:
+
+
+- [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
+- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
- [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
->[!Note]
->Updated November 2017 to document new and modified events. We’ve added some new events and also added new fields to existing events to prepare for upgrades to the next release of Windows.
-## Common data extensions
-
-### Common Data Extensions.App
-
-The following fields are available:
-
-- **expId** Associates a flight, such as an OS flight, or an experiment, such as a web site UX experiment, with an event.
-- **userId** The userID as known by the application.
-- **env** The environment from which the event was logged.
-- **asId** An integer value that represents the app session. This value starts at 0 on the first app launch and increments after each subsequent app launch per boot session.
-
-
-### Common Data Extensions.CS
-
-The following fields are available:
-
-- **sig** A common schema signature that identifies new and modified event schemas.
-
-
-### Common Data Extensions.CUET
-
-The following fields are available:
-
-- **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID.
-- **aId** Represents the ETW ActivityId. Logged via TraceLogging or directly via ETW.
-- **raId** Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW.
-- **op** Represents the ETW Op Code.
-- **cat** Represents a bitmask of the ETW Keywords associated with the event.
-- **flags** Represents the bitmap that captures various Windows specific flags.
-- **cpId** The composer ID, such as Reference, Desktop, Phone, Holographic, Hub, IoT Composer.
-- **tickets** A list of strings that represent entries in the HTTP header of the web request that includes this event.
-- **bseq** Upload buffer sequence number in the format \:\
-- **mon** Combined monitor and event sequence numbers in the format \:\
-
-
-### Common Data Extensions.Device
-
-
-
-The following fields are available:
-
-- **ver** Represents the major and minor version of the extension.
-- **localId** Represents a locally defined unique ID for the device, not the human readable device name. Most likely equal to the value stored at HKLM\Software\Microsoft\SQMClient\MachineId
-- **deviceClass** Represents the classification of the device, the device “family”. For example, Desktop, Server, or Mobile.
-
-
-### Common Data Extensions.Envelope
-
-
-
-The following fields are available:
-
-- **ver** Represents the major and minor version of the extension.
-- **name** Represents the uniquely qualified name for the event.
-- **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format.
-- **popSample** Represents the effective sample rate for this event at the time it was generated by a client.
-- **epoch** Represents the epoch and seqNum fields, which help track how many events were fired and how many events were uploaded, and enables identification of data lost during upload and de-duplication of events on the ingress server.
-- **seqNum** Represents the sequence field used to track absolute order of uploaded events. It is an incrementing identifier for each event added to the upload queue. The Sequence helps track how many events were fired and how many events were uploaded and enables identification of data lost during upload and de-duplication of events on the ingress server.
-- **iKey** Represents an ID for applications or other logical groupings of events.
-- **flags** Represents a collection of bits that describe how the event should be processed by the Connected User Experiences and Telemetry component pipeline. The lowest-order byte is the event persistence. The next byte is the event latency.
-- **os** Represents the operating system name.
-- **osVer** Represents the OS version, and its format is OS dependent.
-- **appId** Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application.
-- **appVer** Represents the version number of the application. Used to understand errors by Version, Usage by Version across an app.
-- **cV** Represents the Correlation Vector: A single field for tracking partial order of related diagnostic data events across component boundaries.
-
-
-### Common Data Extensions.OS
-
-
-
-The following fields are available:
-
-- **ver** Represents the major and minor version of the extension.
-- **expId** Represents the experiment ID. The standard for associating a flight, such as an OS flight (pre-release build), or an experiment, such as a web site UX experiment, with an event is to record the flight / experiment IDs in Part A of the common schema.
-- **locale** Represents the locale of the operating system.
-- **bootId** An integer value that represents the boot session. This value starts at 0 on first boot after OS install and increments after every reboot.
-
-
-### Common Data Extensions.User
-
-
-
-The following fields are available:
-
-- **ver** Represents the major and minor version of the extension.
-- **localId** Represents a unique user identity that is created locally and added by the client. This is not the user's account ID.
-
-
-### Common Data Extensions.XBL
-
-
-
-The following fields are available:
-
-- **nbf** Not before time
-- **expId** Expiration time
-- **sbx** XBOX sandbox identifier
-- **dty** XBOX device type
-- **did** XBOX device ID
-- **xid** A list of base10-encoded XBOX User IDs.
-- **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts.
-
-
-### Common Data Extensions.Consent UI Event
-
-This User Account Control (UAC) diagnostic data point collects information on elevations that originate from low integrity levels. This occurs when a process running at low integrity level (IL) requires higher (administrator) privileges, and therefore requests for elevation via UAC (consent.exe). By better understanding the processes requesting these elevations, Microsoft can in turn improve the detection and handling of potentially malicious behavior in this path.
-
-The following fields are available:
-
-- **eventType** Represents the type of elevation: If it succeeded, was cancelled, or was auto-approved.
-- **splitToken** Represents the flag used to distinguish between administrators and standard users.
-- **friendlyName** Represents the name of the file requesting elevation from low IL.
-- **elevationReason** Represents the distinction between various elevation requests sources (appcompat, installer, COM, MSI and so on).
-- **exeName** Represents the name of the file requesting elevation from low IL.
-- **signatureState** Represents the state of the signature, if it signed, unsigned, OS signed and so on.
-- **publisherName** Represents the name of the publisher of the file requesting elevation from low IL.
-- **cmdLine** Represents the full command line arguments being used to elevate.
-- **Hash.Length** Represents the length of the hash of the file requesting elevation from low IL.
-- **Hash** Represents the hash of the file requesting elevation from low IL.
-- **HashAlgId** Represents the algorithm ID of the hash of the file requesting elevation from low IL.
-- **telemetryFlags** Represents the details about the elevation prompt for CEIP data.
-- **timeStamp** Represents the time stamp on the file requesting elevation.
-- **fileVersionMS** Represents the major version of the file requesting elevation.
-- **fileVersionLS** Represents the minor version of the file requesting elevation.
-
-
-## Common data fields
-
-### Common Data Fields.MS.Device.DeviceInventory.Change
-
-These fields are added whenever Ms.Device.DeviceInventoryChange is included in the event.
-
-The following fields are available:
-
-- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object.
-- **objectType** Indicates the object type that the event applies to.
-- **Action** The change that was invoked on a device inventory object.
-- **inventoryId** Device ID used for Compatibility testing
-
-
-### Common Data Fields.TelClientSynthetic.PrivacySettingsAfterCreatorsUpdate.PreUpgradeSettings
-
-These fields are added whenever PreUpgradeSettings is included in the event.
-
-The following fields are available:
-
-- **HKLM_SensorPermissionState.SensorPermissionState** The state of the Location service before the feature update completed.
-- **HKLM_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the device.
-- **HKCU_SensorPermissionState.SensorPermissionState** The state of the Location service when a user signs on before the feature update completed.
-- **HKCU_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the current user.
-- **HKLM_LocationPlatform.Status** The state of the location platform after the feature update has completed.
-- **HKLM_LocationPlatform.HRESULT** The error code returned when trying to query the location platform for the device.
-- **HKLM_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the device before the feature update completed.
-- **HKLM_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the device.
-- **HKCU_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the current user before the feature update completed.
-- **HKCU_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the current user.
-- **HKLM_AllowTelemetry.AllowTelemetry** The state of the Connected User Experiences and Telemetry component for the device before the feature update.
-- **HKLM_AllowTelemetry.HRESULT** The error code returned when trying to query the Connected User Experiences and Telemetry conponent for the device.
-- **HKLM_TIPC.Enabled** The state of TIPC for the device.
-- **HKLM_TIPC.HRESULT** The error code returned when trying to query TIPC for the device.
-- **HKCU_TIPC.Enabled** The state of TIPC for the current user.
-- **HKCU_TIPC.HRESULT** The error code returned when trying to query TIPC for the current user.
-- **HKLM_FlipAhead.FPEnabled** Is Flip Ahead enabled for the device before the feature update was completed?
-- **HKLM_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the device.
-- **HKCU_FlipAhead.FPEnabled** Is Flip Ahead enabled for the current user before the feature update was completed?
-- **HKCU_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the current user.
-- **HKLM_TailoredExperiences.TailoredExperiencesWithDiagnosticDataEnabled** Is Tailored Experiences with Diagnostics Data enabled for the current user after the feature update had completed?
-- **HKCU_TailoredExperiences.HRESULT** The error code returned when trying to query Tailored Experiences with Diagnostics Data for the current user.
-- **HKLM_AdvertisingID.Enabled** Is the adverising ID enabled for the device?
-- **HKLM_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the device.
-- **HKCU_AdvertisingID.Enabled** Is the adveristing ID enabled for the current user?
-- **HKCU_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the user.
-
-
-### Common Data Fields.TelClientSynthetic.PrivacySettingsAfterCreatorsUpdate.PostUpgradeSettings
-
-These fields are added whenever PostUpgradeSettings is included in the event.
-
-The following fields are available:
-
-- **HKLM_SensorPermissionState.SensorPermissionState** The state of the Location service after the feature update has completed.
-- **HKLM_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the device.
-- **HKCU_SensorPermissionState.SensorPermissionState** The state of the Location service when a user signs on after a feature update has completed.
-- **HKCU_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the current user.
-- **HKLM_LocationPlatform.Status** The state of the location platform after the feature update has completed.
-- **HKLM_LocationPlatform.HRESULT** The error code returned when trying to query the location platform for the device.
-- **HKLM_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the device after the feature update has completed.
-- **HKLM_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the device.
-- **HKCU_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the current user after the feature update has completed.
-- **HKCU_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the current user.
-- **HKLM_AllowTelemetry.AllowTelemetry** The state of the Connected User Experiences and Telemetry component for the device after the feature update.
-- **HKLM_AllowTelemetry.HRESULT** The error code returned when trying to query the Connected User Experiences and Telemetry conponent for the device.
-- **HKLM_TIPC.Enabled** The state of TIPC for the device.
-- **HKLM_TIPC.HRESULT** The error code returned when trying to query TIPC for the device.
-- **HKCU_TIPC.Enabled** The state of TIPC for the current user.
-- **HKCU_TIPC.HRESULT** The error code returned when trying to query TIPC for the current user.
-- **HKLM_FlipAhead.FPEnabled** Is Flip Ahead enabled for the device after the feature update has completed?
-- **HKLM_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the device.
-- **HKCU_FlipAhead.FPEnabled** Is Flip Ahead enabled for the current user after the feature update has completed?
-- **HKCU_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the current user.
-- **HKLM_TailoredExperiences.TailoredExperiencesWithDiagnosticDataEnabled** Is Tailored Experiences with Diagnostics Data enabled for the current user after the feature update had completed?
-- **HKCU_TailoredExperiences.HRESULT** The error code returned when trying to query Tailored Experiences with Diagnostics Data for the current user.
-- **HKLM_AdvertisingID.Enabled** Is the adveristing ID enabled for the device?
-- **HKLM_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the device.
-- **HKCU_AdvertisingID.Enabled** Is the adveristing ID enabled for the current user?
-- **HKCU_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the user.
## Appraiser events
@@ -248,93 +45,46 @@ This event lists the types of objects and how many of each exist on the client d
The following fields are available:
-- **DatasourceApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device. on this device.
-- **DatasourceDevicePnp_RS3** The total DatasourceDevicePnp objects targeting the next release of Windows on this device.
-- **DatasourceDriverPackage_RS3** The total DatasourceDriverPackage objects targeting the next release of Windows on this device.
+- **DatasourceApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
+- **DatasourceDevicePnp_RS3** The total DatasourceDevicePnp objects targeting the next release of Windows on this device.
+- **DatasourceDriverPackage_RS3** The total DatasourceDriverPackage objects targeting the next release of Windows on this device.
- **DataSourceMatchingInfoBlock_RS3** The total DataSourceMatchingInfoBlock objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
-- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
-- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
-- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device.
-- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device.
-- **PCFP** An ID for the system that is calculated by hashing hardware identifiers.
-- **InventoryApplicationFile** The total InventoryApplicationFile objects that are present on this device.
-- **InventoryMediaCenter** The total InventoryMediaCenter objects that are present on this device.
-- **InventoryLanguagePack** The total InventoryLanguagePack objects that are present on this device.
-- **InventoryUplevelDriverPackage** The total InventoryUplevelDriverPackage objects that are present on this device.
-- **InventorySystemBios** The total InventorySystemBios objects that are present on this device.
-- **SystemProcessorCompareExchange** The total SystemProcessorCompareExchange objects that are present on this device.
-- **SystemProcessorLahfSahf** The total SystemProcessorLahfSahf objects that are present on this device.
-- **SystemMemory** The total SystemMemory objects that are present on this device.
-- **SystemProcessorPrefetchW** The total SystemProcessorPrefetchW objects that are present on this device.
-- **SystemProcessorSse2** The total SystemProcessorSse2 objects that are present on this device.
-- **SystemProcessorNx** The total SystemProcessorNx objects that are present on this device.
-- **SystemWlan** The total SystemWlan objects that are present on this device.
-- **SystemWim** The total SystemWim objects that are present on this device
-- **SystemTouch** The total SystemTouch objects that are present on this device.
-- **SystemWindowsActivationStatus** The total SystemWindowsActivationStatus objects that are present on this device.
-- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device.
-
-
-### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureIdHashSha256
-
-This event lists the types of objects and the hashed values of all the identifiers for each one. This allows for a more in-depth way to ensure that the records present on the server match what is present on the client.
-
-The following fields are available:
-
-- **DatasourceApplicationFile_RS3** The total DatasourceApplicationFile objects targeting the next release of Windows on this device.
-- **DatasourceDevicePnp_RS3** The total DatasourceDevicePnp objects targeting the next release of Windows on this device.
-- **DatasourceDriverPackage_RS3** The total DatasourceDriverPackage objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoBlock_RS3** The total DataSourceMatchingInfoBlock objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
-- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
-- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
-- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device.
-- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device.
-- **PCFP** An ID for the system that is calculated by hashing hardware identifiers.
-- **InventoryApplicationFile** The SHA256 hash of InventoryApplicationFile objects that are present on this device.
-- **InventoryMediaCenter** The SHA256 hash of InventoryMediaCenter objects that are present on this device.
-- **InventoryLanguagePack** The SHA256 hash of InventoryLanguagePack objects that are present on this device.
-- **InventoryUplevelDriverPackage** The SHA256 hash of InventoryUplevelDriverPackage objects that are present on this device.
-- **InventorySystemBios** The SHA256 hash of InventorySystemBios objects that are present on this device.
-- **SystemProcessorCompareExchange** The SHA256 hash of SystemProcessorCompareExchange objects that are present on this device.
-- **SystemProcessorLahfSahf** The SHA256 hash of SystemProcessorLahfSahf objects that are present on this device.
-- **SystemMemory** The SHA256 hash of SystemMemory objects that are present on this device.
-- **SystemProcessorPrefetchW** The SHA256 hash of SystemProcessorPrefetchW objects that are present on this device.
-- **SystemProcessorSse2** The SHA256 hash of SystemProcessorSse2 objects that are present on this device.
-- **SystemProcessorNx** The SHA256 hash of SystemProcessorNx objects that are present on this device.
-- **SystemWlan** The SHA256 hash of SystemWlan objects that are present on this device.
-- **SystemWim** The SHA256 hash of SystemWim objects that are present on this device.
-- **SystemTouch** The SHA256 hash of SystemTouch objects that are present on this device.
-- **SystemWindowsActivationStatus** The SHA256 hash of SystemWindowsActivationStatus objects that are present on this device.
-- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
+- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
+- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
+- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device.
+- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device.
+- **InventoryLanguagePack** The count of DecisionApplicationFile objects present on this machine targeting the next release of Windows
+- **InventorySystemBios** The count of DecisionDevicePnp objects present on this machine targeting the next release of Windows
+- **PCFP** The count of DecisionDriverPackage objects present on this machine targeting the next release of Windows
+- **SystemProcessorCompareExchange** The count of DecisionMatchingInfoBlock objects present on this machine targeting the next release of Windows
+- **SystemProcessorNx** The count of DataSourceMatchingInfoPostUpgrade objects present on this machine targeting the next release of Windows
+- **SystemProcessorSse2** The count of DecisionMatchingInfoPostUpgrade objects present on this machine targeting the next release of Windows
+- **SystemWim** The count of DecisionMediaCenter objects present on this machine targeting the next release of Windows
+- **SystemWindowsActivationStatus** The count of DecisionSystemBios objects present on this machine targeting the next release of Windows
+- **SystemWlan** The count of InventoryApplicationFile objects present on this machine.
+- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device.
### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd
-This event sends compatibility information about a file to help keep Windows up-to-date.
+Represents the basic metadata about specific application files installed on the system.
The following fields are available:
- **AppraiserVersion** The version of the appraiser file that is generating the events.
-- **AvDisplayName** If it is an anti-virus app, this is its display name.
+- **AvDisplayName** If the app is an anti-virus app, this is its display name.
- **CompatModelIndex** The compatibility prediction for this file.
-- **HasCitData** Is the file present in CIT data?
-- **HasUpgradeExe** Does the anti-virus app have an upgrade.exe file?
+- **HasCitData** Indicates whether the file is present in CIT data.
+- **HasUpgradeExe** Indicates whether the anti-virus app has an upgrade.exe file.
- **IsAv** Is the file an anti-virus reporting EXE?
-- **ResolveAttempted** This will always be an empty string when sending diagnostic data.
+- **ResolveAttempted** This will always be an empty string when sending telemetry.
- **SdbEntries** An array of fields that indicates the SDB entries that apply to this file.
@@ -342,6 +92,8 @@ The following fields are available:
This event indicates that the DatasourceApplicationFile object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -351,6 +103,8 @@ The following fields are available:
This event indicates that a new set of DatasourceApplicationFileAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -358,16 +112,18 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd
-This event sends compatibility data for a PNP device, to help keep Windows up-to-date.
+This event sends compatibility data for a Plug and Play device, to help keep Windows up to date.
The following fields are available:
+- **ActiveNetworkConnection** Indicates whether the device is an active network device.
- **AppraiserVersion** The version of the appraiser file generating the events.
-- **ActiveNetworkConnection** Is the device an active network device?
-- **IsBootCritical** Is the device boot critical?
+- **IsBootCritical** Indicates whether the device boot is critical.
- **SdbEntries** An array of fields indicating the SDB entries that apply to this device.
-- **WuDriverCoverage** Is there a driver uplevel for this device according to Windows Update?
-- **WuDriverUpdateID** The Windows Update ID of the applicable uplevel driver.
+- **WuDriverCoverage** Indicates whether there is a driver uplevel for this device, according to Windows Update.
+- **WuDriverUpdateId** The Windows Update ID of the applicable uplevel driver.
+- **WuDriverUpdateID** The Update ID of the applicable uplevel driver from Windows Update.
+- **WuPopulatedFromId** The expected uplevel driver matching ID based on driver coverage from Windows Update.
- **WuPopulatedFromID** The expected uplevel driver matching ID based on driver coverage from Windows Update.
@@ -375,6 +131,8 @@ The following fields are available:
This event indicates that the DatasourceDevicePnp object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -384,6 +142,8 @@ The following fields are available:
This event indicates that a new set of DatasourceDevicePnpAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -391,18 +151,19 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageAdd
-This event sends compatibility database data about driver packages to help keep Windows up-to-date.
+This event sends compatibility database data about driver packages to help keep Windows up to date.
The following fields are available:
- **AppraiserVersion** The version of the appraiser file generating the events.
-- **SdbEntries** An array of fields indicating the SDB entries that apply to this driver package.
### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove
This event indicates that the DatasourceDriverPackage object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -412,6 +173,8 @@ The following fields are available:
This event indicates that a new set of DatasourceDriverPackageAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -424,13 +187,14 @@ This event sends blocking data about any compatibility blocking entries hit on t
The following fields are available:
- **AppraiserVersion** The version of the appraiser file generating the events.
-- **SdbEntries** An array of fields indicating the SDB entries that apply to this file.
### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove
This event indicates that the DataSourceMatchingInfoBlock object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -440,6 +204,8 @@ The following fields are available:
This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -452,13 +218,14 @@ This event sends compatibility database information about non-blocking compatibi
The following fields are available:
- **AppraiserVersion** The version of the appraiser file generating the events.
-- **SdbEntries** An array of fields indicating the SDB entries that apply to this file.
### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove
This event indicates that the DataSourceMatchingInfoPassive object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -468,6 +235,8 @@ The following fields are available:
This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -480,13 +249,14 @@ This event sends compatibility database information about entries requiring rein
The following fields are available:
- **AppraiserVersion** The version of the appraiser file generating the events.
-- **SdbEntries** An array of fields indicating the SDB entries that apply to this file.
### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove
This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -496,6 +266,8 @@ The following fields are available:
This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -515,6 +287,8 @@ The following fields are available:
This event indicates that the DatasourceSystemBios object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -524,6 +298,8 @@ The following fields are available:
This event indicates that a new set of DatasourceSystemBiosAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -535,9 +311,9 @@ This event sends compatibility decision data about a file to help keep Windows u
The following fields are available:
-- **AppraiserVersion** The version of the appraiser file generating the events.
+- **AppraiserVersion** The version of the appraiser file that is generating the events.
- **BlockAlreadyInbox** The uplevel runtime block on the file already existed on the current OS.
-- **BlockingApplication** Are there any application issues that interfere with upgrade due to the file in question?
+- **BlockingApplication** Indicates whether there are any application issues that interfere with the upgrade due to the file in question.
- **DisplayGenericMessage** Will be a generic message be shown for this file?
- **HardBlock** This file is blocked in the SDB.
- **HasUxBlockOverride** Does the file have a block that is overridden by a tag in the SDB?
@@ -558,7 +334,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
-This event indicates that the DecisionApplicationFile object is no longer present.
+This event indicates Indicates that the DecisionApplicationFile object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -569,6 +347,8 @@ The following fields are available:
This event indicates that a new set of DecisionApplicationFileAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -576,16 +356,16 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd
-This event sends compatibility decision data about a PNP device to help keep Windows up-to-date.
+This event sends compatibility decision data about a PNP device to help keep Windows up to date.
The following fields are available:
- **AppraiserVersion** The version of the appraiser file generating the events.
- **AssociatedDriverIsBlocked** Is the driver associated with this PNP device blocked?
- **BlockAssociatedDriver** Should the driver associated with this PNP device be blocked?
+- **BlockingDevice** Is this PNP device blocking upgrade?
- **BlockUpgradeIfDriverBlocked** Is the PNP device both boot critical and does not have a driver included with the OS?
- **BlockUpgradeIfDriverBlockedAndOnlyActiveNetwork** Is this PNP device the only active network device?
-- **BlockingDevice** Is this PNP device blocking upgrade?
- **DisplayGenericMessage** Will a generic message be shown during Setup for this PNP device?
- **DriverAvailableInbox** Is a driver included with the operating system for this PNP device?
- **DriverAvailableOnline** Is there a driver for this PNP device on Windows Update?
@@ -595,13 +375,14 @@ The following fields are available:
- **NotRegressed** Does the device have a problem code on the source OS that is no better than the one it would have on the target OS?
- **SdbDeviceBlockUpgrade** Is there an SDB block on the PNP device that blocks upgrade?
- **SdbDriverBlockOverridden** Is there an SDB block on the PNP device that blocks upgrade, but that block was overridden?
-- **AssociatedDriverWillNotMigrate** Will the driver associated with this plug-and-play device migrate?
### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove
This event indicates that the DecisionDevicePnp object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -611,6 +392,8 @@ The following fields are available:
This event indicates that the DecisionDevicePnp object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -618,7 +401,7 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DecisionDriverPackageAdd
-This event sends decision data about driver package compatibility to help keep Windows up-to-date.
+This event sends decision data about driver package compatibility to help keep Windows up to date.
The following fields are available:
@@ -634,6 +417,8 @@ The following fields are available:
This event indicates that the DecisionDriverPackage object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -643,6 +428,8 @@ The following fields are available:
This event indicates that a new set of DecisionDriverPackageAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -650,7 +437,7 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockAdd
-This event sends compatibility decision data about blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+This event sends compatibility decision data about blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up to date.
The following fields are available:
@@ -667,6 +454,8 @@ The following fields are available:
This event indicates that the DecisionMatchingInfoBlock object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -676,6 +465,8 @@ The following fields are available:
This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -696,6 +487,8 @@ The following fields are available:
This event Indicates that the DecisionMatchingInfoPassive object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -705,6 +498,8 @@ The following fields are available:
This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -712,7 +507,7 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeAdd
-This event sends compatibility decision data about entries that require reinstall after upgrade. It's used to help keep Windows up-to-date.
+This event sends compatibility decision data about entries that require reinstall after upgrade. It's used to help keep Windows up to date.
The following fields are available:
@@ -727,6 +522,8 @@ The following fields are available:
This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -736,6 +533,8 @@ The following fields are available:
This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -743,15 +542,15 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DecisionMediaCenterAdd
-This event sends decision data about the presence of Windows Media Center, to help keep Windows up-to-date.
+This event sends decision data about the presence of Windows Media Center, to help keep Windows up to date.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file generating the events.
- **BlockingApplication** Is there any application issues that interfere with upgrade due to Windows Media Center?
- **MediaCenterActivelyUsed** If Windows Media Center is supported on the edition, has it been run at least once and are the MediaCenterIndicators are true?
-- **MediaCenterInUse** Is Windows Media Center actively being used?
- **MediaCenterIndicators** Do any indicators imply that Windows Media Center is in active use?
+- **MediaCenterInUse** Is Windows Media Center actively being used?
- **MediaCenterPaidOrActivelyUsed** Is Windows Media Center actively being used or is it running on a supported edition?
- **NeedsDismissAction** Are there any actions that can be dismissed coming from Windows Media Center?
@@ -760,6 +559,8 @@ The following fields are available:
This event indicates that the DecisionMediaCenter object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -769,6 +570,8 @@ The following fields are available:
This event indicates that a new set of DecisionMediaCenterAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -776,7 +579,7 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DecisionSystemBiosAdd
-This event sends compatibility decision data about the BIOS to help keep Windows up-to-date.
+This event sends compatibility decision data about the BIOS to help keep Windows up to date.
The following fields are available:
@@ -789,6 +592,8 @@ The following fields are available:
This event indicates that the DecisionSystemBios object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -798,6 +603,8 @@ The following fields are available:
This event indicates that a new set of DecisionSystemBiosAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -805,12 +612,12 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.EnterpriseScenarioWithDiagTrackServiceRunning
-The event that indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario.
+This event indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario.
The following fields are available:
-- **Time** The client time of the event.
- **PCFP** An ID for the system calculated by hashing hardware identifiers.
+- **Time** The client time of the event.
### Microsoft.Windows.Appraiser.General.GatedRegChange
@@ -819,31 +626,28 @@ This event sends data about the results of running a set of quick-blocking instr
The following fields are available:
-- **Time** The client time of the event.
+- **NewData** The data in the registry value after the scan completed.
+- **OldData** The previous data in the registry value before the scan ran.
- **PCFP** An ID for the system calculated by hashing hardware identifiers.
- **RegKey** The registry key name for which a result is being sent.
- **RegValue** The registry value for which a result is being sent.
-- **OldData** The previous data in the registry value before the scan ran.
-- **NewData** The data in the registry value after the scan completed.
+- **Time** The client time of the event.
### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd
-This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or are part of an anti-virus program.
+This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program.
The following fields are available:
-- **AvDisplayName** If the app is an anti-virus app, this is its display name.
-- **AvProductState** Represents state of antivirus program with respect to whether it's turned on and the signatures are up-to-date.
-- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64.
- **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets.
- **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets.
- **BoeProgramId** If there is no entry in Add/Remove Programs, this is the ProgramID that is generated from the file metadata.
- **CompanyName** The company name of the vendor who developed this file.
- **FileId** A hash that uniquely identifies a file.
- **FileVersion** The File version field from the file metadata under Properties -> Details.
-- **HasUpgradeExe** Does the anti-virus app have an upgrade.exe file?
-- **IsAv** Is the file an anti-virus reporting EXE?
- **LinkDate** The date and time that this file was linked on.
- **LowerCaseLongPath** The full file path to the file that was inventoried on the device.
- **Name** The name of the file that was inventoried.
@@ -852,29 +656,13 @@ The following fields are available:
- **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it.
- **Size** The size of the file (in hexadecimal bytes).
-### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd
-
-This event represents the drivers that an application installs.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory component
-- **Programids** The unique program identifier the driver is associated with.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync
-
-This event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory component.
-
### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove
This event indicates that the InventoryApplicationFile object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -882,7 +670,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
-This event indicates that a new set of InventoryApplicationFileAdd events will be sent.
+This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -891,19 +681,21 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.InventoryLanguagePackAdd
-This event sends data about the number of language packs installed on the system, to help keep Windows up-to-date.
+This event sends data about the number of language packs installed on the system, to help keep Windows up to date.
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **HasLanguagePack** Does this device have 2 or more language packs?
-- **LanguagePackCount** How many language packs are installed?
+- **HasLanguagePack** Indicates whether this device has 2 or more language packs.
+- **LanguagePackCount** The number of language packs are installed.
### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove
This event indicates that the InventoryLanguagePack object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -913,6 +705,8 @@ The following fields are available:
This event indicates that a new set of InventoryLanguagePackAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -938,6 +732,8 @@ The following fields are available:
This event indicates that the InventoryMediaCenter object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -947,6 +743,8 @@ The following fields are available:
This event indicates that a new set of InventoryMediaCenterAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -967,7 +765,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove
-This event indicates that the InventorySystemBios object is no longer present.
+This event indicates that the InventorySystemBios object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -978,6 +778,8 @@ The following fields are available:
This event indicates that a new set of InventorySystemBiosAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -987,29 +789,33 @@ The following fields are available:
This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
- **BootCritical** Is the driver package marked as boot critical?
- **Build** The build value from the driver package.
- **CatalogFile** The name of the catalog file within the driver package.
-- **ClassGuid** The device class GUID from the driver package.
- **Class** The device class from the driver package.
+- **ClassGuid** The device class unique ID from the driver package.
- **Date** The date from the driver package.
-- **SignatureStatus** Indicates if the driver package is signed. Unknown:0, Unsigned:1, Signed: 2
- **Inbox** Is the driver package of a driver that is included with Windows?
+- **OriginalName** The original name of the INF file before it was renamed. Generally a path under $WINDOWS.~BT\Drivers\DU.
+- **Provider** The provider of the driver package.
+- **PublishedName** The name of the INF file after it was renamed.
+- **Revision** The revision of the driver package.
+- **SignatureStatus** Indicates if the driver package is signed. Unknown = 0, Unsigned = 1, Signed = 2.
- **VersionMajor** The major version of the driver package.
- **VersionMinor** The minor version of the driver package.
-- **OriginalName** The original name of the INF file before it was renamed. Generally a path under $WINDOWS.~BT\Drivers\DU
-- **Provider** The provider of the driver package.
-- **PublishedName** The name of the INF file, post-rename.
-- **Revision** The revision of the driver package.
### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove
This event indicates that the InventoryUplevelDriverPackage object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1019,60 +825,25 @@ The following fields are available:
This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.IsOnlineTelemetryOutputter
-
-This event indicates if Appraiser was able to connect successfully to Windows Update to get driver availability information.
-
-The following fields are available:
-
-- **Time** The client time of the event.
-- **PCFP** A unique hardware identifier that is calculated by hashing hardware identifiers.
-- **IsOnlineRun** Was the device able to connect to Windows Update to get driver availability information?
-
-
-### Microsoft.Windows.Appraiser.General.IsOnlineWuDriverDataSource
-
-This event indicates if Appraiser was able to connect to Windows Update to gather driver coverage information.
-
-The following fields are available:
-
-- **Time** The client time of the event.
-- **PCFP** A unique hardware identifier that is calculated by hashing hardware identifiers.
-- **IsOnlineRun** Was the device able to connect to Windows Update to get driver availability information?
-- **TargetVersion** The abbreviated name for the OS version against which Windows Update was queried.
-
-
### Microsoft.Windows.Appraiser.General.RunContext
-This event indicates what should be expected in the data payload.
+This event indicates what should be expected in the data payload.
The following fields are available:
- **AppraiserBranch** The source branch in which the currently running version of Appraiser was built.
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **Context** Indicates what mode Appraiser is running in. Example: Setup or Diagnostic Data.
-- **Time** The client time of the event.
- **AppraiserProcess** The name of the process that launched Appraiser.
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **Context** Indicates what mode Appraiser is running in. Example: Setup or Telemetry.
- **PCFP** An ID for the system calculated by hashing hardware identifiers.
-
-
-### Microsoft.Windows.Appraiser.General.SetupAdlStatus
-
-This event indicates if Appraiser used data files from the setup image or more up-to-date data files downloaded from a Microsoft server.
-
-The following fields are available:
-
- **Time** The client time of the event.
-- **PCFP** An ID for the system calculated by hashing hardware identifiers.
-- **Result** The last result of the operation to determine if there is a data file to download.
-- **OneSettingsInitialized** Was the query to OneSettings, where the information is stored on if there is a data file to download, initialized?
-- **Url** The URL of the data file to download. This will be an empty string if there is no data file to download.
-- **UsingAlternateData** Is the client using alternate data file or using the data file in the setup image?
### Microsoft.Windows.Appraiser.General.SystemMemoryAdd
@@ -1095,6 +866,8 @@ The following fields are available:
This event that the SystemMemory object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1104,6 +877,8 @@ The following fields are available:
This event indicates that a new set of SystemMemoryAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1122,7 +897,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove
-This event indicates that the SystemProcessorCompareExchange object is no longer present.
+This event indicates that the SystemProcessorCompareExchange object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -1133,6 +910,8 @@ The following fields are available:
This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1151,7 +930,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove
-This event indicates that the SystemProcessorLahfSahf object is no longer present.
+This event indicates that the SystemProcessorLahfSahf object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -1162,6 +943,8 @@ The following fields are available:
This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1183,6 +966,8 @@ The following fields are available:
This event indicates that the SystemProcessorNx object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1192,6 +977,8 @@ The following fields are available:
This event indicates that a new set of SystemProcessorNxAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1199,7 +986,7 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWAdd
-This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up-to-date.
+This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up to date.
The following fields are available:
@@ -1212,6 +999,8 @@ The following fields are available:
This event indicates that the SystemProcessorPrefetchW object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1221,6 +1010,8 @@ The following fields are available:
This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1228,7 +1019,7 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Add
-This event sends data indicating whether the system supports the SSE2 CPU requirement, to help keep Windows up-to-date.
+This event sends data indicating whether the system supports the SSE2 CPU requirement, to help keep Windows up to date.
The following fields are available:
@@ -1241,6 +1032,8 @@ The following fields are available:
This event indicates that the SystemProcessorSse2 object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1250,6 +1043,8 @@ The following fields are available:
This event indicates that a new set of SystemProcessorSse2Add events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1257,7 +1052,7 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemTouchAdd
-This event sends data indicating whether the system supports touch, to help keep Windows up-to-date.
+This event sends data indicating whether the system supports touch, to help keep Windows up to date.
The following fields are available:
@@ -1268,7 +1063,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemTouchRemove
-This event indicates that the SystemTouch object is no longer present.
+This event indicates that the SystemTouch object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -1279,6 +1076,8 @@ The following fields are available:
This event indicates that a new set of SystemTouchAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1286,7 +1085,7 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemWimAdd
-This event sends data indicating whether the operating system is running from a compressed WIM file, to help keep Windows up-to-date.
+This event sends data indicating whether the operating system is running from a compressed Windows Imaging Format (WIM) file, to help keep Windows up to date.
The following fields are available:
@@ -1297,7 +1096,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemWimRemove
-This event indicates that the SystemWim object is no longer present.
+This event indicates that the SystemWim object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -1308,6 +1109,8 @@ The following fields are available:
This event indicates that a new set of SystemWimAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1315,7 +1118,7 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusAdd
-This event sends data indicating whether the current operating system is activated, to help keep Windows up-to-date.
+This event sends data indicating whether the current operating system is activated, to help keep Windows up to date.
The following fields are available:
@@ -1328,6 +1131,8 @@ The following fields are available:
This event indicates that the SystemWindowsActivationStatus object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1337,6 +1142,8 @@ The following fields are available:
This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1359,7 +1166,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemWlanRemove
-This event indicates that the SystemWlan object is no longer present.
+This event indicates that the SystemWlan object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -1370,6 +1179,8 @@ The following fields are available:
This event indicates that a new set of SystemWlanAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1377,58 +1188,62 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
-A summary event indicating the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up-to-date.
+This event indicates the parameters and result of a telemetry (diagnostic) run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
The following fields are available:
-- **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
-- **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
-- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability.
-- **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
-- **Time** The client time of the event.
-- **RunDate** The date that the diagnostic data run was stated, expressed as a filetime.
+- **AppraiserBranch** The source branch in which the version of Appraiser that is running was built.
+- **AppraiserDataVersion** The version of the data files being used by the Appraiser telemetry run.
- **AppraiserProcess** The name of the process that launched Appraiser.
- **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots.
-- **SendingUtc** Indicates if the Appraiser client is sending events during the current diagnostic data run.
+- **AuxFinal** Obsolete, always set to false.
+- **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
- **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
-- **AppraiserBranch** The source branch in which the version of Appraiser that is running was built.
-- **EnterpriseRun** Indicates if the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
-- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic.
-- **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
-- **AuxFinal** Obsolete, always set to false
-- **StoreHandleIsNotNull** Obsolete, always set to false
-- **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
-- **AppraiserDataVersion** The version of the data files being used by the Appraiser diagnostic data run.
+- **EnterpriseRun** Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
- **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent.
- **InventoryFullSync** Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent.
- **PCFP** An ID for the system calculated by hashing hardware identifiers.
+- **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
+- **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
+- **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
+- **RunDate** The date that the telemetry run was stated, expressed as a filetime.
+- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic.
- **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
-- **TelementrySent** Indicates if diagnostic data was successfully sent.
+- **RunResult** The hresult of the Appraiser telemetry run.
+- **SendingUtc** Indicates if the Appraiser client is sending events during the current telemetry run.
+- **StoreHandleIsNotNull** Obsolete, always set to false
+- **TelementrySent** Indicates if telemetry was successfully sent.
+- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability.
+- **Time** The client time of the event.
+- **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
- **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated.
-- **RunResult** The hresult of the Appraiser diagnostic data run.
### Microsoft.Windows.Appraiser.General.WmdrmAdd
This event sends data about the usage of older digital rights management on the system, to help keep Windows up to date. This data does not indicate the details of the media using the digital rights management, only whether any such files exist. Collecting this data was critical to ensuring the correct mitigation for customers, and should be able to be removed once all mitigations are in place.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **BlockingApplication** Same as NeedsDismissAction.
+- **NeedsDismissAction** Indicates if a dismissible message is needed to warn the user about a potential loss of data due to DRM deprecation.
+- **WmdrmApiResult** Raw value of the API used to gather DRM state.
- **WmdrmCdRipped** Indicates if the system has any files encrypted with personal DRM, which was used for ripped CDs.
+- **WmdrmIndicators** WmdrmCdRipped OR WmdrmPurchased.
+- **WmdrmInUse** WmdrmIndicators AND dismissible block in setup was not dismissed.
- **WmdrmNonPermanent** Indicates if the system has any files with non-permanent licenses.
- **WmdrmPurchased** Indicates if the system has any files with permanent licenses.
-- **WmdrmApiResult** Raw value of the API used to gather DRM state.
-- **WmdrmInUse** WmdrmIndicators AND dismissible block in setup was not dismissed.
-- **WmdrmIndicators** WmdrmCdRipped OR WmdrmPurchased
-- **NeedsDismissAction** Indicates if a dismissible message is needed to warn the user about a potential loss of data due to DRM deprecation.
-- **BlockingApplication** Same as NeedsDismissAction
### Microsoft.Windows.Appraiser.General.WmdrmRemove
This event indicates that the Wmdrm object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1438,6 +1253,8 @@ The following fields are available:
This event indicates that a new set of WmdrmAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1451,8 +1268,8 @@ This event sends version data about the Apps running on this device, to help kee
The following fields are available:
-- **IEVersion** Retrieves which version of Internet Explorer is running on this device.
- **CensusVersion** The version of Census that generated the current data for this device.
+- **IEVersion** Retrieves which version of Internet Explorer is running on this device.
### Census.Battery
@@ -1464,8 +1281,8 @@ The following fields are available:
- **InternalBatteryCapablities** Represents information about what the battery is capable of doing.
- **InternalBatteryCapacityCurrent** Represents the battery's current fully charged capacity in mWh (or relative). Compare this value to DesignedCapacity to estimate the battery's wear.
- **InternalBatteryCapacityDesign** Represents the theoretical capacity of the battery when new, in mWh.
-- **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value.
- **InternalBatteryNumberOfCharges** Provides the number of battery charges. This is used when creating new products and validating that existing products meets targeted functionality performance.
+- **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value.
### Census.Camera
@@ -1484,23 +1301,22 @@ This event sends data about Azure presence, type, and cloud domain use in order
The following fields are available:
-- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (AAD) tenant? true/false
-- **IsMDMEnrolled** Whether the device has been MDM Enrolled or not.
-- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
-- **CommercialId** Represents the GUID for the commercial entity which the device is a member of. Will be used to reflect insights back to customers.
-- **AzureVMType** Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs.
- **AzureOSIDPresent** Represents the field used to identify an Azure machine.
-- **IsDomainJoined** Indicates whether a machine is joined to a domain.
-- **HashedDomain** The hashed representation of the user domain used for login.
-- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier
-- **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID
-- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment.
+- **AzureVMType** Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs.
- **CDJType** Represents the type of cloud domain joined for the machine.
-- **IsDeviceProtected** Represents if Device protected by BitLocker/Device Encryption
-- **IsDERequirementMet** Represents if the device can do device encryption.
-- **IsEDPEnabled** Represents if Enterprise data protected on the device.
+- **CommercialId** Represents the GUID for the commercial entity which the device is a member of. Will be used to reflect insights back to customers.
- **ContainerType** The type of container, such as process or virtual machine hosted.
-- **EnrollmentType** Represents the type of enrollment, such as MDM or Intune, for a particular device.
+- **HashedDomain** The hashed representation of the user domain used for login.
+- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (AAD) tenant? true/false
+- **IsDERequirementMet** Represents if the device can do device encryption.
+- **IsDeviceProtected** Represents if Device protected by BitLocker/Device Encryption
+- **IsDomainJoined** Indicates whether a machine is joined to a domain.
+- **IsEDPEnabled** Represents if Enterprise data protected on the device.
+- **IsMDMEnrolled** Whether the device has been MDM Enrolled or not.
+- **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID
+- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise System Center Configuration Manager (SCCM) environment.
+- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
+- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier.
### Census.Firmware
@@ -1517,58 +1333,54 @@ The following fields are available:
### Census.Flighting
-This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up-to-date.
+This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date.
The following fields are available:
-- **FlightIds** A list of the different Windows Insider builds on this device.
-- **MSA_Accounts** Represents a list of hashed IDs of the Microsoft Accounts that are flighting (pre-release builds) on this device.
-- **IsFlightsDisabled** Represents if the device is participating in the Windows Insider program.
-- **FlightingBranchName** The name of the Windows Insider branch currently used by the device.
-- **DeviceSampleRate** The diagnostic data sample rate assigned to the device.
+- **DeviceSampleRate** The telemetry sample rate assigned to the device.
- **EnablePreviewBuilds** Used to enable Windows Insider builds on a device.
+- **FlightIds** A list of the different Windows Insider builds on this device.
+- **FlightingBranchName** The name of the Windows Insider branch currently used by the device.
+- **IsFlightsDisabled** Represents if the device is participating in the Windows Insider program.
+- **MSA_Accounts** Represents a list of hashed IDs of the Microsoft Accounts that are flighting (pre-release builds) on this device.
- **SSRK** Retrieves the mobile targeting settings.
### Census.Hardware
-This event sends data about the device, including hardware type, OEM brand, model line, model, diagnostic data level setting, and TPM support, to help keep Windows up-to-date.
+This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date.
The following fields are available:
+- **ActiveMicCount** The number of active microphones attached to the device.
- **ChassisType** Represents the type of device chassis, such as desktop or low profile desktop. The possible values can range between 1 - 36.
- **ComputerHardwareID** Identifies a device class that is represented by a hash of different SMBIOS fields.
- **DeviceColor** Indicates a color of the device.
+- **DeviceForm** Indicates the form as per the device classification.
- **DeviceName** The device name that is set by the user.
+- **DigitizerSupport** Is a digitizer supported?
+- **DUID** The device unique ID.
+- **InventoryId** The device ID used for compatibility testing.
- **OEMDigitalMarkerFileName** The name of the file placed in the \Windows\system32\drivers directory that specifies the OEM and model name of the device.
- **OEMManufacturerName** The device manufacturer name. The OEMName for an inactive device is not reprocessed even if the clean OEM name is changed at a later date.
-- **OEMModelNumber** The device model number.
+- **OEMModelBaseBoard** The baseboard model used by the OEM.
+- **OEMModelBaseBoardVersion** Differentiates between developer and retail devices.
- **OEMModelName** The device model name.
+- **OEMModelNumber** The device model number.
- **OEMModelSKU** The device edition that is defined by the manufacturer.
+- **OEMModelSystemFamily** The system family set on the device by an OEM.
+- **OEMModelSystemVersion** The system model version set on the device by the OEM.
- **OEMOptionalIdentifier** A Microsoft assigned value that represents a specific OEM subsidiary.
- **OEMSerialNumber** The serial number of the device that is set by the manufacturer.
- **PhoneManufacturer** The friendly name of the phone manufacturer.
-- **SoCName** The firmware manufacturer of the device.
-- **DUID** The device unique ID.
-- **InventoryId** The device ID used for compatibility testing.
-- **VoiceSupported** Does the device have a cellular radio capable of making voice calls?
- **PowerPlatformRole** The OEM preferred power management profile. It's used to help to identify the basic form factor of the device.
-- **TPMVersion** The supported Trusted Platform Module (TPM) on the device. If no TPM is present, the value is 0.
+- **SoCName** The firmware manufacturer of the device.
- **StudyID** Used to identify retail and non-retail device.
-- **TelemetryLevel** The diagnostic data level the user has opted into, such as Basic or Enhanced.
-- **TelemetrySettingAuthority** Determines who set the diagnostic data level, such as GP, MDM, or the user.
-- **DeviceForm** Indicates the form as per the device classification.
-- **DigitizerSupport** Is a digitizer supported?
-- **OEMModelBaseBoard** The baseboard model used by the OEM.
-- **OEMModelSystemFamily** The system family set on the device by an OEM.
-- **OEMModelBaseBoardVersion** Differentiates between developer and retail devices.
-- **ActiveMicCount** The number of active microphones attached to the device.
-- **OEMModelSystemVersion** The system model version set on the device by the OEM.
-- **D3DMaxFeatureLevel** The supported Direct3D version.
-- **Gyroscope** Indicates whether the device has a gyroscope.
-- **Magnetometer** Indicates whether the device has a magnetometer.
-- **NFCProximity** Indicates whether the device supports NFC.
-- **TelemetryLevelLimitEnhanced** The diagnostic data level for Windows Analytics-based solutions.
+- **TelemetryLevel** The telemetry level the user has opted into, such as Basic or Enhanced.
+- **TelemetrySettingAuthority** Determines who set the telemetry level, such as GP, MDM, or the user.
+- **TPMVersion** The supported Trusted Platform Module (TPM) on the device. If no TPM is present, the value is 0.
+- **VoiceSupported** Does the device have a cellular radio capable of making voice calls?
+
### Census.Memory
@@ -1586,21 +1398,21 @@ This event sends data about the mobile and cellular network used by the device (
The following fields are available:
+- **IMEI0** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage.
+- **IMEI1** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage.
+- **MCC0** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
+- **MCC1** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
+- **MEID** Represents the Mobile Equipment Identity (MEID). MEID is a worldwide unique phone ID assigned to CDMA phones. MEID replaces electronic serial number (ESN), and is equivalent to IMEI for GSM and WCDMA phones. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user.
+- **MNC0** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
+- **MNC1** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
- **MobileOperatorBilling** Represents the telephone company that provides services for mobile phone users.
- **MobileOperatorCommercialized** Represents which reseller and geography the phone is commercialized for. This is the set of values on the phone for who and where it was intended to be used. For example, the commercialized mobile operator code AT&T in the US would be ATT-US.
-- **NetworkCost** Represents the network cost associated with a connection.
-- **IMEI0** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage.
-- **SPN0** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage.
- **MobileOperatorNetwork0** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage.
-- **MCC0** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
-- **MNC0** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
-- **IMEI1** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage.
-- **SPN1** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage.
- **MobileOperatorNetwork1** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage.
-- **MCC1** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
-- **MNC1** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
-- **MEID** Represents the Mobile Equipment Identity (MEID). MEID is a worldwide unique phone ID assigned to CDMA phones. MEID replaces electronic serial number (ESN), and is equivalent to IMEI for GSM and WCDMA phones. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user.
- **NetworkAdapterGUID** The GUID of the primary network adapter.
+- **NetworkCost** Represents the network cost associated with a connection.
+- **SPN0** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage.
+- **SPN1** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage.
### Census.OS
@@ -1609,40 +1421,39 @@ This event sends data about the operating system such as the version, locale, up
The following fields are available:
+- **ActivationChannel** Retrieves the retail license key or Volume license key for a machine.
+- **CompactOS** Indicates if the Compact OS feature from Win10 is enabled.
+- **DeveloperUnlockStatus** Represents if a device has been developer unlocked by the user or Group Policy.
+- **DeviceTimeZone** The time zone that is set on the device. Example: Pacific Standard Time
- **GenuineState** Retrieves the ID Value specifying the OS Genuine check.
+- **InstallationType** Retrieves the type of OS installation. (Clean, Upgrade, Reset, Refresh, Update).
+- **InstallLanguage** The first language installed on the user machine.
+- **IsDeviceRetailDemo** Retrieves if the device is running in demo mode.
+- **IsEduData** Returns Boolean if the education data policy is enabled.
- **IsPortableOperatingSystem** Retrieves whether OS is running Windows-To-Go
- **IsSecureBootEnabled** Retrieves whether Boot chain is signed under UEFI.
-- **InstallationType** Retrieves the type of OS installation. (Clean, Upgrade, Reset, Refresh, Update).
+- **LanguagePacks** The list of language packages installed on the device.
+- **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store.
+- **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine.
+- **OSEdition** Retrieves the version of the current OS.
- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc
- **OSOOBEDateTime** Retrieves Out of Box Experience (OOBE) Date in Coordinated Universal Time (UTC).
- **OSSKU** Retrieves the Friendly Name of OS Edition.
+- **OSSubscriptionStatus** Represents the existing status for enterprise subscription feature for PRO machines.
+- **OSSubscriptionTypeId** Returns boolean for enterprise subscription feature for selected PRO machines.
- **OSTimeZoneBiasInMins** Retrieves the time zone set on machine.
- **OSUILocale** Retrieves the locale of the UI that is currently used by the OS.
-- **RACw7Id** Retrieves the Microsoft Reliability Analysis Component (RAC) Win7 Identifier. RAC is used to monitor and analyze system usage and reliability.
-- **CompactOS** Indicates if the Compact OS feature from Win10 is enabled.
-- **Signature** Retrieves if it is a signature machine sold by Microsoft store.
-- **IsDeviceRetailDemo** Retrieves if the device is running in demo mode.
-- **ActivationChannel** Retrieves the retail license key or Volume license key for a machine.
-- **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store.
-- **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine.
-- **ProductKeyID2** Retrieves the License key if the machine is updated with a new license key.
-- **ServiceMachineIP** Retrieves the IP address of the KMS host used for anti-piracy.
-- **ServiceProductKeyID** Retrieves the License key of the KMS
-- **LanguagePacks** The list of language packages installed on the device.
-- **InstallLanguage** The first language installed on the user machine.
-- **IsEduData** Returns Boolean if the education data policy is enabled.
-- **SharedPCMode** Returns Boolean for education devices used as shared cart
-- **SLICVersion** Returns OS type/version from SLIC table.
-- **SLICStatus** Whether a SLIC table exists on the device.
-- **OSEdition** Retrieves the version of the current OS.
-- **ProductActivationTime** Returns the OS Activation time for tracking piracy issues.
- **ProductActivationResult** Returns Boolean if the OS Activation was successful.
-- **OSSubscriptionTypeId** Returns boolean for enterprise subscription feature for selected PRO machines.
-- **OSSubscriptionStatus** Represents the existing status for enterprise subscription feature for PRO machines.
+- **ProductActivationTime** Returns the OS Activation time for tracking piracy issues.
+- **ProductKeyID2** Retrieves the License key if the machine is updated with a new license key.
+- **RACw7Id** Retrieves the Microsoft Reliability Analysis Component (RAC) Win7 Identifier. RAC is used to monitor and analyze system usage and reliability.
+- **ServiceMachineIP** Retrieves the IP address of the KMS host used for anti-piracy.
- **ServiceMachinePort** Retrieves the port of the KMS host used for anti-piracy.
-- **DeviceTimeZone** The time zone that is set on the device. Example: Pacific Standard Time
-- **DeveloperUnlockStatus** Represents if a device has been developer unlocked by the user or Group Policy.
-- **AssignedAccessStatus** The kiosk configuration mode.
+- **ServiceProductKeyID** Retrieves the License key of the KMS
+- **SharedPCMode** Returns Boolean for education devices used as shared cart
+- **Signature** Retrieves if it is a signature machine sold by Microsoft store.
+- **SLICStatus** Whether a SLIC table exists on the device.
+- **SLICVersion** Returns OS type/version from SLIC table.
### Census.Processor
@@ -1651,19 +1462,14 @@ This event sends data about the processor (architecture, speed, number of cores,
The following fields are available:
-- **KvaShadow** Microcode info of the processor.
-- **MMSettingOverride** Microcode setting of the processor.
-- **MMSettingOverrideMask** Microcode setting override of the processor.
-- **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system.
+- **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system.
- **ProcessorClockSpeed** Retrieves the clock speed of the processor in MHz.
- **ProcessorCores** Retrieves the number of cores in the processor.
- **ProcessorIdentifier** The processor identifier of a manufacturer.
- **ProcessorManufacturer** Retrieves the name of the processor's manufacturer.
- **ProcessorModel** Retrieves the name of the processor model.
- **ProcessorPhysicalCores** Number of physical cores in the processor.
-- **ProcessorUpdateRevision** The microcode version.
- **SocketCount** Number of physical CPU sockets of the machine.
-- **SpeculationControl** If the system has enabled protections needed to validate the speculation control vulnerability.
### Census.Speech
@@ -1672,15 +1478,15 @@ This event is used to gather basic speech settings on the device.
The following fields are available:
-- **AboveLockEnabled** Cortana setting that represents if Cortana can be invoked when the device is locked.
-- **GPAllowInputPersonalization** Indicates if a Group Policy setting has enabled speech functionalities.
-- **HolographicSpeechInputDisabled** Holographic setting that represents if the attached HMD devices have speech functionality disabled by the user.
-- **HolographicSpeechInputDisabledRemote** Indicates if a remote policy has disabled speech functionalities for the HMD devices.
-- **KWSEnabled** Cortana setting that represents if a user has enabled the "Hey Cortana" keyword spotter (KWS).
-- **MDMAllowInputPersonalization** Indicates if an MDM policy has enabled speech functionalities.
-- **RemotelyManaged** Indicates if the device is being controlled by a remote administrator (MDM or Group Policy) in the context of speech functionalities.
-- **SpeakerIdEnabled** Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice.
-- **SpeechServicesEnabled** Windows setting that represents whether a user is opted-in for speech services on the device.
+- **AboveLockEnabled** Cortana setting that represents if Cortana can be invoked when the device is locked.
+- **GPAllowInputPersonalization** Indicates if a Group Policy setting has enabled speech functionalities.
+- **HolographicSpeechInputDisabled** Holographic setting that represents if the attached HMD devices have speech functionality disabled by the user.
+- **HolographicSpeechInputDisabledRemote** Indicates if a remote policy has disabled speech functionalities for the HMD devices.
+- **KWSEnabled** Cortana setting that represents if a user has enabled the "Hey Cortana" keyword spotter (KWS).
+- **MDMAllowInputPersonalization** Indicates if an MDM policy has enabled speech functionalities.
+- **RemotelyManaged** Indicates if the device is being controlled by a remote admininistrator (MDM or Group Policy) in the context of speech functionalities.
+- **SpeakerIdEnabled** Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice.
+- **SpeechServicesEnabled** Windows setting that represents whether a user is opted-in for speech services on the device.
### Census.Storage
@@ -1690,8 +1496,8 @@ This event sends data about the total capacity of the system volume and primary
The following fields are available:
- **PrimaryDiskTotalCapacity** Retrieves the amount of disk space on the primary disk of the device in MB.
-- **SystemVolumeTotalCapacity** Retrieves the size of the partition that the System volume is installed on in MB.
- **PrimaryDiskType** Retrieves an enumerator value of type STORAGE_BUS_TYPE that indicates the type of bus to which the device is connected. This should be used to interpret the raw device properties at the end of this structure (if any).
+- **SystemVolumeTotalCapacity** Retrieves the size of the partition that the System volume is installed on in MB.
### Census.Userdefault
@@ -1700,8 +1506,8 @@ This event sends data about the current user's default preferences for browser a
The following fields are available:
-- **DefaultBrowserProgId** The ProgramId of the current user's default browser
-- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html,.htm,.jpg,.jpeg,.png,.mp3,.mp4, .mov,.pdf
+- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf.
+- **DefaultBrowserProgId** The ProgramId of the current user's default browser.
### Census.UserDisplay
@@ -1718,8 +1524,8 @@ The following fields are available:
- **InternalPrimaryDisplayResolutionVertical** Retrieves the number of pixels in the vertical direction of the internal display.
- **InternalPrimaryDisplaySizePhysicalH** Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches .
- **InternalPrimaryDisplaySizePhysicalY** Retrieves the physical vertical length of the display in mm. Used for calculating the diagonal length in inches
-- **NumberofInternalDisplays** Retrieves the number of internal displays in a machine.
- **NumberofExternalDisplays** Retrieves the number of external displays connected to the machine
+- **NumberofInternalDisplays** Retrieves the number of internal displays in a machine.
- **VRAMDedicated** Retrieves the video RAM in MB.
- **VRAMDedicatedSystem** Retrieves the amount of memory on the dedicated video card.
- **VRAMSharedSystem** Retrieves the amount of RAM memory that the video card can use.
@@ -1732,10 +1538,10 @@ This event sends data about the default app language, input, and display languag
The following fields are available:
- **DefaultAppLanguage** The current user Default App Language.
-- **HomeLocation** The current user location, which is populated using GetUserGeoId() function.
- **DisplayLanguage** The current user preferred Windows Display Language.
-- **SpeechInputLanguages** The Speech Input languages installed on the device.
+- **HomeLocation** The current user location, which is populated using GetUserGeoId() function.
- **KeyboardInputLanguages** The Keyboard input languages installed on the device.
+- **SpeechInputLanguages** The Speech Input languages installed on the device.
### Census.VM
@@ -1744,13 +1550,11 @@ This event sends data indicating whether virtualization is enabled on the device
The following fields are available:
-- **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware.
-- **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware.
+- **HyperVisor** Retrieves whether the current OS is running on top of a Hypervisor.
- **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present.
- **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#1 Hypervisors.
-- **HyperVisor** Retrieves whether the current OS is running on top of a Hypervisor.
-- **CloudService** Indicates which cloud service, if any, that this virtual machine is running within.
-- **isVDI** Is the device using Virtual Desktop Infrastructure?
+- **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware.
+- **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware.
### Census.WU
@@ -1759,29 +1563,23 @@ This event sends data about the Windows update server and other App store polici
The following fields are available:
-- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
-- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
-- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
-- **OSWUAutoUpdateOptions** Retrieves the auto update settings on the device.
-- **AppStoreAutoUpdate** Retrieves the Appstore settings for auto upgrade. (Enable/Disabled).
-- **AppStoreAutoUpdatePolicy** Retrieves the Microsoft Store App Auto Update group policy setting
-- **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured
-- **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades.
-- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
-- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades
-- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates
-- **WUPauseState** Retrieves WU setting to determine if updates are paused
-- **OSUninstalled** A flag that represents when a feature update is uninstalled on a device .
-- **OSRolledBack** A flag that represents when a feature update has rolled back during setup.
-- **OSRollbackCount** The number of times feature updates have rolled back on the device.
-- **UninstallActive** A flag that represents when a device has uninstalled a previous upgrade recently.
- **AppraiserGatedStatus** Indicates whether a device has been gated for upgrading.
-- **OSAssessmentFeatureOutOfDate** How many days has it been since a the last feature update was released but the device did not install it?
-- **OSAssessmentForFeatureUpdate** Is the device is on the latest feature update?
-- **OSAssessmentForQualityUpdate** Is the device on the latest quality update?
-- **OSAssessmentForSecurityUpdate** Is the device on the latest security update?
-- **OSAssessmentQualityOutOfDate** How many days has it been since a the last quality update was released but the device did not install it?
-- **OSAssessmentReleaseInfoTime** The freshness of release information used to perform an assessment.
+- **AppStoreAutoUpdate** Retrieves the Appstore settings for auto upgrade. (Enable/Disabled).
+- **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured
+- **AppStoreAutoUpdatePolicy** Retrieves the Microsoft Store App Auto Update group policy setting
+- **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades.
+- **OSRollbackCount** The number of times feature updates have rolled back on the device.
+- **OSRolledBack** A flag that represents when a feature update has rolled back during setup.
+- **OSUninstalled** A flag that represents when a feature update is uninstalled on a device .
+- **OSWUAutoUpdateOptions** Retrieves the auto update settings on the device.
+- **UninstallActive** A flag that represents when a device has uninstalled a previous upgrade recently.
+- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
+- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates.
+- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades.
+- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
+- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
+- **WUPauseState** Retrieves WU setting to determine if updates are paused.
+- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
### Census.Xbox
@@ -1790,66 +1588,211 @@ This event sends data about the Xbox Console, such as Serial Number and DeviceId
The following fields are available:
-- **XboxLiveDeviceId** Retrieves the unique device id of the console.
-- **XboxConsoleSerialNumber** Retrieves the serial number of the Xbox console.
-- **XboxLiveSandboxId** Retrieves the developer sandbox id if the device is internal to MS.
- **XboxConsolePreferredLanguage** Retrieves the preferred language selected by the user on Xbox console.
+- **XboxConsoleSerialNumber** Retrieves the serial number of the Xbox console.
+- **XboxLiveDeviceId** Retrieves the unique device ID of the console.
+- **XboxLiveSandboxId** Retrieves the developer sandbox ID if the device is internal to Microsoft.
-### Census.Security
-This event provides information on about security settings used to help keep Windows up-to-date and secure.
+## Common data extensions
+
+### Common Data Extensions.app
+
+Describes the properties of the running application. This extension could be populated by a client app or a web app.
+
+The following fields are available:
+
+- **asId** An integer value that represents the app session. This value starts at 0 on the first app launch and increments after each subsequent app launch per boot session.
+- **env** The environment from which the event was logged.
+- **expId** Associates a flight, such as an OS flight, or an experiment, such as a web site UX experiment, with an event.
+- **id** Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application.
+- **userId** The userID as known by the application.
+- **ver** Represents the version number of the application. Used to understand errors by Version, Usage by Version across an app.
+
+
+### Common Data Extensions.container
+
+Describes the properties of the container for events logged within a container.
+
+The following fields are available:
+
+- **localId** The device ID as known by the client.
+- **osVer** The operating system version.
+- **type** The container type. Examples: Process or VMHost
+
+
+### Common Data Extensions.cs
+
+Describes properties related to the schema of the event.
+
+The following fields are available:
+
+- **sig** A common schema signature that identifies new and modified event schemas.
+
+
+### Common Data Extensions.device
+
+Describes the device-related fields.
+
+The following fields are available:
+
+- **deviceClass** Represents the classification of the device, the device “family”. For example, Desktop, Server, or Mobile.
+- **localId** Represents a locally defined unique ID for the device, not the human readable device name. Most likely equal to the value stored at HKLM\Software\Microsoft\SQMClient\MachineId
+
+
+### Common Data Extensions.Envelope
+
+Represents an envelope that contains all of the common data extensions.
+
+The following fields are available:
+
+- **appId** Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application.
+- **appVer** Represents the version number of the application. Used to understand errors by version and usage by version across an app.
+- **cV** Represents the Correlation Vector: A single field for tracking partial order of related telemetry events across component boundaries.
+- **data** Represents the optional unique diagnostic data for a particular event schema.
+- **epoch** ID used to help distinguish events in the sequence by indicating the current boot session.
+- **ext_app** Describes the properties of the running application. This extension could be populated by either a client app or a web app. See [Common Data Extensions.app](#common-data-extensionsapp).
+- **ext_container** Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer).
+- **ext_cs** Describes properties related to the schema of the event. See [Common Data Extensions.cs](#common-data-extensionscs).
+- **ext_device** Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice).
+- **ext_os** Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos).
+- **ext_user** Describes the fields related to a user. See [Common Data Extensions.user](#common-data-extensionsuser).
+- **ext_utc** Describes the fields that might be populated by a logging library on Windows. See [Common Data Extensions.utc](#common-data-extensionsutc).
+- **ext_xbl** Describes the fields related to XBOX Live. See [Common Data Extensions.xbl](#common-data-extensionsxbl).
+- **flags** Represents a collection of bits that describe how the event should be processed by the Connected User Experience and Telemetry component pipeline. The lowest-order byte is the event persistence. The next byte is the event latency.
+- **iKey** Represents an ID for applications or other logical groupings of events.
+- **name** Represents the uniquely qualified name for the event.
+- **os** The operating system name.
+- **osVer** The operating system version.
+- **popSample** Represents the effective sample rate for this event at the time it was generated by a client.
+- **seqNum** Used to track the absolute order of uploaded events.
+- **tags** A header for semi-managed extensions.
+- **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format.
+- **ver** Represents the major and minor version of the extension.
+
+
+### Common Data Extensions.os
+
+Describes some properties of the operating system.
+
+The following fields are available:
+
+- **bootId** An integer value that represents the boot session. This value starts at 0 on first boot after OS install and increments after every reboot.
+- **expId** Represents the experiment ID. The standard for associating a flight, such as an OS flight (pre-release build), or an experiment, such as a web site UX experiment, with an event is to record the flight / experiment IDs in Part A of the common schema.
+- **locale** Represents the locale of the operating system.
+
+
+### Common Data Extensions.user
+
+Describes the fields related to a user.
+
+The following fields are available:
+
+- **authId** This is an ID of the user associated with this event that is deduced from a token such as a Microsoft Account ticket or an XBOX token.
+- **localId** Represents a unique user identity that is created locally and added by the client. This is not the user's account ID.
+
+
+### Common Data Extensions.utc
+
+Describes the properties that could be populated by a logging library on Windows.
+
+The following fields are available:
+
+- **aId** Represents the ETW ActivityId. Logged via TraceLogging or directly via ETW.
+- **bSeq** Upload buffer sequence number in the format: buffer identifier:sequence number
+- **cat** Represents a bitmask of the ETW Keywords associated with the event.
+- **cpId** The composer ID, such as Reference, Desktop, Phone, Holographic, Hub, IoT Composer.
+- **flags** Represents the bitmap that captures various Windows specific flags.
+- **mon** Combined monitor and event sequence numbers in the format: monitor sequence : event sequence
+- **op** Represents the ETW Op Code.
+- **raId** Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW.
+- **sqmId** The Windows SQM ID.
+- **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID.
+- **tickets** An array of strings that refer back to a key in the X-Tickets http header that the client uploaded along with a batch of events.
+
+
+### Common Data Extensions.xbl
+
+Describes the fields that are related to XBOX Live.
+
+The following fields are available:
+
+- **claims** Any additional claims whose short claim name hasn't been added to this structure.
+- **did** XBOX device ID
+- **dty** XBOX device type
+- **dvr** The version of the operating system on the device.
+- **eid** A unique ID that represents the developer entity.
+- **exp** Expiration time
+- **ip** The IP address of the client device.
+- **nbf** Not before time
+- **pid** A comma separated list of PUIDs listed as base10 numbers.
+- **sbx** XBOX sandbox identifier
+- **sid** The service instance ID.
+- **sty** The service type.
+- **tid** The XBOX Live title ID.
+- **tvr** The XBOX Live title version.
+- **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts.
+- **xid** A list of base10-encoded XBOX User IDs.
+
+
+## Common data fields
+
+### Ms.Device.DeviceInventoryChange
+
+Describes the installation state for all hardware and software components available on a particular device.
+
+The following fields are available:
+
+- **action** The change that was invoked on a device inventory object.
+- **inventoryId** Device ID used for Compatibility testing
+- **objectInstanceId** Object identity which is unique within the device scope.
+- **objectType** Indicates the object type that the event applies to.
+- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object.
-- **AvailableSecurityProperties** Enumerates and reports state on the relevant security properties for Device Guard.
-- **CGRunning** Is Credential Guard running?
-- **DGState** A summary of the Device Guard state.
-- **HVCIRunning** Is HVCI running?
-- **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security.
-- **SecureBootCapable** Is this device capable of running Secure Boot?
-- **VBSState** Is virtualization-based security enabled, disabled, or running?
## Diagnostic data events
### TelClientSynthetic.AuthorizationInfo_RuntimeTransition
-This event sends data indicating that a device has undergone a change of diagnostic data opt-in level during the runtime of the device (not at UTC boot or offline), to help keep Windows up to date.
+This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect.
The following fields are available:
-- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto diagnostic data from the OS provider groups.
-- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS diagnostic data. Non-OS diagnostic data is responsible for providing its own opt-in mechanism.
+- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto telemetry from the OS provider groups.
+- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS telemetry. Non-OS telemetry is responsible for providing its own opt-in mechanism.
- **CanCollectCoreTelemetry** True if UTC is allowed to collect data which is tagged with both MICROSOFT_KEYWORD_CRITICAL_DATA and MICROSOFT_EVENTTAG_CORE_DATA.
- **CanCollectHeartbeats** True if UTC is allowed to collect heartbeats.
-- **CanCollectOsTelemetry** True if UTC is allowed to collect diagnostic data from the OS provider groups.
+- **CanCollectOsTelemetry** True if UTC is allowed to collect telemetry from the OS provider groups (often called Microsoft Telemetry).
- **CanPerformDiagnosticEscalations** True if UTC is allowed to perform all scenario escalations.
- **CanPerformScripting** True if UTC is allowed to perform scripting.
- **CanPerformTraceEscalations** True if UTC is allowed to perform scenario escalations with tracing actions.
- **CanReportScenarios** True if UTC is allowed to load and report scenario completion, failure, and cancellation events.
-- **TransitionFromEverythingOff** True if this transition is moving from not allowing core diagnostic data to allowing core diagnostic data.
-- **PreviousPermissions** Bitmask representing the previously configured permissions since the diagnostic data opt-in level was last changed.
+- **PreviousPermissions** Bitmask representing the previously configured permissions since the telemetry opt-in level was last changed.
+- **TransitionFromEverythingOff** True if this transition is moving from not allowing core telemetry to allowing core telemetry.
### TelClientSynthetic.AuthorizationInfo_Startup
-This event sends data indicating that a device has undergone a change of diagnostic data opt-in level detected at UTC startup, to help keep Windows up to date.
+This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect.
The following fields are available:
-- **TransitionFromEverythingOff** True if this transition is moving from not allowing core diagnostic data to allowing core diagnostic data.
-- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS diagnostic data. Non-OS diagnostic data is responsible for providing its own opt-in mechanism.
-- **CanCollectHeartbeats** True if UTC is allowed to collect heartbeats.
+- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto telemetry from the OS provider groups.
+- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS telemetry. Non-OS telemetry is responsible for providing its own opt-in mechanism.
- **CanCollectCoreTelemetry** True if UTC is allowed to collect data which is tagged with both MICROSOFT_KEYWORD_CRITICAL_DATA and MICROSOFT_EVENTTAG_CORE_DATA.
-- **CanCollectOsTelemetry** True if UTC is allowed to collect diagnostic data from the OS provider groups.
-- **CanReportScenarios** True if UTC is allowed to load and report scenario completion, failure, and cancellation events.
-- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto diagnostic data from the OS provider groups.
-- **CanPerformTraceEscalations** True if UTC is allowed to perform scenario escalations with tracing actions.
+- **CanCollectHeartbeats** True if UTC is allowed to collect heartbeats.
+- **CanCollectOsTelemetry** True if UTC is allowed to collect telemetry from the OS provider groups (often called Microsoft Telemetry).
- **CanPerformDiagnosticEscalations** True if UTC is allowed to perform all scenario escalations.
- **CanPerformScripting** True if UTC is allowed to perform scripting.
-- **PreviousPermissions** Bitmask representing the previously configured permissions since the diagnostic data client was last started.
+- **CanPerformTraceEscalations** True if UTC is allowed to perform scenario escalations with tracing actions.
+- **CanReportScenarios** True if UTC is allowed to load and report scenario completion, failure, and cancellation events.
+- **PreviousPermissions** Bitmask representing the previously configured permissions since the telemetry client was last started.
+- **TransitionFromEverythingOff** True if this transition is moving from not allowing core telemetry to allowing core telemetry.
### TelClientSynthetic.ConnectivityHeartBeat_0
-This event sends data about the connectivity status of the Connected User Experiences and Telemetry component that uploads diagnostic data events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network.
+This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network.
The following fields are available:
@@ -1857,10 +1800,10 @@ The following fields are available:
- **CensusStartTime** Returns timestamp corresponding to last successful census run.
- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine.
- **LastConnectivityLossTime** Retrieves the last time the device lost free network.
+- **LastConntectivityLossTime** Retrieves the last time the device lost free network.
- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network.
- **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds.
- **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds.
-- **LastConntectivityLossTime** Retrieves the last time the device lost free network.
### TelClientSynthetic.HeartBeat_5
@@ -1869,51 +1812,41 @@ This event sends data about the health and quality of the diagnostic data from t
The following fields are available:
-- **PreviousHeartBeatTime** The time of last heartbeat event. This allows chaining of events.
-- **EtwDroppedCount** The number of events dropped by the ETW layer of the diagnostic data client.
-- **ConsumerDroppedCount** The number of events dropped by the consumer layer of the diagnostic data client.
-- **DecodingDroppedCount** The number of events dropped because of decoding failures.
-- **ThrottledDroppedCount** The number of events dropped due to throttling of noisy providers.
-- **DbDroppedCount** The number of events that were dropped because the database was full.
-- **EventSubStoreResetCounter** The number of times the event database was reset.
-- **EventSubStoreResetSizeSum** The total size of the event database across all resets reports in this instance.
-- **CriticalOverflowEntersCounter** The number of times a critical overflow mode was entered into the event database.
-- **EnteringCriticalOverflowDroppedCounter** The number of events that was dropped because a critical overflow mode was initiated.
-- **UploaderDroppedCount** The number of events dropped by the uploader layer of the diagnostic data client.
-- **InvalidHttpCodeCount** The number of invalid HTTP codes received from Vortex.
-- **LastInvalidHttpCode** The last invalid HTTP code received from Vortex.
-- **MaxInUseScenarioCounter** The soft maximum number of scenarios loaded by the Connected User Experiences and Telemetry component.
-- **LastEventSizeOffender** The name of the last event that exceeded the maximum event size.
-- **SettingsHttpAttempts** The number of attempts to contact the OneSettings service.
-- **SettingsHttpFailures** The number of failures from contacting the OneSettings service.
-- **VortexHttpAttempts** The number of attempts to contact the Vortex service.
-- **EventsUploaded** The number of events that have been uploaded.
-- **DbCriticalDroppedCount** The total number of dropped critical events in the event database.
-- **VortexHttpFailures4xx** The number of 400-499 error codes received from Vortex.
-- **VortexHttpFailures5xx** The number of 500-599 error codes received from Vortex.
-- **VortexFailuresTimeout** The number of timeout failures received from Vortex.
-- **HeartBeatSequenceNumber** A monotonically increasing heartbeat counter.
-- **EtwDroppedBufferCount** The number of buffers dropped in the CUET ETW session.
-- **FullTriggerBufferDroppedCount** The number of events that were dropped because the trigger buffer was full.
-- **CriticalDataThrottleDroppedCount** The number of critical data sampled events that were dropped because of throttling.
-- **CriticalDataDbDroppedCount** The number of critical data sampled events that were dropped at the database layer.
-- **MaxActiveAgentConnectionCount** The maximum number of active agents during this heartbeat timeframe.
- **AgentConnectionErrorsCount** The number of non-timeout errors associated with the host/agent channel.
-- **LastAgentConnectionError** The last non-timeout error that happened in the host/agent channel.
-- **Flags** Flags that indicate device state, such as network, battery, and opt-in state.
-- **CensusTaskEnabled** Indicates whether Census is enabled.
- **CensusExitCode** The last exit code of the Census task.
- **CensusStartTime** The time of the last Census run.
-
-
-### TelClientSynthetic.PrivacySettingsAfterCreatorsUpdate
-
-This event sends basic data on privacy settings before and after a feature update. This is used to ensure that customer privacy settings are correctly migrated across feature updates.
-
-The following fields are available:
-
-- **PostUpgradeSettings** The privacy settings after a feature update.
-- **PreUpgradeSettings** The privacy settings before a feature update.
+- **CensusTaskEnabled** Indicates whether Census is enabled.
+- **ConsumerDroppedCount** The number of events dropped by the consumer layer of the telemetry client.
+- **CriticalDataDbDroppedCount** The number of critical data sampled events that were dropped at the database layer.
+- **CriticalDataThrottleDroppedCount** The number of critical data sampled events that were dropped because of throttling.
+- **CriticalOverflowEntersCounter** The number of times a critical overflow mode was entered into the event database.
+- **DbCriticalDroppedCount** The total number of dropped critical events in the event database.
+- **DbDroppedCount** The number of events that were dropped because the database was full.
+- **DecodingDroppedCount** The number of events dropped because of decoding failures.
+- **EnteringCriticalOverflowDroppedCounter** The number of events that was dropped because a critical overflow mode was initiated.
+- **EtwDroppedBufferCount** The number of buffers dropped in the CUET ETW session.
+- **EtwDroppedCount** The number of events dropped by the ETW layer of the telemetry client.
+- **EventSubStoreResetCounter** The number of times the event database was reset.
+- **EventSubStoreResetSizeSum** The total size of the event database across all resets reports in this instance.
+- **EventsUploaded** The number of events that have been uploaded.
+- **Flags** Flags that indicate device state, such as network, battery, and opt-in state.
+- **FullTriggerBufferDroppedCount** The number of events that were dropped because the trigger buffer was full.
+- **HeartBeatSequenceNumber** A monotonically increasing heartbeat counter.
+- **InvalidHttpCodeCount** The number of invalid HTTP codes received from Vortex.
+- **LastAgentConnectionError** The last non-timeout error that happened in the host/agent channel.
+- **LastEventSizeOffender** The name of the last event that exceeded the maximum event size.
+- **LastInvalidHttpCode** The last invalid HTTP code received from Vortex.
+- **MaxActiveAgentConnectionCount** The maximum number of active agents during this heartbeat timeframe.
+- **MaxInUseScenarioCounter** The soft maximum number of scenarios loaded by the Connected User Experience and Telemetry component.
+- **PreviousHeartBeatTime** The time of last heartbeat event. This allows chaining of events.
+- **SettingsHttpAttempts** The number of attempts to contact the OneSettings service.
+- **SettingsHttpFailures** The number of failures from contacting the OneSettings service.
+- **ThrottledDroppedCount** The number of events dropped due to throttling of noisy providers.
+- **UploaderDroppedCount** The number of events dropped by the uploader layer of the telemetry client.
+- **VortexFailuresTimeout** The number of timeout failures received from Vortex.
+- **VortexHttpAttempts** The number of attempts to contact the Vortex service.
+- **VortexHttpFailures4xx** The number of 400-499 error codes received from Vortex.
+- **VortexHttpFailures5xx** The number of 500-599 error codes received from Vortex.
## DxgKernelTelemetry events
@@ -1924,72 +1857,80 @@ This event sends basic GPU and display driver information to keep Windows and di
The following fields are available:
-- **version** The event version.
-- **bootId** The system boot ID.
- **aiSeqId** The event sequence ID.
-- **MeasureEnabled** Is the device listening to MICROSOFT_KEYWORD_MEASURES?
-- **TelemetryEnabled** Is the device listening to MICROSOFT_KEYWORD_TELEMETRY?
-- **InterfaceId** The GPU interface ID.
-- **GPUVendorID** The GPU vendor ID.
-- **GPUDeviceID** The GPU device ID.
-- **SubVendorID** The GPU sub vendor ID.
-- **SubSystemID** The subsystem ID.
-- **GPURevisionID** The GPU revision ID.
-- **DriverVersion** The display driver version.
+- **bootId** The system boot ID.
+- **ComputePreemptionLevel** The maximum preemption level supported by GPU for compute payload.
+- **DedicatedSystemMemoryB** The amount of system memory dedicated for GPU use (in bytes).
+- **DedicatedVideoMemoryB** The amount of dedicated VRAM of the GPU (in bytes).
+- **DisplayAdapterLuid** The display adapter LUID.
- **DriverDate** The date of the display driver.
- **DriverRank** The rank of the display driver.
-- **IsMiracastSupported** Does the GPU support Miracast?
-- **IsMsMiracastSupported** Are the GPU Miracast capabilities driven by a Microsoft solution?
+- **DriverVersion** The display driver version.
+- **GPUDeviceID** The GPU device ID.
+- **GPUPreemptionLevel** The maximum preemption level supported by GPU for graphics payload.
+- **GPURevisionID** The GPU revision ID.
+- **GPUVendorID** The GPU vendor ID.
+- **InterfaceId** The GPU interface ID.
+- **IsDisplayDevice** Does the GPU have displaying capabilities?
- **IsHybridDiscrete** Does the GPU have discrete GPU capabilities in a hybrid device?
- **IsHybridIntegrated** Does the GPU have integrated GPU capabilities in a hybrid device?
-- **IsMPOSupported** Does the GPU support Multi-Plane Overlays?
- **IsLDA** Is the GPU comprised of Linked Display Adapters?
+- **IsMiracastSupported** Does the GPU support Miracast?
- **IsMismatchLDA** Is at least one device in the Linked Display Adapters chain from a different vendor?
+- **IsMPOSupported** Does the GPU support Multi-Plane Overlays?
+- **IsMsMiracastSupported** Are the GPU Miracast capabilities driven by a Microsoft solution?
- **IsPostAdapter** Is this GPU the POST GPU in the device?
-- **IsSoftwareDevice** Is this a software implementation of the GPU?
- **IsRenderDevice** Does the GPU have rendering capabilities?
-- **IsDisplayDevice** Does the GPU have displaying capabilities?
-- **WDDMVersion** The Windows Display Driver Model version.
-- **DisplayAdapterLuid** The display adapter LUID.
-- **GPUPreemptionLevel** The maximum preemption level supported by GPU for graphics payload.
-- **ComputePreemptionLevel** The maximum preemption level supported by GPU for compute payload.
-- **TelInvEvntTrigger** What triggered this event to be logged? Example: 0 (GPU enumeration) or 1 (DxgKrnlTelemetry provider toggling)
-- **DedicatedVideoMemoryB** The amount of dedicated VRAM of the GPU (in bytes).
-- **DedicatedSystemMemoryB** The amount of system memory dedicated for GPU use (in bytes).
-- **SharedSystemMemoryB** The amount of system memory shared by GPU and CPU (in bytes).
+- **IsSoftwareDevice** Is this a software implementation of the GPU?
+- **MeasureEnabled** Is the device listening to MICROSOFT_KEYWORD_MEASURES?
- **NumVidPnSources** The number of supported display output sources.
- **NumVidPnTargets** The number of supported display output targets.
+- **SharedSystemMemoryB** The amount of system memory shared by GPU and CPU (in bytes).
+- **SubSystemID** The subsystem ID.
+- **SubVendorID** The GPU sub vendor ID.
+- **TelemetryEnabled** Is the device listening to MICROSOFT_KEYWORD_TELEMETRY?
+- **TelInvEvntTrigger** What triggered this event to be logged? Example: 0 (GPU enumeration) or 1 (DxgKrnlTelemetry provider toggling)
+- **version** The event version.
+- **WDDMVersion** The Windows Display Driver Model version.
## Fault Reporting events
### Microsoft.Windows.FaultReporting.AppCrashEvent
-This event sends data about crashes for both native and managed applications, to help keep Windows up to date. The data includes information about the crashing process and a summary of its exception record. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the crash to the Watson service, and the WER event will contain the same ReportID (see field 14 of crash event, field 19 of WER event) as the crash event for the crash being reported. AppCrash is emitted once for each crash handled by WER (e.g. from an unhandled exception or FailFast or ReportException). Note that Generic Watson event types (e.g. from PLM) that may be considered crashes" by a user DO NOT emit this event.
+This event sends data about crashes for both native and managed applications, to help keep Windows up to date. The data includes information about the crashing process and a summary of its exception record. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the crash to the Watson service, and the WER event will contain the same ReportID (see field 14 of crash event, field 19 of WER event) as the crash event for the crash being reported. AppCrash is emitted once for each crash handled by WER (e.g. from an unhandled exception or FailFast or ReportException). Note that Generic Watson event types (e.g. from PLM) that may be considered crashes\" by a user DO NOT emit this event.
The following fields are available:
-- **ProcessId** The ID of the process that has crashed.
-- **ProcessCreateTime** The time of creation of the process that has crashed.
+- **AppName** The name of the app that has crashed.
+- **AppSessionGuid** GUID made up of process ID and is used as a correlation vector for process instances in the telemetry backend.
+- **AppTimeStamp** The date/time stamp of the app.
+- **AppVersion** The version of the app that has crashed.
- **ExceptionCode** The exception code returned by the process that has crashed.
- **ExceptionOffset** The address where the exception had occurred.
-- **AppName** The name of the app that has crashed.
-- **AppVersion** The version of the app that has crashed.
-- **AppTimeStamp** The date/time stamp of the app.
+- **Flags** Flags indicating how reporting is done. For example, queue the report, do not offer JIT debugging, or do not terminate the process after reporting.
- **ModName** Exception module name (e.g. bar.dll).
-- **ModVersion** The version of the module that has crashed.
- **ModTimeStamp** The date/time stamp of the module.
+- **ModVersion** The version of the module that has crashed.
- **PackageFullName** Store application identity.
- **PackageRelativeAppId** Store application identity.
- **ProcessArchitecture** Architecture of the crashing process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64.
+- **ProcessCreateTime** The time of creation of the process that has crashed.
+- **ProcessId** The ID of the process that has crashed.
- **ReportId** A GUID used to identify the report. This can used to track the report across Watson.
-- **Flags** Flags indicating how reporting is done. For example, queue the report, do not offer JIT debugging, or do not terminate the process after reporting.
-- **AppSessionGuid** GUID made up of process ID and is used as a correlation vector for process instances in the diagnostic data backend.
- **TargetAppId** The kernel reported AppId of the application being reported.
- **TargetAppVer** The specific version of the application being reported
- **TargetAsId** The sequence number for the hanging process.
+## Feature update events
+
+### Microsoft.Windows.Upgrade.Uninstall.UninstallGoBackButtonClicked
+
+This event sends basic metadata about the starting point of uninstalling a feature update, which helps ensure customers can safely revert to a well-known state if the update caused any problems.
+
+
+
## Hang Reporting events
### Microsoft.Windows.HangReporting.AppHangEvent
@@ -1999,52 +1940,110 @@ This event sends data about hangs for both native and managed applications, to h
The following fields are available:
- **AppName** The name of the app that has hung.
-- **TypeCode** Bitmap describing the hang type.
-- **ProcessId** The ID of the process that has hung.
-- **UTCReplace_TargetAppId** The kernel reported AppId of the application being reported.
-- **ProcessCreateTime** The time of creation of the process that has hung.
-- **UTCReplace_TargetAppVer** The specific version of the application being reported.
-- **WaitingOnAppName** If this is a cross process hang waiting for an application, this has the name of the application.
+- **AppSessionGuid** GUID made up of process id used as a correlation vector for process instances in the telemetry backend.
+- **AppVersion** The version of the app that has hung.
+- **PackageFullName** Store application identity.
- **PackageRelativeAppId** Store application identity.
- **ProcessArchitecture** Architecture of the hung process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64.
-- **WaitingOnPackageRelativeAppId** If this is a cross process hang waiting for a package, this has the relative application id of the package.
-- **WaitingOnAppVersion** If this is a cross process hang, this has the version of the application for which it is waiting.
-- **AppSessionGuid** GUID made up of process id used as a correlation vector for process instances in the diagnostic data backend.
-- **WaitingOnPackageFullName** If this is a cross process hang waiting for a package, this has the full name of the package for which it is waiting.
-- **PackageFullName** Store application identity.
-- **AppVersion** The version of the app that has hung.
+- **ProcessCreateTime** The time of creation of the process that has hung.
+- **ProcessId** The ID of the process that has hung.
- **ReportId** A GUID used to identify the report. This can used to track the report across Watson.
- **TargetAppId** The kernel reported AppId of the application being reported.
- **TargetAppVer** The specific version of the application being reported.
- **TargetAsId** The sequence number for the hanging process.
+- **TypeCode** Bitmap describing the hang type.
+- **WaitingOnAppName** If this is a cross process hang waiting for an application, this has the name of the application.
+- **WaitingOnAppVersion** If this is a cross process hang, this has the version of the application for which it is waiting.
+- **WaitingOnPackageFullName** If this is a cross process hang waiting for a package, this has the full name of the package for which it is waiting.
+- **WaitingOnPackageRelativeAppId** If this is a cross process hang waiting for a package, this has the relative application id of the package.
## Inventory events
+### ChecksumDictionary
+
+The list of values sent by each object type.
+
+The following fields are available:
+
+- **Key** The object type being described.
+- **Value** The number of objects of this type that were sent.
+
+
+### COMPID
+
+This event provides a device's internal application compatible ID, a vendor-defined identification that Windows uses to match a device to an INF file. A device can have a list of compatible IDs associated with it.
+
+The following fields are available:
+
+- **Order** The index of the array of compatible IDs for the device.
+- **Value** The array of compatible IDs for the device.
+
+
+### HWID
+
+This event provides a device's internal hardware ID, a vendor-defined identification that Windows uses to match a device to an INF file. In most cases, a device has associated with it a list of hardware IDs.
+
+The following fields are available:
+
+- **Order** The index of the array of internal hardware IDs for the device.
+- **Value** The array of internal hardware IDs for the device.
+
+
+### InstallDateArpLastModified
+
+This event indicates the date the add/remove program (ARP) entry was last modified by an update.
+
+The following fields are available:
+
+- **Order** The index of the ordered array.
+- **Value** The value contained in the ordered array.
+
+
+### InstallDateFromLinkFile
+
+This event provides the application installation date from the linked file.
+
+The following fields are available:
+
+- **Order** The index of the ordered array.
+- **Value** The value contained in the ordered array.
+
+
+### InstallDateMsi
+
+The install date from the Microsoft installer (MSI) database.
+
+The following fields are available:
+
+- **Order** The index of the ordered array.
+- **Value** The value contained in the ordered array.
+
+
### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum
This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object.
The following fields are available:
-- **Device** A count of device objects in cache
-- **DeviceCensus** A count of devicecensus objects in cache
-- **DriverPackageExtended** A count of driverpackageextended objects in cache
-- **File** A count of file objects in cache
-- **Generic** A count of generic objects in cache
-- **HwItem** A count of hwitem objects in cache
-- **InventoryApplication** A count of application objects in cache
-- **InventoryApplicationFile** A count of application file objects in cache
-- **InventoryDeviceContainer** A count of device container objects in cache
-- **InventoryDeviceMediaClass** A count of device media objects in cache
-- **InventoryDevicePnp** A count of devicepnp objects in cache
-- **InventoryDriverBinary** A count of driver binary objects in cache
-- **InventoryDriverPackage** A count of device objects in cache
-- **Metadata** A count of metadata objects in cache
-- **Orphan** A count of orphan file objects in cache
-- **Programs** A count of program objects in cache
-- **FileSigningInfo** A count of file signing info objects in cache.
-- **InventoryDeviceInterface** A count of inventory device interface objects in cache.
+- **Device** A count of device objects in cache.
+- **DeviceCensus** A count of devicecensus objects in cache.
+- **DriverPackageExtended** A count of driverpackageextended objects in cache.
+- **File** A count of file objects in cache.
+- **FileSigningInfo** A count of file signing objects in cache.
+- **Generic** A count of generic objects in cache.
+- **HwItem** A count of hwitem objects in cache.
+- **InventoryApplication** A count of application objects in cache.
+- **InventoryApplicationFile** A count of application file objects in cache.
+- **InventoryDeviceContainer** A count of device container objects in cache.
+- **InventoryDeviceInterface** A count of Plug and Play device interface objects in cache.
+- **InventoryDeviceMediaClass** A count of device media objects in cache.
+- **InventoryDevicePnp** A count of device Plug and Play objects in cache.
+- **InventoryDriverBinary** A count of driver binary objects in cache.
+- **InventoryDriverPackage** A count of device objects in cache.
+- **Metadata** A count of metadata objects in cache.
+- **Orphan** A count of orphan file objects in cache.
+- **Programs** A count of program objects in cache.
### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions
@@ -2054,62 +2053,48 @@ This event sends inventory component versions for the Device Inventory data.
The following fields are available:
- **aeinv** The version of the App inventory component.
+- **aeinv.dll** The version of the App inventory component.
- **devinv** The file version of the Device inventory component.
+- **devinv.dll** The file version of the Device inventory component.
-### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync
-This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events
--
-### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd
-
-This event sends basic metadata about the USB hubs on the device
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events
-- **TotalUserConnectablePorts** Total number of connectable USB ports
-- **TotalUserConnectableTypeCPorts** Total number of connectable USB Type C ports
--
### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd
This event sends basic metadata about an application on the system to help keep Windows up to date.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **ProgramInstanceId** A hash of the file IDs in an app.
-- **Name** The name of the application. Location pulled from depends on 'Source' field.
-- **Type** One of ("Application", "Hotfix", "BOE", "Service", "Unknown"). Application indicates Win32 or Appx app, Hotfix indicates app updates (KBs), BOE indicates it's an app with no ARP or MSI entry, Service indicates that it is a service. Application and BOE are the ones most likely seen.
-- **Publisher** The Publisher of the application. Location pulled from depends on the 'Source' field.
-- **Version** The version number of the program.
-- **Language** The language code of the program.
-- **Source** How the program was installed (ARP, MSI, Appx, etc...)
-- **MsiProductCode** A GUID that describe the MSI Product.
-- **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage.
- **HiddenArp** Indicates whether a program hides itself from showing up in ARP.
-- **OSVersionAtInstallTime** The four octets from the OS version at the time of the application's install.
-- **RootDirPath** The path to the root directory where the program was installed.
-- **InstallDate** The date the application was installed (a best guess based on folder creation date heuristics)
-- **InstallDateMsi** The install date if the application was installed via MSI. Passed as an array.
-- **InstallDateFromLinkFile** The estimated date of install based on the links to the files. Passed as an array.
-- **InstallDateArpLastModified** The date of the registry ARP key for a given application. Hints at install date but not always accurate. Passed as an array.
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **objectInstanceId** ProgramId (a hash of Name, Version, Publisher, and Language of an application used to identify it).
-- **PackageFullName** The package full name for a Store application.
+- **InstallDate** The date the application was installed (a best guess based on folder creation date heuristics).
+- **InstallDateArpLastModified** The date of the registry ARP key for a given application. Hints at install date but not always accurate. Passed as an array. Example: 4/11/2015 00:00:00 See [InstallDateArpLastModified](#installdatearplastmodified).
+- **InstallDateFromLinkFile** The estimated date of install based on the links to the files. Passed as an array. See [InstallDateFromLinkFile](#installdatefromlinkfile).
+- **InstallDateMsi** The install date if the application was installed via Microsoft Installer (MSI). Passed as an array. See [InstallDateMsi](#installdatemsi).
- **InventoryVersion** The version of the inventory file generating the events.
+- **Language** The language code of the program.
+- **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage.
+- **MsiProductCode** A GUID that describe the MSI Product.
+- **Name** The name of the application.
+- **OSVersionAtInstallTime** The four octets from the OS version at the time of the application's install.
+- **PackageFullName** The package full name for a Store application.
+- **ProgramInstanceId** A hash of the file IDs in an app.
+- **Publisher** The Publisher of the application. Location pulled from depends on the 'Source' field.
+- **RootDirPath** The path to the root directory where the program was installed.
+- **Source** How the program was installed (for example, ARP, MSI, Appx).
- **StoreAppType** A sub-classification for the type of Microsoft Store app, such as UWP or Win8StoreApp.
+- **Type** One of ("Application", "Hotfix", "BOE", "Service", "Unknown"). Application indicates Win32 or Appx app, Hotfix indicates app updates (KBs), BOE indicates it's an app with no ARP or MSI entry, Service indicates that it is a service. Application and BOE are the ones most likely seen.
+- **Version** The version number of the program.
### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove
This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2117,43 +2102,45 @@ The following fields are available:
This event indicates that a new set of InventoryApplicationAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
- **InventoryVersion** The version of the inventory file generating the events.
### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd
-This event sends basic metadata about a device container (such as a monitor or printer as opposed to a PNP device) to help keep Windows up-to-date.
+This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **ModelName** The model name.
-- **ModelId** A model GUID.
-- **PrimaryCategory** The primary category for the device container.
- **Categories** A comma separated list of functional categories in which the container belongs.
-- **IsConnected** For a physically attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link.
-- **IsActive** Is the device connected, or has it been seen in the last 14 days?
-- **IsPaired** Does the device container require pairing?
-- **IsNetworked** Is this a networked device?
-- **IsMachineContainer** Is the container the root device itself?
-- **FriendlyName** The name of the device container.
- **DiscoveryMethod** The discovery method for the device container.
-- **ModelNumber** The model number for the device container.
-- **Manufacturer** The manufacturer name for the device container.
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **objectInstanceId** ContainerId
+- **FriendlyName** The name of the device container.
- **InventoryVersion** The version of the inventory file generating the events.
+- **IsActive** Is the device connected, or has it been seen in the last 14 days?
+- **IsConnected** For a physically attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link.
+- **IsMachineContainer** Is the container the root device itself?
+- **IsNetworked** Is this a networked device?
+- **IsPaired** Does the device container require pairing?
+- **Manufacturer** The manufacturer name for the device container.
+- **ModelId** A unique model ID.
+- **ModelName** The model name.
+- **ModelNumber** The model number for the device container.
+- **PrimaryCategory** The primary category for the device container.
### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove
This event indicates that the InventoryDeviceContainer object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2161,9 +2148,10 @@ The following fields are available:
This event indicates that a new set of InventoryDeviceContainerAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2171,9 +2159,10 @@ The following fields are available:
This event retrieves information about what sensor interfaces are available on the device.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **InventoryVersion** The version of the inventory file generating the events.
- **Accelerometer3D** Indicates if an Accelerator3D sensor is found.
- **ActivityDetection** Indicates if an Activity Detection sensor is found.
- **AmbientLight** Indicates if an Ambient Light sensor is found.
@@ -2184,6 +2173,7 @@ The following fields are available:
- **GravityVector** Indicates if a Gravity Detector sensor is found.
- **Gyrometer3D** Indicates if a Gyrometer3D sensor is found.
- **Humidity** Indicates if a Humidity sensor is found.
+- **InventoryVersion** The version of the inventory file generating the events.
- **LinearAccelerometer** Indicates if a Linear Accelerometer sensor is found.
- **Magnetometer3D** Indicates if a Magnetometer3D sensor is found.
- **Orientation** Indicates if an Orientation sensor is found.
@@ -2192,13 +2182,14 @@ The following fields are available:
- **RelativeOrientation** Indicates if a Relative Orientation sensor is found.
- **SimpleDeviceOrientation** Indicates if a Simple Device Orientation sensor is found.
- **Temperature** Indicates if a Temperature sensor is found.
-- **EnergyMeter** Indicates if an Energy sensor is found.
### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync
This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2206,23 +2197,25 @@ The following fields are available:
### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd
-This event sends additional metadata about a PNP device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload.
+This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
- **Audio_CaptureDriver** The Audio device capture driver endpoint.
- **Audio_RenderDriver** The Audio device render driver endpoint.
+- **InventoryVersion** The version of the inventory file generating the events.
### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove
This event indicates that the InventoryDeviceMediaClassRemove object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2230,56 +2223,58 @@ The following fields are available:
This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
- **InventoryVersion** The version of the inventory file generating the events.
### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd
-This event sends basic metadata about a PNP device and its associated driver to help keep Windows up-to-date.
+This event represents the basic metadata about a plug and play (PNP) device and its associated driver.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **HWID** A JSON array that provides the value and order of the HWID tree for the device.
-- **COMPID** A JSON array the provides the value and order of the compatible ID tree for the device.
-- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx
-- **Enumerator** The bus that enumerated the device.
+- **Class** The device setup class of the driver loaded for the device
+- **ClassGuid** The device class GUID from the driver package
+- **COMPID** A JSON array the provides the value and order of the compatible ID tree for the device. See [COMPID](#compid).
- **ContainerId** A system-supplied GUID that uniquely groups the functional devices associated with a single-function or multifunction device installed in the device.
-- **DeviceState** DeviceState is a bitmask of the following: DEVICE_IS_CONNECTED 0x0001 (currently only for container). DEVICE_IS_NETWORK_DEVICE 0x0002 (currently only for container). DEVICE_IS_PAIRED 0x0004 (currently only for container). DEVICE_IS_ACTIVE 0x0008 (currently never set). DEVICE_IS_MACHINE 0x0010 (currently only for container). DEVICE_IS_PRESENT 0x0020 (currently always set). DEVICE_IS_HIDDEN 0x0040. DEVICE_IS_PRINTER 0x0080 (currently only for container). DEVICE_IS_WIRELESS 0x0100. DEVICE_IS_WIRELESS_FAT 0x0200. The most common values are therefore: 32 (0x20)= device is present. 96 (0x60)= device is present but hidden. 288 (0x120)= device is a wireless device that is present.
-- **ParentId** Device instance id of the parent of the device.
-- **STACKID** A JSON array that provides the value and order of the STACKID tree for the device.
-- **Description** The device description.
-- **MatchingID** Represents the hardware ID or compatible ID that Windows uses to install a device instance.
-- **Class** The device setup class of the driver loaded for the device.
-- **ClassGuid** The device setup class guid of the driver loaded for the device.
-- **Manufacturer** The device manufacturer.
-- **Model** The device model.
-- **Inf** The INF file name.
-- **DriverVerVersion** The version of the driver loaded for the device.
-- **DriverVerDate** The date of the driver loaded for the device.
-- **Provider** The device provider.
-- **DriverPackageStrongName** The immediate parent directory name in the Directory field of InventoryDriverPackage.
-- **Service** The device service name.
-- **LowerClassFilters** Lower filter class drivers IDs installed for the device.
-- **LowerFilters** Lower filter drivers IDs installed for the device.
-- **UpperClassFilters** Upper filter class drivers IDs installed for the device.
-- **UpperFilters** Upper filter drivers IDs installed for the device.
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
+- **Description** The device description
+- **DeviceState** DeviceState is a bitmask of the following: DEVICE_IS_CONNECTED 0x0001 (currently only for container). DEVICE_IS_NETWORK_DEVICE 0x0002 (currently only for container). DEVICE_IS_PAIRED 0x0004 (currently only for container). DEVICE_IS_ACTIVE 0x0008 (currently never set). DEVICE_IS_MACHINE 0x0010 (currently only for container). DEVICE_IS_PRESENT 0x0020 (currently always set). DEVICE_IS_HIDDEN 0x0040. DEVICE_IS_PRINTER 0x0080 (currently only for container). DEVICE_IS_WIRELESS 0x0100. DEVICE_IS_WIRELESS_FAT 0x0200. The most common values are therefore: 32 (0x20)= device is present. 96 (0x60)= device is present but hidden. 288 (0x120)= device is a wireless device that is present
- **DriverId** A unique identifier for the installed device.
- **DriverName** The name of the driver image file.
+- **DriverVerDate** The date of the driver loaded for the device
+- **DriverVerVersion** The version of the driver loaded for the device
+- **Enumerator** The bus that enumerated the device
+- **HWID** A JSON array that provides the value and order of the HWID tree for the device. See [HWID](#hwid).
+- **Inf** The INF file name.
+- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx
- **InventoryVersion** The version of the inventory file generating the events.
+- **LowerClassFilters** Lower filter class drivers IDs installed for the device.
+- **LowerFilters** Lower filter drivers IDs installed for the device
+- **Manufacturer** The device manufacturer
+- **MatchingID** Represents the hardware ID or compatible ID that Windows uses to install a device instance
+- **Model** The device model
+- **ParentId** Device instance id of the parent of the device
- **ProblemCode** The current error code for the device.
+- **Provider** The device provider
+- **Service** The device service name
+- **STACKID** A JSON array that provides the value and order of the STACKID tree for the device. See [STACKID](#stackid).
+- **UpperClassFilters** Upper filter class drivers IDs installed for the device
+- **UpperFilters** Upper filter drivers IDs installed for the device
### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove
This event indicates that the InventoryDevicePnpRemove object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2287,45 +2282,48 @@ The following fields are available:
This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
- **InventoryVersion** The version of the inventory file generating the events.
### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd
-This event sends basic metadata about driver files running on the system to help keep Windows up-to-date.
+This event provides the basic metadata about driver binaries running on the system.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **DriverName** The file name of the driver.
-- **Inf** The name of the INF file.
-- **DriverPackageStrongName** The strong name of the driver package.
-- **DriverCompany** The company name that developed the driver.
- **DriverCheckSum** The checksum of the driver file.
+- **DriverCompany** The company name that developed the driver.
+- **DriverInBox** Is the driver included with the operating system?
+- **DriverIsKernelMode** Is it a kernel mode driver?
+- **DriverName** The file name of the driver.
+- **DriverPackageStrongName** The strong name of the driver package
+- **DriverSigned** The strong name of the driver package
- **DriverTimeStamp** The low 32 bits of the time stamp of the driver file.
- **DriverType** A bitfield of driver attributes: 1. define DRIVER_MAP_DRIVER_TYPE_PRINTER 0x0001. 2. define DRIVER_MAP_DRIVER_TYPE_KERNEL 0x0002. 3. define DRIVER_MAP_DRIVER_TYPE_USER 0x0004. 4. define DRIVER_MAP_DRIVER_IS_SIGNED 0x0008. 5. define DRIVER_MAP_DRIVER_IS_INBOX 0x0010. 6. define DRIVER_MAP_DRIVER_IS_WINQUAL 0x0040. 7. define DRIVER_MAP_DRIVER_IS_SELF_SIGNED 0x0020. 8. define DRIVER_MAP_DRIVER_IS_CI_SIGNED 0x0080. 9. define DRIVER_MAP_DRIVER_HAS_BOOT_SERVICE 0x0100. 10. define DRIVER_MAP_DRIVER_TYPE_I386 0x10000. 11. define DRIVER_MAP_DRIVER_TYPE_IA64 0x20000. 12. define DRIVER_MAP_DRIVER_TYPE_AMD64 0x40000. 13. define DRIVER_MAP_DRIVER_TYPE_ARM 0x100000. 14. define DRIVER_MAP_DRIVER_TYPE_THUMB 0x200000. 15. define DRIVER_MAP_DRIVER_TYPE_ARMNT 0x400000. 16. define DRIVER_MAP_DRIVER_IS_TIME_STAMPED 0x800000.
-- **DriverInBox** Is the driver included with the operating system?
-- **DriverSigned** Is the driver signed?
-- **DriverIsKernelMode** Is it a kernel mode driver?
- **DriverVersion** The version of the driver file.
- **ImageSize** The size of the driver file.
+- **Inf** The name of the INF file.
+- **InventoryVersion** The version of the inventory file generating the events.
- **Product** The product name that is included in the driver file.
- **ProductVersion** The product version that is included in the driver file.
-- **WdfVersion** The Windows Driver Framework version.
- **Service** The name of the service that is installed for the device.
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
+- **WdfVersion** The Windows Driver Framework version.
### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove
This event indicates that the InventoryDriverBinary object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2333,38 +2331,40 @@ The following fields are available:
This event indicates that a new set of InventoryDriverBinaryAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
- **InventoryVersion** The version of the inventory file generating the events.
### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd
-This event sends basic metadata about drive packages installed on the system to help keep Windows up-to-date.
+This event sends basic metadata about drive packages installed on the system to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **Inf** The INF name of the driver package.
-- **ClassGuid** The class GUID for the device driver.
- **Class** The class name for the device driver.
-- **Directory** The path to the driver package.
+- **ClassGuid** The class GUID for the device driver.
- **Date** The driver package date.
-- **Version** The version of the driver package.
+- **Directory** The path to the driver package.
+- **Inf** The INF name of the driver package.
+- **InventoryVersion** The version of the inventory file generating the events.
- **Provider** The provider for the driver package.
- **SubmissionId** The HLK submission ID for the driver package.
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **InventoryVersion** The version of the inventory file generating the events.
-- **DriverInBox** Is the driver included with the operating system?
+- **Version** The version of the driver package.
### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove
This event indicates that the InventoryDriverPackageRemove object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2372,9 +2372,10 @@ The following fields are available:
This event indicates that a new set of InventoryDriverPackageAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2384,187 +2385,83 @@ This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd e
The following fields are available:
-- **ChecksumDictionary** A count of each operating system indicator.
+- **ChecksumDictionary** A count of each operating system indicator. See [ChecksumDictionary](#checksumdictionary).
- **PCFP** Equivalent to the InventoryId field that is found in other core events.
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd
-
-This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions
-
-The following fields are available:
-
-- **Design** Count of files with design issues found
-- **Design_x64** Count of files with 64 bit design issues found
-- **DuplicateVBA** Count of files with duplicate VBA code
-- **HasVBA** Count of files with VBA code
-- **Inaccessible** Count of files that were inaccessible for scanning
-- **Issues** Count of files with issues detected
-- **Issues_x64** Count of files with 64-bit issues detected
-- **IssuesNone** Count of files with no issues detected
-- **IssuesNone_x64** Count of files with no 64-bit issues detected
-- **Locked** Count of files that were locked, preventing scanning
-- **NoVBA** Count of files with no VBA inside
-- **Protected** Count of files that were password protected, preventing scanning
-- **RemLimited** Count of files that require limited remediation changes
-- **RemLimited_x64** Count of files that require limited remediation changes for 64-bit issues
-- **RemSignificant** Count of files that require significant remediation changes
-- **RemSignificant_x64** Count of files that require significant remediation changes for 64-bit issues
-- **Score** Overall compatibility score calculated for scanned content
-- **Score_x64** Overall 64-bit compatibility score calculated for scanned content
-- **Total** Total number of files scanned
-- **Validation** Count of files that require additional manual validation
-- **Validation_x64** Count of files that require additional manual validation for 64-bit issues
-
-### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync
-
-This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events
-
-### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd
-
-This event provides the basic metadata about the frameworks an application may depend on
-
-The following fields are available:
-
-- **FileId** A hash that uniquely identifies a file
-- **Frameworks** The list of frameworks this file depends on
-- **InventoryVersion** The version of the inventory file generating the events
-- **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it
-
### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd
-These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up-to-date.
+These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-- **IndicatorValue** The indicator value
+- **IndicatorValue** The indicator value.
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync
-
-This event indicates that a new sync is being generated for this object type.
-
-There are no fields in this event.
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync
-
-This event indicates that a new sync is being generated for this object type.
-
-There are no fields in this event.
### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove
-This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd, indicating that the item has been removed. There are no additional unique fields in this event.
+This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed.
-The following fields are available:
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync
This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent.
-The following fields are available:
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
-- **PartB_Ms.Device.DeviceInventoryChange** See the Common Data Fields section.
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd
-This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule
+### STACKID
+
+This event provides the internal compatible ID for the stack.
The following fields are available:
-- **Count** Count of total Microsoft Office VBA rule violations
+- **Order** The index of the ordered array.
+- **Value** The value contained in the ordered array.
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
-This event provides data on the installed Office Add-ins.
+## Kernel events
-- **AddInCLSID** The CLSID key office the Office addin.
-- **AddInId** The ID of the Office addin.
-- **BinFileTimestamp** The timestamp of the Office addin.
-- **BinFileVersion** The version of the Office addin.
-- **Description** The description of the Office addin.
-- **FileId** The file ID of the Office addin.
-- **FriendlyName** The friendly name of the Office addin.
-- **FullPath** The full path to the Office addin.
-- **LoadBehavior** A Uint32 that describes the load behavior.
-- **LoadTime** The load time for the Office addin.
-- **OfficeApplication** The OIffice application for this addin.
-- **OfficeArchitecture** The architecture of the addin.
-- **OfficeVersion** The Office version for this addin.
-- **OutlookCrashingAddin** A boolean value that indicates if crashes have been found for this addin.
-- **Provider** The provider name for this addin.
+### IO
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync
+This event indicates the number of bytes read from or read by the OS and written to or written by the OS upon system startup.
-This event indicates that a new sync is being generated for this object type.
+The following fields are available:
-There are no fields in this event.
+- **BytesRead** The total number of bytes read from or read by the OS upon system startup.
+- **BytesWritten** The total number of bytes written to or written by the OS upon system startup.
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd
-This event provides data on the installed Office identifiers.
+### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch
-- **OAudienceData** The Office Audience descriptor.
-- **OAudienceId** The Office Audience ID.
-- **OMID** The Office machine ID.
-- **OPlatform** The Office architecture.
-- **OVersion** The Office version
-- **OTenantId** The Office 365 Tenant GUID.
-- **OWowMID** The Office machine ID.
+This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process.
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync
+The following fields are available:
-This event indicates that a new sync is being generated for this object type.
+- **BootApplicationId** This field tells us what the OS Loader Application Identifier is.
+- **BootAttemptCount** The number of consecutive times the boot manager has attempted to boot into this operating system.
+- **BootSequence** The current Boot ID, used to correlate events related to a particular boot session.
+- **BootStatusPolicy** Identifies the applicable Boot Status Policy.
+- **BootType** Identifies the type of boot (e.g.: "Cold", "Hiber", "Resume").
+- **EventTimestamp** Seconds elapsed since an arbitrary time point. This can be used to identify the time difference in successive boot attempts being made.
+- **FirmwareResetReasonEmbeddedController** Reason for system reset provided by firmware.
+- **FirmwareResetReasonEmbeddedControllerAdditional** Additional information on system reset reason provided by firmware if needed.
+- **FirmwareResetReasonPch** Reason for system reset provided by firmware.
+- **FirmwareResetReasonPchAdditional** Additional information on system reset reason provided by firmware if needed.
+- **FirmwareResetReasonSupplied** Flag indicating that a reason for system reset was provided by firmware.
+- **IO** Amount of data written to and read from the disk by the OS Loader during boot. See [IO](#io).
+- **LastBootSucceeded** Flag indicating whether the last boot was successful.
+- **LastShutdownSucceeded** Flag indicating whether the last shutdown was successful.
+- **MenuPolicy** Type of advanced options menu that should be shown to the user (Legacy, Standard, etc.).
+- **RecoveryEnabled** Indicates whether recovery is enabled.
+- **UserInputTime** The amount of time the loader application spent waiting for user input.
-There are no fields in this event.
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync
-
-This event indicates that a new sync is being generated for this object type.
-
-There are no fields in this event.
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync
-
-This event indicates that a new sync is being generated for this object type.
-
-There are no fields in this event.
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd
-
-This event provides data on the installed Office-related Internet Explorer features.
-
-- **OIeFeatureAddon** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
-- **OIeMachineLockdown** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
-- **OIeMimeHandling** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
-- **OIeMimeSniffing** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
-- **OIeNoAxInstall** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
-- **OIeNoDownload** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
-- **OIeObjectCaching** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
-- **OIePasswordDisable** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
-- **OIeSafeBind** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
-- **OIeSecurityBand** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
-- **OIeUncSaveCheck** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
-- **OIeValidateUrl** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
-- **OIeWebOcPopup** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
-- **OIeWinRestrict** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
-- **OIeZoneElevate** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx).
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd
-
-This event describes the Office products that are installed.
-
-- **OC2rApps** The Office Click-to-Run apps.
-- **OC2rSkus** The Office Click-to-Run products.
-- **OMsiApps** The Office MSI apps.
-- **OProductCodes** The Office MSI product code.
## OneDrive events
@@ -2575,10 +2472,10 @@ This event includes basic data about install and uninstall OneDrive API operatio
The following fields are available:
- **APIName** The name of the API.
-- **ScenarioName** The name of the scenario.
- **Duration** How long the operation took.
-- **isSuccess** Was the operation successful?
+- **IsSuccess** Was the operation successful?
- **ResultCode** The result code.
+- **ScenarioName** The name of the scenario.
### Microsoft.OneDrive.Sync.Setup.EndExperience
@@ -2588,9 +2485,9 @@ This event includes a success or failure summary of the installation.
The following fields are available:
- **APIName** The name of the API.
+- **HResult** Indicates the result code of the event
+- **IsSuccess** Was the operation successful?
- **ScenarioName** The name of the scenario.
-- **Hresult** The HResult of the operation.
-- **isSuccess** Was the operation successful?
### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation
@@ -2599,14 +2496,14 @@ This event is related to the OS version when the OS is upgraded with OneDrive in
The following fields are available:
-- **HResult** The HResult of the operation.
-- **SourceOSVersion** The source version of the operating system.
-- **SourceOSBuildNumber** The source build number of the operating system.
-- **SourceOSBuildBranch** The source branch of the operating system.
-- **CurrentOSVersion** The current version of the operating system.
-- **CurrentOSBuildNumber** The current build number of the operating system.
-- **CurrentOSBuildBranch** The current branch of the operating system.
- **CurrentOneDriveVersion** The current version of OneDrive.
+- **CurrentOSBuildBranch** The current branch of the operating system.
+- **CurrentOSBuildNumber** The current build number of the operating system.
+- **CurrentOSVersion** The current version of the operating system.
+- **HResult** The HResult of the operation.
+- **SourceOSBuildBranch** The source branch of the operating system.
+- **SourceOSBuildNumber** The source build number of the operating system.
+- **SourceOSVersion** The source version of the operating system.
### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation
@@ -2616,10 +2513,10 @@ This event is related to registering or unregistering the OneDrive update task.
The following fields are available:
- **APIName** The name of the API.
+- **IsSuccess** Was the operation successful?
+- **RegisterNewTaskResult** The HResult of the RegisterNewTask operation.
- **ScenarioName** The name of the scenario.
- **UnregisterOldTaskResult** The HResult of the UnregisterOldTask operation.
-- **RegisterNewTaskResult** The HResult of the RegisterNewTask operation.
-- **isSuccess** Was the operation successful?
### Microsoft.OneDrive.Sync.Setup.SetupCommonData
@@ -2629,19 +2526,15 @@ This event contains basic OneDrive configuration data that helps to diagnose fai
The following fields are available:
- **AppVersion** The version of the app.
-- **OfficeVersion** The version of Office that is installed.
-- **BuildArch** Is the architecture x86 or x64?
-- **Market** Which market is this in?
-- **OneDriveDeviceId** The OneDrive device ID.
+- **BuildArchitecture** Is the architecture x86 or x64?
+- **Environment** Is the device on the production or int service?
- **MachineGuid** The CEIP machine ID.
-- **IsMSFTInternal** Is this an internal Microsoft device?
+- **Market** Which market is this in?
+- **MSFTInternal** Is this an internal Microsoft device?
+- **OfficeVersionString** The version of Office that is installed.
- **OSDeviceName** Only if the device is internal to Microsoft, the device name.
- **OSUserName** Only if the device is internal to Microsoft, the user name.
-- **Environment** Is the device on the production or int service?
-- **OfficeVersionString** The version of Office that is installed.
-- **BuildArchitecture** Is the architecture x86 or x64?
- **UserGuid** The CEIP user ID.
-- **MSFTInternal** Is this an internal Microsoft device?
### Microsoft.OneDrive.Sync.Updater.CommonData
@@ -2651,21 +2544,21 @@ This event contains basic OneDrive configuration data that helps to diagnose fai
The following fields are available:
- **AppVersion** The version of the app.
-- **OfficeVersion** The version of Office that is installed.
- **BuildArch** Is the architecture x86 or x64?
-- **Market** Which market is this in?
-- **OneDriveDeviceId** The OneDrive device ID.
-- **MachineGuid** The CEIP machine ID.
+- **Environment** Is the device on the production or int service?
- **IsMSFTInternal** Is this an internal Microsoft device?
+- **MachineGuid** The CEIP machine ID.
+- **Market** Which market is this in?
+- **OfficeVersion** The version of Office that is installed.
+- **OneDriveDeviceId** The OneDrive device ID.
- **OSDeviceName** Only if the device is internal to Microsoft, the device name.
- **OSUserName** Only if the device is internal to Microsoft, the user name.
-- **Environment** Is the device on the production or int service?
- **UserGuid** A unique global user identifier.
### Microsoft.OneDrive.Sync.Updater.ComponentInstallState
-This event determines the installation state of dependent OneDrive components.
+This event includes basic data about the installation state of dependent OneDrive components.
The following fields are available:
@@ -2675,7 +2568,7 @@ The following fields are available:
### Microsoft.OneDrive.Sync.Updater.OfficeRegistration
-This event determines the status of the OneDrive integration with Microsoft Office.
+This event indicates the status of the OneDrive integration with Microsoft Office.
The following fields are available:
@@ -2716,9 +2609,9 @@ This event determines the outcome of the operation.
The following fields are available:
-- **UpdaterVersion** The version of the updater.
-- **IsLoggingEnabled** Is logging enabled?
- **hr** The HResult of the operation.
+- **IsLoggingEnabled** Is logging enabled?
+- **UpdaterVersion** The version of the updater.
### Microsoft.OneDrive.Sync.Updater.UpdateTierReg
@@ -2748,287 +2641,684 @@ The following fields are available:
- **winInetError** The HResult of the operation.
-## Remediation events
->[!NOTE]
->Events from this provider are sent with the installation of KB4023057 and any subsequent Windows update. For details, see [this support article](https://support.microsoft.com/help/4023057).
+## Remediation events
### Microsoft.Windows.Remediation.Applicable
-Reports whether a specific remediation to issues preventing security and quality updates is applicable based on detection.
+This event indicates a remedial plug-in is applicable if/when such a plug-in is detected. This is used to ensure Windows is up to date.
The following fields are available:
-- **CV** Correlation vector.
-- **DetectedCondition** Boolean true if detect condition is true and perform action will be run.
-- **GlobalEventCounter** Client side counter which indicates ordering of events sent by the remediation system.
-- **PackageVersion** Current package version of Remediation.
-- **PluginName** Name of the remediation plugin specified for each generic plugin event.
-- **Result** Result for detection or perform action phases of the remediation system.
-- **RunAppraiserFailed** Rerun if the appraiser command line tool failed.
+- **ActionName** The name of the action to be taken by the plug-in.
+- **AppraiserBinariesValidResult** Indicates whether plug-in was appraised as valid.
+- **AppraiserDetectCondition** Indicates whether the plug-in passed the appraiser's check.
+- **AppraiserRegistryValidResult** Indicates whether the registry entry checks out as valid.
+- **AppraiserTaskDisabled** Indicates the appraiser task is disabled.
+- **AppraiserTaskValidFailed** Indicates the Appraiser task did not function and requires intervention.
+- **CV** Correlation vector
+- **DateTimeDifference** The difference between local and reference clock times.
+- **DateTimeSyncEnabled** Indicates whether the datetime sync plug-in is enabled.
+- **DaysSinceLastSIH** The number of days since the most recent SIH executed.
+- **DaysToNextSIH** The number of days until the next scheduled SIH execution.
+- **DetectedCondition** Indicates whether detect condition is true and the perform action will be run.
+- **EvalAndReportAppraiserBinariesFailed** Indicates the EvalAndReportAppraiserBinaries event failed.
+- **EvalAndReportAppraiserRegEntries** Indicates the EvalAndReportAppraiserRegEntriesFailed event failed.
+- **EvalAndReportAppraiserRegEntriesFailed** Indicates the EvalAndReportAppraiserRegEntriesFailed event failed.
+- **GlobalEventCounter** Client side counter that indicates ordering of events sent by the remediation system.
+- **HResult** The HRESULT for detection or perform action phases of the plugin.
+- **IsAppraiserLatestResult** The HRESULT from the appraiser task.
+- **IsConfigurationCorrected** Indicates whether the configuration of SIH task was successfully corrected.
+- **LastHresult** The HRESULT for detection or perform action phases of the plugin.
+- **LastRun** The date of the most recent SIH run.
+- **NextRun** Date of the next scheduled SIH run.
+- **PackageVersion** The version of the current remediation package.
+- **PluginName** Name of the plugin specified for each generic plugin event.
+- **Reload** True if SIH reload is required.
+- **RemediationNoisyHammerAcLineStatus** Event that indicates the AC Line Status of the machine.
+- **RemediationNoisyHammerAutoStartCount** The number of times hammer auto-started.
+- **RemediationNoisyHammerCalendarTaskEnabled** Event that indicates Update Assistant Calendar Task is enabled.
+- **RemediationNoisyHammerCalendarTaskExists** Event that indicates an Update Assistant Calendar Task exists.
+- **RemediationNoisyHammerCalendarTaskTriggerEnabledCount** Event that indicates calendar triggers are enabled in the task.
+- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the most recent hammer task ran.
+- **RemediationNoisyHammerGetCurrentSize** Size in MB of the $GetCurrent folder.
+- **RemediationNoisyHammerIsInstalled** TRUE if the noisy hammer is installed.
+- **RemediationNoisyHammerLastTaskRunResult** The result of the last hammer task run.
+- **RemediationNoisyHammerMeteredNetwork** TRUE if the machine is on a metered network.
+- **RemediationNoisyHammerTaskEnabled** Indicates whether the Update Assistant Task (Noisy Hammer) is enabled.
+- **RemediationNoisyHammerTaskExists** Indicates whether the Update Assistant Task (Noisy Hammer) exists.
+- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether counting is enabled for the Update Assistant (Noisy Hammer) task trigger.
+- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant (Noisy Hammer) task.
+- **RemediationNoisyHammerUAExitState** The code for the exit state of the Update Assistant (Noisy Hammer) task.
+- **RemediationNoisyHammerUserLoggedIn** TRUE if there is a user logged in.
+- **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin.
+- **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled.
+- **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS.
+- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager).
+- **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely.
+- **RemediationTargetMachine** Indicates whether the device is a target of the specified fix.
+- **RemediationTaskHealthAutochkProxy** True/False based on the health of the AutochkProxy task.
+- **RemediationTaskHealthChkdskProactiveScan** True/False based on the health of the Check Disk task.
+- **RemediationTaskHealthDiskCleanup_SilentCleanup** True/False based on the health of the Disk Cleanup task.
+- **RemediationTaskHealthMaintenance_WinSAT** True/False based on the health of the Health Maintenance task.
+- **RemediationTaskHealthServicing_ComponentCleanupTask** True/False based on the health of the Health Servicing Component task.
+- **RemediationTaskHealthUSO_ScheduleScanTask** True/False based on the health of the USO (Update Session Orchestrator) Schedule task.
+- **RemediationTaskHealthWindowsUpdate_ScheduledStartTask** True/False based on the health of the Windows Update Scheduled Start task.
+- **RemediationTaskHealthWindowsUpdate_SihbootTask** True/False based on the health of the Sihboot task.
+- **RemediationUHServiceBitsServiceEnabled** Indicates whether BITS service is enabled.
+- **RemediationUHServiceDeviceInstallEnabled** Indicates whether Device Install service is enabled.
+- **RemediationUHServiceDoSvcServiceEnabled** Indicates whether DO service is enabled.
+- **RemediationUHServiceDsmsvcEnabled** Indicates whether DSMSVC service is enabled.
+- **RemediationUHServiceLicensemanagerEnabled** Indicates whether License Manager service is enabled.
+- **RemediationUHServiceMpssvcEnabled** Indicates whether MPSSVC service is enabled.
+- **RemediationUHServiceTokenBrokerEnabled** Indicates whether Token Broker service is enabled.
+- **RemediationUHServiceTrustedInstallerServiceEnabled** Indicates whether Trusted Installer service is enabled.
+- **RemediationUHServiceUsoServiceEnabled** Indicates whether USO (Update Session Orchestrator) service is enabled.
+- **RemediationUHServicew32timeServiceEnabled** Indicates whether W32 Time service is enabled.
+- **RemediationUHServiceWecsvcEnabled** Indicates whether WECSVC service is enabled.
+- **RemediationUHServiceWinmgmtEnabled** Indicates whether WMI service is enabled.
+- **RemediationUHServiceWpnServiceEnabled** Indicates whether WPN service is enabled.
+- **RemediationUHServiceWuauservServiceEnabled** Indicates whether WUAUSERV service is enabled.
+- **Result** This is the HRESULT for Detection or Perform Action phases of the plugin.
+- **RunAppraiserFailed** Indicates RunAppraiser failed to run correctly.
+- **RunTask** TRUE if SIH task should be run by the plug-in.
+- **TimeServiceNTPServer** The URL for the NTP time server used by device.
+- **TimeServiceStartType** The startup type for the NTP time service.
+- **TimeServiceSyncDomainJoined** True if device domain joined and hence uses DC for clock.
+- **TimeServiceSyncType** Type of sync behavior for Date & Time service on device.
+
### Microsoft.Windows.Remediation.Completed
-Enables tracking the completion of a process that remediates issues preventing security and quality updates.
+This event enables completion tracking of a process that remediates issues preventing security and quality updates.
The following fields are available:
-- **CV** Correlation vector.
-- **GlobalEventCounter** Client side counter which indicates ordering of events sent by the remediation system.
-- **HResult** Result of execution of the event.
-- **LatestState** Final state of the plugin component.
-- **PackageVersion** Current package version of Remediation.
-- **PluginName** Name of the specific remediation for each generic plugin event.
-- **RemediationNoisyHammerTaskKickOffIsSuccess** Event that indicates the Update Assistant task has been started successfully.
-- **Result** This is the HRESULT for detection or perform action phases of the plugin.
+- **ActionName** Name of the action to be completed by the plug-in.
+- **AppraiserTaskCreationFailed** TRUE if the appraiser task creation failed to complete successfully.
+- **AppraiserTaskDeleteFailed** TRUE if deletion of appraiser task failed to complete successfully.
+- **AppraiserTaskExistFailed** TRUE if detection of the appraiser task failed to complete successfully.
+- **AppraiserTaskLoadXmlFailed** TRUE if the Appraiser XML Loader failed to complete successfully.
+- **AppraiserTaskMissing** TRUE if the Appraiser task is missing.
+- **AppraiserTaskTimeTriggerUpdateFailedId** TRUE if the Appraiser Task Time Trigger failed to update successfully.
+- **AppraiserTaskValidateTaskXmlFailed** TRUE if the Appraiser Task XML failed to complete successfully.
+- **CrossedDiskSpaceThreshold** Indicates if cleanup resulted in hard drive usage threshold required for feature update to be exceeded.
+- **CV** The Correlation Vector.
+- **DateTimeDifference** The difference between the local and reference clocks.
+- **DaysSinceOsInstallation** The number of days since the installation of the Operating System.
+- **DiskMbCleaned** The amount of space cleaned on the hard disk, measured in Megabytes.
+- **DiskMbFreeAfterCleanup** The amount of free hard disk space after cleanup, measured in Megabytes.
+- **DiskMbFreeBeforeCleanup** The amount of free hard disk space before cleanup, measured in Megabytes.
+- **ForcedAppraiserTaskTriggered** TRUE if Appraiser task ran from the plug-in.
+- **GlobalEventCounter** Client-side counter that indicates ordering of events sent by the active user.
+- **HandlerCleanupFreeDiskInMegabytes** The amount of hard disk space cleaned by the storage sense handlers, measured in Megabytes.
+- **HResult** The result of the event execution.
+- **LatestState** The final state of the plug-in component.
+- **PackageVersion** The package version for the current Remediation.
+- **PageFileCount** The number of Windows Page files.
+- **PageFileCurrentSize** The size of the Windows Page file, measured in Megabytes.
+- **PageFileLocation** The storage location (directory path) of the Windows Page file.
+- **PageFilePeakSize** The maximum amount of hard disk space used by the Windows Page file, measured in Megabytes.
+- **PluginName** The name of the plug-in specified for each generic plug-in event.
+- **RanCleanup** TRUE if the plug-in ran disk cleanup.
+- **RemediationConfigurationTroubleshooterExecuted** True/False based on whether the Remediation Configuration Troubleshooter executed successfully.
+- **RemediationConfigurationTroubleshooterIpconfigFix** TRUE if IPConfig Fix completed successfully.
+- **RemediationConfigurationTroubleshooterNetShFix** TRUE if network card cache reset ran successfully.
+- **RemediationDiskCleanSizeBtWindowsFolderInMegabytes** The size of the Windows BT folder (used to store Windows upgrade files), measured in Megabytes.
+- **RemediationDiskCleanupBTFolderEsdSizeInMB** The size of the Windows BT folder (used to store Windows upgrade files) ESD (Electronic Software Delivery), measured in Megabytes.
+- **RemediationDiskCleanupGetCurrentEsdSizeInMB** The size of any existing ESD (Electronic Software Delivery) folder, measured in Megabytes.
+- **RemediationDiskCleanupSearchFileSizeInMegabytes** The size of the Cleanup Search index file, measured in Megabytes.
+- **RemediationDiskCleanupUpdateAssistantSizeInMB** The size of the Update Assistant folder, measured in Megabytes.
+- **RemediationDoorstopChangeSucceeded** TRUE if Doorstop registry key was successfully modified.
+- **RemediationDoorstopExists** TRUE if there is a OneSettings Doorstop value.
+- **RemediationDoorstopRegkeyError** TRUE if an error occurred accessing the Doorstop registry key.
+- **RemediationDRFKeyDeleteSucceeded** TRUE if the RecoveredFrom (Doorstop) registry key was successfully deleted.
+- **RemediationDUABuildNumber** The build number of the DUA.
+- **RemediationDUAKeyDeleteSucceeded** TRUE if the UninstallActive registry key was successfully deleted.
+- **RemediationDuplicateTokenSucceeded** TRUE if the user token was successfully duplicated.
+- **RemediationImpersonateUserSucceeded** TRUE if the user was successfully impersonated.
+- **RemediationNoisyHammerTaskKickOffIsSuccess** TRUE if the NoisyHammer task started successfully.
+- **RemediationQueryTokenSucceeded** TRUE if the user token was successfully queried.
+- **RemediationRanHibernation** TRUE if the system entered Hibernation.
+- **RemediationRevertToSystemSucceeded** TRUE if reversion to the system context succeeded.
+- **RemediationUpdateServiceHealthRemediationResult** The result of the Update Service Health plug-in.
+- **RemediationUpdateTaskHealthRemediationResult** The result of the Update Task Health plug-in.
+- **RemediationUpdateTaskHealthTaskList** A list of tasks fixed by the Update Task Health plug-in.
+- **RemediationWindowsLogSpaceFound** The size of the Windows log files found, measured in Megabytes.
+- **RemediationWindowsLogSpaceFreed** The amount of disk space freed by deleting the Windows log files, measured in Megabytes.
+- **RemediationWindowsSecondaryDriveFreeSpace** The amount of free space on the secondary drive, measured in Megabytes.
+- **RemediationWindowsSecondaryDriveLetter** The letter designation of the first secondary drive with a total capacity of 10GB or more.
+- **RemediationWindowsSecondaryDriveTotalSpace** The total storage capacity of the secondary drive, measured in Megabytes.
+- **RemediationWindowsTotalSystemDiskSize** The total storage capacity of the System Disk Drive, measured in Megabytes.
+- **Result** The HRESULT for Detection or Perform Action phases of the plug-in.
+- **RunResult** The HRESULT for Detection or Perform Action phases of the plug-in.
+- **ServiceHealthPlugin** The nae of the Service Health plug-in.
+- **StartComponentCleanupTask** TRUE if the Component Cleanup task started successfully.
+- **TotalSizeofOrphanedInstallerFilesInMegabytes** The size of any orphaned Windows Installer files, measured in Megabytes.
+- **TotalSizeofStoreCacheAfterCleanupInMegabytes** The size of the Windows Store cache after cleanup, measured in Megabytes.
+- **TotalSizeofStoreCacheBeforeCleanupInMegabytes** The size of the Windows Store cache (prior to cleanup), measured in Megabytes.
+- **usoScanDaysSinceLastScan** The number of days since the last USO (Update Session Orchestrator) scan.
+- **usoScanInProgress** TRUE if a USO (Update Session Orchestrator) scan is in progress, to prevent multiple simultaneous scans.
+- **usoScanIsAllowAutoUpdateKeyPresent** TRUE if the AllowAutoUpdate registry key is set.
+- **usoScanIsAllowAutoUpdateProviderSetKeyPresent** TRUE if AllowAutoUpdateProviderSet registry key is set.
+- **usoScanIsAuOptionsPresent** TRUE if Auto Update Options registry key is set.
+- **usoScanIsFeatureUpdateInProgress** TRUE if a USO (Update Session Orchestrator) scan is in progress, to prevent multiple simultaneous scans.
+- **usoScanIsNetworkMetered** TRUE if the device is currently connected to a metered network.
+- **usoScanIsNoAutoUpdateKeyPresent** TRUE if no Auto Update registry key is set/present.
+- **usoScanIsUserLoggedOn** TRUE if the user is logged on.
+- **usoScanPastThreshold** TRUE if the most recent USO (Update Session Orchestrator) scan is past the threshold (late).
+- **usoScanType** The type of USO (Update Session Orchestrator) scan (Interactive or Background).
+- **WindowsHyberFilSysSizeInMegabytes** The size of the Windows Hibernation file, measured in Megabytes.
+- **WindowsInstallerFolderSizeInMegabytes** The size of the Windows Installer folder, measured in Megabytes.
+- **WindowsOldFolderSizeInMegabytes** The size of the Windows.OLD folder, measured in Megabytes.
+- **WindowsOldSpaceCleanedInMB** The amount of disk space freed by removing the Windows.OLD folder, measured in Megabytes.
+- **WindowsPageFileSysSizeInMegabytes** The size of the Windows Page file, measured in Megabytes.
+- **WindowsSoftwareDistributionFolderSizeInMegabytes** The size of the SoftwareDistribution folder, measured in Megabytes.
+- **WindowsSwapFileSysSizeInMegabytes** The size of the Windows Swap file, measured in Megabytes.
+- **WindowsSxsFolderSizeInMegabytes** The size of the WinSxS (Windows Side-by-Side) folder, measured in Megabytes.
+- **WindowsSxsTempFolderSizeInMegabytes** The size of the WinSxS (Windows Side-by-Side) Temp folder, measured in Megabytes.
+
### Microsoft.Windows.Remediation.DiskCleanUnExpectedErrorEvent
-Event that indicates whether an error condition occurred while trying to clean up disk space.
+This event indicates that an unexpected error occurred during an update and provides information to help address the issue.
The following fields are available:
-- **CV** Correlation vector.
-- **ErrorMessage** Description of any error that was encountered.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **HResult** Result of execution of the event.
-- **PackageVersion** Current Remediation package version.
+- **CV** The Correlation vector.
+- **ErrorMessage** A description of any errors encountered while the plug-in was running.
+- **GlobalEventCounter** The client-side counter that indicates ordering of events.
+- **Hresult** The result of the event execution.
+- **PackageVersion** The version number of the current remediation package.
+- **SessionGuid** GUID associated with a given execution of sediment pack.
+
### Microsoft.Windows.Remediation.Error
-Event for general errors in the Remediation shell.
+This event indicates a Sediment Pack error (update stack failure) has been detected and provides information to help address the issue.
The following fields are available:
-- **HResult** Return value.
-- **Message** Contains information about any error that occurred.
-- **PackageVersion** Current Remediation package version.
+- **HResult** The result of the event execution.
+- **Message** A message containing information about the error that occurred.
+- **PackageVersion** The version number of the current remediation package.
+
### Microsoft.Windows.Remediation.FallbackError
-Indicates whether an error occurs for a fallback in the plugin.
+This event indicates an error when Self Update results in a Fallback and provides information to help address the issue.
The following fields are available:
-- **S0** Fallback error level.
-- **wilResult** Result for Windows Installer Logging function.
+- **s0** Indicates the Fallback error level. See [Microsoft.Windows.Remediation.wilResult](#microsoftwindowsremediationwilresult).
+- **wilResult** The result of the Windows Installer Logging. See [wilResult](#wilresult).
-### Microsoft.Windows.Remediation.RemediationShellFailedAutomaticAppUpdateModifyEventId
-
-Event indicates that there was a failure modifying the wsautoupdate task.
-
-The following fields are available:
-
-- **CV** Correlation vector.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **hResult** Result of the failed call.
-- **PackageVersion** Current Remediation package version.
-
-### Microsoft.Windows.Remediation.RemediationShellUnexpectedExceptionId
-
-Event fires when an unexpected error occurs in the shell routine.
-
-The following fields are available:
-
-- **CV** Correlation vector.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **PackageVersion** Current package version of Remediation.
-- **RemediationShellUnexpectedExceptionId** Identifier of the remediation plugin.
-
-### Microsoft.Windows.Remediation.RemediationUHEnableServiceFailed
-
-Event indicates that enabling a service failed.
-
-The following fields are available:
-
-- **CV** Correlation vector.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **hResult** Result associated with the given failure.
-- **PackageVersion** Current package version of Remediation.
-- **serviceName** ServiceName associated with the given operation.
-
-### Microsoft.Windows.Remediation.RemediationUpgradeSucceededDataEventId
-
-Event containing data about the upgrade process.
-
-The following fields are available:
-
-- **AppraiserPlugin** True or False depending on whether the Appraiser Plugin task fix was successful.
-- **ClearAUOptionsPlugin** True or False depending on whether the AU Options regkeys were successfully deleted.
-- **CV** Correlation vector.
-- **DatetimeSyncPlugin** True or False depending on whether the datetime sync plugin ran.
-- **DiskCleanupPlugin** Disk space free by disk cleanup plugin.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **NoisyHammerPlugin** True or False depending on whether the Noisy Hammer plugin was successful.
-- **PackageVersion** Current package version of Remediation.
-- **RebootRequiredPlugin** True or False depending on whether the reboot required plugin ran.
-- **RemediationNotifyUserFixIssuesPlugin** True or False depending on whether notify user fix issues plugin was successful.
-- **RemediationPostUpgradeDiskSpace** Disk space available after the upgrade.
-- **RemediationPostUpgradeHibernationSize** Size of the hibernation file after upgrade.
-- **ServiceHealthPlugin** List of services updated by the plugin.
-- **SIHHealthPlugin** True or False depending on whether the service health plugin completed successfully.
-- **StackDataResetPlugin** True or False depending on whether resetting the update stack completed successfully.
-- **TaskHealthPlugin** List of tasks updated by the plugin.
-- **UpdateApplicabilityFixerPlugin** True or False depending on whether the update applicability fixer plugin completed successfully.
-- **WindowsUpdateEndpointPlugin** True or False depending on whether the windows update endpoint was successful.
### Microsoft.Windows.Remediation.RemediationNotifyUserFixIssuesInvokeUIEvent
-Event occurs when notify users task executes.
+This event occurs when the Notify User task executes and provides information about the cause of the notification.
The following fields are available:
-- **CV** Correlation vector.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **PackageVersion** Current Remediation package version.
-- **RemediationNotifyUserFixIssuesCallResult** Result of calling the USO sequence of steps.
-- **RemediationNotifyUserFixIssuesUsoDownloadCalledHr** Error code from USO start download call.
-- **RemediationNotifyUserFixIssuesUsoInitializedHr** Error code from USO initialize call.
-- **RemediationNotifyUserFixIssuesUsoProxyBlanketHr** Error code from USO proxy blanket call.
-- **RemediationNotifyUserFixIssuesUsoSetSessionHr** Error code from USO set session call.
+- **CV** The Correlation vector.
+- **GlobalEventCounter** The client-side counter that indicates ordering of events.
+- **PackageVersion** The version number of the current remediation package.
+- **RemediationNotifyUserFixIssuesCallResult** The result of calling the USO (Update Session Orchestrator) sequence steps.
+- **RemediationNotifyUserFixIssuesUsoDownloadCalledHr** The error code from the USO (Update Session Orchestrator) download call.
+- **RemediationNotifyUserFixIssuesUsoInitializedHr** The error code from the USO (Update Session Orchestrator) initialize call.
+- **RemediationNotifyUserFixIssuesUsoProxyBlanketHr** The error code from the USO (Update Session Orchestrator) proxy blanket call.
+- **RemediationNotifyUserFixIssuesUsoSetSessionHr** The error code from the USO (Update Session Orchestrator) session call.
+
+
+### Microsoft.Windows.Remediation.RemediationShellFailedAutomaticAppUpdateModifyEventId
+
+This event provides the modification of the date on which an Automatic App Update scheduled task failed and provides information about the failure.
+
+The following fields are available:
+
+- **CV** The Correlation Vector.
+- **GlobalEventCounter** The client-side counter that indicates ordering of events.
+- **hResult** The result of the event execution.
+- **PackageVersion** The version number of the current remediation package.
+
+
+### Microsoft.Windows.Remediation.RemediationShellUnexpectedExceptionId
+
+This event identifies the remediation plug-in that returned an unexpected exception and provides information about the exception.
+
+The following fields are available:
+
+- **CV** The Correlation Vector.
+- **GlobalEventCounter** The client-side counter that indicates ordering of events.
+- **PackageVersion** The version number of the current remediation package.
+- **RemediationShellUnexpectedExceptionId** The ID of the remediation plug-in that caused the exception.
+
+
+### Microsoft.Windows.Remediation.RemediationUHEnableServiceFailed
+
+This event tracks the health of key update (Remediation) services and whether they are enabled.
+
+The following fields are available:
+
+- **CV** The Correlation Vector.
+- **GlobalEventCounter** The client-side counter that indicates ordering of events.
+- **hResult** The result of the event execution.
+- **PackageVersion** The version number of the current remediation package.
+- **serviceName** The name associated with the operation.
+
+
+### Microsoft.Windows.Remediation.RemediationUpgradeSucceededDataEventId
+
+This event returns information about the upgrade upon success to help ensure Windows is up to date.
+
+The following fields are available:
+
+- **AppraiserPlugin** TRUE / FALSE depending on whether the Appraiser plug-in task fix was successful.
+- **ClearAUOptionsPlugin** TRUE / FALSE depending on whether the AU (Auto Updater) Options registry keys were successfully deleted.
+- **CV** The Correlation Vector.
+- **DatetimeSyncPlugin** TRUE / FALSE depending on whether the DateTimeSync plug-in ran successfully.
+- **DiskCleanupPlugin** TRUE / FALSE depending on whether the DiskCleanup plug-in ran successfully.
+- **GlobalEventCounter** The client-side counter that indicates ordering of events.
+- **NoisyHammerPlugin** TRUE / FALSE depending on whether the NoisyHammer plug-in ran successfully.
+- **PackageVersion** The version number of the current remediation package.
+- **RebootRequiredPlugin** TRUE / FALSE depending on whether the Reboot plug-in ran successfully.
+- **RemediationNotifyUserFixIssuesPlugin** TRUE / FALSE depending on whether the User Fix Issues plug-in ran successfully
+- **RemediationPostUpgradeDiskSpace** The amount of disk space available after the upgrade.
+- **RemediationPostUpgradeHibernationSize** The size of the Hibernation file after the upgrade.
+- **ServiceHealthPlugin** A list of services updated by the plug-in.
+- **SIHHealthPlugin** TRUE / FALSE depending on whether the SIH Health plug-in ran successfully.
+- **StackDataResetPlugin** TRUE / FALSE depending on whether the update stack completed successfully.
+- **TaskHealthPlugin** A list of tasks updated by the plug-in.
+- **UpdateApplicabilityFixerPlugin** TRUE / FALSE depending on whether the update applicability fixer plug-in completed successfully.
+- **WindowsUpdateEndpointPlugin** TRUE / FALSE depending on whether the Windows Update Endpoint was successful.
+
### Microsoft.Windows.Remediation.Started
-Enables tracking the start of a process that remediates issues preventing security and quality updates.
+This event reports whether a plug-in started, to help ensure Windows is up to date.
The following fields are available:
-- **CV** Correlation vector.
-- **GlobalEventCounter** Client side counter which indicates ordering of events sent by the remediation system.
-- **PackageVersion** Current package version of Remediation.
-- **PluginName** Name of the specific remediation for each generic plugin event.
-- **Result** Results of the detection or perform action phases of the remediation system.
+- **CV** The Correlation Vector.
+- **GlobalEventCounter** The client-side counter that indicates ordering of events.
+- **PackageVersion** The version number of the current remediation package.
+- **PluginName** The name of the plug-in specified for each generic plug-in event.
+- **Result** The HRESULT for Detection or Perform Action phases of the plug-in.
+
### Microsoft.Windows.Remediation.wilResult
-Event containing self-update information.
+This event provides Self Update information to help keep Windows up to date.
The following fields are available:
-- **callContext** List of telemetry activities containing this error.
-- **currentContextId** Identifier for the newest telemetry activity containing this error.
-- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any).
-- **currentContextName** Name of the newest telemetry activity containing this error.
-- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast).
-- **failureId** Identifier assigned to this failure
-- **filename** The name of the source file where the error occurred.
-- **hresult** Failure error code.
-- **lineNumber** Line number within the source file where the error occurred.
-- **message** Custom message associated with the failure (if any).
-- **module** Name of the binary where the error occurred.
-- **originatingContextId** Identifier for the oldest telemetry activity containing this error.
-- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any).
-- **originatingContextName** Name of the oldest telemetry activity containing this error.
-- **threadId** Identifier of the thread the error occurred on.
+- **callContext** A list of diagnostic activities containing this error.
+- **currentContextId** An identifier for the newest diagnostic activity containing this error.
+- **currentContextMessage** A message associated with the most recent diagnostic activity containing this error (if any).
+- **currentContextName** Name of the most recent diagnostic activity containing this error.
+- **failureCount** Number of failures seen within the binary where the error occurred.
+- **failureId** The identifier assigned to this failure.
+- **failureType** Indicates the type of failure observed (exception, returned, error, logged error, or fail fast).
+- **fileName** The source code file name where the error occurred.
+- **function** The name of the function where the error occurred.
+- **hresult** The failure error code.
+- **lineNumber** The Line Number within the source code file where the error occurred.
+- **message** A message associated with the failure (if any).
+- **module** The name of the binary module in which the error occurred.
+- **originatingContextId** The identifier for the oldest diagnostic activity containing this error.
+- **originatingContextMessage** A message associated with the oldest diagnostic activity containing this error (if any).
+- **originatingContextName** The name of the oldest diagnostic activity containing this error.
+- **threadId** The identifier of the thread the error occurred on.
-## Sediment Service events
->[!NOTE]
->Events from this provider are sent with the installation of KB4023057 and any subsequent Windows update. For details, see [this support article](https://support.microsoft.com/help/4023057).
+## Sediment events
-### Microsoft.Windows.SedimentService.Applicable
+### Microsoft.Windows.Sediment.Info.AppraiserData
-Indicates whether a given plugin is applicable.
+This event provides data on the current Appraiser status of the device to help ensure Windows is up to date.
The following fields are available:
-- **CV** Correlation vector.
-- **DetectedCondition** Boolean true if detect condition is true and perform action will be run.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **IsSelfUpdateEnabledInOneSettings** True/False based on whether self update is enabled.
-- **IsSelfUpdateNeeded** True/False based on whether a newer version is available.
-- **PackageVersion** Version of the package.
-- **PluginName** Name of the plugin specified for each generic plugin event.
-- **Result** This is the HRESULT for detection or perform action phases of the plugin.
+- **ErrorCode** The value of the Return Code for the registry query.
+- **GStatus** The pre-upgrade GStatus value.
+- **PayloadVersion** The version information for the remediation component.
+- **RegKeyName** The name of the registry subkey where data was found for this event.
+- **Time** The system time at which the event began.
+- **UpgEx** The pre-upgrade UpgEx value.
-### Microsoft.Windows.SedimentService.Completed
-Indicates whether a given plugin has completed its work.
+### Microsoft.Windows.Sediment.Info.BinaryInfo
+
+This event provides information about the binary returned by the Operating System Remediation System Service (OSRSS) to help ensure Windows is up to date.
The following fields are available:
-- **CV** Correlation vector.
-- **FailedReasons** String reason for any plugin failures.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **PackageVersion** Current package version of Remediation.
-- **PluginName** Name of the plugin specified for each generic plugin event.
-- **Result** Result of the service execution.
-- **SedimentServiceCheckTaskFunctional** Result of checking if the scheduled task is functional.
-- **SedimentServiceCurrentBytes** Current number of bytes the service is consuming.
-- **SedimentServiceKillService** True/False based on whether the service should be stopped.
-- **SedimentServiceMaximumBytes** Maximum bytes the service can consume.
-- **SedimentServiceRetrievedKillService** True/False whether the kill service information was retrieved.
-- **SedimentServiceStopping** True/False indicating whether the service was found to be stopping.
-- **SedimentServiceTaskFunctional** True/False if scheduled task is functional. If task is not functional this indicates plugins will be run.
-- **SedimentServiceTotalIterations** Number of iterations service will wait before running again.
+- **BinaryPath** The sanitized name of the system binary from which the data was gathered.
+- **ErrorCode** The value of the return code for querying the version from the binary.
+- **FileVerBuild** The binary’s build number.
+- **FileVerMajor** The binary’s major version number.
+- **FileVerMinor** The binary’s minor version number.
+- **FileVerRev** The binary’s revision number.
+- **PayloadVersion** The version information for the remediation component.
+- **Time** The system time at which the event began.
-### Microsoft.Windows.SedimentService.Error
-Indicates whether an error condition occurs in the plugin.
+### Microsoft.Windows.Sediment.Info.DownloadServiceError
+
+This event provides information when the Download Service returns an error. The information provided helps keep Windows up to date.
The following fields are available:
-- **Message** String message containing information from the service.
-- **PackageVersion** Version of the package.
-- **HResult** Return value from the plugin result.
+- **Architecture** The platform architecture used to identify the correct download payload.
+- **BuildNumber** The starting build number used to identify the correct download payload.
+- **Edition** The Operating System Edition used to identify the correct download payload.
+- **Error** The description of the error encountered.
+- **LanguageCode** The system User Interface Language used to identify the correct download payload.
+- **Stack** Details about the error encountered.
+- **WorkingDirectory** The folder location (path) downloader was attempting to say the payload to.
-### Microsoft.Windows.SedimentService.FallbackError
-Indicates whether an error occurs for a fallback in the plugin.
+### Microsoft.Windows.Sediment.Info.DownloadServiceProgress
+
+This event indicates the progress of the downloader in 1% increments.
The following fields are available:
-- **s0** Fallback error level.
-- **wilResult** Result for Windows Installer Logging function.
+- **Percentage** The amount successfully downloaded, measured as a percentage of the whole.
-### Microsoft.Windows.SedimentService.Information
-General information returned from the plugin.
+### Microsoft.Windows.Sediment.Info.Error
+
+This event indicates an error in the updater payload. This information assists in keeping Windows up to date.
The following fields are available:
-- **HResult** Result of the plugin execution.
-- **Message** Information collected from the plugin based on the purpose of the plugin.
-- **PackageVersion** Version of the package.
+- **FailureType** The type of error encountered.
+- **FileName** The code file in which the error occurred.
+- **HResult** The failure error code.
+- **LineNumber** The line number in the code file at which the error occurred.
+- **ReleaseVer** The version information for the component in which the error occurred.
+- **Time** The system time at which the error occurred.
-### Microsoft.Windows.SedimentService.Started
-Indicates that a given plugin has started.
+### Microsoft.Windows.Sediment.Info.PhaseChange
+
+The event indicates progress made by the updater. This information assists in keeping Windows up to date.
The following fields are available:
-- **CV** Correlation vector
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **PackageVersion** Version of the package.
-- **PluginName** Name of the plugin running.
-- **Result** Return code from the plugin result.
+- **NewPhase** The phase of progress made.
+- **ReleaseVer** The version information for the component in which the change occurred.
+- **Time** The system time at which the phase chance occurred.
-### Microsoft.Windows.SedimentService.wilResult
-Result from the windows internal library.
+### Microsoft.Windows.Sediment.Info.ServiceInfo
+
+This event provide information about the system service for which data is being gathered by the Operating System Remediation System Service (OSRSS) to help ensure Windows is up to date.
The following fields are available:
-- **callContext** List of telemetry activities containing this error.
-- **currentContextId** Identifier for the newest telemetry activity containing this error.
-- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any).
-- **currentContextName** Name of the newest telemetry activity containing this error.
-- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast.
-- **failureId** Identifier assigned to this failure.
-- **filename** The name of the source file where the error occurred.
-- **hresult** Failure error code.
-- **lineNumber** Line number within the source file where the error occurred.
-- **message** Custom message associated with the failure (if any).
-- **module** Name of the binary where the error occurred.
-- **originatingContextId** Identifier for the oldest telemetry activity containing this error.
-- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any).
-- **originatingContextName** Name of the oldest telemetry activity containing this error.
-- **threadId** Identifier of the thread the error occurred on.
+- **ErrorCode** The value returned by the error for querying the service information.
+- **PayloadVersion** The version information for the remediation component.
+- **ServiceName** The name of the system service for which data was gathered.
+- **ServiceStatus** The status of the specified service.
+- **Time** The system time at which the event occurred.
-## Sediment Launcher events
->[!NOTE]
->Events from this provider are sent with the installation of KB4023057 and any subsequent Windows update. For details, see [this support article](https://support.microsoft.com/help/4023057).
+### Microsoft.Windows.Sediment.Info.Uptime
+
+This event provides information about how long the device has been operating. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **Days** The number of days the device has been on.
+- **Hours** The number of hours the device has been on.
+- **Minutes** The number of minutes the device has been on.
+- **PayloadVersion** The version information for the remediation component.
+- **Seconds** The number of seconds the machine has been on.
+- **Ticks** The number of system clock “ticks” the device has been on.
+- **Time** The system time at which the event occurred.
+
+
+### Microsoft.Windows.Sediment.OSRSS.CheckingOneSettings
+
+This event indicates the parameters that the Operating System Remediation System Service (OSRSS) uses for a secure ping to Microsoft to help ensure Windows is up to date.
+
+The following fields are available:
+
+- **CustomVer** The registry value for targeting.
+- **IsMetered** TRUE if the machine is on a metered network.
+- **LastVer** The version of the last successful run.
+- **ServiceVersionMajor** The Major version information of the component.
+- **ServiceVersionMinor** The Minor version information of the component.
+- **Time** The system time at which the event occurred.
+
+
+### Microsoft.Windows.Sediment.OSRSS.DownloadingUrl
+
+This event provides information about the URL from which the Operating System Remediation System Service (OSRSS) is attempting to download. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **AttemptNumber** The count indicating which download attempt is starting.
+- **ServiceVersionMajor** The Major version information of the component.
+- **ServiceVersionMinor** The Minor version information of the component.
+- **Time** The system time at which the event occurred.
+- **Url** The URL from which data was downloaded.
+
+
+### Microsoft.Windows.Sediment.OSRSS.DownloadSuccess
+
+This event indicates the Operating System Remediation System Service (OSRSS) successfully download data from the indicated URL. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **ServiceVersionMajor** The Major version information of the component.
+- **ServiceVersionMinor** The Minor version information of the component.
+- **Time** The system time at which the event occurred.
+- **Url** The URL from which data was downloaded.
+
+
+### Microsoft.Windows.Sediment.OSRSS.Error
+
+This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful.
+
+The following fields are available:
+
+- **FailureType** The type of error encountered.
+- **FileName** The code file in which the error occurred.
+- **HResult** The failure error code.
+- **LineNumber** The line number in the code file at which the error occurred.
+- **ServiceVersionMajor** The Major version information of the component.
+- **ServiceVersionMinor** The Minor version information of the component.
+- **Time** The system time at which the event occurred.
+
+
+### Microsoft.Windows.Sediment.OSRSS.ExeSignatureValidated
+
+This event indicates the Operating System Remediation System Service (OSRSS) successfully validated the signature of an EXE from the indicated URL. The information provided helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **ServiceVersionMajor** The Major version information of the component.
+- **ServiceVersionMinor** The Minor version information of the component.
+- **Time** The system time at which the event occurred.
+- **Url** The URL from which the validated EXE was downloaded.
+
+
+### Microsoft.Windows.Sediment.OSRSS.ExtractSuccess
+
+This event indicates that the Operating System Remediation System Service (OSRSS) successfully extracted downloaded content. The information provided helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **ServiceVersionMajor** The Major version information of the component.
+- **ServiceVersionMinor** The Minor version information of the component.
+- **Time** The system time at which the event occurred.
+- **Url** The URL from which the successfully extracted content was downloaded.
+
+
+### Microsoft.Windows.Sediment.OSRSS.NewUrlFound
+
+This event indicates the Operating System Remediation System Service (OSRSS) succeeded in finding a new URL to download from. This helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **ServiceVersionMajor** The Major version information of the component.
+- **ServiceVersionMinor** The Minor version information of the component.
+- **Time** The system time at which the event occurred.
+- **Url** The new URL from which content will be downloaded.
+
+
+### Microsoft.Windows.Sediment.OSRSS.ProcessCreated
+
+This event indicates the Operating System Remediation System Service (OSRSS) created a new process to execute content downloaded from the indicated URL. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **ServiceVersionMajor** The Major version information of the component.
+- **ServiceVersionMinor** The Minor version information of the component.
+- **Time** The system time at which the event occurred.
+- **Url** The new URL from which content will be executed.
+
+
+### Microsoft.Windows.Sediment.OSRSS.UrlState
+
+This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL.
+
+The following fields are available:
+
+- **Id** A number identifying the URL
+- **ServiceVersionMajor** Version info for the component
+- **ServiceVersionMinor** Version info for the component
+- **StateData** State-specific data, such as which attempt number for the download
+- **StateNumber** A number identifying which state the URL is in (found, downloading, extracted, etc.)
+- **Time** System timestamp the event was fired
+
+
+### Microsoft.Windows.Sediment.ServiceInstaller.AttemptingUpdate
+
+This event indicates the Operating System Remediation System Service (OSRSS) installer is attempting an update to itself. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **InstallerVersion** The version information of the Installer component.
+- **Time** The system time at which the event occurred.
+
+
+### Microsoft.Windows.Sediment.ServiceInstaller.BinaryUpdated
+
+This event indicates the Operating System Remediation System Service (OSRSS) updated installer binaries with new binaries as part of its self-update process. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **InstallerVersion** The version information of the Installer component.
+- **Time** The system time at which the event occurred.
+
+
+### Microsoft.Windows.Sediment.ServiceInstaller.Error
+
+This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful.
+
+The following fields are available:
+
+- **FailureType** The type of error encountered.
+- **FileName** The code file in which the error occurred.
+- **HResult** The failure error code.
+- **InstallerVersion** The version information of the Installer component.
+- **LineNumber** The line number in the code file at which the error occurred.
+- **Time** The system time at which the event occurred.
+
+
+### Microsoft.Windows.Sediment.ServiceInstaller.InstallerLaunched
+
+This event indicates the Operating System Remediation System Service (OSRSS) has launched. The information provided helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **InstallerVersion** The version information of the Installer component.
+- **Time** The system time at which the event occurred.
+
+
+### Microsoft.Windows.Sediment.ServiceInstaller.ServiceInstalled
+
+This event indicates the Operating System Remediation System Service (OSRSS) successfully installed the Installer Component. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **InstallerVersion** The version information of the Installer component.
+- **Time** The system time at which the event occurred.
+
+
+### Microsoft.Windows.Sediment.ServiceInstaller.ServiceRestarted
+
+This event indicates the Operating System Remediation System Service (OSRSS) has restarted after installing an updated version of itself. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **InstallerVersion** The version information of the Installer component.
+- **Time** The system time at which the event occurred.
+
+
+### Microsoft.Windows.Sediment.ServiceInstaller.ServiceStarted
+
+This event indicates the Operating System Remediation System Service (OSRSS) has started after installing an updated version of itself. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **InstallerVersion** The version information of the Installer component.
+- **Time** The system time at which the event occurred.
+
+
+### Microsoft.Windows.Sediment.ServiceInstaller.ServiceStopped
+
+This event indicates the Operating System Remediation System Service (OSRSS) was stopped by a self-updated to install an updated version of itself. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **InstallerVersion** The version information of the Installer component.
+- **Time** The system time at which the event occurred.
+
+
+### Microsoft.Windows.Sediment.ServiceInstaller.UninstallerCompleted
+
+This event indicates the Operating System Remediation System Service (OSRSS) successfully uninstalled the installed version as part of a self-update. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **InstallerVersion** The version information of the Installer component.
+- **Time** The system time at which the event occurred.
+
+
+### Microsoft.Windows.Sediment.ServiceInstaller.UninstallerLaunched
+
+This event indicates the Operating System Remediation System Service (OSRSS) successfully started the Uninstaller as part of a self-update. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **InstallerVersion** The version information of the Installer component.
+- **Time** The system time at which the event occurred.
+
+
+### Microsoft.Windows.Sediment.ServiceInstaller.UpdaterCompleted
+
+This event indicates the Operating System Remediation System Service (OSRSS) successfully completed the self-update operation. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **InstallerVersion** The version information of the Installer component.
+- **Time** The system time at which the event occurred.
+
+
+### Microsoft.Windows.Sediment.ServiceInstaller.UpdaterLaunched
+
+This event indicates the Operating System Remediation System Service (OSRSS) successfully launched the self-updater after downloading it. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **InstallerVersion** The version information of the Installer component.
+- **Time** The system time at which the event occurred.
+
### Microsoft.Windows.SedimentLauncher.Applicable
@@ -3036,14 +3326,15 @@ Indicates whether a given plugin is applicable.
The following fields are available:
-- **CV** Correlation vector.
-- **DetectedCondition** Boolean true if detect condition is true and action will be run.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **IsSelfUpdateEnabledInOneSettings** True/False based on whether self update is enabled.
-- **IsSelfUpdateNeeded** True/False based on whether a newer version is available.
-- **PackageVersion** Version of the package.
-- **PluginName** Name of the plugin specified for each generic plugin event.
-- **Result** This is the HRESULT for detection or perform action phases of the plugin.
+- **CV** Correlation vector.
+- **DetectedCondition** Boolean true if detect condition is true and perform action will be run.
+- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user.
+- **IsSelfUpdateEnabledInOneSettings** True if self update enabled in Settings.
+- **IsSelfUpdateNeeded** True if self update needed by device.
+- **PackageVersion** Current package version of Remediation.
+- **PluginName** Name of the plugin specified for each generic plugin event.
+- **Result** This is the HRESULT for detection or perform action phases of the plugin.
+
### Microsoft.Windows.SedimentLauncher.Completed
@@ -3051,97 +3342,210 @@ Indicates whether a given plugin has completed its work.
The following fields are available:
-- **CV** Correlation vector.
-- **FailedReasons** String reason for any plugin failures.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **PackageVersion** Current package version of Remediation.
-- **PluginName** Name of the plugin specified for each generic plugin event.
-- **Result** Result of the service execution.
-- **SedLauncherExecutionResult** Final result of launcher running the plugins from the dll.
+- **CV** Correlation vector.
+- **FailedReasons** Concatenated list of failure reasons.
+- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user.
+- **PackageVersion** Current package version of Remediation.
+- **PluginName** Name of the plugin specified for each generic plugin event.
+- **Result** This is the HRESULT for detection or perform action phases of the plugin.
+- **SedLauncherExecutionResult** HRESULT for one execution of the Sediment Launcher.
+
### Microsoft.Windows.SedimentLauncher.Error
-Error occurred during execution of the plugin.
+This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful.
The following fields are available:
-- **Message** Information message returned from a plugin containing only information internal to plugin execution.
-- **PackageVersion** Version of the package.
-- **HResult** Return value from the plugin result.
+- **HResult** The result for the Detection or Perform Action phases of the plug-in.
+- **Message** A message containing information about the error that occurred (if any).
+- **PackageVersion** The version number of the current remediation package.
+
### Microsoft.Windows.SedimentLauncher.FallbackError
-Error occurred during execution of the plugin fallback.
+This event indicates that an error occurred during execution of the plug-in fallback.
The following fields are available:
-- **s0** Fallback error level for plugin.
-- **wilResult** Result from executing Windows Installer Logging based function.
+- **s0** Error occurred during execution of the plugin fallback. See [Microsoft.Windows.SedimentLauncher.wilResult](#microsoftwindowssedimentlauncherwilresult).
+
### Microsoft.Windows.SedimentLauncher.Information
-General information returned from the plugin.
+This event provides general information returned from the plug-in.
The following fields are available:
-- **HResult** Result of the plugin execution.
-- **Message** Information collected from the plugin based on the purpose of the plugin.
-- **PackageVersion** Version of the package.
+- **HResult** This is the HRESULT for detection or perform action phases of the plugin.
+- **Message** Information message returned from a plugin containing only information internal to the plugins execution.
+- **PackageVersion** Current package version of Remediation.
+
### Microsoft.Windows.SedimentLauncher.Started
-Indicates that a given plugin has started.
+This event indicates that a given plug-in has started.
The following fields are available:
-- **CV** Correlation vector.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **PackageVersion** Version of the package.
-- **PluginName** Name of the plugin running.
-- **Result** Return code from the plugin result.
+- **CV** Correlation vector.
+- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user.
+- **PackageVersion** Current package version of Remediation.
+- **PluginName** Name of the plugin specified for each generic plugin event.
+- **Result** This is the HRESULT for detection or perform action phases of the plugin.
+
### Microsoft.Windows.SedimentLauncher.wilResult
-Result from the windows internal library.
+This event provides the result from the Windows internal library.
The following fields are available:
-- **callContext** List of telemetry activities containing this error.
-- **currentContextId** Identifier for the newest telemetry activity containing this error.
-- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any).
-- **currentContextName** Name of the newest telemetry activity containing this error.
-- **failurecount** Number of failures seen.
-- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast.
-- **failureId** Identifier assigned to this failure.
-- **filename** The name of the source file where the error occurred.
-- **function** Name of the function where the error occurred.
-- **hresult** Failure error code.
-- **lineNumber** Line number within the source file where the error occurred.
-- **message** Custom message associated with the failure (if any).
-- **module** Name of the binary where the error occurred.
-- **originatingContextId** Identifier for the oldest telemetry activity containing this error.
-- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any).
-- **originatingContextName** Name of the oldest telemetry activity containing this error.
-- **threadId** Identifier of the thread the error occurred on.
+- **callContext** List of telemetry activities containing this error.
+- **currentContextId** Identifier for the newest telemetry activity containing this error.
+- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any).
+- **currentContextName** Name of the newest telemetry activity containing this error.
+- **failureCount** Number of failures seen within the binary where the error occurred.
+- **failureId** Identifier assigned to this failure.
+- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast).
+- **fileName** Source code file name where the error occurred.
+- **function** Name of the function where the error occurred.
+- **hresult** Failure error code.
+- **lineNumber** Line number within the source code file where the error occurred.
+- **message** Custom message associated with the failure (if any).
+- **module** Name of the binary where the error occurred.
+- **originatingContextId** Identifier for the oldest telemetry activity containing this error.
+- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any).
+- **originatingContextName** Name of the oldest telemetry activity containing this error.
+- **threadId** Identifier of the thread the error occurred on.
+
+
+### Microsoft.Windows.SedimentService.Applicable
+
+This event indicates whether a given plug-in is applicable.
+
+The following fields are available:
+
+- **CV** Correlation vector.
+- **DetectedCondition** Determine whether action needs to run based on device properties.
+- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user.
+- **IsSelfUpdateEnabledInOneSettings** Indicates if self update is enabled in One Settings.
+- **IsSelfUpdateNeeded** Indicates if self update is needed.
+- **PackageVersion** Current package version of Remediation.
+- **PluginName** Name of the plugin.
+- **Result** This is the HRESULT for detection or perform action phases of the plugin.
+
+
+### Microsoft.Windows.SedimentService.Completed
+
+This event indicates whether a given plug-in has completed its work.
+
+The following fields are available:
+
+- **CV** Correlation vector.
+- **FailedReasons** List of reasons when the plugin action failed.
+- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user.
+- **PackageVersion** Current package version of Remediation.
+- **PluginName** Name of the plugin specified for each generic plugin event.
+- **Result** This is the HRESULT for detection or perform action phases of the plugin.
+- **SedimentServiceCheckTaskFunctional** True/False if scheduled task check succeeded.
+- **SedimentServiceCurrentBytes** Number of current private bytes of memory consumed by sedsvc.exe.
+- **SedimentServiceKillService** True/False if service is marked for kill (Shell.KillService).
+- **SedimentServiceMaximumBytes** Maximum bytes allowed for the service.
+- **SedimentServiceRetrievedKillService** True/False if result of One Settings check for kill succeeded - we only send back one of these indicators (not for each call).
+- **SedimentServiceStopping** True/False indicating whether the service is stopping.
+- **SedimentServiceTaskFunctional** True/False if scheduled task is functional. If task is not functional this indicates plugins will be run.
+- **SedimentServiceTotalIterations** Number of 5 second iterations service will wait before running again.
+
+
+### Microsoft.Windows.SedimentService.Error
+
+This event indicates whether an error condition occurred in the plug-in.
+
+The following fields are available:
+
+- **HResult** This is the HRESULT for detection or perform action phases of the plugin.
+- **Message** Custom message associated with the failure (if any).
+- **PackageVersion** Current package version of Remediation.
+
+
+### Microsoft.Windows.SedimentService.FallbackError
+
+This event indicates whether an error occurred for a fallback in the plug-in.
+
+The following fields are available:
+
+- **s0** Event returned when an error occurs for a fallback in the plugin. See [Microsoft.Windows.SedimentService.wilResult](#microsoftwindowssedimentservicewilresult).
+
+
+### Microsoft.Windows.SedimentService.Information
+
+This event provides general information returned from the plug-in.
+
+The following fields are available:
+
+- **HResult** This is the HRESULT for detection or perform action phases of the plugin.
+- **Message** Custom message associated with the failure (if any).
+- **PackageVersion** Current package version of Remediation.
+
+
+### Microsoft.Windows.SedimentService.Started
+
+This event indicates a specified plug-in has started. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **CV** The Correlation Vector.
+- **GlobalEventCounter** The client-side counter that indicates ordering of events.
+- **PackageVersion** The version number of the current remediation package.
+- **PluginName** Name of the plugin specified for each generic plugin event.
+- **Result** This is the HRESULT for Detection or Perform Action phases of the plugin.
+
+
+### Microsoft.Windows.SedimentService.wilResult
+
+This event provides the result from the Windows internal library.
+
+The following fields are available:
+
+- **callContext** List of telemetry activities containing this error.
+- **currentContextId** Identifier for the newest telemetry activity containing this error.
+- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any).
+- **currentContextName** Name of the newest telemetry activity containing this error.
+- **failureCount** Number of failures seen within the binary where the error occurred.
+- **failureId** Identifier assigned to this failure.
+- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast).
+- **fileName** Source code file name where the error occurred.
+- **function** Name of the function where the error occurred.
+- **hresult** Failure error code.
+- **lineNumber** Line number within the source code file where the error occurred.
+- **message** Custom message associated with the failure (if any).
+- **module** Name of the binary where the error occurred.
+- **originatingContextId** Identifier for the oldest telemetry activity containing this error.
+- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any).
+- **originatingContextName** Name of the oldest telemetry activity containing this error.
+- **threadId** Identifier of the thread the error occurred on.
+
## Setup events
### SetupPlatformTel.SetupPlatformTelActivityEvent
-This event sends a unique ID that can be used to bind Setup Platform events together, to help keep Windows up to date.
+This event sends basic metadata about the SetupPlatform update installation process, to help keep Windows up to date.
The following fields are available:
-- **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc.
-- **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc.
-- **Value** Retrieves the value associated with the corresponding event name. For example: For time-related events, this will include the system time.
- **ActivityId** Provides a unique Id to correlate events that occur between a activity start event, and a stop event
- **ActivityName** Provides a friendly name of the package type that belongs to the ActivityId (Setup, LanguagePack, GDR, Driver, etc.)
+- **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc.
+- **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc.
+- **value** Value associated with the corresponding event name. For example, time-related events will include the system time
+- **Value** Value associated with the corresponding event name. For example, time-related events will include the system time
### SetupPlatformTel.SetupPlatformTelActivityStarted
-This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date.
+This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date.
The following fields are available:
@@ -3161,8 +3565,8 @@ This service retrieves events generated by SetupPlatform, the engine that drives
The following fields are available:
- **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc.
-- **Value** Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time.
- **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc.
+- **Value** Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time.
## Shared PC events
@@ -3173,9 +3577,9 @@ Activity for deletion of a user account for devices set up for Shared PC mode as
The following fields are available:
-- **wilActivity** Windows Error Reporting data collected when there is a failure in deleting a user account with the Transient Account Manager.
-- **userSid** The security identifier of the account.
- **accountType** The type of account that was deleted. Example: AD, AAD, or Local
+- **userSid** The security identifier of the account.
+- **wilActivity** Windows Error Reporting data collected when there is a failure in deleting a user account with the Transient Account Manager. See [wilActivity](#wilactivity).
### Microsoft.Windows.SharedPC.AccountManager.SinglePolicyEvaluation
@@ -3184,9 +3588,59 @@ Activity for run of the Transient Account Manager that determines if any user ac
The following fields are available:
-- **wilActivity** Windows Error Reporting data collected when there is a failure in evaluating accounts to be deleted with the Transient Account Manager.
-- **totalAccountCount** The number of accounts on a device after running the Transient Account Manager policies.
- **evaluationTrigger** When was the Transient Account Manager policies ran? Example: At log off or during maintenance hours
+- **totalAccountCount** The number of accounts on a device after running the Transient Account Manager policies.
+- **wilActivity** Windows Error Reporting data collected when there is a failure in evaluating accounts to be deleted with the Transient Account Manager. See [wilActivity](#wilactivity).
+
+
+### wilActivity
+
+This event provides a Windows Internal Library context used for Product and Service diagnostics.
+
+The following fields are available:
+
+- **callContext** The function where the failure occurred.
+- **currentContextId** The ID of the current call context where the failure occurred.
+- **currentContextMessage** The message of the current call context where the failure occurred.
+- **currentContextName** The name of the current call context where the failure occurred.
+- **failureCount** The number of failures for this failure ID.
+- **failureId** The ID of the failure that occurred.
+- **failureType** The type of the failure that occurred.
+- **fileName** The file name where the failure occurred.
+- **function** The function where the failure occurred.
+- **hresult** The HResult of the overall activity.
+- **lineNumber** The line number where the failure occurred.
+- **message** The message of the failure that occurred.
+- **module** The module where the failure occurred.
+- **originatingContextId** The ID of the originating call context that resulted in the failure.
+- **originatingContextMessage** The message of the originating call context that resulted in the failure.
+- **originatingContextName** The name of the originating call context that resulted in the failure.
+- **threadId** The ID of the thread on which the activity is executing.
+
+
+### wilResult
+
+This event provides a Windows Internal Library context used for Product and Service diagnostics.
+
+The following fields are available:
+
+- **callContext** The call context stack where failure occurred.
+- **currentContextId** The ID of the current call context where the failure occurred.
+- **currentContextMessage** The message of the current call context where the failure occurred.
+- **currentContextName** The name of the current call context where the failure occurred.
+- **failureCount** The number of failures for this failure ID.
+- **failureId** The ID of the failure that occurred.
+- **failureType** The type of the failure that occurred.
+- **fileName** The file name where the failure occurred.
+- **function** The function where the failure occurred.
+- **hresult** The HResult of the overall activity.
+- **lineNumber** The line number where the failure occurred.
+- **message** The message of the failure that occurred.
+- **module** The module where the failure occurred.
+- **originatingContextId** The ID of the originating call context that resulted in the failure.
+- **originatingContextMessage** The message of the originating call context that resulted in the failure.
+- **originatingContextName** The name of the originating call context that resulted in the failure.
+- **threadId** The ID of the thread on which the activity is executing.
## Software update events
@@ -3197,81 +3651,80 @@ This event sends tracking data about the software distribution client check for
The following fields are available:
-- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
-- **EventInstanceID** A globally unique identifier for event instance.
-- **DeviceModel** What is the device model.
+- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion.
+- **AllowCachedResults** Indicates if the scan allowed using cached results.
+- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable
+- **BiosFamily** The family of the BIOS (Basic Input Output System).
- **BiosName** The name of the device BIOS.
+- **BiosReleaseDate** The release date of the device BIOS.
+- **BiosSKUNumber** The sku number of the device BIOS.
- **BIOSVendor** The vendor of the BIOS.
- **BiosVersion** The version of the BIOS.
-- **BiosReleaseDate** The release date of the device BIOS.
-- **SystemBIOSMajorRelease** Major version of the BIOS.
-- **SystemBIOSMinorRelease** Minor version of the BIOS.
-- **BiosFamily** The family of the BIOS (Basic Input Output System).
-- **BiosSKUNumber** The sku number of the device BIOS.
-- **ClientVersion** The version number of the software distribution client.
-- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
-- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
-- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.).
-- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult).
-- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
-- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
-- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
-- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
-- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
-- **ShippingMobileOperator** The mobile operator that a device shipped on.
-- **CurrentMobileOperator** The mobile operator the device is currently connected to.
-- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
-- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced.
-- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion.
-- **SyncType** Describes the type of scan the event was
-- **IPVersion** Indicates whether the download took place over IPv4 or IPv6
-- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked
-- **ScanDurationInSeconds** The number of seconds a scan took
-- **ScanEnqueueTime** The number of seconds it took to initialize a scan
-- **NumberOfLoop** The number of round trips the scan required
-- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan
-- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan
-- **ServiceUrl** The environment URL a device is configured to scan with
-- **Online** Indicates if this was an online scan.
-- **AllowCachedResults** Indicates if the scan allowed using cached results.
-- **MetadataIntegrityMode** The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce
-- **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down.
-- **NumFailedMetadataSignatures** The number of metadata signatures checks which failed for new metadata synced down.
-- **MSIError** The last error that was encountered during a scan for updates.
-- **DriverError** The error code hit during a driver scan. This is 0 if no error was encountered.
-- **FailedUpdatesCount** The number of updates that failed to be evaluated during the scan.
-- **FailedUpdateGuids** The GUIDs for the updates that failed to be evaluated during the scan.
-- **CapabilityDetectoidGuid** The GUID for a hardware applicability detectoid that could not be evaluated.
-- **ExtendedMetadataCabUrl** Hostname that is used to download an update.
-- **CDNId** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **CDNCountryCode** Two letter country abbreviation for the CDN's location.
-- **NetworkConnectivityDetected** Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6
-- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
-- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable
-- **WebServiceRetryMethods** Web service method requests that needed to be retried to complete operation.
-- **DeferredUpdates** Update IDs which are currently being deferred until a later time
- **BranchReadinessLevel** The servicing branch configured on the device.
+- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
+- **CapabilityDetectoidGuid** The GUID for a hardware applicability detectoid that could not be evaluated.
+- **CDNCountryCode** Two letter country abbreviation for the Content Distribution Network (CDN) location.
+- **CDNId** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+- **ClientVersion** The version number of the software distribution client.
+- **Context** Gives context on where the error has occurred. Example: AutoEnable, GetSLSData, AddService, Misc, or Unknown
+- **CurrentMobileOperator** The mobile operator the device is currently connected to.
- **DeferralPolicySources** Sources for any update deferral policies defined (GPO = 0x10, MDM = 0x100, Flight = 0x1000, UX = 0x10000).
-- **QualityUpdateDeferral** The deferral period configured for quality OS updates on the device (in days).
-- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
-- **QualityUpdatePausePeriod** The pause duration configured for quality OS updates on the device (in days).
+- **DeferredUpdates** Update IDs which are currently being deferred until a later time
+- **DeviceModel** What is the device model.
+- **DriverError** The error code hit during a driver scan. This is 0 if no error was encountered.
+- **DriverExclusionPolicy** Indicates if the policy for not including drivers with Windows Update is enabled.
+- **DriverSyncPassPerformed** Were drivers scanned this time?
+- **EventInstanceID** A globally unique identifier for event instance.
+- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **ExtendedMetadataCabUrl** Hostname that is used to download an update.
+- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
+- **FailedUpdateGuids** The GUIDs for the updates that failed to be evaluated during the scan.
+- **FailedUpdatesCount** The number of updates that failed to be evaluated during the scan.
- **FeatureUpdateDeferral** The deferral period configured for feature OS updates on the device (in days).
- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
- **FeatureUpdatePausePeriod** The pause duration configured for feature OS updates on the device (in days).
-- **DriverExclusionPolicy** Indicates if the policy for not including drivers with Windows Update is enabled.
-- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
-- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
-- **SearchFilter** Contains information indicating filters applied while checking for content applicable to the device. For example, to filter out all content which may require a reboot.
+- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
+- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
+- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
+- **IPVersion** Indicates whether the download took place over IPv4 or IPv6
+- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
+- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
+- **MetadataIntegrityMode** The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce
+- **MSIError** The last error that was encountered during a scan for updates.
+- **NetworkConnectivityDetected** Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6
+- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
+- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked
+- **NumberOfLoop** The number of round trips the scan required
+- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan
+- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan
+- **NumFailedMetadataSignatures** The number of metadata signatures checks which failed for new metadata synced down.
+- **Online** Indicates if this was an online scan.
- **PausedUpdates** A list of UpdateIds which that currently being paused.
-- **PauseQualityUpdatesStartTime** If quality OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
-- **PauseQualityUpdatesEndTime** If quality OS updates are paused on the device, this is the date and time for the end of the pause time window.
-- **PauseFeatureUpdatesStartTime** If feature OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
- **PauseFeatureUpdatesEndTime** If feature OS updates are paused on the device, this is the date and time for the end of the pause time window.
-- **Context** Gives context on where the error has occurred. Example: AutoEnable, GetSLSData, AddService, Misc, or Unknown
-- **DriverSyncPassPerformed** Were drivers scanned this time?
+- **PauseFeatureUpdatesStartTime** If feature OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
+- **PauseQualityUpdatesEndTime** If quality OS updates are paused on the device, this is the date and time for the end of the pause time window.
+- **PauseQualityUpdatesStartTime** If quality OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
+- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced.
+- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
+- **QualityUpdateDeferral** The deferral period configured for quality OS updates on the device (in days).
+- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
+- **QualityUpdatePausePeriod** The pause duration configured for quality OS updates on the device (in days).
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
+- **ScanDurationInSeconds** The number of seconds a scan took
+- **ScanEnqueueTime** The number of seconds it took to initialize a scan
+- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Windows Store, etc.).
+- **ServiceUrl** The environment URL a device is configured to scan with
+- **ShippingMobileOperator** The mobile operator that a device shipped on.
+- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult).
+- **SyncType** Describes the type of scan the event was
+- **SystemBIOSMajorRelease** Major version of the BIOS.
+- **SystemBIOSMinorRelease** Minor version of the BIOS.
+- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
+- **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down.
+- **WebServiceRetryMethods** Web service method requests that needed to be retried to complete operation.
+- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
### SoftwareUpdateClientTelemetry.Commit
@@ -3280,28 +3733,28 @@ This event sends data on whether the Update Service has been called to execute a
The following fields are available:
-- **EventScenario** State of call
-- **EventInstanceID** A globally unique identifier for event instance.
-- **DeviceModel** What is the device model.
+- **BiosFamily** The family of the BIOS (Basic Input Output System).
- **BiosName** The name of the device BIOS.
+- **BiosReleaseDate** The release date of the device BIOS.
+- **BiosSKUNumber** The sku number of the device BIOS.
- **BIOSVendor** The vendor of the BIOS.
- **BiosVersion** The version of the BIOS.
-- **BiosReleaseDate** The release date of the device BIOS.
+- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
+- **BundleRevisionNumber** Identifies the revision number of the content bundle
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
+- **ClientVersion** The version number of the software distribution client.
+- **DeviceModel** What is the device model.
+- **EventInstanceID** A globally unique identifier for event instance.
+- **EventScenario** State of call
+- **EventType** Possible values are "Child", "Bundle", or "Driver".
+- **FlightId** The specific id of the flight the device is getting
+- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.)
+- **RevisionNumber** Unique revision number of Update
+- **ServerId** Identifier for the service to which the software distribution client is connecting, such as Windows Update and Windows Store.
- **SystemBIOSMajorRelease** Major version of the BIOS.
- **SystemBIOSMinorRelease** Minor version of the BIOS.
-- **BiosFamily** The family of the BIOS (Basic Input Output System).
-- **BiosSKUNumber** The sku number of the device BIOS.
-- **ClientVersion** The version number of the software distribution client.
-- **WUDeviceID** UniqueDeviceID
-- **ServerId** Identifier for the service to which the software distribution client is connecting, such as Windows Update and Microsoft Store.
-- **EventType** Possible values are "Child", "Bundle", or "Driver".
- **UpdateId** Unique Update ID
-- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
-- **RevisionNumber** Unique revision number of Update
-- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.)
-- **BundleRevisionNumber** Identifies the revision number of the content bundle
-- **FlightId** The specific id of the flight the device is getting
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
+- **WUDeviceID** UniqueDeviceID
### SoftwareUpdateClientTelemetry.Download
@@ -3310,82 +3763,105 @@ This event sends tracking data about the software distribution client download o
The following fields are available:
-- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started downloading content, or whether it was cancelled, succeeded, or failed.
-- **EventInstanceID** A globally unique identifier for event instance.
-- **DeviceModel** What is the device model.
+- **ActiveDownloadTime** How long the download took, in seconds, excluding time where the update wasn't actively being downloaded.
+- **AppXBlockHashValidationFailureCount** A count of the number of blocks that have failed validation after being downloaded.
+- **AppXDownloadScope** Indicates the scope of the download for application content. For streaming install scenarios, AllContent - non-streaming download, RequiredOnly - streaming download requested content required for launch, AutomaticOnly - streaming download requested automatic streams for the app, and Unknown - for events sent before download scope is determined by the Windows Update client.
+- **BiosFamily** The family of the BIOS (Basic Input Output System).
- **BiosName** The name of the device BIOS.
+- **BiosReleaseDate** The release date of the device BIOS.
+- **BiosSKUNumber** The sku number of the device BIOS.
- **BIOSVendor** The vendor of the BIOS.
- **BiosVersion** The version of the BIOS.
-- **BiosReleaseDate** The release date of the device BIOS.
-- **SystemBIOSMajorRelease** Major version of the BIOS.
-- **SystemBIOSMinorRelease** Minor version of the BIOS.
-- **BiosFamily** The family of the BIOS (Basic Input Output System).
-- **BiosSKUNumber** The sku number of the device BIOS.
-- **ClientVersion** The version number of the software distribution client.
-- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+- **BundleBytesDownloaded** How many bytes were downloaded for the specific content bundle.
+- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
+- **BundleRepeatFailFlag** Indicates whether this particular update bundle had previously failed to download.
+- **BundleRevisionNumber** Identifies the revision number of the content bundle.
+- **BytesDownloaded** How many bytes were downloaded for an individual piece of content (not the entire bundle).
+- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
-- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
-- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Microsoft Store, etc.).
-- **StatusCode** Indicates the result of a Download event (success, cancellation, failure code HResult).
-- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
-- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
-- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
-- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
-- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
-- **ShippingMobileOperator** The mobile operator that a device shipped on.
+- **CbsDownloadMethod** Indicates whether the download was a full-file download or a partial/delta download.
+- **CDNCountryCode** Two letter country abbreviation for the Content Distribution Network (CDN) location.
+- **CDNId** ID which defines which CDN the software distribution client downloaded the content from.
+- **ClientManagedByWSUSServer** Indicates whether the client is managed by Windows Server Update Services (WSUS).
+- **ClientVersion** The version number of the software distribution client.
- **CurrentMobileOperator** The mobile operator the device is currently connected to.
+- **DeviceModel** What is the device model.
+- **DeviceOEM** What OEM does this device belong to.
+- **DownloadPriority** Indicates whether a download happened at background, normal, or foreground priority.
+- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
+- **DownloadType** Differentiates the download type of SIH downloads between Metadata and Payload downloads.
+- **Edition** Indicates the edition of Windows being used.
+- **EventInstanceID** A globally unique identifier for event instance.
+- **EventNamespaceID** Indicates whether the event succeeded or failed. Has the format EventType+Event where Event is Succeeded, Cancelled, Failed, etc.
+- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started downloading content, or whether it was cancelled, succeeded, or failed.
+- **EventType** Possible values are Child, Bundle, or Driver.
+- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
+- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
+- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
+- **FlightBuildNumber** If this download was for a flight (pre-release build), this indicates the build number of that flight.
+- **FlightId** The specific id of the flight (pre-release build) the device is getting.
+- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
+- **HandlerType** Indicates what kind of content is being downloaded (app, driver, windows patch, etc.).
+- **HardwareId** If this download was for a driver targeted to a particular device model, this ID indicates the model of the device.
- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
-- **PhonePreviewEnabled** Indicates whether a phone was opted-in to getting preview builds, prior to flighting (pre-release builds) being introduced.
+- **HostName** The hostname URL the content is downloading from.
- **IPVersion** Indicates whether the download took place over IPv4 or IPv6.
+- **IsAOACDevice** Is it Always On, Always Connected?
+- **IsDependentSet** Indicates whether a driver is a part of a larger System Hardware/Firmware Update
+- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
+- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
- **NetworkCostBitMask** Indicates what kind of network the device is connected to (roaming, metered, over data cap, etc.)
- **NetworkRestrictionStatus** More general version of NetworkCostBitMask, specifying whether Windows considered the current network to be "metered."
-- **TimeToEstablishConnection** Time (in ms) it took to establish the connection prior to beginning downloaded.
-- **HostName** The hostname URL the content is downloading from.
-- **CDNId** ID which defines which CDN the software distribution client downloaded the content from.
-- **CDNCountryCode** Two letter country abbreviation for the CDN's location.
-- **ActiveDownloadTime** How long the download took, in seconds, excluding time where the update wasn't actively being downloaded.
-- **IsDependentSet** Indicates whether a driver is a part of a larger System Hardware/Firmware Update
-- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
-- **HardwareId** If this download was for a driver targeted to a particular device model, this ID indicates the model of the device.
-- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
-- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
-- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to download.
-- **BytesDownloaded** How many bytes were downloaded for an individual piece of content (not the entire bundle).
-- **TotalExpectedBytes** The total count of bytes that the download is expected to be.
-- **ThrottlingServiceHResult** Result code (success/failure) while contacting a web service to determine whether this device should download content yet.
-- **EventType** Possible values are Child, Bundle, or Driver.
-- **UpdateId** An identifier associated with the specific piece of content.
-- **RevisionNumber** Identifies the revision number of this specific piece of content.
-- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
-- **BundleRevisionNumber** Identifies the revision number of the content bundle.
-- **HandlerType** Indicates what kind of content is being downloaded (app, driver, windows patch, etc.).
-- **DownloadPriority** Indicates whether a download happened at background, normal, or foreground priority.
-- **FlightId** The specific id of the flight (pre-release build) the device is getting.
-- **Setup360Phase** If the download is for an operating system upgrade, this datapoint indicates which phase of the upgrade is underway.
-- **UsedDO** Whether the download used the delivery optimization service.
-- **CbsDownloadMethod** Indicates whether the download was a full-file download or a partial/delta download.
-- **UsedSystemVolume** Indicates whether the content was downloaded to the device's main system storage drive, or an alternate storage drive.
-- **FlightBuildNumber** If this download was for a flight (pre-release build), this indicates the build number of that flight.
-- **BundleBytesDownloaded** How many bytes were downloaded for the specific content bundle.
-- **BundleRepeatFailFlag** Indicates whether this particular update bundle had previously failed to download.
-- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
- **PackageFullName** The package name of the content.
-- **AppXBlockHashValidationFailureCount** A count of the number of blocks that have failed validation after being downloaded.
-- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
-- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
-- **DownloadType** Differentiates the download type of SIH downloads between Metadata and Payload downloads.
-- **WUSetting** Indicates the users' current updating settings.
-- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM).
+- **PhonePreviewEnabled** Indicates whether a phone was opted-in to getting preview builds, prior to flighting (pre-release builds) being introduced.
- **PlatformRole** The PowerPlatformRole as defined on MSDN
-- **IsAOACDevice** Is it Always On, Always Connected?
-- **EventNamespaceID** Indicates whether the event succeeded or failed. Has the format EventType+Event where Event is Succeeded, Cancelled, Failed, etc.
-- **Edition** Indicates the edition of Windows being used.
-- **DeviceOEM** What OEM does this device belong to.
-- **ClientManagedByWSUSServer** Indicates whether the client is managed by Windows Server Update Services (WSUS).
+- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
+- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM).
- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
-- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
-- **AppXDownloadScope** Indicates the scope of the download for application content. For streaming install scenarios, AllContent - non-streaming download, RequiredOnly - streaming download requested content required for launch, AutomaticOnly - streaming download requested automatic streams for the app, and Unknown - for events sent before download scope is determined by the Windows Update client.
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
+- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to download.
+- **RevisionNumber** Identifies the revision number of this specific piece of content.
+- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Microsoft Store, etc.).
+- **Setup360Phase** If the download is for an operating system upgrade, this datapoint indicates which phase of the upgrade is underway.
+- **ShippingMobileOperator** The mobile operator that a device shipped on.
+- **StatusCode** Indicates the result of a Download event (success, cancellation, failure code HResult).
+- **SystemBIOSMajorRelease** Major version of the BIOS.
+- **SystemBIOSMinorRelease** Minor version of the BIOS.
+- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
+- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
+- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
+- **ThrottlingServiceHResult** Result code (success/failure) while contacting a web service to determine whether this device should download content yet.
+- **TimeToEstablishConnection** Time (in ms) it took to establish the connection prior to beginning downloaded.
+- **TotalExpectedBytes** The total count of bytes that the download is expected to be.
+- **UpdateId** An identifier associated with the specific piece of content.
+- **UpdateID** An identifier associated with the specific piece of content.
+- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
+- **UsedDO** Whether the download used the delivery optimization service.
+- **UsedSystemVolume** Indicates whether the content was downloaded to the device's main system storage drive, or an alternate storage drive.
+- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+- **WUSetting** Indicates the users' current updating settings.
+
+
+### SoftwareUpdateClientTelemetry.DownloadCheckpoint
+
+This event provides a checkpoint between each of the Windows Update download phases for UUP content
+
+The following fields are available:
+
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
+- **ClientVersion** The version number of the software distribution client
+- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
+- **EventType** Possible values are "Child", "Bundle", "Relase" or "Driver"
+- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough
+- **FileId** A hash that uniquely identifies a file
+- **FileName** Name of the downloaded file
+- **FlightId** The unique identifier for each flight
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
+- **RevisionNumber** Unique revision number of Update
+- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.)
+- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult)
+- **UpdateId** Unique Update ID
+- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
### SoftwareUpdateClientTelemetry.Install
@@ -3394,78 +3870,79 @@ This event sends tracking data about the software distribution client installati
The following fields are available:
-- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
-- **EventInstanceID** A globally unique identifier for event instance.
-- **DeviceModel** What is the device model.
+- **BiosFamily** The family of the BIOS (Basic Input Output System).
- **BiosName** The name of the device BIOS.
+- **BiosReleaseDate** The release date of the device BIOS.
+- **BiosSKUNumber** The sku number of the device BIOS.
- **BIOSVendor** The vendor of the BIOS.
- **BiosVersion** The version of the BIOS.
-- **BiosReleaseDate** The release date of the device BIOS.
-- **SystemBIOSMajorRelease** Major version of the BIOS.
-- **SystemBIOSMinorRelease** Minor version of the BIOS.
-- **BiosFamily** The family of the BIOS (Basic Input Output System).
-- **BiosSKUNumber** The sku number of the device BIOS.
-- **ClientVersion** The version number of the software distribution client.
-- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
-- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
-- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Microsoft Store, etc.).
-- **StatusCode** Indicates the result of an installation event (success, cancellation, failure code HResult).
-- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
-- **FlightRing** The ring that a device is on if participating in the Windows Insider Program.
-- **FlightBranch** The branch that a device is on if participating in the Windows Insider Program.
-- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **IsWUfBEnabled** Is Windows Update for Business enabled on the device?
-- **IsWUfBDualScanEnabled** Is Windows Update for Business dual scan enabled on the device?
-- **ShippingMobileOperator** The mobile operator that a device shipped on.
-- **CurrentMobileOperator** Mobile operator that device is currently connected to.
-- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
-- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting being introduced.
-- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
-- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to install.
-- **EventType** Possible values are Child, Bundle, or Driver.
-- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
-- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
-- **IsFirmware** Is this update a firmware update?
-- **IsFinalOutcomeEvent** Does this event signal the end of the update/upgrade process?
-- **IsDependentSet** Is the driver part of a larger System Hardware/Firmware update?
-- **DriverPingBack** Contains information about the previous driver and system state.
-- **ExtendedErrorCode** The extended error code.
-- **CSIErrorType** The stage of CBS installation where it failed.
-- **MsiAction** The stage of MSI installation where it failed.
-- **MsiProductCode** The unique identifier of the MSI installer.
-- **TransactionCode** The ID which represents a given MSI installation
-- **HardwareId** If this install was for a driver targeted to a particular device model, this ID indicates the model of the device.
-- **IsSuccessFailurePostReboot** Did it succeed and then fail after a restart?
-- **UpdateId** Unique update ID
-- **RevisionNumber** The revision number of this specific piece of content.
-- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
-- **BundleRevisionNumber** Identifies the revision number of the content bundle.
-- **HandlerType** Indicates what kind of content is being installed. Example: app, driver, Windows update
-- **FlightId** The specific ID of the Windows Insider build the device is getting.
-- **Setup360Phase** If the install is for an operating system upgrade, indicates which phase of the upgrade is underway.
-- **UsedSystemVolume** Indicates whether the content was downloaded and then installed from the device's main system storage drive, or an alternate storage drive.
-- **FlightBuildNumber** If this installation was for a Windows Insider build, this is the build number of that build.
-- **BundleRepeatFailFlag** Has this particular update bundle previously failed to install?
-- **PackageFullName** The package name of the content being installed.
-- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
- **BundleBytesDownloaded** How many bytes were downloaded for the specific content bundle?
+- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
+- **BundleRepeatFailFlag** Has this particular update bundle previously failed to install?
+- **BundleRevisionNumber** Identifies the revision number of the content bundle.
+- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
- **CbsDownloadMethod** Was the download a full download or a partial download?
- **ClientManagedByWSUSServer** Is the client managed by Windows Server Update Services (WSUS)?
+- **ClientVersion** The version number of the software distribution client.
+- **CSIErrorType** The stage of CBS installation where it failed.
+- **CurrentMobileOperator** Mobile operator that device is currently connected to.
+- **DeviceModel** What is the device model.
- **DeviceOEM** What OEM does this device belong to.
- **DownloadPriority** The priority of the download activity.
- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
+- **DriverPingBack** Contains information about the previous driver and system state.
- **Edition** Indicates the edition of Windows being used.
+- **EventInstanceID** A globally unique identifier for event instance.
- **EventNamespaceID** Indicates whether the event succeeded or failed. Has the format EventType+Event where Event is Succeeded, Cancelled, Failed, etc.
-- **IsAOACDevice** Is it Always On, Always Connected? (Mobile device usage model)
-- **PlatformRole** The PowerPlatformRole as defined on MSDN.
-- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM).
-- **RepeatSuccessInstallFlag** Indicates whether this specific piece of content had previously installed successful, for example if another user had already installed it.
-- **WUSetting** Indicates the user's current updating settings.
-- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
-- **QualityUpdatePause** Are quality OS updates paused on the device?
+- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
+- **EventType** Possible values are Child, Bundle, or Driver.
+- **ExtendedErrorCode** The extended error code.
+- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
- **FeatureUpdatePause** Are feature OS updates paused on the device?
+- **FlightBranch** The branch that a device is on if participating in the Windows Insider Program.
+- **FlightBuildNumber** If this installation was for a Windows Insider build, this is the build number of that build.
+- **FlightId** The specific ID of the Windows Insider build the device is getting.
+- **FlightRing** The ring that a device is on if participating in the Windows Insider Program.
+- **HandlerType** Indicates what kind of content is being installed. Example: app, driver, Windows update
+- **HardwareId** If this install was for a driver targeted to a particular device model, this ID indicates the model of the device.
+- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
+- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
+- **IsAOACDevice** Is it Always On, Always Connected? (Mobile device usage model)
+- **IsDependentSet** Is the driver part of a larger System Hardware/Firmware update?
+- **IsFinalOutcomeEvent** Does this event signal the end of the update/upgrade process?
+- **IsFirmware** Is this update a firmware update?
+- **IsSuccessFailurePostReboot** Did it succeed and then fail after a restart?
+- **IsWUfBDualScanEnabled** Is Windows Update for Business dual scan enabled on the device?
+- **IsWUfBEnabled** Is Windows Update for Business enabled on the device?
- **MergedUpdate** Was the OS update and a BSP update merged for installation?
+- **MsiAction** The stage of MSI installation where it failed.
+- **MsiProductCode** The unique identifier of the MSI installer.
+- **PackageFullName** The package name of the content being installed.
+- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting being introduced.
+- **PlatformRole** The PowerPlatformRole as defined on MSDN.
+- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
+- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM).
+- **QualityUpdatePause** Are quality OS updates paused on the device?
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
+- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to install.
+- **RepeatSuccessInstallFlag** Indicates whether this specific piece of content had previously installed successful, for example if another user had already installed it.
+- **RevisionNumber** The revision number of this specific piece of content.
+- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Windows Store, etc.).
+- **Setup360Phase** If the install is for an operating system upgrade, indicates which phase of the upgrade is underway.
+- **ShippingMobileOperator** The mobile operator that a device shipped on.
+- **StatusCode** Indicates the result of an installation event (success, cancellation, failure code HResult).
+- **SystemBIOSMajorRelease** Major version of the BIOS.
+- **SystemBIOSMinorRelease** Minor version of the BIOS.
+- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
+- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
+- **TransactionCode** The ID which represents a given MSI installation
+- **UpdateId** Unique update ID
+- **UpdateID** An identifier associated with the specific piece of content.
+- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
+- **UsedSystemVolume** Indicates whether the content was downloaded and then installed from the device's main system storage drive, or an alternate storage drive.
+- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+- **WUSetting** Indicates the user's current updating settings.
### SoftwareUpdateClientTelemetry.SLSDiscovery
@@ -3475,13 +3952,13 @@ This event sends data about the ability of Windows to discover the location of a
The following fields are available:
- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
-- **SusClientId** The unique device ID controlled by the software distribution client
-- **WUAVersion** The version number of the software distribution client
-- **ServiceID** An ID which represents which service the software distribution client is connecting to (Windows Update, Microsoft Store, etc.)
-- **UrlPath** Path to the SLS cab that was downloaded
- **HResult** Indicates the result code of the event (success, cancellation, failure code HResult)
- **IsBackground** Indicates whether the SLS discovery event took place in the foreground or background
- **NextExpirationTime** Indicates when the SLS cab expires
+- **ServiceID** An ID which represents which service the software distribution client is connecting to (Windows Update, Microsoft Store, etc.)
+- **SusClientId** The unique device ID controlled by the software distribution client
+- **UrlPath** Path to the SLS cab that was downloaded
+- **WUAVersion** The version number of the software distribution client
### SoftwareUpdateClientTelemetry.UpdateDetected
@@ -3490,44 +3967,13 @@ This event sends data about an AppX app that has been updated from the Microsoft
The following fields are available:
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
-- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable
-- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
-- **WUDeviceID** The unique device ID controlled by the software distribution client
-- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
-- **EventInstanceID** A globally unique identifier for event instance
-- **DeviceModel** The device's model as defined in system bios
-- **BiosName** The name of the device's system bios
-- **BIOSVendor** The vendor of the device's system bios
-- **BiosVersion** The version of the device's system bios
-- **BiosReleaseDate** The release date of the device's system bios
-- **SystemBIOSMajorRelease** The major release version of the device's system bios
-- **SystemBIOSMinorRelease** The minor release version of the device's system bios
-- **BiosFamily** The device's family as defined in system bios
-- **BiosSKUNumber** The device's SKU as defined in system bios
-- **ClientVersion** The version number of the software distribution client
-- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided
-- **ServiceGuid** An ID which represents which service the software distribution client is connecting to (Windows Update, Microsoft Store, etc.)
-- **StatusCode** Indicates the result code of the event (success, cancellation, failure code HResult)
-- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode wasn't specific enough
-- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
-- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
-- **ShippingMobileOperator** The mobile operator that a device shipped on.
-- **CurrentMobileOperator** The mobile operator the device is currently connected to.
-- **HomeMobileOperator** The mobile operator that the device was originally intended to work with
-- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced.
-- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion
-- **SyncType** Describes the type of scan the event was
-- **IPVersion** Indicates whether the download took place over IPv4 or IPv6
-- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked
-- **ScanDurationInSeconds** The number of seconds a scan took
-- **ScanEnqueueTime** The number of seconds it took to initialize a scan
-- **NumberOfLoop** The number of round trips the scan required
-- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan
-- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan
-- **ServiceUrl** The environment URL a device is configured to scan with
+- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable.
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
+- **NumberOfApplicableUpdates** The number of updates ultimately deemed applicable to the system after the detection process is complete.
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one.
+- **ServiceGuid** An ID that represents which service the software distribution client is connecting to (Windows Update, Windows Store, etc.).
+- **WUDeviceID** The unique device ID controlled by the software distribution client.
### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity
@@ -3536,94 +3982,112 @@ This event identifies whether updates have been tampered with and protects again
The following fields are available:
+- **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments.
- **EventScenario** The purpose of this event, such as scan started, scan succeeded, or scan failed.
-- **ServiceGuid** Identifies the service to which the software distribution client is connected, Example: Windows Update or Microsoft Store
-- **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce
-- **StatusCode** The status code of the event.
- **ExtendedStatusCode** The secondary status code of the event.
-- **RevisionId** The revision ID for a specific piece of content.
-- **UpdateId** The update ID for a specific piece of content.
-- **RevisionNumber** The revision number for a specific piece of content.
-- **TimestampTokenId** The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed.
- **LeafCertId** Integral ID from the FragmentSigning data for certificate that failed.
-- **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate.
+- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
+- **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce
- **MetadataSignature** A base64-encoded string of the signature associated with the update metadata (specified by revision ID).
-- **SignatureAlgorithm** The hash algorithm for the metadata signature.
-- **SHA256OfTimestampToken** A base64-encoded string of hash of the timestamp token blob.
-- **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp.
-- **TimestampTokenCertThumbprint** The thumbprint of the encoded timestamp token.
- **RawMode** The raw unparsed mode string from the SLS response. This field is null if not applicable.
- **RawValidityWindowInDays** The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable.
+- **RevisionId** The revision ID for a specific piece of content.
+- **RevisionNumber** The revision number for a specific piece of content.
+- **ServiceGuid** Identifies the service to which the software distribution client is connected, Example: Windows Update or Windows Store
- **SHA256OfLeafCerData** A base64 encoding of the hash for the Base64CerData in the FragmentSigning data of the leaf certificate.
-- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
-- **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments.
+- **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate.
+- **SHA256OfTimestampToken** A base64-encoded string of hash of the timestamp token blob.
+- **SignatureAlgorithm** The hash algorithm for the metadata signature.
- **SLSPrograms** A test program to which a device may have opted in. Example: Insider Fast
+- **StatusCode** The status code of the event.
+- **TimestampTokenCertThumbprint** The thumbprint of the encoded timestamp token.
+- **TimestampTokenId** The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed.
+- **UpdateId** The update ID for a specific piece of content.
+- **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp.
-## Update Assistant Orchestrator events
->[!NOTE]
->Events from this provider are sent with the installation of KB4023814. For details, see [this support article](https://support.microsoft.com/help/4023814).
+## Update Assistant events
### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId
-Event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies..
+The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies.
The following fields are available:
-- **ApplicabilityBlockedReason** Blocked due to an applicability issue.
-- **ClientId** Identification of the current installed version of Update Assistant.
-- **TriggerTaskSource** Describes which task launched this instance of Update Assistant.
+- **ApplicabilityBlockedReason** Blocked due to an applicability issue.
+- **BlockWuUpgrades** The upgrade assistant is currently blocked.
+- **clientID** An identification of the current release of Update Assistant.
+- **CloverTrail** This device is Clovertrail.
+- **DeviceIsMdmManaged** This device is MDM managed.
+- **IsNetworkAvailable** If the device network is not available.
+- **IsNetworkMetered** If network is metered.
+- **IsSccmManaged** This device is SCCM managed.
+- **NewlyInstalledOs** OS is newly installed quiet period.
+- **PausedByPolicy** Updates are paused by policy.
+- **RecoveredFromRS3** Previously recovered from RS3.
+- **RS1UninstallActive** Blocked due to an active RS1 uninstall.
+- **RS3RollBacks** Exceeded number of allowable RS3 rollbacks.
+- **triggerTaskSource** Describe which task launches this instance.
+- **WsusManaged** This device is WSUS managed.
+- **ZeroExhaust** This device is zero exhaust.
+
### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId
-Event sends basic info on the reason the Windows 10 update was blocked or prevented.
+The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version.
The following fields are available:
-- **ClientId** Identification of the current installed version of Update Assistant.
-- **DenyReason** Reasons why Update Assistant was prevented from launching.
-- **TriggerTaskSource** Describes which task launched this instance of Update Assistant.
+- **clientID** An identification of the current release of Update Assistant.
+- **denyReason** All the reasons why the Update Assistant was prevented from launching. Bitmask with values from UpdateAssistant.cpp eUpgradeModeReason.
+- **triggerTaskSource** Describe which task launches this instance.
+
### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId
-Event sends basic info when the Windows 10 Update Assistant tool could not be launched due to an error..
+Event to mark that Update Assistant Orchestrator failed to launch Update Assistant.
The following fields are available:
-- **ClientId** Identification of the current installed version of Update Assistant.
-- **HResult** Error code of the Update Assistant Orchestrator error.
-- **TriggerTaskSource** Describes which task launched this instance of Update Assistant.
+- **clientID** An identification of the current release of Update Assistant.
+- **hResult** Error code of the Update Assistant Orchestrator failure.
+- **triggerTaskSource** Describe which task launches this instance.
+
### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId
-Event sends basic info to signal when the settings related to the Windows 10 update could not be downloaded.
+Event indicating One Settings was not queried by update assistant.
The following fields are available:
-- **ClientId** Identification of the current installed version of Update Assistant.
-- **HResult** Error code of the attempted query for the settings.
+- **clientID** An identification of the current release of Update Assistant.
+- **hResult** Error code of One Settings query failure.
+
### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId
-Event sends basic info on whether the device should or should not be updated to the latest Windows 10 version.
+This event sends basic information on whether the device should be updated to the latest Windows 10 version.
The following fields are available:
-- **ClientId** Identification of the current installed version of Update Assistant.
-- **LaunchMode** Type of launch performed.
-- **LaunchTypeReason** All of the reasons for the type of launch performed.
-- **TriggerTaskSource** Describes which task launched this instance of Update Assistant.
-- **UALaunchRunCount** Total number of times Update Assistant was launched.
+- **autoStartRunCount** The auto start run count of Update Assistant.
+- **clientID** The ID of the current release of Update Assistant.
+- **launchMode** Indicates the type of launch performed.
+- **launchTypeReason** A bitmask of all the reasons for type of launch.
+- **triggerTaskSource** Indicates which task launches this instance.
+- **UALaunchRunCount** Total number of times Update Assistant launched.
+
### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId
-Event sends basic info on whether the Windows 10 update notification had launched previously.
+The event sends basic info on whether the Windows 10 update notification has previously launched.
The following fields are available:
-- **ClientId** Identification of the current installed version of Update Assistant.
-- **RestoreReason** All of the reasons for being restored.
-- **TriggerTaskSource** Describes which task launched this instance of Update Assistant.
+- **clientID** ID of the current release of Update Assistant.
+- **restoreReason** All the reasons for the restore.
+- **triggerTaskSource** Indicates which task launches this instance.
+
## Update events
@@ -3633,25 +4097,25 @@ This event sends data during the download request phase of updating Windows.
The following fields are available:
+- **DeletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted.
- **ErrorCode** The error code returned for the current download request phase.
-- **PackageCountTotal** Total number of packages needed.
-- **PackageCountRequired** Number of required packages requested.
-- **PackageCountOptional** Number of optional packages requested.
-- **ObjectId** Unique value for each Update Agent mode.
-- **SessionId** Unique value for each Update Agent mode attempt.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
-- **Result** Result of the download request phase of update.
-- **PackageSizeCanonical** Size of canonical packages in bytes
-- **PackageSizeDiff** Size of diff packages in bytes
-- **PackageSizeExpress** Size of express packages in bytes
- **FlightId** Unique ID for each flight.
-- **UpdateId** Unique ID for each update.
+- **ObjectId** Unique value for each Update Agent mode.
+- **PackageCountOptional** Number of optional packages requested.
+- **PackageCountRequired** Number of required packages requested.
+- **PackageCountTotal** Total number of packages needed.
- **PackageCountTotalCanonical** Total number of canonical packages.
- **PackageCountTotalDiff** Total number of diff packages.
- **PackageCountTotalExpress** Total number of express packages.
+- **PackageSizeCanonical** Size of canonical packages in bytes
+- **PackageSizeDiff** Size of diff packages in bytes
+- **PackageSizeExpress** Size of express packages in bytes
- **RangeRequestState** Represents the state of the download range request.
-- **DeletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **Result** Result of the download request phase of update.
+- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **SessionId** Unique value for each Update Agent mode attempt.
+- **UpdateId** Unique ID for each update.
### Update360Telemetry.UpdateAgent_Initialize
@@ -3661,15 +4125,15 @@ This event sends data during the initialize phase of updating Windows.
The following fields are available:
- **ErrorCode** The error code returned for the current initialize phase.
-- **SessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios).
-- **UpdateId** Unique ID for each update.
- **FlightId** Unique ID for each flight.
- **FlightMetadata** Contains the FlightId and the build being flighted.
- **ObjectId** Unique value for each Update Agent mode.
-- **SessionId** Unique value for each Update Agent mode attempt .
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
- **RelatedCV** Correlation vector value generated from the latest USO scan.
- **Result** Result of the initialize phase of update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
+- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **SessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios).
+- **SessionId** Unique value for each Update Agent mode attempt .
+- **UpdateId** Unique ID for each update.
### Update360Telemetry.UpdateAgent_Install
@@ -3679,12 +4143,12 @@ This event sends data during the install phase of updating Windows.
The following fields are available:
- **ErrorCode** The error code returned for the current install phase.
-- **ObjectId** Unique value for each Update Agent mode.
-- **SessionId** Unique value for each Update Agent mode attempt.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **RelatedCV** Correlation vector value generated from the latest scan.
-- **Result** Result of the install phase of update. 0 = Succeeded 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
- **FlightId** Unique ID for each flight.
+- **ObjectId** Unique value for each Update Agent mode.
+- **RelatedCV** Correlation vector value generated from the latest scan.
+- **Result** Result of the install phase of update. 0 = Succeeded 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
+- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **SessionId** Unique value for each Update Agent mode attempt.
- **UpdateId** Unique ID for each update.
@@ -3694,12 +4158,12 @@ This event sends data for the start of each mode during the process of updating
The following fields are available:
+- **FlightId** Unique ID for each flight.
- **Mode** Indicates that the Update Agent mode that has started. 1 = Initialize, 2 = DownloadRequest, 3 = Install, 4 = Commit
- **ObjectId** Unique value for each Update Agent mode.
-- **SessionId** Unique value for each Update Agent mode attempt.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
- **RelatedCV** The correlation vector value generated from the latest scan.
-- **FlightId** Unique ID for each flight.
+- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **SessionId** Unique value for each Update Agent mode attempt.
- **UpdateId** Unique ID for each update.
@@ -3709,101 +4173,101 @@ This event sends data during the launching of the setup box when updating Window
The following fields are available:
-- **Quiet** Indicates whether setup is running in quiet mode. 0 = false 1 = true
-- **ObjectId** Unique value for each Update Agent mode.
-- **SessionId** Unique value for each Update Agent mode attempt.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **RelatedCV** Correlation vector value generated from the latest scan.
- **FlightId** Unique ID for each flight.
-- **UpdateId** Unique ID for each update.
-- **SetupMode** Setup mode 1 = predownload, 2 = install, 3 = finalize
+- **ObjectId** Unique value for each Update Agent mode.
+- **Quiet** Indicates whether setup is running in quiet mode. 0 = false 1 = true
+- **RelatedCV** Correlation vector value generated from the latest scan.
- **SandboxSize** The size of the sandbox folder on the device.
+- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **SessionId** Unique value for each Update Agent mode attempt.
+- **SetupMode** Setup mode 1 = predownload, 2 = install, 3 = finalize
+- **UpdateId** Unique ID for each update.
## Upgrade events
### Setup360Telemetry.Downlevel
-This event sends data indicating that the device has invoked the downlevel phase of the upgrade. It's used to help keep Windows up-to-date and secure.
+This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up-to-date and secure.
The following fields are available:
- **ClientId** If using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but it can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the downlevel OS.
+- **HostOsSkuName** The operating system edition which is running Setup360 instance (downlevel OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
- **ReportId** In the Windows Update scenario, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **WuId** This is the Windows Update Client ID. In the Windows Update scenario, this is the same as the clientId.
-- **TestId** A string that uniquely identifies a group of events.
-- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The operating system edition which is running Setup360 instance (downlevel OS).
-- **HostOSBuildNumber** The build number of the downlevel OS.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. It's an HRESULT error code that can be used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Extended** More detailed information about phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360 (for example, Predownload, Install, Finalize, Rollback).
+- **Setup360Result** The result of Setup360 (HRESULT used to diagnose errors).
+- **Setup360Scenario** The Setup360 flow type (for example, Boot, Media, Update, MCT).
- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS).
+- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** An ID that uniquely identifies a group of events.
+- **WuId** This is the Windows Update Client ID. In the Windows Update scenario, this is the same as the clientId.
### Setup360Telemetry.Finalize
-This event sends data indicating that the device has invoked the finalize phase of the upgrade, to help keep Windows up-to-date.
+This event sends data indicating that the device has started the phase of finalizing the upgrade, to help keep Windows up-to-date and secure.
The following fields are available:
- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
-- **TestId** A string to uniquely identify a group of events.
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
-- **HostOSBuildNumber** The build number of the previous OS.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Extended** More detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** ID that uniquely identifies a group of events.
+- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
### Setup360Telemetry.OsUninstall
-The event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.OSUninstall indicates the outcome of an OS uninstall.
+This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall.
The following fields are available:
- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
-- **WuId** Windows Update client ID.
-- **TestId** A string to uniquely identify a group of events.
-- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
-- **HostOSBuildNumber** The build number of the previous OS.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Extended** Detailed information about the phase or action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** ID that uniquely identifies a group of events.
+- **WuId** Windows Update client ID.
### Setup360Telemetry.PostRebootInstall
-This event sends data indicating that the device has invoked the postrebootinstall phase of the upgrade, to help keep Windows up-to-date.
+This event sends data indicating that the device has invoked the post reboot install phase of the upgrade, to help keep Windows up-to-date.
The following fields are available:
- **ClientId** With Windows Update, this is the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as ClientId.
-- **TestId** A string to uniquely identify a group of events.
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
-- **HostOSBuildNumber** The build number of the previous OS.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
- **Setup360Result** The result of Setup360. This is an HRESULT error code that's used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **TestId** A string to uniquely identify a group of events.
+- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as ClientId.
### Setup360Telemetry.PreDownloadQuiet
@@ -3813,81 +4277,81 @@ This event sends data indicating that the device has invoked the predownload qui
The following fields are available:
- **ClientId** Using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
-- **ReportId** Using Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **WuId** This is the Windows Update Client ID. Using Windows Update, this is the same as the clientId.
-- **TestId** A string to uniquely identify a group of events.
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous operating system).
- **HostOSBuildNumber** The build number of the previous OS.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous operating system).
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
+- **ReportId** Using Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled.
+- **TestId** ID that uniquely identifies a group of events.
+- **WuId** This is the Windows Update Client ID. Using Windows Update, this is the same as the clientId.
### Setup360Telemetry.PreDownloadUX
-The event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.PredownloadUX indicates the outcome of the PredownloadUX portion of the update process.
+This event sends data regarding OS Updates and Upgrades from Windows 7.X, Windows 8.X, Windows 10 and RS, to help keep Windows up-to-date and secure. Specifically, it indicates the outcome of the PredownloadUX portion of the update process.
The following fields are available:
- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous operating system.
+- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system).
- **InstanceId** Unique GUID that identifies each instance of setuphost.exe.
- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
-- **WuId** Windows Update client ID.
-- **TestId** A string to uniquely identify a group of events.
-- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system).
-- **HostOSBuildNumber** The build number of the previous operating system.
-- **Setup360Scenario** The Setup360 flow type. Examplle: Boot, Media, Update, MCT
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS).
+- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** ID that uniquely identifies a group of events.
+- **WuId** Windows Update client ID.
### Setup360Telemetry.PreInstallQuiet
-This event sends data indicating that the device has invoked the preinstall quiet phase of the upgrade, to help keep Windows up to date.
+This event sends data indicating that the device has invoked the preinstall quiet phase of the upgrade, to help keep Windows up-to-date.
The following fields are available:
- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
-- **TestId** A string to uniquely identify a group of events.
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
-- **HostOSBuildNumber** The build number of the previous OS.
-- **Setup360Scenario** Setup360 flow type (Boot, Media, Update, MCT)
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback etc.
+- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Scenario** Setup360 flow type (Boot, Media, Update, MCT).
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** A string to uniquely identify a group of events.
+- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
### Setup360Telemetry.PreInstallUX
-This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.PreinstallUX indicates the outcome of the PreinstallUX portion of the update process.
+This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10, to help keep Windows up-to-date. Specifically, it indicates the outcome of the PreinstallUX portion of the update process.
The following fields are available:
- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
-- **WuId** Windows Update client ID.
-- **TestId** A string to uniquely identify a group of events.
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
-- **HostOSBuildNumber** The build number of the previous OS.
-- **Setup360Scenario** The Setup360 flow type, Example: Boot, Media, Update, MCT
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Scenario** The Setup360 flow type, Example: Boot, Media, Update, MCT.
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** A string to uniquely identify a group of events.
+- **WuId** Windows Update client ID.
### Setup360Telemetry.Setup360
@@ -3896,13 +4360,19 @@ This event sends data about OS deployment scenarios, to help keep Windows up-to-
The following fields are available:
+- **ClientId** Retrieves the upgrade ID. In the Windows Update scenario, this will be the Windows Update client ID. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FieldName** Retrieves the data point.
+- **FlightData** Specifies a unique identifier for each group of Windows Insider builds.
- **InstanceId** Retrieves a unique identifier for each instance of a setup session.
- **ReportId** Retrieves the report ID.
-- **FlightData** Specifies a unique identifier for each group of Windows Insider builds.
- **ScenarioId** Retrieves the deployment scenario.
-- **FieldName** Retrieves the data point.
- **Value** Retrieves the value associated with the corresponding FieldName.
-- **ClientId** Retrieves the upgrade ID: Upgrades via Windows Update - specifies the WU clientID. All other deployment - static string.
+
+
+### Setup360Telemetry.Setup360DynamicUpdate
+
+This event helps determine whether the device received supplemental content during an operating system upgrade, to help keep Windows up-to-date.
+
### Setup360Telemetry.UnexpectedEvent
@@ -3912,18 +4382,18 @@ This event sends data indicating that the device has invoked the unexpected even
The following fields are available:
- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
-- **TestId** A string to uniquely identify a group of events.
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
-- **HostOSBuildNumber** The build number of the previous OS.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors.
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** A string to uniquely identify a group of events.
+- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
## Windows Error Reporting events
@@ -3934,19 +4404,25 @@ This event sends binary data from the collected dump file wheneveer a bug check
The following fields are available:
-- **ReportId** WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson).
+- **BootId** Uint32 identifying the boot number for this device.
- **BugCheckCode** Uint64 "bugcheck code" that identifies a proximate cause of the bug check.
- **BugCheckParameter1** Uint64 parameter providing additional information.
-- **BootId** Uint32 identifying the boot number for this device.
- **BugCheckParameter2** Uint64 parameter providing additional information.
-- **BugCheckParameter4** Uint64 parameter providing additional information.
- **BugCheckParameter3** Uint64 parameter providing additional information.
-- **IsValidDumpFile** True if the dump file is valid for the debugger, false otherwise
-- **DumpFileSize** Size of the dump file
+- **BugCheckParameter4** Uint64 parameter providing additional information.
- **DumpFileAttributes** Codes that identify the type of data contained in the dump file
+- **DumpFileSize** Size of the dump file
+- **IsValidDumpFile** True if the dump file is valid for the debugger, false otherwise
+- **ReportId** WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson).
+
+
+## Windows Store events
+
+### Microsoft.Windows.Store.Partner.ReportApplication
+
+Report application event for Windows Store client.
-## Microsoft Store events
### Microsoft.Windows.StoreAgent.Telemetry.AbortedInstallation
@@ -3954,24 +4430,24 @@ This event is sent when an installation or update is canceled by a user or the s
The following fields are available:
-- **PFN** The product family name of the product being installed.
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **AttemptNumber** Number of retry attempts before it was canceled.
+- **BundleId** The Item Bundle ID.
+- **CategoryId** The Item Category ID.
- **ClientAppId** The identity of the app that initiated this operation.
- **HResult** The result code of the last action performed before this operation.
-- **IsUpdate** Flag indicating if this is an update.
-- **AttemptNumber** Number of retry attempts before it was canceled.
-- **CategoryId** The Item Category ID.
-- **ProductId** The identity of the package or packages being installed.
+- **IsBundle** Is this a bundle?
- **IsInteractive** Was this requested by a user?
-- **IsRemediation** Was this a remediation install?
-- **BundleId** The Item Bundle ID.
- **IsMandatory** Was this a mandatory update?
+- **IsRemediation** Was this a remediation install?
+- **IsRestore** Is this automatically restoring a previously acquired product?
+- **IsUpdate** Flag indicating if this is an update.
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The product family name of the product being installed.
+- **ProductId** The identity of the package or packages being installed.
- **SystemAttemptNumber** The total number of automatic attempts at installation before it was canceled.
- **UserAttemptNumber** The total number of user attempts at installation before it was canceled.
-- **IsRestore** Is this automatically restoring a previously acquired product?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **IsBundle** Is this a bundle?
-- **WUContentId** The Windows Update content ID
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **WUContentId** Licensing identity of this package.
### Microsoft.Windows.StoreAgent.Telemetry.BeginGetInstalledContentIds
@@ -3992,40 +4468,40 @@ This event is sent when an app update or installation is canceled while in inter
The following fields are available:
-- **IsInteractive** Was this requested by a user?
+- **AggregatedPackageFullNames** The names of all package or packages to be downloaded and installed.
- **AttemptNumber** Total number of installation attempts.
- **BundleId** The identity of the Windows Insider build that is associated with this product.
-- **PreviousHResult** The previous HResult code.
-- **ClientAppId** The identity of the app that initiated this operation.
- **CategoryId** The identity of the package or packages being installed.
-- **PFN** The name of all packages to be downloaded and installed.
-- **ProductId** The name of the package or packages requested for installation.
-- **IsUpdate** Is this a product update?
-- **IsRemediation** Is this repairing a previous installation?
-- **RelatedCV** Correlation Vector of a previous performed action on this product.
-- **PreviousInstallState** Previous installation state before it was canceled.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Was this requested by a user?
- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this an automatic restore of a previously acquired product?
+- **IsUpdate** Is this a product update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The name of all packages to be downloaded and installed.
+- **PreviousHResult** The previous HResult code.
+- **PreviousInstallState** Previous installation state before it was canceled.
+- **ProductId** The name of the package or packages requested for installation.
+- **RelatedCV** Correlation Vector of a previous performed action on this product.
- **SystemAttemptNumber** Total number of automatic attempts to install before it was canceled.
- **UserAttemptNumber** Total number of user attempts to install before it was canceled.
-- **IsRestore** Is this an automatic restore of a previously acquired product?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **IsBundle** Is this a bundle?
-- **WUContentId** The Windows Update content ID
-- **AggregatedPackageFullNames** The names of all package or packages to be downloaded and installed.
+- **WUContentId** The Windows Update content ID.
### Microsoft.Windows.StoreAgent.Telemetry.CompleteInstallOperationRequest
-This event is sent after the app installations or updates. It's used to help keep Windows up-to-date and secure
+This event is sent at the end of app installations or updates to help keep Windows up-to-date and secure.
The following fields are available:
+- **CatalogId** The Store Product ID of the app being installed.
+- **HResult** HResult code of the action being performed.
- **IsBundle** Is this a bundle?
+- **PackageFamilyName** The name of the package being installed.
- **ProductId** The Store Product ID of the product being installed.
- **SkuId** Specific edition of the item being installed.
-- **CatalogId** The Store Product ID of the app being installed.
-- **PackageFamilyName** The name of the package being installed.
-- **HResult** HResult code of the action being performed.
### Microsoft.Windows.StoreAgent.Telemetry.EndAcquireLicense
@@ -4034,57 +4510,57 @@ This event is sent after the license is acquired when a product is being install
The following fields are available:
-- **PFN** Product Family Name of the product being installed.
-- **HResult** HResult code to show the result of the operation (success/failure).
-- **ProductId** The Store Product ID for the product being installed.
-- **IsInteractive** Did the user initiate the installation?
+- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set.
+- **AttemptNumber** The total number of attempts to acquire this product.
- **CategoryId** The identity of the package or packages being installed.
- **ClientAppId** The identity of the app that initiated this operation.
-- **IsRemediation** Is this repairing a previous installation?
-- **UpdateId** The update ID (if this is an update)
-- **AttemptNumber** The total number of attempts to acquire this product.
-- **IsUpdate** Is this an update?
-- **IsMandatory** Is this a mandatory update?
-- **SystemAttemptNumber** The number of attempts by the system to acquire this product.
-- **UserAttemptNumber** The number of attempts by the user to acquire this product
-- **IsRestore** Is this happening after a device restore?
+- **HResult** HResult code to show the result of the operation (success/failure).
- **IsBundle** Is this a bundle?
-- **WUContentId** The Windows Update content ID
+- **IsInteractive** Did the user initiate the installation?
+- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this happening after a device restore?
+- **IsUpdate** Is this an update?
- **ParentBundledId** The product's parent bundle ID.
-- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set.
+- **PFN** Product Family Name of the product being installed.
+- **ProductId** The Store Product ID for the product being installed.
+- **SystemAttemptNumber** The number of attempts by the system to acquire this product.
+- **UpdateId** The update ID (if this is an update)
+- **UserAttemptNumber** The number of attempts by the user to acquire this product
+- **WUContentId** The Windows Update content ID.
### Microsoft.Windows.StoreAgent.Telemetry.EndDownload
-This event happens during the app update or installation when content is being downloaded at the end of the process to report success or failure. It's used to help keep Windows up-to-date and secure.
+This event is sent after an app is downloaded to help keep Windows up-to-date and secure.
The following fields are available:
-- **PFN** The Product Family Name of the app being download.
-- **IsRemediation** Is this repairing a previous installation?
-- **DownloadSize** The total size of the download.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **CategoryId** The identity of the package or packages being installed.
-- **IsUpdate** Is this an update?
-- **HResult** The result code of the last action performed.
-- **IsInteractive** Is this initiated by the user?
+- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
- **AttemptNumber** Number of retry attempts before it was canceled.
- **BundleId** The identity of the Windows Insider build associated with this product.
-- **ProductId** The Store Product ID for the product being installed.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **DownloadSize** The total size of the download.
+- **ExtendedHResult** Any extended HResult error codes.
+- **HResult** The result code of the last action performed.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this initiated by the user?
- **IsMandatory** Is this a mandatory installation?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this a restore of a previously acquired product?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
+- **PFN** The Product Family Name of the app being download.
+- **ProductId** The Store Product ID for the product being installed.
- **SystemAttemptNumber** The number of attempts by the system to download.
- **UserAttemptNumber** The number of attempts by the user to download.
-- **IsRestore** Is this a restore of a previously acquired product?
-- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
-- **IsBundle** Is this a bundle?
- **WUContentId** The Windows Update content ID.
-- **ExtendedHResult** Any extended HResult error codes.
-- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
### Microsoft.Windows.StoreAgent.Telemetry.EndFrameworkUpdate
-This event happens when an app update requires an updated Framework package and the process starts to download it. It's used to help keep Windows up-to-date and secure.
+This event is sent when an app update requires an updated Framework package and the process starts to download it. It is used to help keep Windows up-to-date and secure.
The following fields are available:
@@ -4102,29 +4578,29 @@ The following fields are available:
### Microsoft.Windows.StoreAgent.Telemetry.EndInstall
-This event is sent after a product has been installed. It's used to help keep Windows up-to-date and secure.
+This event is sent after a product has been installed to help keep Windows up-to-date and secure.
The following fields are available:
-- **BundleId** The identity of the build associated with this product.
-- **PFN** Product Family Name of the product being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **CategoryId** The identity of the package or packages being installed.
-- **ProductId** The Store Product ID for the product being installed.
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
- **AttemptNumber** The number of retry attempts before it was canceled.
+- **BundleId** The identity of the build associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **ExtendedHResult** The extended HResult error code.
- **HResult** The result code of the last action performed.
-- **IsRemediation** Is this repairing a previous installation?
+- **IsBundle** Is this a bundle?
- **IsInteractive** Is this an interactive installation?
-- **IsUpdate** Is this an update?
- **IsMandatory** Is this a mandatory installation?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this automatically restoring a previously acquired product?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** Product Family Name of the product being installed.
+- **ProductId** The Store Product ID for the product being installed.
- **SystemAttemptNumber** The total number of system attempts.
- **UserAttemptNumber** The total number of user attempts.
-- **IsRestore** Is this automatically restoring a previously acquired product?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **IsBundle** Is this a bundle?
-- **WUContentId** The Windows Update content ID
-- **ExtendedHResult** The extended HResult error code.
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **WUContentId** The Windows Update content ID.
### Microsoft.Windows.StoreAgent.Telemetry.EndScanForUpdates
@@ -4133,63 +4609,63 @@ This event is sent after a scan for product updates to determine if there are pa
The following fields are available:
+- **ClientAppId** The identity of the app that initiated this operation.
- **HResult** The result code of the last action performed.
- **IsApplicability** Is this request to only check if there are any applicable packages to install?
- **IsInteractive** Is this user requested?
-- **ClientAppId** The identity of the app that initiated this operation.
- **IsOnline** Is the request doing an online check?
### Microsoft.Windows.StoreAgent.Telemetry.EndSearchUpdatePackages
-This event is sent after searching for update packages to install. It's used to help keep Windows up-to-date and secure.
+This event is sent after searching for update packages to install. It is used to help keep Windows up-to-date and secure.
The following fields are available:
-- **IsRemediation** Is this repairing a previous installation?
-- **IsUpdate** Is this an update?
-- **ClientAppId** The identity of the app that initiated this operation.
-- **HResult** The result code of the last action performed.
-- **ProductId** The Store Product ID for the product being installed.
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
- **AttemptNumber** The total number of retry attempts before it was canceled.
-- **IsInteractive** Is this user requested?
-- **PFN** The name of the package or packages requested for install.
- **BundleId** The identity of the build associated with this product.
- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** The result code of the last action performed.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this user requested?
- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The name of the package or packages requested for install.
+- **ProductId** The Store Product ID for the product being installed.
- **SystemAttemptNumber** The total number of system attempts.
- **UserAttemptNumber** The total number of user attempts.
-- **IsRestore** Is this restoring previously acquired content?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **IsBundle** Is this a bundle?
-- **WUContentId** The Windows Update content ID
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **WUContentId** The Windows Update content ID.
### Microsoft.Windows.StoreAgent.Telemetry.EndStageUserData
-This event is sent between download and installation to see if there is app data that needs to be restored from the cloud. It's used to keep Windows up-to-date and secure.
+This event is sent after restoring user data (if any) that needs to be restored following a product install. It is used to keep Windows up-to-date and secure.
The following fields are available:
-- **IsInteractive** Is this user requested?
-- **PFN** The name of the package or packages requested for install.
-- **IsUpdate** Is this an update?
-- **CategoryId** The identity of the package or packages being installed.
-- **HResult** The result code of the last action performed.
+- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
- **AttemptNumber** The total number of retry attempts before it was canceled.
-- **ProductId** The Store Product ID for the product being installed.
- **BundleId** The identity of the build associated with this product.
-- **IsRemediation** Is this repairing a previous installation?
+- **CategoryId** The identity of the package or packages being installed.
- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** The result code of the last action performed.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this user requested?
- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The name of the package or packages requested for install.
+- **ProductId** The Store Product ID for the product being installed.
- **SystemAttemptNumber** The total number of system attempts.
- **UserAttemptNumber** The total number of system attempts.
-- **IsRestore** Is this restoring previously acquired content?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **IsBundle** Is this a bundle?
-- **WUContentId** The Windows Update content ID
-- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
+- **WUContentId** The Windows Update content ID.
### Microsoft.Windows.StoreAgent.Telemetry.EndUpdateMetadataPrepare
@@ -4203,100 +4679,100 @@ The following fields are available:
### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentComplete
-This event is sent at the end of an app install or update and is used to track the very end of the install or update process.
+This event is sent at the end of an app install or update to help keep Windows up-to-date and secure.
The following fields are available:
-- **ProductId** The product ID of the app that is being updated or installed.
-- **PFN** The Package Family Name of the app that is being installed or updated.
-- **FailedRetry** Was the installation or update retry successful?
+- **FailedRetry** Indicates whether the installation or update retry was successful.
- **HResult** The HResult code of the operation.
+- **PFN** The Package Family Name of the app that is being installed or updated.
+- **ProductId** The product ID of the app that is being updated or installed.
### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentInitiate
-This event is sent at the beginning of an app install or update and is used to track the very beginning of the install or update process.
+This event is sent at the beginning of an app install or update to help keep Windows up-to-date and secure.
The following fields are available:
-- **ProductId** The product ID of the app that is being updated or installed.
- **PFN** The Package Family Name of the app that is being installed or updated.
+- **ProductId** The product ID of the app that is being updated or installed.
### Microsoft.Windows.StoreAgent.Telemetry.InstallOperationRequest
-This event happens at the beginning of the install process when an app update or new app is installed. It's used to help keep Windows up-to-date and secure.
+This event is sent when a product install or update is initiated, to help keep Windows up-to-date and secure.
The following fields are available:
-- **CatalogId** If this product is from a private catalog, the Store Product ID for the product being installed.
- **BundleId** The identity of the build associated with this product.
-- **SkuId** Specific edition ID being installed.
+- **CatalogId** If this product is from a private catalog, the Store Product ID for the product being installed.
- **ProductId** The Store Product ID for the product being installed.
+- **SkuId** Specific edition ID being installed.
- **VolumePath** The disk path of the installation.
### Microsoft.Windows.StoreAgent.Telemetry.PauseInstallation
-This event is sent when a product install or update is paused either by a user or the system. It's used to help keep Windows up-to-date and secure.
+This event is sent when a product install or update is paused (either by a user or the system), to help keep Windows up-to-date and secure.
The following fields are available:
-- **RelatedCV** Correlation Vector of a previous performed action on this product.
-- **IsRemediation** Is this repairing a previous installation?
-- **PreviousHResult** The result code of the last action performed before this operation.
-- **ProductId** The Store Product ID for the product being installed.
-- **IsUpdate** Is this an update?
-- **PreviousInstallState** Previous state before the installation or update was paused.
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **AttemptNumber** The total number of retry attempts before it was canceled.
+- **BundleId** The identity of the build associated with this product.
- **CategoryId** The identity of the package or packages being installed.
- **ClientAppId** The identity of the app that initiated this operation.
-- **AttemptNumber** The total number of retry attempts before it was canceled.
+- **IsBundle** Is this a bundle?
- **IsInteractive** Is this user requested?
-- **BundleId** The identity of the build associated with this product.
-- **PFN** The Product Full Name.
- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The Product Full Name.
+- **PreviousHResult** The result code of the last action performed before this operation.
+- **PreviousInstallState** Previous state before the installation or update was paused.
+- **ProductId** The Store Product ID for the product being installed.
+- **RelatedCV** Correlation Vector of a previous performed action on this product.
- **SystemAttemptNumber** The total number of system attempts.
- **UserAttemptNumber** The total number of user attempts.
-- **IsRestore** Is this restoring previously acquired content?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **IsBundle** Is this a bundle?
-- **WUContentId** The Windows Update content ID
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **WUContentId** The Windows Update content ID.
### Microsoft.Windows.StoreAgent.Telemetry.ResumeInstallation
-This event happens when a product install or update is resumed either by a user or the system. It's used to help keep Windows up-to-date and secure.
+This event is sent when a product install or update is resumed (either by a user or the system), to help keep Windows up-to-date and secure.
The following fields are available:
-- **RelatedCV** Correlation Vector for the original install before it was resumed.
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
- **AttemptNumber** The number of retry attempts before it was canceled.
- **BundleId** The identity of the build associated with this product.
-- **PreviousHResult** The previous HResult error code.
-- **ClientAppId** The identity of the app that initiated this operation.
- **CategoryId** The identity of the package or packages being installed.
-- **PFN** The name of the package or packages requested for install.
-- **IsUpdate** Is this an update?
-- **PreviousInstallState** Previous state before the installation was paused.
-- **IsRemediation** Is this repairing a previous installation?
+- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** The result code of the last action performed before this operation.
+- **IsBundle** Is this a bundle?
- **IsInteractive** Is this user requested?
-- **ProductId** The Store Product ID for the product being installed.
- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **IsUserRetry** Did the user initiate the retry?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The name of the package or packages requested for install.
+- **PreviousHResult** The previous HResult error code.
+- **PreviousInstallState** Previous state before the installation was paused.
+- **ProductId** The Store Product ID for the product being installed.
+- **RelatedCV** Correlation Vector for the original install before it was resumed.
- **SystemAttemptNumber** The total number of system attempts.
- **UserAttemptNumber** The total number of user attempts.
-- **IsRestore** Is this restoring previously acquired content?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **IsBundle** Is this a bundle?
-- **WUContentId** The Windows Update content ID
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-- **IsUserRetry** Did the user initiate the retry?
-- **HResult** The result code of the last action performed before this operation.
+- **WUContentId** The Windows Update content ID.
### Microsoft.Windows.StoreAgent.Telemetry.ResumeOperationRequest
-This event happens when a product install or update is resumed by a user and on installation retries. It's used to help keep Windows up-to-date and secure.
+This event is sent when a product install or update is resumed by a user or on installation retries, to help keep Windows up-to-date and secure.
The following fields are available:
@@ -4305,22 +4781,22 @@ The following fields are available:
### Microsoft.Windows.StoreAgent.Telemetry.SearchForUpdateOperationRequest
-This event is sent when searching for update packages to install. It's used to help keep Windows up-to-date and secure.
+This event is sent when searching for update packages to install, to help keep Windows up-to-date and secure.
The following fields are available:
+- **CatalogId** The Store Catalog ID for the product being installed.
- **ProductId** The Store Product ID for the product being installed.
- **SkuId** Specfic edition of the app being updated.
-- **CatalogId** The Store Product ID for the product being installed.
### Microsoft.Windows.StoreAgent.Telemetry.UpdateAppOperationRequest
-This event happens an app for a user needs to be updated. It's used to help keep Windows up-to-date and secure.
+This event occurs when an update is requested for an app, to help keep Windows up-to-date and secure.
The following fields are available:
-- **PFamN** The name of the product that is requested for update.
+- **PFamN** The name of the app that is requested for update.
## Windows Update Delivery Optimization events
@@ -4331,22 +4807,22 @@ This event describes when a download was canceled with Delivery Optimization. It
The following fields are available:
-- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same group.
-- **fileID** The ID of the file being downloaded.
-- **sessionID** The ID of the file download session.
-- **scenarioID** The ID of the scenario.
-- **bytesFromCDN** The number of bytes received from a CDN source.
-- **updateID** The ID of the update being downloaded.
- **background** Is the download being done in the background?
-- **bytesFromPeers** The number of bytes received from a peer in the same LAN.
-- **clientTelId** A random number used for device sampling.
+- **bytesFromCDN** The number of bytes received from a CDN source.
- **bytesFromGroupPeers** The number of bytes received from a peer in the same group.
-- **errorCode** The error code that was returned.
-- **doErrorCode** The Delivery Optimization error code that was returned.
+- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same group.
+- **bytesFromPeers** The number of bytes received from a peer in the same LAN.
- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event.
- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered.
+- **clientTelId** A random number used for device sampling.
+- **doErrorCode** The Delivery Optimization error code that was returned.
+- **errorCode** The error code that was returned.
- **experimentId** When running a test, this is used to correlate events that are part of the same test.
+- **fileID** The ID of the file being downloaded.
- **isVpn** Is the device connected to a Virtual Private Network?
+- **scenarioID** The ID of the scenario.
+- **sessionID** The ID of the file download session.
+- **updateID** The ID of the update being downloaded.
- **usedMemoryStream** Did the download use memory streaming?
@@ -4356,37 +4832,36 @@ This event describes when a download has completed with Delivery Optimization. I
The following fields are available:
-- **sessionID** The ID of the download session.
-- **scenarioID** The ID of the scenario.
-- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same domain group.
-- **updateID** The ID of the update being downloaded.
-- **fileSize** The size of the file being downloaded.
-- **bytesFromCDN** The number of bytes received from a CDN source.
-- **fileID** The ID of the file being downloaded.
- **background** Is the download a background download?
-- **bytesFromPeers** The number of bytes received from a peer in the same LAN.
-- **totalTime** How long did the download take (in seconds)?
-- **restrictedUpload** Is the upload restricted?
-- **clientTelId** A random number used for device sampling.
+- **bytesFromCDN** The number of bytes received from a CDN source.
- **bytesFromGroupPeers** The number of bytes received from a peer in the same domain group.
-- **downloadMode** The download mode used for this file download session.
-- **doErrorCode** The Delivery Optimization error code that was returned.
-- **numPeers** The total number of peers used for this download.
+- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same domain group.
+- **bytesFromPeers** The number of bytes received from a peer in the same LAN.
+- **bytesRequested** The total number of bytes requested for download.
- **cdnConnectionCount** The total number of connections made to the CDN.
-- **lanConnectionCount** The total number of connections made to peers in the same LAN.
-- **groupConnectionCount** The total number of connections made to peers in the same group.
-- **internetConnectionCount** The total number of connections made to peers not in the same LAN or the same group.
-- **cdnIp** The IP address of the source CDN.
-- **downlinkBps** The maximum measured available download bandwidth (in bytes per second).
-- **uplinkBps** The maximum measured available upload bandwidth (in bytes per second).
-- **downlinkUsageBps** The download speed (in bytes per second).
-- **uplinkUsageBps** The upload speed (in bytes per second).
-- **totalTimeMs** Duration of the download (in seconds).
- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event.
- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered.
-- **bytesRequested** The total number of bytes requested for download.
+- **cdnIp** The IP address of the source CDN.
+- **clientTelId** A random number used for device sampling.
+- **doErrorCode** The Delivery Optimization error code that was returned.
+- **downlinkBps** The maximum measured available download bandwidth (in bytes per second).
+- **downlinkUsageBps** The download speed (in bytes per second).
+- **downloadMode** The download mode used for this file download session.
- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
+- **fileID** The ID of the file being downloaded.
+- **fileSize** The size of the file being downloaded.
+- **groupConnectionCount** The total number of connections made to peers in the same group.
+- **internetConnectionCount** The total number of connections made to peers not in the same LAN or the same group.
- **isVpn** Is the device connected to a Virtual Private Network?
+- **lanConnectionCount** The total number of connections made to peers in the same LAN.
+- **numPeers** The total number of peers used for this download.
+- **restrictedUpload** Is the upload restricted?
+- **scenarioID** The ID of the scenario.
+- **sessionID** The ID of the download session.
+- **totalTimeMs** Duration of the download (in seconds).
+- **updateID** The ID of the update being downloaded.
+- **uplinkBps** The maximum measured available upload bandwidth (in bytes per second).
+- **uplinkUsageBps** The upload speed (in bytes per second).
- **usedMemoryStream** Did the download use memory streaming?
@@ -4396,48 +4871,48 @@ This event represents a temporary suspension of a download with Delivery Optimiz
The following fields are available:
-- **updateID** The ID of the update being paused.
-- **errorCode** The error code that was returned.
-- **scenarioID** The ID of the scenario.
- **background** Is the download a background download?
-- **sessionID** The ID of the download session.
- **clientTelId** A random number used for device sampling.
-- **reasonCode** The reason for pausing the download.
-- **fileID** The ID of the file being paused.
+- **errorCode** The error code that was returned.
- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
+- **fileID** The ID of the file being paused.
- **isVpn** Is the device connected to a Virtual Private Network?
+- **reasonCode** The reason for pausing the download.
+- **scenarioID** The ID of the scenario.
+- **sessionID** The ID of the download session.
+- **updateID** The ID of the update being paused.
### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted
-This event describes the start of a new download with Delivery Optimization. It's used to understand and address problems regarding downloads.
+This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads.
The following fields are available:
-- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
-- **errorCode** The error code that was returned.
-- **doErrorCode** The Delivery Optimization error code that was returned.
-- **peerID** The ID for this Delivery Optimization client.
-- **doClientVersion** The version of the Delivery Optimization client.
-- **jobID** The ID of the Windows Update job.
-- **sessionID** The ID of the download session.
-- **updateID** The ID of the update being downloaded.
-- **scenarioID** The ID of the scenario.
-- **fileID** The ID of the file being downloaded.
-- **cdnUrl** The URL of the CDN.
-- **filePath** The path where the file will be written.
-- **groupID** ID for the group.
-- **background** Is the download a background download?
-- **downloadMode** The download mode used for this file download session.
-- **minFileSizePolicy** The minimum content file size policy to allow the download using Peering.
-- **diceRoll** The dice roll value used in sampling events.
-- **deviceProfile** Identifies the usage or form factor. Example: Desktop or Xbox
-- **isVpn** Is the device connected to a Virtual Private Network?
-- **usedMemoryStream** Did the download use memory streaming?
-- **minDiskSizePolicyEnforced** Is the minimum disk size enforced via policy?
-- **minDiskSizeGB** The minimum disk size (in GB) required for Peering.
+- **background** Indicates whether the download is happening in the background.
+- **cdnUrl** The URL of the source CDN.
- **clientTelId** A random number used for device sampling.
- **costFlags** A set of flags representing network cost.
+- **deviceProfile** Identifies the usage or form factor (such as Desktop, Xbox, or VM).
+- **diceRoll** Random number used for determining if a client will use peering.
+- **doClientVersion** The version of the Delivery Optimization client.
+- **doErrorCode** The Delivery Optimization error code that was returned.
+- **downloadMode** The download mode used for this file download session (CdnOnly = 0, Lan = 1, Group = 2, Internet = 3, Simple = 99, Bypass = 100).
+- **errorCode** The error code that was returned.
+- **experimentId** ID used to correlate client/services calls that are part of the same test during A/B testing.
+- **fileID** The ID of the file being downloaded.
+- **filePath** The path to where the downloaded file will be written.
+- **groupID** ID for the group.
+- **isVpn** Indicates whether the device is connected to a Virtual Private Network.
+- **jobID** The ID of the Windows Update job.
+- **minDiskSizeGB** The minimum disk size (in GB) policy set for the device to allow peering with delivery optimization.
+- **minDiskSizePolicyEnforced** Indicates whether there is an enforced minimum disk size requirement for peering.
+- **minFileSizePolicy** The minimum content file size policy to allow the download using peering with delivery optimization.
+- **peerID** The ID for this delivery optimization client.
+- **scenarioID** The ID of the scenario.
+- **sessionID** The ID for the file download session.
+- **updateID** The ID of the update being downloaded.
+- **usedMemoryStream** Indicates whether the download used memory streaming.
### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication
@@ -4446,19 +4921,19 @@ This event represents a failure to download from a CDN with Delivery Optimizatio
The following fields are available:
+- **cdnHeaders** The HTTP headers returned by the CDN.
+- **cdnIp** The IP address of the CDN.
+- **cdnUrl** The URL of the CDN.
+- **clientTelId** A random number used for device sampling.
+- **errorCode** The error code that was returned.
+- **errorCount** The total number of times this error code was seen since the last FailureCdnCommunication event was encountered.
- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
- **fileID** The ID of the file being downloaded.
-- **errorCode** The error code that was returned.
- **httpStatusCode** The HTTP status code returned by the CDN.
-- **errorCount** The total number of times this error code was seen since the last FailureCdnCommunication event was encountered.
-- **sessionID** The ID of the download session.
-- **cdnUrl** The URL of the CDN.
-- **cdnIp** The IP address of the CDN.
-- **cdnHeaders** The HTTP headers returned by the CDN.
-- **clientTelId** A random number used for device sampling.
- **isHeadRequest** The type of HTTP request that was sent to the CDN. Example: HEAD or GET
- **requestSize** The size of the range requested from the CDN.
- **responseSize** The size of the range response received from the CDN.
+- **sessionID** The ID of the download session.
### Microsoft.OSG.DU.DeliveryOptClient.JobError
@@ -4467,11 +4942,11 @@ This event represents a Windows Update job error. It allows for investigation of
The following fields are available:
-- **jobID** The Windows Update job ID.
-- **fileID** The ID of the file being downloaded.
-- **errorCode** The error code returned.
- **clientTelId** A random number used for device sampling.
+- **errorCode** The error code returned.
- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
+- **fileID** The ID of the file being downloaded.
+- **jobID** The Windows Update job ID.
## Windows Update events
@@ -4482,11 +4957,11 @@ This event sends data collected at the end of the Data Migration Framework (DMF)
The following fields are available:
-- **MigrationEndtime** A system timestamp of when the DMF migration completed.
-- **UpdateIds** A collection of GUIDs for updates that are associated with the DMF session.
-- **WuClientid** The GUID of the Windows Update client responsible for triggering the DMF migration.
-- **MigrationDurationinmilliseconds** How long the DMF migration took (in milliseconds).
+- **MigrationDurationInMilliseconds** How long the DMF migration took (in milliseconds)
+- **MigrationEndTime** A system timestamp of when the DMF migration completed.
- **RevisionNumbers** A collection of revision numbers for the updates associated with the DMF session.
+- **UpdateIds** A collection of GUIDs for updates that are associated with the DMF session.
+- **WuClientId** The GUID of the Windows Update client responsible for triggering the DMF migration
### Microsoft.Windows.Update.DataMigrationFramework.DmfMigrationStarted
@@ -4495,12 +4970,12 @@ This event sends data collected at the beginning of the Data Migration Framework
The following fields are available:
-- **UpdateIds** A collection of GUIDs identifying the upgrades that are running.
-- **MigrationStarttime** The timestamp representing the beginning of the DMF migration.
-- **MigrationOEMphases** The number of OEM-authored migrators scheduled to be ran by DMF for this upgrade.
-- **WuClientid** The GUID of the Windows Update client invoking DMF.
-- **MigrationMicrosoftphases** The number of Microsoft-authored migrators scheduled to be ran by DMF for this upgrade.
+- **MigrationMicrosoftPhases** Revision numbers for the updates that were installed.
+- **MigrationOEMPhases** WU Update IDs for the updates that were installed.
+- **MigrationStartTime** The timestamp representing the beginning of the DMF migration
- **RevisionNumbers** A collection of the revision numbers associated with the UpdateIds.
+- **UpdateIds** A collection of GUIDs identifying the upgrades that are running.
+- **WuClientId** The GUID of the Windows Update client invoking DMF
### Microsoft.Windows.Update.DataMigrationFramework.MigratorResult
@@ -4509,42 +4984,185 @@ This event sends DMF migrator data to help keep Windows up to date.
The following fields are available:
-- **MigratorGuid** A GUID identifying the migrator that just completed.
-- **RunDurationInSeconds** The time it took for the migrator to complete.
- **CurrentStep** This is the last step the migrator reported before returning a result. This tells us how far through the individual migrator the device was before failure.
-- **MigratorName** The name of the migrator that just completed.
-- **MigratorId** A GUID identifying the migrator that just completed.
- **ErrorCode** The result (as an HRESULT) of the migrator that just completed.
+- **MigratorId** A GUID identifying the migrator that just completed.
+- **MigratorName** The name of the migrator that just completed.
+- **RunDurationInSeconds** The time it took for the migrator to complete.
- **TotalSteps** Migrators report progress in number of completed steps against the total steps. This is the total number of steps.
+### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed
+
+This event indicates that a notification dialog box is about to be displayed to user.
+
+The following fields are available:
+
+- **AcceptAutoModeLimit** The maximum number of days for a device to automatically enter Auto Reboot mode.
+- **AutoToAutoFailedLimit** The maximum number of days for Auto Reboot mode to fail before the RebootFailed dialog box is shown.
+- **DeviceLocalTime** The local time on the device sending the event.
+- **EngagedModeLimit** The number of days to switch between DTE dialog boxes.
+- **EnterAutoModeLimit** The maximum number of days for a device to enter Auto Reboot mode.
+- **ETag** OneSettings versioning value.
+- **IsForcedEnabled** Indicates whether Forced Reboot mode is enabled for this device.
+- **IsUltimateForcedEnabled** Indicates whether Ultimate Forced Reboot mode is enabled for this device.
+- **NotificationUxState** Indicates which dialog box is shown.
+- **NotificationUxStateString** Indicates which dialog box is shown.
+- **RebootUxState** Indicates the state of the restart (Engaged, Auto, Forced, or UltimateForced).
+- **RebootUxStateString** Indicates the state of the restart (Engaged, Auto, Forced, or UltimateForced).
+- **RebootVersion** Version of DTE.
+- **SkipToAutoModeLimit** The minimum length of time to pass in restart pending before a device can be put into auto mode.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+
+
+### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog
+
+This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed.
+
+The following fields are available:
+
+- **DeviceLocalTime** The local time on the device sending the event.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that user chose on this dialog box.
+
+
+### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog
+
+This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed.
+
+The following fields are available:
+
+- **DeviceLocalTime** The local time on the device sending the event.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that user chose in this dialog box.
+
+
+### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedPrecursorDialog
+
+This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed.
+
+The following fields are available:
+
+- **DeviceLocalTime** The local time on the device sending the event.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that the user chose in this dialog box.
+
+
+### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedWarningDialog
+
+This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed.
+
+The following fields are available:
+
+- **DeviceLocalTime** The local time on the device sending the event.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that the user chose in this dialog box.
+
+
+### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog
+
+This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed.
+
+The following fields are available:
+
+- **DeviceLocalTime** The local time of the device sending the event.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that the user chose in this dialog box.
+
+
+### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog
+
+This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed.
+
+The following fields are available:
+
+- **DeviceLocalTime** Time the dialog box was shown on the local device.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that user chose in this dialog box.
+
+
+### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog
+
+This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart.
+
+The following fields are available:
+
+- **DeviceLocalTime** The time the dialog box was shown on the local device.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that the user chose in this dialog box.
+
+
+### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog
+
+This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed.
+
+The following fields are available:
+
+- **DeviceLocalTime** The time the dialog box was shown on the local device.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that the user chose in this dialog box.
+
+
### Microsoft.Windows.Update.Orchestrator.CommitFailed
-This events tracks when a device needs to restart after an update but did not.
+This event indicates that a device was unable to restart after an update.
The following fields are available:
-- **wuDeviceid** The Windows Update device GUID.
- **errorCode** The error code that was returned.
+- **wuDeviceid** The Windows Update device GUID.
### Microsoft.Windows.Update.Orchestrator.Detection
-This event sends launch data for a Windows Update scan to help keep Windows up to date.
+This event indicates that a scan for a Windows Update occurred.
The following fields are available:
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **revisionNumber** Update revision number.
-- **eventScenario** End to end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
- **deferReason** Reason why the device could not check for updates.
- **detectionBlockreason** Reason for detection not completing.
-- **interactive** Identifies if session is User Initiated.
-- **updateId** Update ID.
- **detectionDeferreason** A log of deferral reasons for every update state.
-- **flightID** A unique update ID.
-- **updateScenarioType** The update session type.
- **errorCode** The returned error code.
+- **eventScenario** End-to-end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
+- **flightID** The specific ID of the Windows Insider build the device is getting.
+- **interactive** Indicates whether the session was user initiated.
+- **revisionNumber** Update revision number.
+- **updateId** Update ID.
+- **updateScenarioType** The update session type.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.Download
@@ -4553,31 +5171,31 @@ This event sends launch data for a Windows Update download to help keep Windows
The following fields are available:
+- **deferReason** Reason for download not completing.
- **detectionDeferreason** Reason for download not completing
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **interactive** Identifies if session is user initiated.
+- **errorCode** An error code represented as a hexadecimal value.
+- **eventScenario** End-to-end update session ID.
+- **flightID** The specific ID of the Windows Insider build the device is getting.
+- **interactive** Indicates whether the session is user initiated.
- **revisionNumber** Update revision number.
-- **deferReason** Reason for download not completing
- **updateId** Update ID.
-- **eventScenario** End to end update session ID.
-- **errorCode** An error code represented as a hexadecimal value
-- **flightID** Unique update ID.
- **updateScenarioType** The update session type.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.FlightInapplicable
-This event sends data on whether the update was applicable to the device, to help keep Windows up to date.
+This event indicates that the update is no longer applicable to this device.
The following fields are available:
-- **updateId** Unique Update ID
-- **revisionNumber** Revision Number of the Update
-- **UpdateStatus** Integer that describes Update state
-- **EventPublishedTime** time that the event was generated
-- **wuDeviceid** Unique Device ID
-- **flightID** Unique Update ID
-- **updateScenarioType** The update session type.
+- **EventPublishedTime** Time when this event was generated.
+- **flightID** The specific ID of the Windows Insider build.
+- **revisionNumber** Update revision number.
+- **updateId** Unique Windows Update ID.
+- **updateScenarioType** Update session type.
+- **UpdateStatus** Last status of update.
+- **wuDeviceid** Unique Device ID.
### Microsoft.Windows.Update.Orchestrator.InitiatingReboot
@@ -4586,15 +5204,15 @@ This event sends data about an Orchestrator requesting a reboot from power manag
The following fields are available:
-- **revisionNumber** Revision number of the update.
- **EventPublishedTime** Time of the event.
-- **updateId** Update ID.
-- **wuDeviceid** Unique device ID used by Windows Update.
- **flightID** Unique update ID
-- **interactive** Indicates the reboot initiation stage of the update process was entered as a result of user action or not.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **interactive** Indicates whether the reboot initiation stage of the update process was entered as a result of user action.
+- **rebootOutsideOfActiveHours** Indicates whether the reboot was to occur outside of active hours.
+- **revisionNumber** Revision number of the update.
+- **updateId** Update ID.
- **updateScenarioType** The update session type.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.Install
@@ -4603,59 +5221,59 @@ This event sends launch data for a Windows Update install to help keep Windows u
The following fields are available:
-- **eventScenario** End to end update session ID.
-- **deferReason** Reason for install not completing.
-- **interactive** Identifies if session is user initiated.
-- **wuDeviceid** Unique device ID used by Windows Update.
- **batteryLevel** Current battery capacity in mWh or percentage left.
-- **installCommitfailedtime** The time it took for a reboot to happen but the upgrade failed to progress.
+- **deferReason** Reason for install not completing.
- **errorCode** The error code reppresented by a hexadecimal value.
-- **updateId** Update ID.
-- **revisionNumber** Update revision number.
-- **flightID** Unique update ID
-- **installRebootinitiatetime** The time it took for a reboot to be attempted.
-- **flightUpdate** Flight update
-- **minutesToCommit** The time it took to install updates.
+- **eventScenario** End-to-end update session ID.
+- **flightID** The specific ID of the Windows Insider build the device is getting.
+- **flightUpdate** Indicates whether the update is a Windows Insider build.
- **ForcedRebootReminderSet** A boolean value that indicates if a forced reboot will happen for updates.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **installCommitfailedtime** The time it took for a reboot to happen but the upgrade failed to progress.
+- **installRebootinitiatetime** The time it took for a reboot to be attempted.
+- **interactive** Identifies if session is user initiated.
+- **minutesToCommit** The time it took to install updates.
+- **rebootOutsideOfActiveHours** Indicates whether a reboot is scheduled outside of active hours.
+- **revisionNumber** Update revision number.
+- **updateId** Update ID.
- **updateScenarioType** The update session type.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.PostInstall
-This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date.
+This event is sent after a Windows update install completes.
The following fields are available:
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **eventScenario** End to end update session ID.
-- **sessionType** Interactive vs. Background.
-- **bundleRevisionnumber** Bundle revision number.
- **batteryLevel** Current battery capacity in mWh or percentage left.
-- **bundleId** Update grouping ID.
-- **errorCode** Hex code for the error message, to allow lookup of the specific error.
+- **bundleId** Identifier associated with the specific content bundle.
+- **bundleRevisionnumber** Identifies the revision number of the content bundle.
+- **errorCode** The error code returned for the current phase.
+- **eventScenario** State of update action.
- **flightID** Unique update ID.
+- **sessionType** The Windows Update session type (Interactive or Background).
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.RebootFailed
-This event sends information about whether an update required a reboot and reasons for failure to help keep Windows up to date.
+This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date.
The following fields are available:
-- **updateId** Update ID.
- **batteryLevel** Current battery capacity in mWh or percentage left.
-- **RebootResults** Hex code indicating failure reason. Typically, we expect this to be a specific USO generated hex code.
-- **installRebootDeferreason** Reason for reboot not occurring.
-- **revisionNumber** Update revision number.
-- **EventPublishedTime** The time that the reboot failure occurred.
- **deferReason** Reason for install not completing.
-- **wuDeviceid** Unique device ID used by Windows Update.
+- **EventPublishedTime** The time that the reboot failure occurred.
- **flightID** Unique update ID.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **installRebootDeferreason** Reason for reboot not occurring.
+- **rebootOutsideOfActiveHours** Indicates whether a reboot was scheduled outside of active hours.
+- **RebootResults** Hex code indicating failure reason. Typically, we expect this to be a specific USO generated hex code.
+- **revisionNumber** Update revision number.
+- **updateId** Update ID.
- **updateScenarioType** The update session type.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask
@@ -4665,9 +5283,9 @@ This event sends data indicating that a reboot task is missing unexpectedly on a
The following fields are available:
- **RebootTaskRestoredTime** Time at which this reboot task was restored.
-- **wuDeviceid** Device id on which the reboot is restored
- **revisionNumber** Update revision number.
- **updateId** Update ID.
+- **wuDeviceid** Device ID for the device on which the reboot is restored.
### Microsoft.Windows.Update.Orchestrator.SystemNeeded
@@ -4676,14 +5294,14 @@ This event sends data about why a device is unable to reboot, to help keep Windo
The following fields are available:
-- **eventScenario** End to end update session ID.
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **systemNeededReason** Reason ID
-- **updateId** Update ID.
+- **eventScenario** End-to-end update session ID.
+- **rebootOutsideOfActiveHours** Indicates whether a reboot is scheduled outside of active hours.
- **revisionNumber** Update revision number.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **systemNeededReason** List of apps or tasks that are preventing the system from restarting.
+- **updateId** Update ID.
- **updateScenarioType** The update session type.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh
@@ -4692,11 +5310,11 @@ This event sends data on whether Update Management Policies were enabled on a de
The following fields are available:
+- **configuredPoliciescount** Number of policies on the device.
+- **policiesNamevaluesource** Policy name and source of policy (group policy, MDM or flight).
+- **policyCacherefreshtime** Time when policy cache was refreshed.
+- **updateInstalluxsetting** Indicates whether a user has set policies via a user experience option.
- **wuDeviceid** Unique device ID used by Windows Update.
-- **policyCacherefreshtime** Refresh time
-- **policiesNamevaluesource** Policy Name
-- **updateInstalluxsetting** This shows whether a user has set policies via UX option
-- **configuredPoliciescount** Policy Count
### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired
@@ -4705,13 +5323,13 @@ This event sends data about whether an update required a reboot to help keep Win
The following fields are available:
-- **updateId** Update ID.
+- **flightID** The specific ID of the Windows Insider build the device is getting.
+- **interactive** Indicates whether the reboot initiation stage of the update process was entered as a result of user action.
- **revisionNumber** Update revision number.
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **flightID** Unique update ID.
-- **interactive** Indicates the reboot initiation stage of the update process was entered as a result of user action or not.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **updateId** Update ID.
- **updateScenarioType** The update session type.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.UpdateStackServicing.CheckForUpdates
@@ -4720,18 +5338,18 @@ This event sends data about the UpdateStackServicing check for updates, to help
The following fields are available:
-- **EventScenario** The scenario of the event. Example: Started, Failed, or Succeeded
-- **StatusCode** The HRESULT code of the operation.
+- **BspVersion** The version of the BSP.
- **CallerApplicationName** The name of the USS scheduled task. Example UssScheduled or UssBoot
- **ClientVersion** The version of the client.
-- **EventInstanceID** The USS session ID.
-- **WUDeviceID** The Windows Update device ID.
-- **ServiceGuid** The GUID of the service.
-- **BspVersion** The version of the BSP.
-- **OemName** The name of the manufacturer.
-- **DeviceName** The name of the device.
- **CommercializationOperator** The name of the operator.
- **DetectionVersion** The string returned from the GetDetectionVersion export of the downloaded detection DLL.
+- **DeviceName** The name of the device.
+- **EventInstanceID** The USS session ID.
+- **EventScenario** The scenario of the event. Example: Started, Failed, or Succeeded
+- **OemName** The name of the manufacturer.
+- **ServiceGuid** The GUID of the service.
+- **StatusCode** The HRESULT code of the operation.
+- **WUDeviceID** The Windows Update device ID.
### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded
@@ -4749,16 +5367,16 @@ This event sends data about a required reboot that is scheduled with no user int
The following fields are available:
-- **updateId** Update ID of the update that is getting installed with this reboot.
-- **ScheduledRebootTime** Time of the scheduled reboot.
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **revisionNumber** Revision number of the update that is getting installed with this reboot.
-- **forcedreboot** True, if a reboot is forced on the device. False, otherwise.
+- **activeHoursApplicable** Indicates whether Active Hours applies on this device.
+- **forcedReboot** True, if a reboot is forced on the device. Otherwise, this is False
- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action.
-- **rebootScheduledByUser** True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically.
-- **activeHoursApplicable** True, If Active Hours applicable on this device. False, otherwise.
- **rebootOutsideOfActiveHours** True, if a reboot is scheduled outside of active hours. False, otherwise.
-- **rebootState** The state of the reboot.
+- **rebootScheduledByUser** True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically.
+- **rebootState** Current state of the reboot.
+- **revisionNumber** Revision number of the OS.
+- **scheduledRebootTime** Time scheduled for the reboot.
+- **updateId** Identifies which update is being scheduled.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Ux.MusNotification.ToastDisplayedToScheduleReboot
@@ -4776,16 +5394,16 @@ This event sends basic information for scheduling a device restart to install se
The following fields are available:
-- **ScheduledRebootTime** The time that the device was restarted.
-- **updateId** The Windows Update device GUID.
-- **revisionNumber** The revision number of the OS being updated.
-- **wuDeviceid** The Windows Update device GUID.
-- **forcedreboot** Is the restart that's being scheduled a forced restart?
-- **rebootArgument** The arguments that are passed to the OS for the restarted.
-- **rebootScheduledByUser** Was the restart scheduled by the user? If the value is false, the restart was scheduled by the device.
- **activeHoursApplicable** Is the restart respecting Active Hours?
+- **forcedReboot** True, if a reboot is forced on the device. Otherwise, this is False
+- **rebootArgument** The arguments that are passed to the OS for the restarted.
- **rebootOutsideOfActiveHours** Was the restart scheduled outside of Active Hours?
+- **rebootScheduledByUser** Was the restart scheduled by the user? If the value is false, the restart was scheduled by the device.
- **rebootState** The state of the restart.
+- **revisionNumber** The revision number of the OS being updated.
+- **scheduledRebootTime** Time of the scheduled reboot
+- **updateId** The Windows Update device GUID.
+- **wuDeviceid** The Windows Update device GUID.
## Winlogon events
@@ -4796,3 +5414,4 @@ This event signals the completion of the setup process. It happens only once dur
+
diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md
index d9719bbdd6..665450f693 100644
--- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md
+++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md
@@ -1,27 +1,26 @@
---
-description: Learn more about the Windows diagnostic data that is gathered at the basic level.
+description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level.
title: Windows 10, version 1709 basic diagnostic events and fields (Windows 10)
-keywords: privacy, diagnostic data
+keywords: privacy, telemetry
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
localizationpriority: high
-author: danihalfin
-ms.author: daniha
-ms.date: 06/20/2018
+author: brianlic-msft
+ms.author: brianlic
+ms.date: 09/10/2018
---
# Windows 10, version 1709 basic level Windows diagnostic events and fields
-
**Applies to**
- Windows 10, version 1709
-The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. When the level is set to Basic, it also includes the Security level information.
+The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Windows Store. When the level is set to Basic, it also includes the Security level information.
The Basic level helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems.
@@ -30,340 +29,315 @@ Use this article to learn about diagnostic events, grouped by event area, and th
You can learn more about Windows functional and diagnostic data through these articles:
-- [Windows 10, version 1803 basic diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1803)
-- [Windows 10, version 1703 basic diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703)
-- [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services)
-- [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization)
+- [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
+- [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
+- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
+- [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
-## Common data extensions
-
-### Common Data Extensions.App
-
-
-
-The following fields are available:
-
-- **expId** Associates a flight, such as an OS flight, or an experiment, such as a web site UX experiment, with an event.
-- **userId** The userID as known by the application.
-- **env** The environment from which the event was logged.
-- **asId** An integer value that represents the app session. This value starts at 0 on the first app launch and increments after each subsequent app launch per boot session.
-
-
-### Common Data Extensions.CS
-
-
-
-The following fields are available:
-
-- **sig** A common schema signature that identifies new and modified event schemas.
-
-
-### Common Data Extensions.CUET
-
-
-
-The following fields are available:
-
-- **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID.
-- **aId** Represents the ETW ActivityId. Logged via TraceLogging or directly via ETW.
-- **raId** Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW.
-- **op** Represents the ETW Op Code.
-- **cat** Represents a bitmask of the ETW Keywords associated with the event.
-- **flags** Represents the bitmap that captures various Windows specific flags.
-- **cpId** The composer ID, such as Reference, Desktop, Phone, Holographic, Hub, IoT Composer.
-- **tickets** A list of strings that represent entries in the HTTP header of the web request that includes this event.
-- **bseq** Upload buffer sequence number in the format \:\
-- **mon** Combined monitor and event sequence numbers in the format \:\
-
-
-### Common Data Extensions.Device
-
-
-
-The following fields are available:
-
-- **ver** Represents the major and minor version of the extension.
-- **localId** Represents a locally defined unique ID for the device, not the human readable device name. Most likely equal to the value stored at HKLM\Software\Microsoft\SQMClient\MachineId
-- **deviceClass** Represents the classification of the device, the device “family”. For example, Desktop, Server, or Mobile.
-
-
-### Common Data Extensions.Envelope
-
-
-
-The following fields are available:
-
-- **ver** Represents the major and minor version of the extension.
-- **name** Represents the uniquely qualified name for the event.
-- **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format.
-- **popSample** Represents the effective sample rate for this event at the time it was generated by a client.
-- **epoch** Represents the epoch and seqNum fields, which help track how many events were fired and how many events were uploaded, and enables identification of data lost during upload and de-duplication of events on the ingress server.
-- **seqNum** Represents the sequence field used to track absolute order of uploaded events. It is an incrementing identifier for each event added to the upload queue. The Sequence helps track how many events were fired and how many events were uploaded and enables identification of data lost during upload and de-duplication of events on the ingress server.
-- **iKey** Represents an ID for applications or other logical groupings of events.
-- **flags** Represents a collection of bits that describe how the event should be processed by the Connected User Experiences and Telemetry component pipeline. The lowest-order byte is the event persistence. The next byte is the event latency.
-- **os** Represents the operating system name.
-- **osVer** Represents the OS version, and its format is OS dependent.
-- **appId** Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application.
-- **appVer** Represents the version number of the application. Used to understand errors by Version, Usage by Version across an app.
-- **cV** Represents the Correlation Vector: A single field for tracking partial order of related diagnostic data events across component boundaries.
-
-
-### Common Data Extensions.OS
-
-
-
-The following fields are available:
-
-- **ver** Represents the major and minor version of the extension.
-- **expId** Represents the experiment ID. The standard for associating a flight, such as an OS flight (pre-release build), or an experiment, such as a web site UX experiment, with an event is to record the flight / experiment IDs in Part A of the common schema.
-- **locale** Represents the locale of the operating system.
-- **bootId** An integer value that represents the boot session. This value starts at 0 on first boot after OS install and increments after every reboot.
-
-
-### Common Data Extensions.User
-
-
-
-The following fields are available:
-
-- **ver** Represents the major and minor version of the extension.
-- **localId** Represents a unique user identity that is created locally and added by the client. This is not the user's account ID.
-
-
-### Common Data Extensions.XBL
-
-
-
-The following fields are available:
-
-- **nbf** Not before time
-- **expId** Expiration time
-- **sbx** XBOX sandbox identifier
-- **dty** XBOX device type
-- **did** XBOX device ID
-- **xid** A list of base10-encoded XBOX User IDs.
-- **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts.
-
-
-### Common Data Extensions.Consent UI Event
-
-This User Account Control (UAC) diagnostic data point collects information on elevations that originate from low integrity levels. This occurs when a process running at low integrity level (IL) requires higher (administrator) privileges, and therefore requests for elevation via UAC (consent.exe). By better understanding the processes requesting these elevations, Microsoft can in turn improve the detection and handling of potentially malicious behavior in this path.
-
-The following fields are available:
-
-- **eventType** Represents the type of elevation: If it succeeded, was cancelled, or was auto-approved.
-- **splitToken** Represents the flag used to distinguish between administrators and standard users.
-- **friendlyName** Represents the name of the file requesting elevation from low IL.
-- **elevationReason** Represents the distinction between various elevation requests sources (appcompat, installer, COM, MSI and so on).
-- **exeName** Represents the name of the file requesting elevation from low IL.
-- **signatureState** Represents the state of the signature, if it signed, unsigned, OS signed and so on.
-- **publisherName** Represents the name of the publisher of the file requesting elevation from low IL.
-- **cmdLine** Represents the full command line arguments being used to elevate.
-- **Hash.Length** Represents the length of the hash of the file requesting elevation from low IL.
-- **Hash** Represents the hash of the file requesting elevation from low IL.
-- **HashAlgId** Represents the algorithm ID of the hash of the file requesting elevation from low IL.
-- **telemetryFlags** Represents the details about the elevation prompt for CEIP data.
-- **timeStamp** Represents the time stamp on the file requesting elevation.
-- **fileVersionMS** Represents the major version of the file requesting elevation.
-- **fileVersionLS** Represents the minor version of the file requesting elevation.
-
-
-## Common data fields
-
-### Common Data Fields.MS.Device.DeviceInventory.Change
-
-These fields are added whenever Ms.Device.DeviceInventoryChange is included in the event.
-
-The following fields are available:
-
-- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object.
-- **objectType** Indicates the object type that the event applies to.
-- **Action** The change that was invoked on a device inventory object.
-- **inventoryId** Device ID used for Compatibility testing
-
-
-### Common Data Fields.TelClientSynthetic.PrivacySettingsAfterCreatorsUpdate.PreUpgradeSettings
-
-These fields are added whenever PreUpgradeSettings is included in the event.
-
-The following fields are available:
-
-- **HKLM_SensorPermissionState.SensorPermissionState** The state of the Location service before the feature update completed.
-- **HKLM_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the device.
-- **HKCU_SensorPermissionState.SensorPermissionState** The state of the Location service when a user signs on before the feature update completed.
-- **HKCU_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the current user.
-- **HKLM_LocationPlatform.Status** The state of the location platform after the feature update has completed.
-- **HKLM_LocationPlatform.HRESULT** The error code returned when trying to query the location platform for the device.
-- **HKLM_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the device before the feature update completed.
-- **HKLM_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the device.
-- **HKCU_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the current user before the feature update completed.
-- **HKCU_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the current user.
-- **HKLM_AllowTelemetry.AllowTelemetry** The state of the Connected User Experiences and Telemetry component for the device before the feature update.
-- **HKLM_AllowTelemetry.HRESULT** The error code returned when trying to query the Connected User Experiences and Telemetry conponent for the device.
-- **HKLM_TIPC.Enabled** The state of TIPC for the device.
-- **HKLM_TIPC.HRESULT** The error code returned when trying to query TIPC for the device.
-- **HKCU_TIPC.Enabled** The state of TIPC for the current user.
-- **HKCU_TIPC.HRESULT** The error code returned when trying to query TIPC for the current user.
-- **HKLM_FlipAhead.FPEnabled** Is Flip Ahead enabled for the device before the feature update was completed?
-- **HKLM_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the device.
-- **HKCU_FlipAhead.FPEnabled** Is Flip Ahead enabled for the current user before the feature update was completed?
-- **HKCU_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the current user.
-- **HKLM_TailoredExperiences.TailoredExperiencesWithDiagnosticDataEnabled** Is Tailored Experiences with Diagnostics Data enabled for the current user after the feature update had completed?
-- **HKCU_TailoredExperiences.HRESULT** The error code returned when trying to query Tailored Experiences with Diagnostics Data for the current user.
-- **HKLM_AdvertisingID.Enabled** Is the adveristing ID enabled for the device?
-- **HKLM_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the device.
-- **HKCU_AdvertisingID.Enabled** Is the adveristing ID enabled for the current user?
-- **HKCU_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the user.
-
-
-### Common Data Fields.TelClientSynthetic.PrivacySettingsAfterCreatorsUpdate.PostUpgradeSettings
-
-These fields are added whenever PostUpgradeSettings is included in the event.
-
-The following fields are available:
-
-- **HKLM_SensorPermissionState.SensorPermissionState** The state of the Location service after the feature update has completed.
-- **HKLM_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the device.
-- **HKCU_SensorPermissionState.SensorPermissionState** The state of the Location service when a user signs on after a feature update has completed.
-- **HKCU_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the current user.
-- **HKLM_LocationPlatform.Status** The state of the location platform after the feature update has completed.
-- **HKLM_LocationPlatform.HRESULT** The error code returned when trying to query the location platform for the device.
-- **HKLM_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the device after the feature update has completed.
-- **HKLM_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the device.
-- **HKCU_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the current user after the feature update has completed.
-- **HKCU_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the current user.
-- **HKLM_AllowTelemetry.AllowTelemetry** The state of the Connected User Experiences and Telemetry component for the device after the feature update.
-- **HKLM_AllowTelemetry.HRESULT** The error code returned when trying to query the Connected User Experiences and Telemetry conponent for the device.
-- **HKLM_TIPC.Enabled** The state of TIPC for the device.
-- **HKLM_TIPC.HRESULT** The error code returned when trying to query TIPC for the device.
-- **HKCU_TIPC.Enabled** The state of TIPC for the current user.
-- **HKCU_TIPC.HRESULT** The error code returned when trying to query TIPC for the current user.
-- **HKLM_FlipAhead.FPEnabled** Is Flip Ahead enabled for the device after the feature update has completed?
-- **HKLM_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the device.
-- **HKCU_FlipAhead.FPEnabled** Is Flip Ahead enabled for the current user after the feature update has completed?
-- **HKCU_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the current user.
-- **HKLM_TailoredExperiences.TailoredExperiencesWithDiagnosticDataEnabled** Is Tailored Experiences with Diagnostics Data enabled for the current user after the feature update had completed?
-- **HKCU_TailoredExperiences.HRESULT** The error code returned when trying to query Tailored Experiences with Diagnostics Data for the current user.
-- **HKLM_AdvertisingID.Enabled** Is the adveristing ID enabled for the device?
-- **HKLM_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the device.
-- **HKCU_AdvertisingID.Enabled** Is the adveristing ID enabled for the current user?
-- **HKCU_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the user.
-
## Appraiser events
-### Microsoft.Windows.Appraiser.General.RunContext
+### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount
-This event indicates what should be expected in the data payload.
+Invalid Signature - This event is superseded by an event that contains additional fields.
The following fields are available:
-- **AppraiserBranch** The source branch in which the currently running version of Appraiser was built.
-- **AppraiserProcess** The name of the process that launched Appraiser.
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **Context** Indicates what mode Appraiser is running in. Example: Setup or Diagnostic Data.
-- **PCFP** An ID for the system calculated by hashing hardware identifiers.
-- **Time** The client time of the event.
+- **DatasourceApplicationFile_RS1** An ID for the system, calculated by hashing hardware identifiers.
+- **DatasourceApplicationFile_RS4** An ID for the system, calculated by hashing hardware identifiers.
+- **DatasourceDevicePnp_RS4** An ID for the system, calculated by hashing hardware identifiers.
+- **DatasourceDriverPackage_RS4** The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device.
+- **DatasourceSystemBios_RS4** The count of the number of this particular object type present on this device.
+- **DecisionApplicationFile_RS1** An ID for the system, calculated by hashing hardware identifiers.
+- **DecisionApplicationFile_RS4** The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_RS4** The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_RS4** The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device.
+- **DecisionMediaCenter_RS4** The count of the number of this particular object type present on this device.
+- **DecisionSystemBios_RS4** The total DecisionSystemBios objects targeting Windows 10 version, 1803 present on this device.
+- **DecisionTest_RS1** An ID for the system, calculated by hashing hardware identifiers.
+- **InventoryApplicationFile** The count of the number of this particular object type present on this device.
+- **InventoryLanguagePack** The count of InventoryLanguagePack objects present on this machine.
+- **InventoryMediaCenter** The count of the number of this particular object type present on this device.
+- **InventorySystemBios** The count of the number of this particular object type present on this device.
+- **InventoryTest** The count of the number of this particular object type present on this device.
+- **InventoryUplevelDriverPackage** The count of the number of this particular object type present on this device.
+- **PCFP** An ID for the system, calculated by hashing hardware identifiers.
+- **SystemMemory** The count of the number of this particular object type present on this device.
+- **SystemProcessorCompareExchange** The count of the number of this particular object type present on this device.
+- **SystemProcessorLahfSahf** The count of the number of this particular object type present on this device.
+- **SystemProcessorNx** The count of the number of this particular object type present on this device.
+- **SystemProcessorPrefetchW** The count of SystemProcessorPrefetchW objects present on this machine.
+- **SystemProcessorSse2** The count of SystemProcessorSse2 objects present on this machine.
+- **SystemTouch** The count of SystemTouch objects present on this machine.
+- **SystemWim** The count of SystemWim objects present on this machine.
+- **SystemWindowsActivationStatus** The count of SystemWindowsActivationStatus objects present on this machine.
+- **SystemWlan** The count of the number of this particular object type present on this device.
+- **Wmdrm_RS1** An ID for the system, calculated by hashing hardware identifiers.
+- **Wmdrm_RS4** The total Wmdrm objects targeting Windows 10, version 1803 present on this device.
-### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
+### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd
-A summary event indicating the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up-to-date.
+Represents the basic metadata about specific application files installed on the system.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **AppraiserBranch** The source branch in which the version of Appraiser that is running was built.
-- **AppraiserDataVersion** The version of the data files being used by the Appraiser diagnostic data run.
-- **AppraiserProcess** The name of the process that launched Appraiser.
-- **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots.
-- **AuxFinal** Obsolete, always set to false
-- **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
-- **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
-- **EnterpriseRun** Indicates if the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
-- **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent.
-- **InventoryFullSync** Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent.
-- **PCFP** An ID for the system calculated by hashing hardware identifiers.
-- **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
-- **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
-- **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
-- **RunDate** The date that the diagnostic data run was stated, expressed as a filetime.
-- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic.
-- **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
-- **RunResult** The hresult of the Appraiser diagnostic data run.
-- **SendingUtc** Indicates if the Appraiser client is sending events during the current diagnostic data run.
-- **StoreHandleIsNotNull** Obsolete, always set to false
-- **TelementrySent** Indicates if diagnostic data was successfully sent.
-- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability.
-- **Time** The client time of the event.
-- **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
-- **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated.
+- **AppraiserVersion** The version of the appraiser file that is generating the events.
+- **AvDisplayName** If the app is an anti-virus app, this is its display name.
+- **CompatModelIndex** The compatibility prediction for this file.
+- **HasCitData** Indicates whether the file is present in CIT data.
+- **HasUpgradeExe** Indicates whether the anti-virus app has an upgrade.exe file.
+- **IsAv** Is the file an anti-virus reporting EXE?
+- **ResolveAttempted** This will always be an empty string when sending telemetry.
+- **SdbEntries** An array of fields that indicates the SDB entries that apply to this file.
-### Microsoft.Windows.Appraiser.General.EnterpriseScenarioWithDiagTrackServiceRunning
+### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove
-The event that indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario.
+This event indicates that the DatasourceApplicationFile object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **PCFP** An ID for the system calculated by hashing hardware identifiers.
-- **Time** The client time of the event.
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd
+### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync
-This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or are part of an anti-virus program.
+This event indicates that a new set of DatasourceApplicationFileAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd
+
+This event sends compatibility data for a Plug and Play device, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **ActiveNetworkConnection** Indicates whether the device is an active network device.
+- **AppraiserVersion** The version of the appraiser file generating the events.
+- **IsBootCritical** Indicates whether the device boot is critical.
+- **WuDriverCoverage** Indicates whether there is a driver uplevel for this device, according to Windows Update.
+- **WuDriverUpdateId** The Windows Update ID of the applicable uplevel driver.
+- **WuPopulatedFromId** The expected uplevel driver matching ID based on driver coverage from Windows Update.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove
+
+This event indicates that the DatasourceDevicePnp object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync
+
+This event indicates that a new set of DatasourceDevicePnpAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageAdd
+
+This event sends compatibility database data about driver packages to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the appraiser file generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove
+
+This event indicates that the DatasourceDriverPackage object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync
+
+This event indicates that a new set of DatasourceDriverPackageAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
+
+This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the appraiser file generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove
+
+This event indicates that the DataSourceMatchingInfoBlock object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync
+
+This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
+
+This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the appraiser file generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove
+
+This event indicates that the DataSourceMatchingInfoPassive object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync
+
+This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
+
+This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the appraiser file generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove
+
+This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync
+
+This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd
+
+This event sends compatibility database information about the BIOS to help keep Windows up-to-date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **AvDisplayName** If the app is an anti-virus app, this is its display name.
-- **AvProductState** Represents state of antivirus program with respect to whether it's turned on and the signatures are up-to-date.
-- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64
-- **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets.
-- **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets.
-- **BoeProgramId** If there is no entry in Add/Remove Programs, this is the ProgramID that is generated from the file metadata.
-- **CompanyName** The company name of the vendor who developed this file.
-- **FileId** A hash that uniquely identifies a file.
-- **FileVersion** The File version field from the file metadata under Properties -> Details.
-- **HasUpgradeExe** Does the anti-virus app have an upgrade.exe file?
-- **IsAv** Is the file an anti-virus reporting EXE?
-- **LinkDate** The date and time that this file was linked on.
-- **LowerCaseLongPath** The full file path to the file that was inventoried on the device.
-- **Name** The name of the file that was inventoried.
-- **ProductName** The Product name field from the file metadata under Properties -> Details.
-- **ProductVersion** The Product version field from the file metadata under Properties -> Details.
-- **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it.
-- **Size** The size of the file (in hexadecimal bytes).
-### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd
-This event represents the drivers that an application installs.
+### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove
+
+This event indicates that the DatasourceSystemBios object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **InventoryVersion** The version of the inventory component
-- **Programids** The unique program identifier the driver is associated with.
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync
+### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync
-This event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent.
+This event indicates that a new set of DatasourceSystemBiosAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **InventoryVersion** The version of the inventory component.
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd
This event sends compatibility decision data about a file to help keep Windows up-to-date.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **AppraiserVersion** The version of the appraiser file generating the events.
+- **AppraiserVersion** The version of the appraiser file that is generating the events.
- **BlockAlreadyInbox** The uplevel runtime block on the file already existed on the current OS.
-- **BlockingApplication** Are there any application issues that interfere with upgrade due to the file in question?
+- **BlockingApplication** Indicates whether there are any application issues that interfere with the upgrade due to the file in question.
- **DisplayGenericMessage** Will be a generic message be shown for this file?
- **HardBlock** This file is blocked in the SDB.
- **HasUxBlockOverride** Does the file have a block that is overridden by a tag in the SDB?
@@ -381,93 +355,40 @@ The following fields are available:
- **SdbReinstallUpgradeWarn** The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade.
- **SoftBlock** The file is softblocked in the SDB and has a warning.
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
-This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date.
+### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
-The following fields are available:
+This event indicates Indicates that the DecisionApplicationFile object is no longer present.
-- **AppraiserVersion** The version of the appraiser file generating the events.
-
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockAdd
-
-This event sends compatibility decision data about blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the appraiser file generating the events.
-- **BlockingApplication** Are there are any application issues that interfere with upgrade due to matching info blocks?
-- **DisplayGenericMessage** Will a generic message be shown for this block?
-- **NeedsUninstallAction** Does the user need to take an action in setup due to a matching info block?
-- **SdbBlockUpgrade** Is a matching info block blocking upgrade?
-- **SdbBlockUpgradeCanReinstall** Is a matching info block blocking upgrade, but has the can reinstall tag?
-- **SdbBlockUpgradeUntilUpdate** Is a matching info block blocking upgrade but has the until update tag?
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
-
-This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the appraiser file generating the events.
-
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveAdd
-
-This event sends compatibility decision data about non-blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **BlockingApplication** Are there any application issues that interfere with upgrade due to matching info blocks?
-- **MigApplication** Is there a matching info block with a mig for the current mode of upgrade?
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
+### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync
-This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+This event indicates that a new set of DecisionApplicationFileAdd events will be sent.
-The following fields are available:
-
-- **AppraiserVersion** The version of the appraiser file generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeAdd
-
-This event sends compatibility decision data about entries that require reinstall after upgrade. It's used to help keep Windows up-to-date.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **NeedsInstallPostUpgradeData** Will the file have a notification after upgrade to install a replacement for the app?
-- **NeedsNotifyPostUpgradeData** Should a notification be shown for this file after upgrade?
-- **NeedsReinstallPostUpgradeData** Will the file have a notification after upgrade to reinstall the app?
-- **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the compatibility database (but is not blocking upgrade).
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd
-
-This event sends compatibility data for a PNP device, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **ActiveNetworkConnection** Is the device an active network device?
-- **AppraiserVersion** The version of the appraiser file generating the events.
-- **IsBootCritical** Is the device boot critical?
-- **WuDriverCoverage** Is there a driver uplevel for this device according to Windows Update?
-- **WuDriverUpdateId** The Windows Update ID of the applicable uplevel driver.
-- **WuPopulatedFromId** The expected uplevel driver matching ID based on driver coverage from Windows Update.
### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd
-This event sends compatibility decision data about a PNP device to help keep Windows up-to-date.
+This event sends compatibility decision data about a PNP device to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **AssociatedDriverWillNotMigrate** Will the driver associated with this plug-and-play device migrate?
- **AppraiserVersion** The version of the appraiser file generating the events.
- **AssociatedDriverIsBlocked** Is the driver associated with this PNP device blocked?
+- **AssociatedDriverWillNotMigrate** Will the driver associated with this plug-and-play device migrate?
- **BlockAssociatedDriver** Should the driver associated with this PNP device be blocked?
- **BlockingDevice** Is this PNP device blocking upgrade?
- **BlockUpgradeIfDriverBlocked** Is the PNP device both boot critical and does not have a driver included with the OS?
@@ -483,17 +404,33 @@ The following fields are available:
- **SdbDriverBlockOverridden** Is there an SDB block on the PNP device that blocks upgrade, but that block was overridden?
-### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageAdd
+### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove
-This event sends compatibility database data about driver packages to help keep Windows up-to-date.
+This event indicates that the DecisionDevicePnp object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **AppraiserVersion** The version of the appraiser file generating the events.
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync
+
+The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
### Microsoft.Windows.Appraiser.General.DecisionDriverPackageAdd
-This event sends decision data about driver package compatibility to help keep Windows up-to-date.
+This event sends decision data about driver package compatibility to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -505,188 +442,144 @@ The following fields are available:
- **SdbDriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden?
-### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd
+### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove
-This event sends basic metadata about the BIOS to determine whether it has a compatibility block.
+This event indicates that the DecisionDriverPackage object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **BiosDate** The release date of the BIOS in UTC format.
-- **BiosName** The name field from Win32_BIOS.
-- **Manufacturer** The manufacturer field from Win32_ComputerSystem.
-- **Model** The model field from Win32_ComputerSystem.
-### Microsoft.Windows.Appraiser.General.SystemMemoryAdd
+### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync
-This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date.
+This event indicates that a new set of DecisionDriverPackageAdd events will be sent.
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **Blocking** Is the device from upgrade due to memory restrictions?
-- **MemoryRequirementViolated** Was a memory requirement violated?
-- **pageFile** The current committed memory limit for the system or the current process, whichever is smaller (in bytes).
-- **ram** The amount of memory on the device.
-- **ramKB** The amount of memory (in KB).
-- **virtual** The size of the user-mode portion of the virtual address space of the calling process (in bytes).
-- **virtualKB** The amount of virtual memory (in KB).
-
-
-### Microsoft.Windows.Appraiser.General.DecisionSystemBiosAdd
-
-This event sends compatibility decision data about the BIOS to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **Blocking** Is the device blocked from upgrade due to a BIOS block?
-- **HasBiosBlock** Does the device have a BIOS block?
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd
-
-This event sends compatibility database information about the BIOS to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **SdbEntries** An array of fields indicating the SDB entries that apply to this BIOS.
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeAdd
-
-This event sends data indicating whether the system supports the CompareExchange128 CPU requirement, to help keep Windows up to date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **Blocking** Is the upgrade blocked due to the processor?
-- **CompareExchange128Support** Does the CPU support CompareExchange128?
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd
-
-This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **Blocking** Is the upgrade blocked due to the processor?
-- **LahfSahfSupport** Does the CPU support LAHF/SAHF?
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd
-
-This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **Blocking** Is the upgrade blocked due to the processor?
-- **NXDriverResult** The result of the driver used to do a non-deterministic check for NX support.
-- **NXProcessorSupport** Does the processor support NX?
-### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWAdd
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockAdd
-This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up-to-date.
+This event sends compatibility decision data about blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the appraiser file generating the events.
+- **BlockingApplication** Are there are any application issues that interfere with upgrade due to matching info blocks?
+- **DisplayGenericMessage** Will a generic message be shown for this block?
+- **NeedsUninstallAction** Does the user need to take an action in setup due to a matching info block?
+- **SdbBlockUpgrade** Is a matching info block blocking upgrade?
+- **SdbBlockUpgradeCanReinstall** Is a matching info block blocking upgrade, but has the can reinstall tag?
+- **SdbBlockUpgradeUntilUpdate** Is a matching info block blocking upgrade but has the until update tag?
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove
+
+This event indicates that the DecisionMatchingInfoBlock object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **Blocking** Is the upgrade blocked due to the processor?
-- **PrefetchWSupport** Does the processor support PrefetchW?
-### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Add
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync
-This event sends data indicating whether the system supports the SSE2 CPU requirement, to help keep Windows up-to-date.
+This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **Blocking** Is the upgrade blocked due to the processor?
-- **SSE2ProcessorSupport** Does the processor support SSE2?
-### Microsoft.Windows.Appraiser.General.SystemWimAdd
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveAdd
-This event sends data indicating whether the operating system is running from a compressed WIM file, to help keep Windows up-to-date.
+This event sends compatibility decision data about non-blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **IsWimBoot** Is the current operating system running from a compressed WIM file?
-- **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM.
+- **BlockingApplication** Are there any application issues that interfere with upgrade due to matching info blocks?
+- **MigApplication** Is there a matching info block with a mig for the current mode of upgrade?
-### Microsoft.Windows.Appraiser.General.SystemTouchAdd
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove
-This event sends data indicating whether the system supports touch, to help keep Windows up-to-date.
+This event Indicates that the DecisionMatchingInfoPassive object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **IntegratedTouchDigitizerPresent** Is there an integrated touch digitizer?
-- **MaximumTouches** The maximum number of touch points supported by the device hardware.
-### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusAdd
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync
-This event sends data indicating whether the current operating system is activated, to help keep Windows up-to-date.
+This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **WindowsIsLicensedApiValue** The result from the API that's used to indicate if operating system is activated.
-- **WindowsNotActivatedDecision** Is the current operating system activated?
-### Microsoft.Windows.Appraiser.General.InventoryLanguagePackAdd
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeAdd
-This event sends data about the number of language packs installed on the system, to help keep Windows up-to-date.
+This event sends compatibility decision data about entries that require reinstall after upgrade. It's used to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **HasLanguagePack** Does this device have 2 or more language packs?
-- **LanguagePackCount** How many language packs are installed?
+- **NeedsInstallPostUpgradeData** Will the file have a notification after upgrade to install a replacement for the app?
+- **NeedsNotifyPostUpgradeData** Should a notification be shown for this file after upgrade?
+- **NeedsReinstallPostUpgradeData** Will the file have a notification after upgrade to reinstall the app?
+- **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the compatibility database (but is not blocking upgrade).
-### Microsoft.Windows.Appraiser.General.SystemWlanAdd
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove
-This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date.
+This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **Blocking** Is the upgrade blocked because of an emulated WLAN driver?
-- **HasWlanBlock** Does the emulated WLAN driver have an upgrade block?
-- **WlanEmulatedDriver** Does the device have an emulated WLAN driver?
-- **WlanExists** Does the device support WLAN at all?
-- **WlanModulePresent** Are any WLAN modules present?
-- **WlanNativeDriver** Does the device have a non-emulated WLAN driver?
-### Microsoft.Windows.Appraiser.General.InventoryMediaCenterAdd
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync
-This event sends true/false data about decision points used to understand whether Windows Media Center is used on the system, to help keep Windows up to date.
+This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **EverLaunched** Has Windows Media Center ever been launched?
-- **HasConfiguredTv** Has the user configured a TV tuner through Windows Media Center?
-- **HasExtendedUserAccounts** Are any Windows Media Center Extender user accounts configured?
-- **HasWatchedFolders** Are any folders configured for Windows Media Center to watch?
-- **IsDefaultLauncher** Is Windows Media Center the default app for opening music or video files?
-- **IsPaid** Is the user running a Windows Media Center edition that implies they paid for Windows Media Center?
-- **IsSupported** Does the running OS support Windows Media Center?
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
### Microsoft.Windows.Appraiser.General.DecisionMediaCenterAdd
-This event sends decision data about the presence of Windows Media Center, to help keep Windows up-to-date.
+This event sends decision data about the presence of Windows Media Center, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -699,187 +592,11 @@ The following fields are available:
- **NeedsDismissAction** Are there any actions that can be dismissed coming from Windows Media Center?
-### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount
+### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove
-This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client.
+This event indicates that the DecisionMediaCenter object is no longer present.
-The following fields are available:
-
-- **DatasourceApplicationFile_RS2** The total DatasourceApplicationFile objects targeting Windows 10 version 1703 present on this device.
-- **DatasourceDevicePnp_RS2** The total DatasourceDevicePnp objects targeting Windows 10 version 1703 present on this device.
-- **DatasourceDriverPackage_RS2** The total DatasourceDriverPackage objects targeting Windows 10 version 1703 present on this device.
-- **DataSourceMatchingInfoBlock_RS2** The total DataSourceMatchingInfoBlock objects targeting Windows 10 version 1703 present on this device.
-- **DataSourceMatchingInfoPassive_RS2** The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1703 present on this device.
-- **DataSourceMatchingInfoPostUpgrade_RS2** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 present on this device.
-- **DatasourceSystemBios_RS2** The total DatasourceSystemBios objects targeting Windows 10 version 1703 present on this device.
-- **DecisionApplicationFile_RS2** The total DecisionApplicationFile objects targeting Windows 10 version 1703 present on this device.
-- **DecisionDevicePnp_RS2** The total DecisionDevicePnp objects targeting Windows 10 version 1703 present on this device.
-- **DecisionDriverPackage_RS2** The total DecisionDriverPackage objects targeting Windows 10 version 1703 present on this device.
-- **DecisionMatchingInfoBlock_RS2** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1703 present on this device.
-- **DecisionMatchingInfoPassive_RS2** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1703 present on this device.
-- **DecisionMatchingInfoPostUpgrade_RS2** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 present on this device.
-- **DecisionMediaCenter_RS2** The total DecisionMediaCenter objects targeting Windows 10 version 1703 present on this device.
-- **DecisionSystemBios_RS2** The total DecisionSystemBios objects targeting Windows 10 version 1703 present on this device.
-- **InventoryApplicationFile** The total InventoryApplicationFile objects that are present on this device.
-- **InventoryLanguagePack** The total InventoryLanguagePack objects that are present on this device.
-- **InventoryMediaCenter** The total InventoryMediaCenter objects that are present on this device.
-- **InventorySystemBios** The total InventorySystemBios objects that are present on this device.
-- **InventoryUplevelDriverPackage** The total InventoryUplevelDriverPackage objects that are present on this device.
-- **PCFP** An ID for the system that is calculated by hashing hardware identifiers.
-- **SystemMemory** The total SystemMemory objects that are present on this device.
-- **SystemProcessorCompareExchange** The total SystemProcessorCompareExchange objects that are present on this device.
-- **SystemProcessorLahfSahf** The total SystemProcessorLahfSahf objects that are present on this device.
-- **SystemProcessorNx** The total SystemProcessorNx objects that are present on this device.
-- **SystemProcessorPrefetchW** The total SystemProcessorPrefetchW objects that are present on this device.
-- **SystemProcessorSse2** The total SystemProcessorSse2 objects that are present on this device.
-- **SystemTouch** The total SystemTouch objects that are present on this device.
-- **SystemWim** The total SystemWim objects that are present on this device
-- **SystemWindowsActivationStatus** The total SystemWindowsActivationStatus objects that are present on this device.
-- **SystemWlan** The total SystemWlan objects that are present on this device.
-- **Wmdrm_RS2** The total Wmdrm objects targeting Windows 10 version 1703 present on this device.
-- **DatasourceApplicationFile_RS3** "The total DecisionApplicationFile objects targeting the next release of Windows on this device. "
-- **DatasourceDevicePnp_RS3** The total DatasourceDevicePnp objects targeting the next release of Windows on this device.
-- **DatasourceDriverPackage_RS3** The total DatasourceDriverPackage objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoBlock_RS3** The total DataSourceMatchingInfoBlock objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
-- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
-- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
-- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device.
-- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device.
-- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync
-
-This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync
-
-This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync
-
-This event indicates that a new set of SystemProcessorSse2Add events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync
-
-This event indicates that a new set of InventorySystemBiosAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync
-
-This event indicates that a new set of DecisionSystemBiosAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync
-
-This event indicates that a new set of SystemMemoryAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync
-
-This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync
-
-This event indicates that a new set of SystemProcessorNxAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync
-
-This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemWimStartSync
-
-This event indicates that a new set of SystemWimAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync
-
-This event indicates that a new set of DatasourceSystemBiosAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemTouchStartSync
-
-This event indicates that a new set of SystemTouchAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageEndSync
-
-This event indicates that a full set of DatasourceDriverPackageAdd events has been sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemWlanStartSync
-
-This event indicates that a new set of SystemWlanAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync
-
-This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -890,198 +607,48 @@ The following fields are available:
This event indicates that a new set of DecisionMediaCenterAdd events will be sent.
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync
-
-This event indicates that a new set of InventoryMediaCenterAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync
-
-This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync
+### Microsoft.Windows.Appraiser.General.DecisionSystemBiosAdd
-This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent.
+This event sends compatibility decision data about the BIOS to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **Blocking** Is the device blocked from upgrade due to a BIOS block?
+- **HasBiosBlock** Does the device have a BIOS block?
+
+
+### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove
+
+This event indicates that the DecisionSystemBios object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
+### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync
-This event indicates that a new set of InventoryApplicationFileAdd events will be sent.
+This event indicates that a new set of DecisionSystemBiosAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync
-
-This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.WmdrmStartSync
-
-This event indicates that a new set of WmdrmAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveEndSync
-
-This event indicates that a full set of DataSourceMatchingInfoPassiveAdd events have been sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync
-
-This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync
-
-This event indicates that a new set of DatasourceApplicationFileAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync
-
-This event indicates that a new set of DatasourceDevicePnpAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync
-
-This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync
-
-This event indicates that a new set of DecisionApplicationFileAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync
-
-This event indicates that a new set of InventoryLanguagePackAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync
-
-This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync
-
-This event indicates that the DecisionDevicePnp object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync
-
-This event indicates that a new set of DatasourceDriverPackageAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync
-
-This event indicates that a new set of DecisionDriverPackageAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.WmdrmAdd
-
-This event sends data about the usage of older digital rights management on the system, to help keep Windows up to date. This data does not indicate the details of the media using the digital rights management, only whether any such files exist. Collecting this data was critical to ensuring the correct mitigation for customers, and should be able to be removed once all mitigations are in place.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **BlockingApplication** Same as NeedsDismissAction
-- **NeedsDismissAction** Indicates if a dismissible message is needed to warn the user about a potential loss of data due to DRM deprecation.
-- **WmdrmApiResult** Raw value of the API used to gather DRM state.
-- **WmdrmCdRipped** Indicates if the system has any files encrypted with personal DRM, which was used for ripped CDs.
-- **WmdrmIndicators** WmdrmCdRipped OR WmdrmPurchased
-- **WmdrmInUse** WmdrmIndicators AND dismissible block in setup was not dismissed.
-- **WmdrmNonPermanent** Indicates if the system has any files with non-permanent licenses.
-- **WmdrmPurchased** Indicates if the system has any files with permanent licenses.
-
-### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd
-
-This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **BootCritical** Is the driver package marked as boot critical?
-- **Build** The build value from the driver package.
-- **CatalogFile** The name of the catalog file within the driver package.
-- **Class** The device class from the driver package.
-- **ClassGuid** The device class GUID from the driver package.
-- **Date** The date from the driver package.
-- **Inbox** Is the driver package of a driver that is included with Windows?
-- **OriginalName** The original name of the INF file before it was renamed. Generally a path under $WINDOWS.~BT\Drivers\DU
-- **Provider** The provider of the driver package.
-- **PublishedName** The name of the INF file, post-rename.
-- **Revision** The revision of the driver package.
-- **SignatureStatus** Indicates if the driver package is signed. Unknown:0, Unsigned:1, Signed: 2
-- **VersionMajor** The major version of the driver package.
-- **VersionMinor** The minor version of the driver package.
-
### Microsoft.Windows.Appraiser.General.GatedRegChange
This event sends data about the results of running a set of quick-blocking instructions, to help keep Windows up to date.
@@ -1096,109 +663,546 @@ The following fields are available:
- **Time** The client time of the event.
-### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove
+### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd
-This event indicates that the DatasourceApplicationFile object is no longer present.
+This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **AvDisplayName** If the app is an antivirus app, this is its display name.
+- **AvProductState** Indicates whether the antivirus program is turned on and the signatures are up to date.
+- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64.
+- **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets.
+- **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets.
+- **BoeProgramId** If there is no entry in Add/Remove Programs, this is the ProgramID that is generated from the file metadata.
+- **CompanyName** The company name of the vendor who developed this file.
+- **FileId** A hash that uniquely identifies a file.
+- **FileVersion** The File version field from the file metadata under Properties -> Details.
+- **HasUpgradeExe** Indicates whether the antivirus app has an upgrade.exe file.
+- **IsAv** Indicates whether the file an antivirus reporting EXE.
+- **LinkDate** The date and time that this file was linked on.
+- **LowerCaseLongPath** The full file path to the file that was inventoried on the device.
+- **Name** The name of the file that was inventoried.
+- **ProductName** The Product name field from the file metadata under Properties -> Details.
+- **ProductVersion** The Product version field from the file metadata under Properties -> Details.
+- **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it.
+- **Size** The size of the file (in hexadecimal bytes).
+
+
+### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove
+
+This event indicates that the InventoryApplicationFile object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove
+### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
-This event indicates that the DatasourceDevicePnp object is no longer present.
+This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove
+### Microsoft.Windows.Appraiser.General.InventoryLanguagePackAdd
-This event indicates that the DatasourceDriverPackage object is no longer present.
+This event sends data about the number of language packs installed on the system, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **HasLanguagePack** Indicates whether this device has 2 or more language packs.
+- **LanguagePackCount** The number of language packs are installed.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove
+
+This event indicates that the InventoryLanguagePack object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove
+### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync
-This event indicates that the SystemProcessorSse2 object is no longer present.
+This event indicates that a new set of InventoryLanguagePackAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove
+### Microsoft.Windows.Appraiser.General.InventoryMediaCenterAdd
-This event indicates that the InventoryUplevelDriverPackage object is no longer present.
+This event sends true/false data about decision points used to understand whether Windows Media Center is used on the system, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove
-
-This event indicates that the DecisionMediaCenter object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **EverLaunched** Has Windows Media Center ever been launched?
+- **HasConfiguredTv** Has the user configured a TV tuner through Windows Media Center?
+- **HasExtendedUserAccounts** Are any Windows Media Center Extender user accounts configured?
+- **HasWatchedFolders** Are any folders configured for Windows Media Center to watch?
+- **IsDefaultLauncher** Is Windows Media Center the default app for opening music or video files?
+- **IsPaid** Is the user running a Windows Media Center edition that implies they paid for Windows Media Center?
+- **IsSupported** Does the running OS support Windows Media Center?
### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove
This event indicates that the InventoryMediaCenter object is no longer present.
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove
-
-This event indicates that the DatasourceSystemBios object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
+### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync
-This event indicates that the DecisionApplicationFile object is no longer present.
+This event indicates that a new set of InventoryMediaCenterAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove
+### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd
-This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present.
+This event sends basic metadata about the BIOS to determine whether it has a compatibility block.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **BiosDate** The release date of the BIOS in UTC format.
+- **BiosName** The name field from Win32_BIOS.
+- **Manufacturer** The manufacturer field from Win32_ComputerSystem.
+- **Model** The model field from Win32_ComputerSystem.
+
+
+### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove
+
+This event indicates that the InventorySystemBios object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync
+
+This event indicates that a new set of InventorySystemBiosAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd
+
+This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **BootCritical** Is the driver package marked as boot critical?
+- **Build** The build value from the driver package.
+- **CatalogFile** The name of the catalog file within the driver package.
+- **Class** The device class from the driver package.
+- **ClassGuid** The device class unique ID from the driver package.
+- **Date** The date from the driver package.
+- **Inbox** Is the driver package of a driver that is included with Windows?
+- **OriginalName** The original name of the INF file before it was renamed. Generally a path under $WINDOWS.~BT\Drivers\DU.
+- **Provider** The provider of the driver package.
+- **PublishedName** The name of the INF file after it was renamed.
+- **Revision** The revision of the driver package.
+- **SignatureStatus** Indicates if the driver package is signed. Unknown = 0, Unsigned = 1, Signed = 2.
+- **VersionMajor** The major version of the driver package.
+- **VersionMinor** The minor version of the driver package.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove
+
+This event indicates that the InventoryUplevelDriverPackage object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync
+
+This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.RunContext
+
+This event indicates what should be expected in the data payload.
+
+The following fields are available:
+
+- **AppraiserBranch** The source branch in which the currently running version of Appraiser was built.
+- **AppraiserProcess** The name of the process that launched Appraiser.
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **Context** Indicates what mode Appraiser is running in. Example: Setup or Telemetry.
+- **PCFP** An ID for the system calculated by hashing hardware identifiers.
+- **Time** The client time of the event.
+
+
+### Microsoft.Windows.Appraiser.General.SystemMemoryAdd
+
+This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **Blocking** Is the device from upgrade due to memory restrictions?
+- **MemoryRequirementViolated** Was a memory requirement violated?
+- **pageFile** The current committed memory limit for the system or the current process, whichever is smaller (in bytes).
+- **ram** The amount of memory on the device.
+- **ramKB** The amount of memory (in KB).
+- **virtual** The size of the user-mode portion of the virtual address space of the calling process (in bytes).
+- **virtualKB** The amount of virtual memory (in KB).
+
+
+### Microsoft.Windows.Appraiser.General.SystemMemoryRemove
+
+This event that the SystemMemory object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync
+
+This event indicates that a new set of SystemMemoryAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeAdd
+
+This event sends data indicating whether the system supports the CompareExchange128 CPU requirement, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **Blocking** Is the upgrade blocked due to the processor?
+- **CompareExchange128Support** Does the CPU support CompareExchange128?
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove
+
+This event indicates that the SystemProcessorCompareExchange object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync
+
+This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd
+
+This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file generating the events.
+- **Blocking** Is the upgrade blocked due to the processor?
+- **LahfSahfSupport** Does the CPU support LAHF/SAHF?
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove
+
+This event indicates that the SystemProcessorLahfSahf object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync
+
+This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd
+
+This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **Blocking** Is the upgrade blocked due to the processor?
+- **NXDriverResult** The result of the driver used to do a non-deterministic check for NX support.
+- **NXProcessorSupport** Does the processor support NX?
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove
+
+This event indicates that the SystemProcessorNx object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync
+
+This event indicates that a new set of SystemProcessorNxAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWAdd
+
+This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **Blocking** Is the upgrade blocked due to the processor?
+- **PrefetchWSupport** Does the processor support PrefetchW?
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove
+
+This event indicates that the SystemProcessorPrefetchW object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync
+
+This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Add
+
+This event sends data indicating whether the system supports the SSE2 CPU requirement, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **Blocking** Is the upgrade blocked due to the processor?
+- **SSE2ProcessorSupport** Does the processor support SSE2?
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove
+
+This event indicates that the SystemProcessorSse2 object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync
+
+This event indicates that a new set of SystemProcessorSse2Add events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemTouchAdd
+
+This event sends data indicating whether the system supports touch, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **IntegratedTouchDigitizerPresent** Is there an integrated touch digitizer?
+- **MaximumTouches** The maximum number of touch points supported by the device hardware.
### Microsoft.Windows.Appraiser.General.SystemTouchRemove
-"This event indicates that the SystemTouch object is no longer present. "
+This event indicates that the SystemTouch object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+### Microsoft.Windows.Appraiser.General.SystemTouchStartSync
+
+This event indicates that a new set of SystemTouchAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWimAdd
+
+This event sends data indicating whether the operating system is running from a compressed Windows Imaging Format (WIM) file, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **IsWimBoot** Is the current operating system running from a compressed WIM file?
+- **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWimRemove
+
+This event indicates that the SystemWim object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWimStartSync
+
+This event indicates that a new set of SystemWimAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusAdd
+
+This event sends data indicating whether the current operating system is activated, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **WindowsIsLicensedApiValue** The result from the API that's used to indicate if operating system is activated.
+- **WindowsNotActivatedDecision** Is the current operating system activated?
+
+
### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove
This event indicates that the SystemWindowsActivationStatus object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync
+
+This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1206,185 +1210,120 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemWlanRemove
-"This event indicates that the SystemWlan object is no longer present. "
+This event indicates that the SystemWlan object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove
+### Microsoft.Windows.Appraiser.General.SystemWlanStartSync
-This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present.
+This event indicates that a new set of SystemWlanAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove
+### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
-This event indicates that the SystemProcessorNx object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove
-
-This event indicates that the DataSourceMatchingInfoBlock object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove
-
-This event indicates that the DecisionDevicePnp object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove
-
-This event Indicates that the DecisionMatchingInfoPassive object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemMemoryRemove
-
-This event that the SystemMemory object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove
-
-This event indicates that the DecisionMatchingInfoBlock object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove
-
-This event indicates that the DataSourceMatchingInfoPassive object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove
-
-This event indicates that the InventoryApplicationFile object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemWimRemove
-
-"This event indicates that the SystemWim object is no longer present. "
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove
-
-"This event indicates that the InventorySystemBios object is no longer present. "
+This event indicates the parameters and result of a telemetry (diagnostic) run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
+
+The following fields are available:
+
+- **AppraiserBranch** The source branch in which the version of Appraiser that is running was built.
+- **AppraiserDataVersion** The version of the data files being used by the Appraiser telemetry run.
+- **AppraiserProcess** The name of the process that launched Appraiser.
+- **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots.
+- **AuxFinal** Obsolete, always set to false.
+- **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
+- **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
+- **EnterpriseRun** Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
+- **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent.
+- **InventoryFullSync** Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent.
+- **PCFP** An ID for the system calculated by hashing hardware identifiers.
+- **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
+- **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
+- **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
+- **RunDate** The date that the telemetry run was stated, expressed as a filetime.
+- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic.
+- **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
+- **RunResult** The hresult of the Appraiser telemetry run.
+- **SendingUtc** Indicates if the Appraiser client is sending events during the current telemetry run.
+- **StoreHandleIsNotNull** Obsolete, always set to false
+- **TelementrySent** Indicates if telemetry was successfully sent.
+- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability.
+- **Time** The client time of the event.
+- **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
+- **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated.
+
+
+### Microsoft.Windows.Appraiser.General.WmdrmAdd
+
+This event sends data about the usage of older digital rights management on the system, to help keep Windows up to date. This data does not indicate the details of the media using the digital rights management, only whether any such files exist. Collecting this data was critical to ensuring the correct mitigation for customers, and should be able to be removed once all mitigations are in place.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+- **BlockingApplication** Same as NeedsDismissAction.
+- **NeedsDismissAction** Indicates if a dismissible message is needed to warn the user about a potential loss of data due to DRM deprecation.
+- **WmdrmApiResult** Raw value of the API used to gather DRM state.
+- **WmdrmCdRipped** Indicates if the system has any files encrypted with personal DRM, which was used for ripped CDs.
+- **WmdrmIndicators** WmdrmCdRipped OR WmdrmPurchased.
+- **WmdrmInUse** WmdrmIndicators AND dismissible block in setup was not dismissed.
+- **WmdrmNonPermanent** Indicates if the system has any files with non-permanent licenses.
+- **WmdrmPurchased** Indicates if the system has any files with permanent licenses.
### Microsoft.Windows.Appraiser.General.WmdrmRemove
This event indicates that the Wmdrm object is no longer present.
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove
-
-"This event indicates that the SystemProcessorLahfSahf object is no longer present. "
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove
+### Microsoft.Windows.Appraiser.General.WmdrmStartSync
-This event indicates that the InventoryLanguagePack object is no longer present.
+This event indicates that a new set of WmdrmAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove
-
-This event indicates that the DecisionDriverPackage object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove
-
-This event indicates that the DecisionSystemBios object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove
-
-"This event indicates that the SystemProcessorCompareExchange object is no longer present. "
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove
-
-This event indicates that the SystemProcessorPrefetchW object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.InventoryDriverBinaryEndSync
-
-This event indicates that a full set of InventoryDriverBinaryAdd events has been sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
## Census events
+### Census.App
+
+Provides information on IE and Census versions running on the device
+
+The following fields are available:
+
+- **AppraiserEnterpriseErrorCode** The error code of the last Appraiser enterprise run.
+- **AppraiserErrorCode** The error code of the last Appraiser run.
+- **AppraiserRunEndTimeStamp** The end time of the last Appraiser run.
+- **AppraiserRunIsInProgressOrCrashed** Flag that indicates if the Appraiser run is in progress or has crashed.
+- **AppraiserRunStartTimeStamp** The start time of the last Appraiser run.
+- **AppraiserTaskEnabled** Whether the Appraiser task is enabled.
+- **AppraiserTaskExitCode** The Appraiser task exist code.
+- **AppraiserTaskLastRun** The last runtime for the Appraiser task.
+- **CensusVersion** The version of Census that generated the current data for this device.
+- **IEVersion** Retrieves which version of Internet Explorer is running on this device.
+
+
### Census.Battery
This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date.
@@ -1398,6 +1337,16 @@ The following fields are available:
- **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value.
+### Census.Camera
+
+This event sends data about the resolution of cameras on the device, to help keep Windows up to date.
+
+The following fields are available:
+
+- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0.
+- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0.
+
+
### Census.Enterprise
This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment.
@@ -1409,7 +1358,7 @@ The following fields are available:
- **CDJType** Represents the type of cloud domain joined for the machine.
- **CommercialId** Represents the GUID for the commercial entity which the device is a member of. Will be used to reflect insights back to customers.
- **ContainerType** The type of container, such as process or virtual machine hosted.
-- **EnrollmentType** Represents the type of enrollment, such as MDM or Intune, for a particular device.
+- **EnrollmentType** Defines the type of MDM enrollment on the device.
- **HashedDomain** The hashed representation of the user domain used for login.
- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (AAD) tenant? true/false
- **IsDERequirementMet** Represents if the device can do device encryption.
@@ -1423,48 +1372,6 @@ The following fields are available:
- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier
-### Census.App
-
-This event sends version data about the Apps running on this device, to help keep Windows up to date.
-
-The following fields are available:
-
-- **CensusVersion** The version of Census that generated the current data for this device.
-- **IEVersion** Retrieves which version of Internet Explorer is running on this device.
-
-
-### Census.Camera
-
-This event sends data about the resolution of cameras on the device, to help keep Windows up to date.
-
-The following fields are available:
-
-- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0.
-- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0.
-
-
-### Census.UserDisplay
-
-This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date.
-
-The following fields are available:
-
-- **InternalPrimaryDisplayLogicalDPIX** Retrieves the logical DPI in the x-direction of the internal display.
-- **InternalPrimaryDisplayLogicalDPIY** Retrieves the logical DPI in the y-direction of the internal display.
-- **InternalPrimaryDisplayPhysicalDPIX** Retrieves the physical DPI in the x-direction of the internal display.
-- **InternalPrimaryDisplayPhysicalDPIY** Retrieves the physical DPI in the y-direction of the internal display.
-- **InternalPrimaryDisplayResolutionHorizontal** Retrieves the number of pixels in the horizontal direction of the internal display.
-- **InternalPrimaryDisplayResolutionVertical** Retrieves the number of pixels in the vertical direction of the internal display.
-- **InternalPrimaryDisplaySizePhysicalH** Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches .
-- **InternalPrimaryDisplaySizePhysicalY** Retrieves the physical vertical length of the display in mm. Used for calculating the diagonal length in inches
-- **InternalPrimaryDisplayType** Represents the type of technology used in the monitor, such as Plasma, LED, LCOS, etc.
-- **NumberofExternalDisplays** Retrieves the number of external displays connected to the machine
-- **NumberofInternalDisplays** Retrieves the number of internal displays in a machine.
-- **VRAMDedicated** Retrieves the video RAM in MB.
-- **VRAMDedicatedSystem** Retrieves the amount of memory on the dedicated video card.
-- **VRAMSharedSystem** Retrieves the amount of RAM memory that the video card can use.
-
-
### Census.Firmware
This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date.
@@ -1479,11 +1386,11 @@ The following fields are available:
### Census.Flighting
-This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up-to-date.
+This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date.
The following fields are available:
-- **DeviceSampleRate** The diagnostic data sample rate assigned to the device.
+- **DeviceSampleRate** The telemetry sample rate assigned to the device.
- **EnablePreviewBuilds** Used to enable Windows Insider builds on a device.
- **FlightIds** A list of the different Windows Insider builds on this device.
- **FlightingBranchName** The name of the Windows Insider branch currently used by the device.
@@ -1494,23 +1401,23 @@ The following fields are available:
### Census.Hardware
-This event sends data about the device, including hardware type, OEM brand, model line, model, diagnostic data level setting, and TPM support, to help keep Windows up-to-date.
+This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date.
The following fields are available:
- **ActiveMicCount** The number of active microphones attached to the device.
- **ChassisType** Represents the type of device chassis, such as desktop or low profile desktop. The possible values can range between 1 - 36.
- **ComputerHardwareID** Identifies a device class that is represented by a hash of different SMBIOS fields.
-- **D3DMaxFeatureLevel** The supported Direct3D version.
+- **D3DMaxFeatureLevel** Supported Direct3D version.
- **DeviceColor** Indicates a color of the device.
- **DeviceForm** Indicates the form as per the device classification.
- **DeviceName** The device name that is set by the user.
- **DigitizerSupport** Is a digitizer supported?
- **DUID** The device unique ID.
-- **Gyroscope** Indicates whether the device has a gyroscope.
+- **Gyroscope** Indicates whether the device has a gyroscope (a mechanical component that measures and maintains orientation).
- **InventoryId** The device ID used for compatibility testing.
-- **Magnetometer** Indicates whether the device has a magnetometer.
-- **NFCProximity** Indicates whether the device supports NFC.
+- **Magnetometer** Indicates whether the device has a magnetometer (a mechanical component that works like a compass).
+- **NFCProximity** Indicates whether the device supports NFC (a set of communication protocols that helps establish communication when applicable devices are brought close together.)
- **OEMDigitalMarkerFileName** The name of the file placed in the \Windows\system32\drivers directory that specifies the OEM and model name of the device.
- **OEMManufacturerName** The device manufacturer name. The OEMName for an inactive device is not reprocessed even if the clean OEM name is changed at a later date.
- **OEMModelBaseBoard** The baseboard model used by the OEM.
@@ -1526,9 +1433,9 @@ The following fields are available:
- **PowerPlatformRole** The OEM preferred power management profile. It's used to help to identify the basic form factor of the device.
- **SoCName** The firmware manufacturer of the device.
- **StudyID** Used to identify retail and non-retail device.
-- **TelemetryLevel** The diagnostic data level the user has opted into, such as Basic or Enhanced.
-- **TelemetryLevelLimitEnhanced** The diagnostic data level for Windows Analytics-based solutions.
-- **TelemetrySettingAuthority** Determines who set the diagnostic data level, such as GP, MDM, or the user.
+- **TelemetryLevel** The telemetry level the user has opted into, such as Basic or Enhanced.
+- **TelemetryLevelLimitEnhanced** The telemetry level for Windows Analytics-based solutions.
+- **TelemetrySettingAuthority** Determines who set the telemetry level, such as GP, MDM, or the user.
- **TPMVersion** The supported Trusted Platform Module (TPM) on the device. If no TPM is present, the value is 0.
- **VoiceSupported** Does the device have a cellular radio capable of making voice calls?
@@ -1573,9 +1480,9 @@ This event sends data about the operating system such as the version, locale, up
The following fields are available:
- **ActivationChannel** Retrieves the retail license key or Volume license key for a machine.
-- **AssignedAccessStatus** The kiosk configuration mode.
+- **AssignedAccessStatus** Kiosk configuration mode.
- **CompactOS** Indicates if the Compact OS feature from Win10 is enabled.
-- **DeveloperUnlockStatus** "Represents if a device has been developer unlocked by the user or Group Policy. "
+- **DeveloperUnlockStatus** Represents if a device has been developer unlocked by the user or Group Policy.
- **DeviceTimeZone** The time zone that is set on the device. Example: Pacific Standard Time
- **GenuineState** Retrieves the ID Value specifying the OS Genuine check.
- **InstallationType** Retrieves the type of OS installation. (Clean, Upgrade, Reset, Refresh, Update).
@@ -1585,10 +1492,9 @@ The following fields are available:
- **IsPortableOperatingSystem** Retrieves whether OS is running Windows-To-Go
- **IsSecureBootEnabled** Retrieves whether Boot chain is signed under UEFI.
- **LanguagePacks** The list of language packages installed on the device.
-- **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the Microsoft Store.
+- **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store.
- **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine.
- **OSEdition** Retrieves the version of the current OS.
-- **OSInstallDateTime** Retrieves the date the OS was installed using ISO 8601 (Date part) == yyyy-mm-dd
- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc
- **OSOOBEDateTime** Retrieves Out of Box Experience (OOBE) Date in Coordinated Universal Time (UTC).
- **OSSKU** Retrieves the Friendly Name of OS Edition.
@@ -1611,38 +1517,41 @@ The following fields are available:
### Census.Processor
-This event sends data about the processor (architecture, speed, number of cores, manufacturer, and model number), to help keep Windows up to date.
+Provides information on several important data points about Processor settings
The following fields are available:
-- **KvaShadow** Microcode info of the processor.
-- **MMSettingOverride** Microcode setting of the processor.
-- **MMSettingOverrideMask** Microcode setting override of the processor.
-- **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system.
-- **ProcessorClockSpeed** Retrieves the clock speed of the processor in MHz.
-- **ProcessorCores** Retrieves the number of cores in the processor.
-- **ProcessorIdentifier** The processor identifier of a manufacturer.
-- **ProcessorManufacturer** Retrieves the name of the processor's manufacturer.
-- **ProcessorModel** Retrieves the name of the processor model.
+- **KvaShadow** Microcode info of the processor.
+- **MMSettingOverride** Microcode setting of the processor.
+- **MMSettingOverrideMask** Microcode setting override of the processor.
+- **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system.
+- **ProcessorClockSpeed** Clock speed of the processor in MHz.
+- **ProcessorCores** Number of logical cores in the processor.
+- **ProcessorIdentifier** Processor Identifier of a manufacturer.
+- **ProcessorManufacturer** Name of the processor manufacturer.
+- **ProcessorModel** Name of the processor model.
- **ProcessorPhysicalCores** Number of physical cores in the processor.
-- **ProcessorUpdateRevision** The microcode version.
-- **SocketCount** Number of physical CPU sockets of the machine.
-- **SpeculationControl** If the system has enabled protections needed to validate the speculation control vulnerability.
+- **ProcessorUpdateRevision** Microcode revision
+- **ProcessorUpdateStatus** Enum value that represents the processor microcode load status
+- **SocketCount** Count of CPU sockets.
+- **SpeculationControl** If the system has enabled protections needed to validate the speculation control vulnerability.
### Census.Security
-This event provides information on about security settings used to help keep Windows up-to-date and secure.
+This event provides information on about security settings used to help keep Windows up to date and secure.
-- **AvailableSecurityProperties** Enumerates and reports state on the relevant security properties for Device Guard.
-- **CGRunning** Is Credential Guard running?
-- **DGState** A summary of the Device Guard state.
-- **HVCIRunning** Is HVCI running?
-- **IsSawGuest** Describes whether the device is running as a Secure Admin Workstation Guest.
-- **IsSawHost** Describes whether the device is running as a Secure Admin Workstation Host.
-- **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security.
-- **SecureBootCapable** Is this device capable of running Secure Boot?
-- **VBSState** Is virtualization-based security enabled, disabled, or running?
+The following fields are available:
+
+- **AvailableSecurityProperties** This field helps to enumerate and report state on the relevant security properties for Device Guard.
+- **CGRunning** Credential Guard isolates and hardens key system and user secrets against compromise, helping to minimize the impact and breadth of a Pass the Hash style attack in the event that malicious code is already running via a local or network based vector. This field tells if Credential Guard is running.
+- **DGState** This field summarizes the Device Guard state.
+- **HVCIRunning** Is HVCI running?
+- **IsSawGuest** Indicates whether the device is running as a Secure Admin Workstation Guest.
+- **IsSawHost** Indicates whether the device is running as a Secure Admin Workstation Host.
+- **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security.
+- **SecureBootCapable** Systems that support Secure Boot can have the feature turned off via BIOS. This field tells if the system is capable of running Secure Boot, regardless of the BIOS setting.
+- **VBSState** Virtualization-based security (VBS) uses the hypervisor to help protect the kernel and other parts of the operating system. Credential Guard and Hypervisor Code Integrity (HVCI) both depend on VBS to isolate/protect secrets, and kernel-mode code integrity validation. VBS has a tri-state that can be Disabled, Enabled, or Running.
### Census.Speech
@@ -1655,14 +1564,13 @@ The following fields are available:
- **GPAllowInputPersonalization** Indicates if a Group Policy setting has enabled speech functionalities.
- **HolographicSpeechInputDisabled** Holographic setting that represents if the attached HMD devices have speech functionality disabled by the user.
- **HolographicSpeechInputDisabledRemote** Indicates if a remote policy has disabled speech functionalities for the HMD devices.
-- **KWSEnabled** "Cortana setting that represents if a user has enabled the ""Hey Cortana"" keyword spotter (KWS)."
+- **KWSEnabled** Cortana setting that represents if a user has enabled the "Hey Cortana" keyword spotter (KWS).
- **MDMAllowInputPersonalization** Indicates if an MDM policy has enabled speech functionalities.
-- **RemotelyManaged** Indicates if the device is being controlled by a remote admininistrator (MDM or Group Policy) in the context of speech functionalities.
+- **RemotelyManaged** Indicates if the device is being controlled by a remote administrator (MDM or Group Policy) in the context of speech functionalities.
- **SpeakerIdEnabled** Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice.
- **SpeechServicesEnabled** Windows setting that represents whether a user is opted-in for speech services on the device.
-
### Census.Storage
This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date.
@@ -1673,14 +1581,36 @@ The following fields are available:
- **PrimaryDiskType** Retrieves an enumerator value of type STORAGE_BUS_TYPE that indicates the type of bus to which the device is connected. This should be used to interpret the raw device properties at the end of this structure (if any).
- **SystemVolumeTotalCapacity** Retrieves the size of the partition that the System volume is installed on in MB.
+
### Census.Userdefault
This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date.
The following fields are available:
-- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html,.htm,.jpg,.jpeg,.png,.mp3,.mp4, .mov,.pdf
-- **DefaultBrowserProgId** The ProgramId of the current user's default browser
+- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf.
+- **DefaultBrowserProgId** The ProgramId of the current user's default browser.
+
+
+### Census.UserDisplay
+
+This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date.
+
+The following fields are available:
+
+- **InternalPrimaryDisplayLogicalDPIX** Retrieves the logical DPI in the x-direction of the internal display.
+- **InternalPrimaryDisplayLogicalDPIY** Retrieves the logical DPI in the y-direction of the internal display.
+- **InternalPrimaryDisplayPhysicalDPIX** Retrieves the physical DPI in the x-direction of the internal display.
+- **InternalPrimaryDisplayPhysicalDPIY** Retrieves the physical DPI in the y-direction of the internal display.
+- **InternalPrimaryDisplayResolutionHorizontal** Retrieves the number of pixels in the horizontal direction of the internal display.
+- **InternalPrimaryDisplayResolutionVertical** Retrieves the number of pixels in the vertical direction of the internal display.
+- **InternalPrimaryDisplaySizePhysicalH** Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches .
+- **InternalPrimaryDisplaySizePhysicalY** Retrieves the physical vertical length of the display in mm. Used for calculating the diagonal length in inches
+- **NumberofExternalDisplays** Retrieves the number of external displays connected to the machine
+- **NumberofInternalDisplays** Retrieves the number of internal displays in a machine.
+- **VRAMDedicated** Retrieves the video RAM in MB.
+- **VRAMDedicatedSystem** Retrieves the amount of memory on the dedicated video card.
+- **VRAMSharedSystem** Retrieves the amount of RAM memory that the video card can use.
### Census.UserNLS
@@ -1695,26 +1625,22 @@ The following fields are available:
- **KeyboardInputLanguages** The Keyboard input languages installed on the device.
- **SpeechInputLanguages** The Speech Input languages installed on the device.
+
### Census.VM
This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date.
The following fields are available:
-- **CloudService** Indicates which cloud service, if any, that this virtual machine is running within.
+- **CloudService** Indicates which cloud service, if any, that this virtual machine is running within.
- **HyperVisor** Retrieves whether the current OS is running on top of a Hypervisor.
- **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present.
-- **isVDI** Is the device using Virtual Desktop Infrastructure?
-- **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#HASH#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#HASH#1 Hypervisors.
+- **IsVDI** Is the device using Virtual Desktop Infrastructure?
+- **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#1 Hypervisors.
- **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware.
- **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware.
-
-
-
-
-
### Census.WU
This event sends data about the Windows update server and other App store policies, to help keep Windows up to date.
@@ -1726,25 +1652,26 @@ The following fields are available:
- **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured
- **AppStoreAutoUpdatePolicy** Retrieves the Microsoft Store App Auto Update group policy setting
- **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades.
-- **OSAssessmentFeatureOutOfDate** How many days has it been since a the last feature update was released but the device did not install it?
-- **OSAssessmentForFeatureUpdate** Is the device is on the latest feature update?
-- **OSAssessmentForQualityUpdate** Is the device on the latest quality update?
-- **OSAssessmentForSecurityUpdate** Is the device on the latest security update?
-- **OSAssessmentQualityOutOfDate** How many days has it been since a the last quality update was released but the device did not install it?
-- **OSAssessmentReleaseInfoTime** The freshness of release information used to perform an assessment.
+- **OSAssessmentFeatureOutOfDate** How many days has it been since a the last feature update was released but the device did not install it?
+- **OSAssessmentForFeatureUpdate** Is the device is on the latest feature update?
+- **OSAssessmentForQualityUpdate** Is the device on the latest quality update?
+- **OSAssessmentForSecurityUpdate** Is the device on the latest security update?
+- **OSAssessmentQualityOutOfDate** How many days has it been since a the last quality update was released but the device did not install it?
+- **OSAssessmentReleaseInfoTime** The freshness of release information used to perform an assessment.
- **OSRollbackCount** The number of times feature updates have rolled back on the device.
- **OSRolledBack** A flag that represents when a feature update has rolled back during setup.
- **OSUninstalled** A flag that represents when a feature update is uninstalled on a device .
- **OSWUAutoUpdateOptions** Retrieves the auto update settings on the device.
- **UninstallActive** A flag that represents when a device has uninstalled a previous upgrade recently.
- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
-- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates
-- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades
+- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates.
+- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades.
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
-- **WUPauseState** Retrieves WU setting to determine if updates are paused
+- **WUPauseState** Retrieves WU setting to determine if updates are paused.
- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
+
### Census.Xbox
This event sends data about the Xbox Console, such as Serial Number and DeviceId, to help keep Windows up to date.
@@ -1753,349 +1680,863 @@ The following fields are available:
- **XboxConsolePreferredLanguage** Retrieves the preferred language selected by the user on Xbox console.
- **XboxConsoleSerialNumber** Retrieves the serial number of the Xbox console.
-- **XboxLiveDeviceId** Retrieves the unique device id of the console.
-- **XboxLiveSandboxId** Retrieves the developer sandbox id if the device is internal to MS.
+- **XboxLiveDeviceId** Retrieves the unique device ID of the console.
+- **XboxLiveSandboxId** Retrieves the developer sandbox ID if the device is internal to Microsoft.
+## Common data extensions
+
+### Common Data Extensions.app
+
+Describes the properties of the running application. This extension could be populated by a client app or a web app.
+
+The following fields are available:
+
+- **asId** An integer value that represents the app session. This value starts at 0 on the first app launch and increments after each subsequent app launch per boot session.
+- **env** The environment from which the event was logged.
+- **expId** Associates a flight, such as an OS flight, or an experiment, such as a web site UX experiment, with an event.
+- **id** Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application.
+- **userId** The userID as known by the application.
+- **ver** Represents the version number of the application. Used to understand errors by Version, Usage by Version across an app.
+
+
+### Common Data Extensions.container
+
+Describes the properties of the container for events logged within a container.
+
+The following fields are available:
+
+- **localId** The device ID as known by the client.
+- **osVer** The operating system version.
+- **type** The container type. Examples: Process or VMHost
+
+
+### Common Data Extensions.cs
+
+Describes properties related to the schema of the event.
+
+The following fields are available:
+
+- **sig** A common schema signature that identifies new and modified event schemas.
+
+
+### Common Data Extensions.device
+
+Describes the device-related fields.
+
+The following fields are available:
+
+- **deviceClass** Represents the classification of the device, the device “family”. For example, Desktop, Server, or Mobile.
+- **localId** Represents a locally defined unique ID for the device, not the human readable device name. Most likely equal to the value stored at HKLM\Software\Microsoft\SQMClient\MachineId
+
+
+### Common Data Extensions.Envelope
+
+Represents an envelope that contains all of the common data extensions.
+
+The following fields are available:
+
+- **appId** Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application.
+- **appVer** Represents the version number of the application. Used to understand errors by version and usage by version across an app.
+- **cV** Represents the Correlation Vector: A single field for tracking partial order of related telemetry events across component boundaries.
+- **data** Represents the optional unique diagnostic data for a particular event schema.
+- **epoch** ID used to help distinguish events in the sequence by indicating the current boot session.
+- **ext_app** Describes the properties of the running application. This extension could be populated by either a client app or a web app. See [Common Data Extensions.app](#common-data-extensionsapp).
+- **ext_container** Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer).
+- **ext_cs** Describes properties related to the schema of the event. See [Common Data Extensions.cs](#common-data-extensionscs).
+- **ext_device** Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice).
+- **ext_os** Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos).
+- **ext_user** Describes the fields related to a user. See [Common Data Extensions.user](#common-data-extensionsuser).
+- **ext_utc** Describes the fields that might be populated by a logging library on Windows. See [Common Data Extensions.utc](#common-data-extensionsutc).
+- **ext_xbl** Describes the fields related to XBOX Live. See [Common Data Extensions.xbl](#common-data-extensionsxbl).
+- **flags** Represents a collection of bits that describe how the event should be processed by the Connected User Experience and Telemetry component pipeline. The lowest-order byte is the event persistence. The next byte is the event latency.
+- **iKey** Represents an ID for applications or other logical groupings of events.
+- **name** Represents the uniquely qualified name for the event.
+- **os** The operating system name.
+- **osVer** The operating system version.
+- **popSample** Represents the effective sample rate for this event at the time it was generated by a client.
+- **seqNum** Used to track the absolute order of uploaded events.
+- **tags** A header for semi-managed extensions.
+- **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format.
+- **ver** Represents the major and minor version of the extension.
+
+
+### Common Data Extensions.os
+
+Describes some properties of the operating system.
+
+The following fields are available:
+
+- **bootId** An integer value that represents the boot session. This value starts at 0 on first boot after OS install and increments after every reboot.
+- **expId** Represents the experiment ID. The standard for associating a flight, such as an OS flight (pre-release build), or an experiment, such as a web site UX experiment, with an event is to record the flight / experiment IDs in Part A of the common schema.
+- **locale** Represents the locale of the operating system.
+
+
+### Common Data Extensions.user
+
+Describes the fields related to a user.
+
+The following fields are available:
+
+- **authId** This is an ID of the user associated with this event that is deduced from a token such as a Microsoft Account ticket or an XBOX token.
+- **localId** Represents a unique user identity that is created locally and added by the client. This is not the user's account ID.
+
+
+### Common Data Extensions.utc
+
+Describes the properties that could be populated by a logging library on Windows.
+
+The following fields are available:
+
+- **aId** Represents the ETW ActivityId. Logged via TraceLogging or directly via ETW.
+- **bSeq** Upload buffer sequence number in the format: buffer identifier:sequence number
+- **cat** Represents a bitmask of the ETW Keywords associated with the event.
+- **cpId** The composer ID, such as Reference, Desktop, Phone, Holographic, Hub, IoT Composer.
+- **flags** Represents the bitmap that captures various Windows specific flags.
+- **mon** Combined monitor and event sequence numbers in the format: monitor sequence : event sequence
+- **op** Represents the ETW Op Code.
+- **raId** Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW.
+- **sqmId** The Windows SQM ID.
+- **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID.
+- **tickets** An array of strings that refer back to a key in the X-Tickets http header that the client uploaded along with a batch of events.
+
+
+### Common Data Extensions.xbl
+
+Describes the fields that are related to XBOX Live.
+
+The following fields are available:
+
+- **claims** Any additional claims whose short claim name hasn't been added to this structure.
+- **did** XBOX device ID
+- **dty** XBOX device type
+- **dvr** The version of the operating system on the device.
+- **eid** A unique ID that represents the developer entity.
+- **exp** Expiration time
+- **ip** The IP address of the client device.
+- **nbf** Not before time
+- **pid** A comma separated list of PUIDs listed as base10 numbers.
+- **sbx** XBOX sandbox identifier
+- **sid** The service instance ID.
+- **sty** The service type.
+- **tid** The XBOX Live title ID.
+- **tvr** The XBOX Live title version.
+- **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts.
+- **xid** A list of base10-encoded XBOX User IDs.
+
+
+## Common data fields
+
+### Ms.Device.DeviceInventoryChange
+
+Describes the installation state for all hardware and software components available on a particular device.
+
+The following fields are available:
+
+- **action** The change that was invoked on a device inventory object.
+- **inventoryId** Device ID used for Compatibility testing
+- **objectInstanceId** Object identity which is unique within the device scope.
+- **objectType** Indicates the object type that the event applies to.
+- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object.
## Diagnostic data events
-### TelClientSynthetic.AuthorizationInfo_Startup
-
-This event sends data indicating that a device has undergone a change of diagnostic data opt-in level detected at UTC startup, to help keep Windows up to date.
-
-The following fields are available:
-
-- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto diagnostic data from the OS provider groups.
-- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS diagnostic data. Non-OS diagnostic data is responsible for providing its own opt-in mechanism.
-- **CanCollectCoreTelemetry** True if UTC is allowed to collect data which is tagged with both MICROSOFT_KEYWORD_CRITICAL_DATA and MICROSOFT_EVENTTAG_CORE_DATA.
-- **CanCollectHeartbeats** True if UTC is allowed to collect heartbeats.
-- **CanCollectOsTelemetry** True if UTC is allowed to collect diagnostic data from the OS provider groups.
-- **CanPerformDiagnosticEscalations** True if UTC is allowed to perform all scenario escalations.
-- **CanPerformScripting** True if UTC is allowed to perform scripting.
-- **CanPerformTraceEscalations** True if UTC is allowed to perform scenario escalations with tracing actions.
-- **CanReportScenarios** True if UTC is allowed to load and report scenario completion, failure, and cancellation events.
-- **PreviousPermissions** Bitmask representing the previously configured permissions since the diagnostic data client was last started.
-- **TransitionFromEverythingOff** True if this transition is moving from not allowing core diagnostic data to allowing core diagnostic data.
-
-
### TelClientSynthetic.AuthorizationInfo_RuntimeTransition
-This event sends data indicating that a device has undergone a change of diagnostic data opt-in level during the runtime of the device (not at UTC boot or offline), to help keep Windows up to date.
-
-The following fields are available:
-
-- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto diagnostic data from the OS provider groups.
-- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS diagnostic data. Non-OS diagnostic data is responsible for providing its own opt-in mechanism.
-- **CanCollectCoreTelemetry** True if UTC is allowed to collect data which is tagged with both MICROSOFT_KEYWORD_CRITICAL_DATA and MICROSOFT_EVENTTAG_CORE_DATA.
-- **CanCollectHeartbeats** True if UTC is allowed to collect heartbeats.
-- **CanCollectOsTelemetry** True if UTC is allowed to collect diagnostic data from the OS provider groups.
-- **CanPerformDiagnosticEscalations** True if UTC is allowed to perform all scenario escalations.
-- **CanPerformScripting** True if UTC is allowed to perform scripting.
-- **CanPerformTraceEscalations** True if UTC is allowed to perform scenario escalations with tracing actions.
-- **CanReportScenarios** True if UTC is allowed to load and report scenario completion, failure, and cancellation events.
-- **PreviousPermissions** Bitmask representing the previously configured permissions since the diagnostic data opt-in level was last changed.
-- **TransitionFromEverythingOff** True if this transition is moving from not allowing core diagnostic data to allowing core diagnostic data.
+This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect.
-### TelClientSynthetic.ConnectivityHeartBeat_0
-This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads diagnostic data events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network.
+### TelClientSynthetic.AuthorizationInfo_Startup
-The following fields are available:
+This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect.
-- **CensusExitCode** Returns last execution codes from census client run.
-- **CensusStartTime** Returns timestamp corresponding to last successful census run.
-- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine.
-- **LastConnectivityLossTime** Retrieves the last time the device lost free network.
-- **LastConntectivityLossTime** Retrieves the last time the device lost free network.
-- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network.
-- **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds.
-- **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds.
### TelClientSynthetic.HeartBeat_5
This event sends data about the health and quality of the diagnostic data from the given device, to help keep Windows up to date. It also enables data analysts to determine how 'trusted' the data is from a given device.
-The following fields are available:
-
-- **AgentConnectionErrorsCount** The number of non-timeout errors associated with the host/agent channel.
-- **CensusExitCode** The last exit code of the Census task.
-- **CensusStartTime** The time of the last Census run.
-- **CensusTaskEnabled** Indicates whether Census is enabled.
-- **ConsumerDroppedCount** The number of events dropped by the consumer layer of the diagnostic data client.
-- **CriticalDataDbDroppedCount** The number of critical data sampled events that were dropped at the database layer.
-- **CriticalDataThrottleDroppedCount** The number of critical data sampled events that were dropped because of throttling.
-- **CriticalOverflowEntersCounter** The number of times a critical overflow mode was entered into the event database.
-- **DbCriticalDroppedCount** The total number of dropped critical events in the event database.
-- **DbDroppedCount** The number of events that were dropped because the database was full.
-- **DecodingDroppedCount** The number of events dropped because of decoding failures.
-- **EnteringCriticalOverflowDroppedCounter** The number of events that was dropped because a critical overflow mode was initiated.
-- **EtwDroppedBufferCount** The number of buffers dropped in the CUET ETW session.
-- **EtwDroppedCount** The number of events dropped by the ETW layer of the diagnostic data client.
-- **EventSubStoreResetCounter** The number of times the event database was reset.
-- **EventSubStoreResetSizeSum** The total size of the event database across all resets reports in this instance.
-- **EventsUploaded** The number of events that have been uploaded.
-- **Flags** Flags that indicate device state, such as network, battery, and opt-in state.
-- **FullTriggerBufferDroppedCount** The number of events that were dropped because the trigger buffer was full.
-- **HeartBeatSequenceNumber** A monotonically increasing heartbeat counter.
-- **InvalidHttpCodeCount** The number of invalid HTTP codes received from Vortex.
-- **LastAgentConnectionError** The last non-timeout error that happened in the host/agent channel.
-- **LastEventSizeOffender** The name of the last event that exceeded the maximum event size.
-- **LastInvalidHttpCode** The last invalid HTTP code received from Vortex.
-- **MaxActiveAgentConnectionCount** The maximum number of active agents during this heartbeat timeframe.
-- **MaxInUseScenarioCounter** The soft maximum number of scenarios loaded by the Connected User Experiences and Telemetry component.
-- **PreviousHeartBeatTime** The time of last heartbeat event. This allows chaining of events.
-- **SettingsHttpAttempts** The number of attempts to contact the OneSettings service.
-- **SettingsHttpFailures** The number of failures from contacting the OneSettings service.
-- **ThrottledDroppedCount** The number of events dropped due to throttling of noisy providers.
-- **UploaderDroppedCount** The number of events dropped by the uploader layer of the diagnostic data client.
-- **VortexFailuresTimeout** The number of timeout failures received from Vortex.
-- **VortexHttpAttempts** The number of attempts to contact the Vortex service.
-- **VortexHttpFailures4xx** The number of 400-499 error codes received from Vortex.
-- **VortexHttpFailures5xx** The number of 500-599 error codes received from Vortex.
-### TelClientSynthetic.PrivacySettingsAfterCreatorsUpdate
+### TelClientSynthetic.HeartBeat_Aria_5
-This event sends basic data on privacy settings before and after a feature update. This is used to ensure that customer privacy settings are correctly migrated across feature updates.
+This event is the telemetry client ARIA heartbeat.
The following fields are available:
-- **PostUpgradeSettings** The privacy settings after a feature update.
-- **PreUpgradeSettings** The privacy settings before a feature update.
-
-
-## DxgKernelTelemetry events
-
-### DxgKrnlTelemetry.GPUAdapterInventoryV2
-
-This event sends basic GPU and display driver information to keep Windows and display drivers up-to-date.
-
-The following fields are available:
-
-- **aiSeqId** The event sequence ID.
-- **bootId** The system boot ID.
-- **ComputePreemptionLevel** The maximum preemption level supported by GPU for compute payload.
-- **DedicatedSystemMemoryB** The amount of system memory dedicated for GPU use (in bytes).
-- **DedicatedVideoMemoryB** The amount of dedicated VRAM of the GPU (in bytes).
-- **DisplayAdapterLuid** The display adapter LUID.
-- **DriverDate** The date of the display driver.
-- **DriverRank** The rank of the display driver.
-- **DriverVersion** The display driver version.
-- **GPUDeviceID** The GPU device ID.
-- **GPUPreemptionLevel** The maximum preemption level supported by GPU for graphics payload.
-- **GPURevisionID** The GPU revision ID.
-- **GPUVendorID** The GPU vendor ID.
-- **InterfaceId** The GPU interface ID.
-- **IsDisplayDevice** Does the GPU have displaying capabilities?
-- **IsHybridDiscrete** Does the GPU have discrete GPU capabilities in a hybrid device?
-- **IsHybridIntegrated** Does the GPU have integrated GPU capabilities in a hybrid device?
-- **IsLDA** Is the GPU comprised of Linked Display Adapters?
-- **IsMiracastSupported** Does the GPU support Miracast?
-- **IsMismatchLDA** Is at least one device in the Linked Display Adapters chain from a different vendor?
-- **IsMPOSupported** Does the GPU support Multi-Plane Overlays?
-- **IsMsMiracastSupported** Are the GPU Miracast capabilities driven by a Microsoft solution?
-- **IsPostAdapter** Is this GPU the POST GPU in the device?
-- **IsRenderDevice** Does the GPU have rendering capabilities?
-- **IsSoftwareDevice** Is this a software implementation of the GPU?
-- **MeasureEnabled** Is the device listening to MICROSOFT_KEYWORD_MEASURES?
-- **SharedSystemMemoryB** The amount of system memory shared by GPU and CPU (in bytes).
-- **SubSystemID** The subsystem ID.
-- **SubVendorID** The GPU sub vendor ID.
-- **TelemetryEnabled** Is the device listening to MICROSOFT_KEYWORD_TELEMETRY?
-- **TelInvEvntTrigger** What triggered this event to be logged? Example: 0 (GPU enumeration) or 1 (DxgKrnlTelemetry provider toggling)
-- **version** The event version.
-- **WDDMVersion** The Windows Display Driver Model version.
-- **NumVidPnSources** The number of supported display output sources.
-- **NumVidPnTargets** The number of supported display output targets.
-
-
-## Fault Reporting events
-
-### Microsoft.Windows.FaultReporting.AppCrashEvent
-
-"This event sends data about crashes for both native and managed applications, to help keep Windows up to date. The data includes information about the crashing process and a summary of its exception record. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the crash to the Watson service, and the WER event will contain the same ReportID (see field 14 of crash event, field 19 of WER event) as the crash event for the crash being reported. AppCrash is emitted once for each crash handled by WER (e.g. from an unhandled exception or FailFast or ReportException). Note that Generic Watson event types (e.g. from PLM) that may be considered crashes"" by a user DO NOT emit this event."
-
-The following fields are available:
-
-- **AppName** The name of the app that has crashed.
-- **AppSessionGuid** GUID made up of process ID and is used as a correlation vector for process instances in the diagnostic data backend.
-- **AppTimeStamp** The date/time stamp of the app.
-- **AppVersion** The version of the app that has crashed.
-- **ExceptionCode** The exception code returned by the process that has crashed.
-- **ExceptionOffset** The address where the exception had occurred.
-- **Flags** "Flags indicating how reporting is done. For example, queue the report, do not offer JIT debugging, or do not terminate the process after reporting. "
-- **ModName** Exception module name (e.g. bar.dll).
-- **ModTimeStamp** The date/time stamp of the module.
-- **ModVersion** The version of the module that has crashed.
-- **PackageFullName** Store application identity.
-- **PackageRelativeAppId** Store application identity.
-- **ProcessArchitecture** Architecture of the crashing process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64.
-- **ProcessCreateTime** The time of creation of the process that has crashed.
-- **ProcessId** The ID of the process that has crashed.
-- **ReportId** A GUID used to identify the report. This can used to track the report across Watson.
-- **TargetAppId** The kernel reported AppId of the application being reported.
-- **TargetAppVer** The specific version of the application being reported
-- **TargetAsId** The sequence number for the hanging process.
+- **CompressedBytesUploaded** Number of compressed bytes uploaded
+- **CriticalDataDbDroppedCount** Number of critical data sampled events dropped at the database layer.
+- **CriticalOverflowEntersCounter** Number of times critical overflow mode was entered in event database.
+- **DbCriticalDroppedCount** Total number of dropped critical events in event database.
+- **DbDroppedCount** Number of events dropped at the database layer.
+- **EnteringCriticalOverflowDroppedCounter** Number of events dropped due to critical overflow mode being initiated.
+- **EventSubStoreResetCounter** Number of times event database was reset.
+- **EventSubStoreResetSizeSum** Total size of event database across all resets reports in this instance.
+- **EventsUploaded** Number of events uploaded.
+- **InvalidHttpCodeCounter** Number of invalid HTTP codes received from contacting Vortex.
+- **LastInvalidHttpCode** Last invalid HTTP code received from Vortex.
+- **SettingsHttpAttempts** Number of attempts to contact OneSettings service.
+- **SettingsHttpFailures** Number of failures from contacting OneSettings service.
+- **UploaderDroppedCount** Number of events dropped at the uploader layer of telemetry client.
+- **VortexFailuresTimeout** Number of time out failures received from Vortex.
+- **VortexHttpAttempts** Number of attempts to contact Vortex.
+- **VortexHttpFailures4xx** Number of 400-499 error codes received from Vortex.
+- **VortexHttpFailures5xx** Number of 500-599 error codes received from Vortex.
+- **VortexHttpResponseFailures** Number of Vortex responses that are not 2XX or 400.
+- **VortexHttpResponsesWithDroppedEvents** Number of Vortex responses containing at least 1 dropped event.
## Feature update events
### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed
-This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state
+This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state.
The following fields are available:
-- **failureReason** Provides data about the uninstall initialization operation failure
-- **hr** Provides the Win32 error code for the operation failure
+- **failureReason** Provides data about the uninstall initialization operation failure.
+- **hr** Provides the Win32 error code for the operation failure.
### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered
-Indicates that the uninstall was properly configured and that a system reboot was initiated
+This event indicates that the uninstall was properly configured and that a system reboot was initiated.
The following fields are available:
- **name** Name of the event
-## Hang Reporting events
+### Microsoft.Windows.Upgrade.Uninstall.UninstallGoBackButtonClicked
-### Microsoft.Windows.HangReporting.AppHangEvent
+This event sends basic metadata about the starting point of uninstalling a feature update, which helps ensure customers can safely revert to a well-known state if the update caused any problems.
-This event sends data about hangs for both native and managed applications, to help keep Windows up to date. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the hang to the Watson service, and the WER event will contain the same ReportID (see field 13 of hang event, field 19 of WER event) as the hang event for the hang being reported. AppHang is reported only on PC devices. It handles classic Win32 hangs and is emitted only once per report. Some behaviors that may be perceived by a user as a hang are reported by app managers (e.g. PLM/RM/EM) as Watson Generics and will not produce AppHang events.
-
-The following fields are available:
-
-- **AppName** The name of the app that has hung.
-- **AppSessionGuid** GUID made up of process id used as a correlation vector for process instances in the diagnostic data backend.
-- **AppVersion** The version of the app that has hung.
-- **PackageFullName** Store application identity.
-- **PackageRelativeAppId** Store application identity.
-- **ProcessArchitecture** Architecture of the hung process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64.
-- **ProcessCreateTime** The time of creation of the process that has hung.
-- **ProcessId** The ID of the process that has hung.
-- **ReportId** A GUID used to identify the report. This can used to track the report across Watson.
-- **TargetAppId** The kernel reported AppId of the application being reported.
-- **TargetAppVer** The specific version of the application being reported.
-- **TargetAsId** The sequence number for the hanging process.
-- **TypeCode** Bitmap describing the hang type.
-- **WaitingOnAppName** If this is a cross process hang waiting for an application, this has the name of the application.
-- **WaitingOnAppVersion** If this is a cross process hang, this has the version of the application for which it is waiting.
-- **WaitingOnPackageFullName** If this is a cross process hang waiting for a package, this has the full name of the package for which it is waiting.
-- **WaitingOnPackageRelativeAppId** If this is a cross process hang waiting for a package, this has the relative application id of the package.
## Inventory events
-### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync
+### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum
-This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent
+This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object.
The following fields are available:
-- **InventoryVersion** The version of the inventory file generating the events
+- **Device** A count of device objects in cache.
+- **DeviceCensus** A count of devicecensus objects in cache.
+- **DriverPackageExtended** A count of driverpackageextended objects in cache.
+- **File** A count of file objects in cache.
+- **FileSigningInfo** A count of file signing objects in cache.
+- **Generic** A count of generic objects in cache.
+- **HwItem** A count of hwitem objects in cache.
+- **InventoryApplication** A count of application objects in cache.
+- **InventoryApplicationFile** A count of application file objects in cache.
+- **InventoryDeviceContainer** A count of device container objects in cache.
+- **InventoryDeviceInterface** A count of Plug and Play device interface objects in cache.
+- **InventoryDeviceMediaClass** A count of device media objects in cache.
+- **InventoryDevicePnp** A count of device Plug and Play objects in cache.
+- **InventoryDeviceUsbHubClass** A count of device usb objects in cache
+- **InventoryDriverBinary** A count of driver binary objects in cache.
+- **InventoryDriverPackage** A count of device objects in cache.
+- **Metadata** A count of metadata objects in cache.
+- **Orphan** A count of orphan file objects in cache.
+- **Programs** A count of program objects in cache.
+
+
+### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions
+
+This event sends inventory component versions for the Device Inventory data.
+
+The following fields are available:
+
+- **aeinv** The version of the App inventory component.
+- **devinv** The file version of the Device inventory component.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd
+
+This event sends basic metadata about an application on the system to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **HiddenArp** Indicates whether a program hides itself from showing up in ARP.
+- **InstallDate** The date the application was installed (a best guess based on folder creation date heuristics).
+- **InstallDateArpLastModified** The date of the registry ARP key for a given application. Hints at install date but not always accurate. Passed as an array. Example: 4/11/2015 00:00:00
+- **InstallDateFromLinkFile** The estimated date of install based on the links to the files. Passed as an array.
+- **InstallDateMsi** The install date if the application was installed via Microsoft Installer (MSI). Passed as an array.
+- **InventoryVersion** The version of the inventory file generating the events.
+- **Language** The language code of the program.
+- **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage.
+- **MsiProductCode** A GUID that describe the MSI Product.
+- **Name** The name of the application.
+- **OSVersionAtInstallTime** The four octets from the OS version at the time of the application's install.
+- **PackageFullName** The package full name for a Store application.
+- **ProgramInstanceId** A hash of the file IDs in an app.
+- **Publisher** The Publisher of the application. Location pulled from depends on the 'Source' field.
+- **RootDirPath** The path to the root directory where the program was installed.
+- **Source** How the program was installed (for example, ARP, MSI, Appx).
+- **StoreAppType** A sub-classification for the type of Microsoft Store app, such as UWP or Win8StoreApp.
+- **Type** One of ("Application", "Hotfix", "BOE", "Service", "Unknown"). Application indicates Win32 or Appx app, Hotfix indicates app updates (KBs), BOE indicates it's an app with no ARP or MSI entry, Service indicates that it is a service. Application and BOE are the ones most likely seen.
+- **Version** The version number of the program.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd
+
+This event represents what drivers an application installs.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory component
+- **ProgramIds** The unique program identifier the driver is associated with.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync
+
+The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory component.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd
+
+This event provides the basic metadata about the frameworks an application may depend on.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **FileId** A hash that uniquely identifies a file.
+- **Frameworks** The list of frameworks this file depends on.
+- **InventoryVersion** The version of the inventory file generating the events.
+- **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync
+
+This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove
+
+This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync
+
+This event indicates that a new set of InventoryApplicationAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd
+
+This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **Categories** A comma separated list of functional categories in which the container belongs.
+- **DiscoveryMethod** The discovery method for the device container.
+- **FriendlyName** The name of the device container.
+- **InventoryVersion** The version of the inventory file generating the events.
+- **IsActive** Is the device connected, or has it been seen in the last 14 days?
+- **IsConnected** For a physically attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link.
+- **IsMachineContainer** Is the container the root device itself?
+- **IsNetworked** Is this a networked device?
+- **IsPaired** Does the device container require pairing?
+- **Manufacturer** The manufacturer name for the device container.
+- **ModelId** A unique model ID.
+- **ModelName** The model name.
+- **ModelNumber** The model number for the device container.
+- **PrimaryCategory** The primary category for the device container.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove
+
+This event indicates that the InventoryDeviceContainer object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync
+
+This event indicates that a new set of InventoryDeviceContainerAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd
+
+This event retrieves information about what sensor interfaces are available on the device.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **Accelerometer3D** Indicates if an Accelerator3D sensor is found.
+- **ActivityDetection** Indicates if an Activity Detection sensor is found.
+- **AmbientLight** Indicates if an Ambient Light sensor is found.
+- **Barometer** Indicates if a Barometer sensor is found.
+- **Custom** Indicates if a Custom sensor is found.
+- **EnergyMeter** Indicates if an Energy sensor is found.
+- **FloorElevation** Indicates if a Floor Elevation sensor is found.
+- **GeomagneticOrientation** Indicates if a Geo Magnetic Orientation sensor is found.
+- **GravityVector** Indicates if a Gravity Detector sensor is found.
+- **Gyrometer3D** Indicates if a Gyrometer3D sensor is found.
+- **Humidity** Indicates if a Humidity sensor is found.
+- **InventoryVersion** The version of the inventory file generating the events.
+- **LinearAccelerometer** Indicates if a Linear Accelerometer sensor is found.
+- **Magnetometer3D** Indicates if a Magnetometer3D sensor is found.
+- **Orientation** Indicates if an Orientation sensor is found.
+- **Pedometer** Indicates if a Pedometer sensor is found.
+- **Proximity** Indicates if a Proximity sensor is found.
+- **RelativeOrientation** Indicates if a Relative Orientation sensor is found.
+- **SimpleDeviceOrientation** Indicates if a Simple Device Orientation sensor is found.
+- **Temperature** Indicates if a Temperature sensor is found.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync
+
+This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd
+
+This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **Audio_CaptureDriver** The Audio device capture driver endpoint.
+- **Audio_RenderDriver** The Audio device render driver endpoint.
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove
+
+This event indicates that the InventoryDeviceMediaClassRemove object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync
+
+This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd
+
+This event represents the basic metadata about a plug and play (PNP) device and its associated driver.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **BusReportedDescription** System-supplied GUID that uniquely groups the functional devices associated with a single-function or multifunction device installed in the computer.
+- **Class** System-supplied GUID that uniquely groups the functional devices associated with a single-function or multifunction device installed in the computer.
+- **ClassGuid** A unique identifier for the driver installed.
+- **COMPID** Name of the .sys image file (or wudfrd.sys if using user mode driver framework).
+- **ContainerId** INF file name (the name could be renamed by OS, such as oemXX.inf)
+- **Description** The version of the inventory binary generating the events.
+- **DeviceState** The current error code for the device.
+- **DriverId** A unique identifier for the driver installed.
+- **DriverName** Name of the .sys image file (or wudfrd.sys if using user mode driver framework).
+- **DriverPackageStrongName** The immediate parent directory name in the Directory field of InventoryDriverPackage.
+- **DriverVerDate** The date of the driver loaded for the device.
+- **DriverVerVersion** The version of the driver loaded for the device.
+- **Enumerator** The bus that enumerated the device.
+- **HWID** List of hardware ids for the device.
+- **Inf** INF file name (the name could be renamed by OS, such as oemXX.inf)
+- **InstallState** Device installation state.
+- **InventoryVersion** The version of the inventory binary generating the events.
+- **LowerClassFilters** Lower filter class drivers IDs installed for the device.
+- **LowerFilters** Lower filter drivers IDs installed for the device.
+- **Manufacturer** The device manufacturer.
+- **MatchingID** Represents the hardware ID or compatible ID that Windows uses to install a device instance.
+- **Model** The device model.
+- **ParentId** Device instance id of the parent of the device.
+- **ProblemCode** The current error code for the device.
+- **Provider** The device provider.
+- **Service** The device service name
+- **STACKID** The device service name.
+- **UpperClassFilters** The list of hardware ids for the stack
+- **UpperFilters** Upper filter drivers IDs installed for the device
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove
+
+This event indicates that the InventoryDevicePnpRemove object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync
+
+This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd
-This event sends basic metadata about the USB hubs on the device
+This event sends basic metadata about the USB hubs on the device.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **InventoryVersion** The version of the inventory file generating the events
-- **TotalUserConnectablePorts** Total number of connectable USB ports
-- **TotalUserConnectableTypeCPorts** Total number of connectable USB Type C ports
+- **InventoryVersion** The version of the inventory file generating the events.
+- **TotalUserConnectablePorts** Total number of connectable USB ports.
+- **TotalUserConnectableTypeCPorts** Total number of connectable USB Type C ports.
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd
+### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync
-This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule
+This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **Count** Count of total Microsoft Office VBA rule violations
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd
+
+This event provides the basic metadata about driver binaries running on the system.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **DriverCheckSum** The checksum of the driver file.
+- **DriverCompany** The company name that developed the driver.
+- **DriverInBox** Is the driver included with the operating system?
+- **DriverIsKernelMode** Is it a kernel mode driver?
+- **DriverName** The file name of the driver.
+- **DriverPackageStrongName** The strong name of the driver package
+- **DriverSigned** The strong name of the driver package
+- **DriverTimeStamp** The low 32 bits of the time stamp of the driver file.
+- **DriverType** A bitfield of driver attributes: 1. define DRIVER_MAP_DRIVER_TYPE_PRINTER 0x0001. 2. define DRIVER_MAP_DRIVER_TYPE_KERNEL 0x0002. 3. define DRIVER_MAP_DRIVER_TYPE_USER 0x0004. 4. define DRIVER_MAP_DRIVER_IS_SIGNED 0x0008. 5. define DRIVER_MAP_DRIVER_IS_INBOX 0x0010. 6. define DRIVER_MAP_DRIVER_IS_WINQUAL 0x0040. 7. define DRIVER_MAP_DRIVER_IS_SELF_SIGNED 0x0020. 8. define DRIVER_MAP_DRIVER_IS_CI_SIGNED 0x0080. 9. define DRIVER_MAP_DRIVER_HAS_BOOT_SERVICE 0x0100. 10. define DRIVER_MAP_DRIVER_TYPE_I386 0x10000. 11. define DRIVER_MAP_DRIVER_TYPE_IA64 0x20000. 12. define DRIVER_MAP_DRIVER_TYPE_AMD64 0x40000. 13. define DRIVER_MAP_DRIVER_TYPE_ARM 0x100000. 14. define DRIVER_MAP_DRIVER_TYPE_THUMB 0x200000. 15. define DRIVER_MAP_DRIVER_TYPE_ARMNT 0x400000. 16. define DRIVER_MAP_DRIVER_IS_TIME_STAMPED 0x800000.
+- **DriverVersion** The version of the driver file.
+- **ImageSize** The size of the driver file.
+- **Inf** The name of the INF file.
+- **InventoryVersion** The version of the inventory file generating the events.
+- **Product** The product name that is included in the driver file.
+- **ProductVersion** The product version that is included in the driver file.
+- **Service** The name of the service that is installed for the device.
+- **WdfVersion** The Windows Driver Framework version.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove
+
+This event indicates that the InventoryDriverBinary object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync
+
+This event indicates that a new set of InventoryDriverBinaryAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd
+
+This event sends basic metadata about drive packages installed on the system to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **Class** The class name for the device driver.
+- **ClassGuid** The class GUID for the device driver.
+- **Date** The driver package date.
+- **Directory** The path to the driver package.
+- **DriverInBox** Is the driver included with the operating system?
+- **Inf** The INF name of the driver package.
+- **InventoryVersion** The version of the inventory file generating the events.
+- **Provider** The provider for the driver package.
+- **SubmissionId** The HLK submission ID for the driver package.
+- **Version** The version of the driver package.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove
+
+This event indicates that the InventoryDriverPackageRemove object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync
+
+This event indicates that a new set of InventoryDriverPackageAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory file generating the events.
+
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
-This event provides data on the installed Office Add-ins.
+Invalid variant - Provides data on the installed Office Add-ins
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AddinCLSID** The CLSID for the Office addin
+- **AddInCLSID** The CLSID for the Add-in
+- **AddInId** Add-In identifier
+- **AddinType** The type of the Office addin.
+- **BinFileTimestamp** Timestamp of the Office addin
+- **BinFileVersion** Version of the Office addin
+- **Description** Add-in description
+- **FileId** FileId of the Office addin
+- **FileSize** File size of the Office addin
+- **FriendlyName** Add-in friendly name
+- **FullPath** Full path to the add-in module
+- **LoadBehavior** The load behavior
+- **LoadTime** The load time for the add-in
+- **OfficeApplication** The Microsoft Office application associated with the add-in
+- **OfficeArchitecture** Architecture of the addin
+- **OfficeVersion** The Microsoft Office version installed
+- **OutlookCrashingAddin** Whether the Outlook addin is crashing
+- **ProductCompany** The name of the company associated with the Office addin
+- **ProductName** The product name associated with the Office addin
+- **ProductVersion** The version associated with the Office addin
+- **ProgramId** The unique program identifier of the Office addin
+- **Provider** Name of the provider for this addin
+- **Usage** Data regarding usage of the add-in.
-- **AddInCLSID** The CLSID key office for the Office addin.
-- **AddInId** The identifier of the Office addin.
-- **AddinType** The type of the Office addin.
-- **BinFileTimestamp** The timestamp of the Office addin.
-- **BinFileVersion** The version of the Office addin.
-- **Description** The description of the Office addin.
-- **FileId** The file ID of the Office addin.
-- **FriendlyName** The friendly name of the Office addin.
-- **FullPath** The full path to the Office addin.
-- **LoadBehavior** A Uint32 that describes the load behavior.
-- **LoadTime** The load time for the Office addin.
-- **OfficeApplication** The OIffice application for this addin.
-- **OfficeArchitecture** The architecture of the addin.
-- **OfficeVersion** The Office version for this addin.
-- **OutlookCrashingAddin** A boolean value that indicates if crashes have been found for this addin.
-- **ProductCompany** The name of the company associated with the Office addin.
-- **ProductName** The product name associated with the Office addin.
-- **ProductVersion** The version associated with the Office addin.
-- **ProgramId** The unique program identifier of the Office addin.
-- **Provider** The provider name for this addin.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove
This event indicates that the particular data object represented by the objectInstanceId is no longer present.
-There are no fields in this event.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync
+
+This event indicates that a new sync is being generated for this object type.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd
+
+This event provides data on the Office identifiers
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **OAudienceData** Sub-identifier for Microsoft Office release management, identifying the pilot group for a device
+- **OAudienceId** Microsoft Office identifier for Microsoft Office release management, identifying the pilot group for a device
+- **OMID** Identifier for the Office SQM Machine
+- **OPlatform** Whether the installed Microsoft Office product is 32-bit or 64-bit
+- **OTenantId** Unique GUID representing the Microsoft O365 Tenant
+- **OVersion** Installed version of Microsoft Office. For example, 16.0.8602.1000
+- **OWowMID** Legacy Microsoft Office telemetry identifier (SQM Machine ID) for WoW systems (32-bit Microsoft Office on 64-bit Windows)
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync
+
+Diagnostic event to indicate a new sync is being generated for this object type
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd
+
+This event includes the Office-related Internet Explorer features
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **OIeFeatureAddon** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_ADDON_MANAGEMENT feature lets applications hosting the WebBrowser Control to respect add-on management selections made using the Add-on Manager feature of Internet Explorer. Add-ons disabled by the user or by administrative group policy will also be disabled in applications that enable this feature.
+- **OIeMachineLockdown** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_LOCALMACHINE_LOCKDOWN feature is enabled, Internet Explorer applies security restrictions on content loaded from the user's local machine, which helps prevent malicious behavior involving local files.
+- **OIeMimeHandling** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_MIME_HANDLING feature control is enabled, Internet Explorer handles MIME types more securely. Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2)
+- **OIeMimeSniffing** Flag indicating which Microsoft Office products have this setting enabled. Determines a file's type by examining its bit signature. Windows Internet Explorer uses this information to determine how to render the file. The FEATURE_MIME_SNIFFING feature, when enabled, allows to be set differently for each security zone by using the URLACTION_FEATURE_MIME_SNIFFING URL action flag
+- **OIeNoAxInstall** Flag indicating which Microsoft Office products have this setting enabled. When a webpage attempts to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request. When a webpage tries to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request
+- **OIeNoDownload** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_RESTRICT_FILEDOWNLOAD feature blocks file download requests that navigate to a resource, that display a file download dialog box, or that are not initiated explicitly by a user action (for example, a mouse click or key press). Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2)
+- **OIeObjectCaching** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_OBJECT_CACHING feature prevents webpages from accessing or instantiating ActiveX controls cached from different domains or security contexts
+- **OIePasswordDisable** Flag indicating which Microsoft Office products have this setting enabled. After Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2), Internet Explorer no longer allows usernames and passwords to be specified in URLs that use the HTTP or HTTPS protocols. URLs using other protocols, such as FTP, still allow usernames and passwords
+- **OIeSafeBind** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SAFE_BINDTOOBJECT feature performs additional safety checks when calling MonikerBindToObject to create and initialize Microsoft ActiveX controls. Specifically, prevent the control from being created if COMPAT_EVIL_DONT_LOAD is in the registry for the control
+- **OIeSecurityBand** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SECURITYBAND feature controls the display of the Internet Explorer Information bar. When enabled, the Information bar appears when file download or code installation is restricted
+- **OIeUncSaveCheck** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_UNC_SAVEDFILECHECK feature enables the Mark of the Web (MOTW) for local files loaded from network locations that have been shared by using the Universal Naming Convention (UNC)
+- **OIeValidateUrl** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_VALIDATE_NAVIGATE_URL feature control prevents Windows Internet Explorer from navigating to a badly formed URL
+- **OIeWebOcPopup** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_WEBOC_POPUPMANAGEMENT feature allows applications hosting the WebBrowser Control to receive the default Internet Explorer pop-up window management behavior
+- **OIeWinRestrict** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_WINDOW_RESTRICTIONS feature adds several restrictions to the size and behavior of popup windows
+- **OIeZoneElevate** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_ZONE_ELEVATION feature prevents pages in one zone from navigating to pages in a higher security zone unless the navigation is generated by the user
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync
+
+Diagnostic event to indicate a new sync is being generated for this object type
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd
-This event provides insight data on the installed Office products.
+Provides insight data on the installed Office products
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **OfficeApplication** The name of the Office application.
-- **OfficeArchitecture** The bitness of the Office application.
-- **OfficeVersion** The version of the Office application.
-- **Value** The insights collected about this entity.
+- **OfficeApplication** The name of the Office application.
+- **OfficeArchitecture** The bitness of the Office application.
+- **OfficeVersion** The version of the Office application.
+- **Value** The insights collected about this entity.
+
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove
This event indicates that the particular data object represented by the objectInstanceId is no longer present.
-There are no fields in this event.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync
-This diagnostic event indicates that a new sync is being generated for this object type.
+Diagnostic event to indicate a new sync is being generated for this object type
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd
+
+This event list all installed Office products
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **OC2rApps** A GUID the describes the Office Click-To-Run apps
+- **OC2rSkus** Comma-delimited list (CSV) of Office Click-To-Run products installed on the device. For example, Office 2016 ProPlus
+- **OMsiApps** Comma-delimited list (CSV) of Office MSI products installed on the device. For example, Microsoft Word
+- **OProductCodes** A GUID that describes the Office MSI products
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync
+
+Diagnostic event to indicate a new sync is being generated for this object type
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
-There are no fields in this event.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd
-This event describes various Office settings.
+This event describes various Office settings
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **BrowserFlags** Browser flags for Office-related products.
-- **ExchangeProviderFlags** Provider policies for Office Exchange.
-- **SharedComputerLicensing** Office shared computer licensing policies.
+- **BrowserFlags** Browser flags for Office-related products
+- **ExchangeProviderFlags** Office Exchange provider policies
+- **SharedComputerLicensing** Office Shared Computer Licensing policies
+
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync
-Diagnostic event to indicate a new sync is being generated for this object type.
+Diagnostic event to indicate a new sync is being generated for this object type
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
-There are no fields in this event.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd
This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **Design** Count of files with design issues found
@@ -2125,43 +2566,74 @@ The following fields are available:
This event indicates that the particular data object represented by the objectInstanceId is no longer present.
-There are no fields in this event.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd
+
+This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **Count** Count of total Microsoft Office VBA rule violations
+
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove
This event indicates that the particular data object represented by the objectInstanceId is no longer present.
-There are no fields in this event.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
-### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync
-This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync
+
+This event indicates that a new sync is being generated for this object type.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync
+
+Diagnostic event to indicate a new sync is being generated for this object type
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd
+
+Provides data on Unified Update Platform (UUP) products and what version they are at.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **InventoryVersion** The version of the inventory file generating the events
+- **Identifier** UUP identifier
+- **LastActivatedVersion** Last activated version
+- **PreviousVersion** Previous version
+- **Source** UUP source
+- **Version** UUP version
-### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove
-This event provides the basic metadata about the frameworks an application may depend on
+Indicates that this particular data object represented by the objectInstanceId is no longer present.
-The following fields are available:
-
-- **FileId** A hash that uniquely identifies a file
-- **Frameworks** The list of frameworks this file depends on
-- **InventoryVersion** The version of the inventory file generating the events
-- **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
-### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd
-These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up-to-date.
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync
-The following fields are available:
+Diagnostic event to indicate a new sync is being generated for this object type
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
-- **IndicatorValue** The indicator value
-- **Value** Describes an operating system indicator that may be relevant for the device upgrade.
### Microsoft.Windows.Inventory.Indicators.Checksum
@@ -2174,627 +2646,147 @@ The following fields are available:
- **PCFP** Equivalent to the InventoryId field that is found in other core events.
-### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd
+### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd
-This event sends basic metadata about an application on the system to help keep Windows up to date.
+These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **HiddenArp** Indicates whether a program hides itself from showing up in ARP.
-- **InstallDate** The date the application was installed (a best guess based on folder creation date heuristics).
-- **InstallDateArpLastModified** The date of the registry ARP key for a given application. Hints at install date but not always accurate. Passed as an array. Example: 4/11/2015 00:00:00
-- **InstallDateFromLinkFile** The estimated date of install based on the links to the files. Passed as an array.
-- **InstallDateMsi** The install date if the application was installed via MSI. Passed as an array.
-- **InventoryVersion** The version of the inventory file generating the events.
-- **Language** The language code of the program.
-- **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage.
-- **MsiProductCode** A GUID that describe the MSI Product.
-- **Name** The name of the application
-- **OSVersionAtInstallTime** The four octets from the OS version at the time of the application's install.
-- **PackageFullName** The package full name for a Store application.
-- **ProgramInstanceId** A hash of the file IDs in an app.
-- **Publisher** The Publisher of the application. Location pulled from depends on the 'Source' field.
-- **RootDirPath** The path to the root directory where the program was installed.
-- **Source** How the program was installed (ARP, MSI, Appx, etc...)
-- **StoreAppType** A sub-classification for the type of Microsoft Store app, such as UWP or Win8StoreApp.
-- **Type** "One of (""Application"", ""Hotfix"", ""BOE"", ""Service"", ""Unknown""). Application indicates Win32 or Appx app, Hotfix indicates app updates (KBs), BOE indicates it's an app with no ARP or MSI entry, Service indicates that it is a service. Application and BOE are the ones most likely seen."
-- **Version** The version number of the program.
+- **IndicatorValue** The indicator value.
-### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove
-
-This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync
-
-This event indicates that a new set of InventoryApplicationAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove
-
-This event indicates that the InventoryDeviceContainer object is no longer present.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd
-
-This event sends basic metadata about drive packages installed on the system to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **Class** The class name for the device driver.
-- **ClassGuid** The class GUID for the device driver.
-- **Date** The driver package date.
-- **Directory** The path to the driver package.
-- **DriverInBox** Is the driver included with the operating system?
-- **Inf** The INF name of the driver package.
-- **InventoryVersion** The version of the inventory file generating the events.
-- **Provider** The provider for the driver package.
-- **SubmissionId** The HLK submission ID for the driver package.
-- **Version** The version of the driver package.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync
-
-This event indicates that a new set of InventoryDriverBinaryAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove
-
-This event indicates that the InventoryDriverBinary object is no longer present.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove
-
-This event indicates that the InventoryDriverPackageRemove object is no longer present.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove
-
-This event indicates that the InventoryDevicePnpRemove object is no longer present.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd
-
-This event sends basic metadata about a device container (such as a monitor or printer as opposed to a PNP device) to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **Categories** A comma separated list of functional categories in which the container belongs.
-- **DiscoveryMethod** The discovery method for the device container.
-- **FriendlyName** The name of the device container.
-- **InventoryVersion** The version of the inventory file generating the events.
-- **IsActive** Is the device connected, or has it been seen in the last 14 days?
-- **IsConnected** For a physically attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link.
-- **IsMachineContainer** Is the container the root device itself?
-- **IsNetworked** Is this a networked device?
-- **IsPaired** Does the device container require pairing?
-- **Manufacturer** The manufacturer name for the device container.
-- **ModelId** A model GUID.
-- **ModelName** The model name.
-- **ModelNumber** The model number for the device container.
-- **PrimaryCategory** The primary category for the device container.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync
-
-This event indicates that a new set of InventoryDeviceContainerAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync
-
-This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync
-
-This event indicates that a new set of InventoryDriverPackageAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove
-
-This event indicates that the InventoryDeviceMediaClassRemove object is no longer present.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync
-
-This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd
-
-This event sends additional metadata about a PNP device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload.
-
-The following fields are available:
-
-- **Audio_CaptureDriver** The Audio device capture driver endpoint.
-- **Audio_RenderDriver** The Audio device render driver endpoint.
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd
-
-This event represents the basic metadata about a PNP device and its associated driver
-
-The following fields are available:
-
-- **class** The device setup class of the driver loaded for the device
-- **classGuid** The device class GUID from the driver package
-- **COMPID** A JSON array the provides the value and order of the compatible ID tree for the device.
-- **ContainerId** A system-supplied GUID that uniquely groups the functional devices associated with a single-function or multifunction device installed in the device.
-- **description** The device description
-- **deviceState** DeviceState is a bitmask of the following: DEVICE_IS_CONNECTED 0x0001 (currently only for container). DEVICE_IS_NETWORK_DEVICE 0x0002 (currently only for container). DEVICE_IS_PAIRED 0x0004 (currently only for container). DEVICE_IS_ACTIVE 0x0008 (currently never set). DEVICE_IS_MACHINE 0x0010 (currently only for container). DEVICE_IS_PRESENT 0x0020 (currently always set). DEVICE_IS_HIDDEN 0x0040. DEVICE_IS_PRINTER 0x0080 (currently only for container). DEVICE_IS_WIRELESS 0x0100. DEVICE_IS_WIRELESS_FAT 0x0200. The most common values are therefore: 32 (0x20)= device is present. 96 (0x60)= device is present but hidden. 288 (0x120)= device is a wireless device that is present
-- **DriverId** A unique identifier for the installed device.
-- **DriverName** The name of the driver image file.
-- **driverPackageStrongName** The immediate parent directory name in the Directory field of InventoryDriverPackage.
-- **driverVerDate** The date of the driver loaded for the device
-- **driverVerVersion** The version of the driver loaded for the device
-- **enumerator** The bus that enumerated the device
-- **HWID** A JSON array that provides the value and order of the HWID tree for the device.
-- **Inf** The INF file name.
-- **installState** The device installation state. One of these values: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx
-- **InventoryVersion** The version of the inventory file generating the events.
-- **lowerClassFilters** Lower filter class drivers IDs installed for the device.
-- **lowerFilters** Lower filter drivers IDs installed for the device
-- **manufacturer** The device manufacturer
-- **matchingID** Represents the hardware ID or compatible ID that Windows uses to install a device instance
-- **model** The device model
-- **parentId** Device instance id of the parent of the device
-- **ProblemCode** The current error code for the device.
-- **provider** The device provider
-- **service** The device service name#N##N##N##N##N#
-- **STACKID** A JSON array that provides the value and order of the STACKID tree for the device.
-- **upperClassFilters** Upper filter class drivers IDs installed for the device
-- **upperFilters** Upper filter drivers IDs installed for the device
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd
-
-This event provides the basic metadata about driver binaries running on the system
-
-The following fields are available:
-
-- **DriverCheckSum** The checksum of the driver file.
-- **DriverCompany** The company name that developed the driver.
-- **driverInBox** Is the driver included with the operating system?
-- **driverIsKernelMode** Is it a kernel mode driver?
-- **DriverName** The file name of the driver.
-- **driverPackageStrongName** The strong name of the driver package
-- **driverSigned** The strong name of the driver package
-- **DriverTimeStamp** The low 32 bits of the time stamp of the driver file.
-- **DriverType** A bitfield of driver attributes: 1. define DRIVER_MAP_DRIVER_TYPE_PRINTER 0x0001. 2. define DRIVER_MAP_DRIVER_TYPE_KERNEL 0x0002. 3. define DRIVER_MAP_DRIVER_TYPE_USER 0x0004. 4. define DRIVER_MAP_DRIVER_IS_SIGNED 0x0008. 5. define DRIVER_MAP_DRIVER_IS_INBOX 0x0010. 6. define DRIVER_MAP_DRIVER_IS_WINQUAL 0x0040. 7. define DRIVER_MAP_DRIVER_IS_SELF_SIGNED 0x0020. 8. define DRIVER_MAP_DRIVER_IS_CI_SIGNED 0x0080. 9. define DRIVER_MAP_DRIVER_HAS_BOOT_SERVICE 0x0100. 10. define DRIVER_MAP_DRIVER_TYPE_I386 0x10000. 11. define DRIVER_MAP_DRIVER_TYPE_IA64 0x20000. 12. define DRIVER_MAP_DRIVER_TYPE_AMD64 0x40000. 13. define DRIVER_MAP_DRIVER_TYPE_ARM 0x100000. 14. define DRIVER_MAP_DRIVER_TYPE_THUMB 0x200000. 15. define DRIVER_MAP_DRIVER_TYPE_ARMNT 0x400000. 16. define DRIVER_MAP_DRIVER_IS_TIME_STAMPED 0x800000.
-- **DriverVersion** The version of the driver file.
-- **ImageSize** The size of the driver file.
-- **Inf** The name of the INF file.
-- **InventoryVersion** The version of the inventory file generating the events.
-- **Product** The product name that is included in the driver file.
-- **ProductVersion** The product version that is included in the driver file.
-- **service** The device service name
-- **WdfVersion** The Windows Driver Framework version.
-
-
-### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicator
-
-This event sends value data about the markers on custom devices, to help keep Windows up to date. The formal name for markers is UEX Indicators. See marker list for definitions.
-
-The following fields are available:
-
-- **IndicatorValue** Value of the marker/indicator
-- **Key** Name of the marker/indicator
-
-
-### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions
-
-This event sends inventory component versions for the Device Inventory data.
-
-The following fields are available:
-
-- **aeinv** The version of the App inventory component.
-- **devinv** The file version of the Device inventory component.
-
-
-### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum
-
-This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object.
-
-The following fields are available:
-
-- **Device** A count of device objects in cache
-- **DeviceCensus** A count of devicecensus objects in cache
-- **DriverPackageExtended** A count of driverpackageextended objects in cache
-- **File** A count of file objects in cache
-- **FileSigningInfo** A count of file signing info objects in cache.
-- **Generic** A count of generic objects in cache
-- **HwItem** A count of hwitem objects in cache
-- **InventoryApplication** A count of application objects in cache
-- **InventoryApplicationFile** A count of application file objects in cache
-- **InventoryDeviceContainer** A count of device container objects in cache
-- **InventoryDeviceInterface** A count of inventory device interface objects in cache.
-- **InventoryDeviceMediaClass** A count of device media objects in cache
-- **InventoryDevicePnp** A count of devicepnp objects in cache
-- **InventoryDriverBinary** A count of driver binary objects in cache
-- **InventoryDriverPackage** A count of device objects in cache
-- **Metadata** A count of metadata objects in cache
-- **Orphan** A count of orphan file objects in cache
-- **Programs** A count of program objects in cache
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync
-
-This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent.
-
-The following fields are available:
-
-- **InventoryVersion** The version of the inventory file generating the events.
-
-
-### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd
-
-This event retrieves information about what sensor interfaces are available on the device.
-
-The following fields are available:
-
-- **Accelerometer3D** Indicates if an Accelerator3D sensor is found.
-- **ActivityDetection** Indicates if an Activity Detection sensor is found.
-- **AmbientLight** Indicates if an Ambient Light sensor is found.
-- **Barometer** Indicates if a Barometer sensor is found.
-- **Custom** Indicates if a Custom sensor is found.
-- **EnergyMeter** Indicates if an Energy sensor is found.
-- **FloorElevation** Indicates if a Floor Elevation sensor is found.
-- **GeomagneticOrientation** Indicates if a Geo Magnetic Orientation sensor is found.
-- **GravityVector** Indicates if a Gravity Detector sensor is found.
-- **Gyrometer3D** Indicates if a Gyrometer3D sensor is found.
-- **Humidity** Indicates if a Humidity sensor is found.
-- **InventoryVersion** The version of the inventory file generating the events.
-- **LinearAccelerometer** Indicates if a Linear Accelerometer sensor is found.
-- **Magnetometer3D** Indicates if a Magnetometer3D sensor is found.
-- **Orientation** Indicates if an Orientation sensor is found.
-- **Pedometer** Indicates if a Pedometer sensor is found.
-- **Proximity** Indicates if a Proximity sensor is found.
-- **RelativeOrientation** Indicates if a Relative Orientation sensor is found.
-- **SimpleDeviceOrientation** Indicates if a Simple Device Orientation sensor is found.
-- **Temperature** Indicates if a Temperature sensor is found.
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync
-
-This event indicates that a new sync is being generated for this object type.
-
-There are no fields in this event.
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd
-
-This event provides data on the installed Office identifiers.
-
-- **OAudienceData** The Office Audience descriptor.
-- **OAudienceId** The Office Audience ID.
-- **OMID** The Office machine ID.
-- **OPlatform** The Office architecture.
-- **OVersion** The Office version
-- **OTenantId** The Office 365 Tenant GUID.
-- **OWowMID** The Office machine ID.
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync
-
-This event indicates that a new sync is being generated for this object type.
-
-There are no fields in this event.
-
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd
-
-This event provides data on the installed Office-related Internet Explorer features.
-
-- **OIeFeatureAddon** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx).
-- **OIeMachineLockdown** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx).
-- **OIeMimeHandling** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx).
-- **OIeMimeSniffing** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx).
-- **OIeNoAxInstall** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx).
-- **OIeNoDownload** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx).
-- **OIeObjectCaching** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx).
-- **OIePasswordDisable** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx).
-- **OIeSafeBind** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx).
-- **OIeSecurityBand** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx).
-- **OIeUncSaveCheck** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx).
-- **OIeValidateUrl** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx).
-- **OIeWebOcPopup** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx).
-- **OIeWinRestrict** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx).
-- **OIeZoneElevate** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx).
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync
-
-This event indicates that a new sync is being generated for this object type.
-
-There are no fields in this event.
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd
-
-This event describes the Office products that are installed.
-
-- **OC2rApps** The Office Click-to-Run apps.
-- **OC2rSkus** The Office Click-to-Run products.
-- **OMsiApps** The Office MSI apps.
-- **OProductCodes** The Office MSI product code.
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync
-
-This event indicates that a new sync is being generated for this object type.
-
-There are no fields in this event.
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync
-
-This event indicates that a new sync is being generated for this object type.
-
-There are no fields in this event.
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync
-
-This event indicates that a new sync is being generated for this object type.
-
-There are no fields in this event.
-
-### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove
-
-This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed.
-
-There are no fields in this event.
-
### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync
This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent.
-There are no fields in this event.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
-## OneDrive events
-### Microsoft.OneDrive.Sync.Updater.OfficeRegistration
-This event determines the status of the OneDrive integration with Microsoft Office.
+## Kernel events
+
+### IO
+
+This event indicates the number of bytes read from or read by the OS and written to or written by the OS upon system startup.
The following fields are available:
-- **isValid** Is the Microsoft Office registration valid?
+- **BytesRead** The total number of bytes read from or read by the OS upon system startup.
+- **BytesWritten** The total number of bytes written to or written by the OS upon system startup.
-### Microsoft.OneDrive.Sync.Updater.UpdateTierReg
+### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch
-This event determines status of the update tier registry values.
+OS information collected during Boot, used to evaluate the success of the upgrade process.
The following fields are available:
-- **regReadEnterpriseHr** The HResult of the enterprise reg read value.
-- **regReadTeamHr** The HResult of the team reg read value.
-
-
-### Microsoft.OneDrive.Sync.Updater.RepairResult
-
-The event determines the result of the installation repair.
-
-The following fields are available:
-
-- **hr** The HResult of the operation.
-
-
-### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult
-
-This event determines the status when downloading the OneDrive update configuration file.
-
-The following fields are available:
-
-- **hr** The HResult of the operation.
-
-
-### Microsoft.OneDrive.Sync.Updater.SetupBinaryDownloadHResult
-
-This event indicates the status when downloading the OneDrive setup file.
-
-The following fields are available:
-
-- **hr** The HResult of the operation.
-
-
-### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult
-
-This event determines the outcome of the operation.
-
-The following fields are available:
-
-- **hr** The HResult of the operation.
-- **IsLoggingEnabled** Is logging enabled?
-- **UpdaterVersion** The version of the updater.
-
-
-### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus
-
-This event determines the error code that was returned when verifying Internet connectivity.
-
-The following fields are available:
-
-- **winInetError** The HResult of the operation.
-
-
-### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus
-
-This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken
-
-The following fields are available:
-
-- **32bit** The status of the OneDrive overlay icon on a 32-bit operating system.
-- **64bit** The status of the OneDrive overlay icon on a 64-bit operating system.
-- **SixtyFourBit** The status of the OneDrive overlay icon on a 32-bit operating system.
-- **ThirtyTwoBit** The status of the OneDrive overlay icon on a 64-bit operating system.
-
-
-### Microsoft.OneDrive.Sync.Updater.ComponentInstallState
-
-This event determines the installation state of dependent OneDrive components.
-
-The following fields are available:
-
-- **ComponentName** The name of the dependent component.
-- **isInstalled** Is the dependent component installed?
-
-
-### Microsoft.OneDrive.Sync.Updater.CommonData
-
-This event contains basic OneDrive configuration data that helps to diagnose failures.
-
-The following fields are available:
-
-- **AppVersion** The version of the app.
-- **BuildArch** Is the architecture x86 or x64?
-- **Environment** Is the device on the production or int service?
-- **IsMSFTInternal** Is this an internal Microsoft device?
-- **MachineGuid** The CEIP machine ID.
-- **Market** Which market is this in?
-- **OfficeVersion** The version of Office that is installed.
-- **OneDriveDeviceId** The OneDrive device ID.
-- **OSDeviceName** Only if the device is internal to Microsoft, the device name.
-- **OSUserName** Only if the device is internal to Microsoft, the user name.
-- **UserGuid** A unique global user identifier.
-
-
-### Microsoft.OneDrive.Sync.Setup.APIOperation
-
-This event includes basic data about install and uninstall OneDrive API operations.
-
-The following fields are available:
-
-- **APIName** The name of the API.
-- **Duration** How long the operation took.
-- **IsSuccess** Was the operation successful?
-- **ResultCode** The result code.
-- **ScenarioName** The name of the scenario.
-
-
-### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation
-
-This event is related to registering or unregistering the OneDrive update task.
-
-The following fields are available:
-
-- **APIName** The name of the API.
-- **IsSuccess** Was the operation successful?
-- **RegisterNewTaskResult** The HResult of the RegisterNewTask operation.
-- **ScenarioName** The name of the scenario.
-- **UnregisterOldTaskResult** The HResult of the UnregisterOldTask operation.
-
-
-### Microsoft.OneDrive.Sync.Setup.EndExperience
-
-This event includes a success or failure summary of the installation.
-
-The following fields are available:
-
-- **APIName** The name of the API.
-- **HResult** Indicates the result code of the event
-- **IsSuccess** Was the operation successful?
-- **ScenarioName** The name of the scenario.
-
-
-### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation
-
-This event is related to the OS version when the OS is upgraded with OneDrive installed.
-
-The following fields are available:
-
-- **CurrentOneDriveVersion** The current version of OneDrive.
-- **CurrentOSBuildBranch** The current branch of the operating system.
-- **CurrentOSBuildNumber** The current build number of the operating system.
-- **CurrentOSVersion** The current version of the operating system.
-- **HResult** The HResult of the operation.
-- **SourceOSBuildBranch** The source branch of the operating system.
-- **SourceOSBuildNumber** The source build number of the operating system.
-- **SourceOSVersion** The source version of the operating system.
-
-
-### Microsoft.OneDrive.Sync.Setup.SetupCommonData
-
-This event contains basic OneDrive configuration data that helps to diagnose failures.
-
-The following fields are available:
-
-- **AppVersion** The version of the app.
-- **BuildArchitecture** Is the architecture x86 or x64?
-- **Environment** Is the device on the production or int service?
-- **MachineGuid** The CEIP machine ID.
-- **Market** Which market is this in?
-- **MSFTInternal** Is this an internal Microsoft device?
-- **OfficeVersionString** The version of Office that is installed.
-- **OSDeviceName** Only if the device is internal to Microsoft, the device name.
-- **OSUserName** Only if the device is internal to Microsoft, the user name.
-- **UserGuid** The CEIP user ID.
+- **BootApplicationId** This field tells us what the OS Loader Application Identifier is.
+- **BootAttemptCount** The number of consecutive times the boot manager has attempted to boot into this operating system.
+- **BootSequence** The current Boot ID, used to correlate events related to a particular boot session.
+- **BootStatusPolicy** Identifies the applicable Boot Status Policy.
+- **BootType** Identifies the type of boot (e.g.: "Cold", "Hiber", "Resume").
+- **EventTimestamp** Seconds elapsed since an arbitrary time point. This can be used to identify the time difference in successive boot attempts being made.
+- **FirmwareResetReasonEmbeddedController** Reason for system reset provided by firmware.
+- **FirmwareResetReasonEmbeddedControllerAdditional** Additional information on system reset reason provided by firmware if needed.
+- **FirmwareResetReasonPch** Reason for system reset provided by firmware.
+- **FirmwareResetReasonPchAdditional** Additional information on system reset reason provided by firmware if needed.
+- **FirmwareResetReasonSupplied** Flag indicating that a reason for system reset was provided by firmware.
+- **IO** Amount of data written to and read from the disk by the OS Loader during boot. See [IO](#io).
+- **LastBootSucceeded** Flag indicating whether the last boot was successful.
+- **LastShutdownSucceeded** Flag indicating whether the last shutdown was successful.
+- **MenuPolicy** Type of advanced options menu that should be shown to the user (Legacy, Standard, etc.).
+- **RecoveryEnabled** Indicates whether recovery is enabled.
+- **UserInputTime** The amount of time the loader application spent waiting for user input.
## Remediation events
->[!NOTE]
->Events from this provider are sent with the installation of KB4023057 and any subsequent Windows update. For details, see [this support article](https://support.microsoft.com/help/4023057).
-
### Microsoft.Windows.Remediation.Applicable
-Reports whether a specific remediation to issues preventing security and quality updates is applicable based on detection.
+This event indicates a remedial plug-in is applicable if/when such a plug-in is detected. This is used to ensure Windows is up to date.
The following fields are available:
-- **CV** Correlation vector.
-- **DetectedCondition** Boolean true if detect condition is true and perform action will be run.
-- **GlobalEventCounter** Client side counter which indicates ordering of events sent by the remediation system.
-- **PackageVersion** Current package version of Remediation.
-- **PluginName** Name of the remediation plugin specified for each generic plugin event.
-- **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated is disabled.
-- **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS.
-- **RemediationShellDeviceSccm** TRUE if the device is SCCM managed.
-- **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely.
-- **Result** Result for detection or perform action phases of the remediation system.
+- **ActionName** The name of the action to be taken by the plug-in.
+- **AppraiserBinariesValidResult** Indicates whether plug-in was appraised as valid.
+- **AppraiserDetectCondition** Indicates whether the plug-in passed the appraiser's check.
+- **AppraiserRegistryValidResult** Indicates whether the registry entry checks out as valid.
+- **AppraiserTaskDisabled** Indicates the appraiser task is disabled.
+- **AppraiserTaskValidFailed** Indicates the Appraiser task did not function and requires intervention.
+- **CV** Correlation vector
+- **DateTimeDifference** The difference between local and reference clock times.
+- **DateTimeSyncEnabled** Indicates whether the datetime sync plug-in is enabled.
+- **DaysSinceLastSIH** The number of days since the most recent SIH executed.
+- **DaysToNextSIH** The number of days until the next scheduled SIH execution.
+- **DetectedCondition** Indicates whether detect condition is true and the perform action will be run.
+- **EvalAndReportAppraiserBinariesFailed** Indicates the EvalAndReportAppraiserBinaries event failed.
+- **EvalAndReportAppraiserRegEntries** Indicates the EvalAndReportAppraiserRegEntriesFailed event failed.
+- **EvalAndReportAppraiserRegEntriesFailed** Indicates the EvalAndReportAppraiserRegEntriesFailed event failed.
+- **GlobalEventCounter** Client side counter that indicates ordering of events sent by the remediation system.
+- **HResult** The HRESULT for detection or perform action phases of the plugin.
+- **IsAppraiserLatestResult** The HRESULT from the appraiser task.
+- **IsConfigurationCorrected** Indicates whether the configuration of SIH task was successfully corrected.
+- **LastHresult** The HRESULT for detection or perform action phases of the plugin.
+- **LastRun** The date of the most recent SIH run.
+- **NextRun** Date of the next scheduled SIH run.
+- **PackageVersion** The version of the current remediation package.
+- **PluginName** Name of the plugin specified for each generic plugin event.
+- **Reload** True if SIH reload is required.
+- **RemediationNoisyHammerAcLineStatus** Event that indicates the AC Line Status of the machine.
+- **RemediationNoisyHammerAutoStartCount** The number of times hammer auto-started.
+- **RemediationNoisyHammerCalendarTaskEnabled** Event that indicates Update Assistant Calendar Task is enabled.
+- **RemediationNoisyHammerCalendarTaskExists** Event that indicates an Update Assistant Calendar Task exists.
+- **RemediationNoisyHammerCalendarTaskTriggerEnabledCount** Event that indicates calendar triggers are enabled in the task.
+- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the most recent hammer task ran.
+- **RemediationNoisyHammerGetCurrentSize** Size in MB of the $GetCurrent folder.
+- **RemediationNoisyHammerIsInstalled** TRUE if the noisy hammer is installed.
+- **RemediationNoisyHammerLastTaskRunResult** The result of the last hammer task run.
+- **RemediationNoisyHammerMeteredNetwork** TRUE if the machine is on a metered network.
+- **RemediationNoisyHammerTaskEnabled** Indicates whether the Update Assistant Task (Noisy Hammer) is enabled.
+- **RemediationNoisyHammerTaskExists** Indicates whether the Update Assistant Task (Noisy Hammer) exists.
+- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether counting is enabled for the Update Assistant (Noisy Hammer) task trigger.
+- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant (Noisy Hammer) task.
+- **RemediationNoisyHammerUAExitState** The code for the exit state of the Update Assistant (Noisy Hammer) task.
+- **RemediationNoisyHammerUserLoggedIn** TRUE if there is a user logged in.
+- **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin.
+- **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled.
+- **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS.
+- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager).
+- **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely.
+- **RemediationTargetMachine** Indicates whether the device is a target of the specified fix.
+- **RemediationTaskHealthAutochkProxy** True/False based on the health of the AutochkProxy task.
+- **RemediationTaskHealthChkdskProactiveScan** True/False based on the health of the Check Disk task.
+- **RemediationTaskHealthDiskCleanup_SilentCleanup** True/False based on the health of the Disk Cleanup task.
+- **RemediationTaskHealthMaintenance_WinSAT** True/False based on the health of the Health Maintenance task.
+- **RemediationTaskHealthServicing_ComponentCleanupTask** True/False based on the health of the Health Servicing Component task.
+- **RemediationTaskHealthUSO_ScheduleScanTask** True/False based on the health of the USO (Update Session Orchestrator) Schedule task.
+- **RemediationTaskHealthWindowsUpdate_ScheduledStartTask** True/False based on the health of the Windows Update Scheduled Start task.
+- **RemediationTaskHealthWindowsUpdate_SihbootTask** True/False based on the health of the Sihboot task.
+- **RemediationUHServiceBitsServiceEnabled** Indicates whether BITS service is enabled.
+- **RemediationUHServiceDeviceInstallEnabled** Indicates whether Device Install service is enabled.
+- **RemediationUHServiceDoSvcServiceEnabled** Indicates whether DO service is enabled.
+- **RemediationUHServiceDsmsvcEnabled** Indicates whether DSMSVC service is enabled.
+- **RemediationUHServiceLicensemanagerEnabled** Indicates whether License Manager service is enabled.
+- **RemediationUHServiceMpssvcEnabled** Indicates whether MPSSVC service is enabled.
+- **RemediationUHServiceTokenBrokerEnabled** Indicates whether Token Broker service is enabled.
+- **RemediationUHServiceTrustedInstallerServiceEnabled** Indicates whether Trusted Installer service is enabled.
+- **RemediationUHServiceUsoServiceEnabled** Indicates whether USO (Update Session Orchestrator) service is enabled.
+- **RemediationUHServicew32timeServiceEnabled** Indicates whether W32 Time service is enabled.
+- **RemediationUHServiceWecsvcEnabled** Indicates whether WECSVC service is enabled.
+- **RemediationUHServiceWinmgmtEnabled** Indicates whether WMI service is enabled.
+- **RemediationUHServiceWpnServiceEnabled** Indicates whether WPN service is enabled.
+- **RemediationUHServiceWuauservServiceEnabled** Indicates whether WUAUSERV service is enabled.
+- **Result** This is the HRESULT for Detection or Perform Action phases of the plugin.
+- **RunAppraiserFailed** Indicates RunAppraiser failed to run correctly.
+- **RunTask** TRUE if SIH task should be run by the plug-in.
+- **TimeServiceNTPServer** The URL for the NTP time server used by device.
+- **TimeServiceStartType** The startup type for the NTP time service.
+- **TimeServiceSyncDomainJoined** True if device domain joined and hence uses DC for clock.
+- **TimeServiceSyncType** Type of sync behavior for Date & Time service on device.
+
### Microsoft.Windows.Remediation.ChangePowerProfileDetection
@@ -2802,166 +2794,181 @@ Indicates whether the remediation system can put in a request to defer a system-
The following fields are available:
-- **ActionName** A descriptive name for the plugin action.
-- **CurrentPowerPlanGUID** The ID of the current power plan configured on the device.
-- **CV** Correlation vector.
-- **GlobalEventCounter** Counter that indicates the ordering of events on the device.
-- **PackageVersion** Current package version of remediation service.
-- **RemediationBatteryPowerBatteryLevel** Integer between 0 and 100 indicating % battery power remaining (if not on battery, expect 0).
-- **RemediationFUInProcess** Result that shows whether the device is currently installing a feature update.
-- **RemediationScanInProcess** Result that shows whether the device is currently scanning for updates.
-- **RemediationTargetMachine** Result that shows whether this device is a candidate for remediation(s) that will fix update issues.
-- **SetupMutexAvailable** Result that shows whether setup mutex is available or not.
-- **SysPowerStatusAC** Result that shows whether system is on AC power or not.
+- **ActionName** A descriptive name for the plugin action
+- **CurrentPowerPlanGUID** The ID of the current power plan configured on the device
+- **CV** Correlation vector
+- **GlobalEventCounter** Counter that indicates the ordering of events on the device
+- **PackageVersion** Current package version of remediation service
+- **RemediationBatteryPowerBatteryLevel** Integer between 0 and 100 indicating % battery power remaining (if not on battery, expect 0)
+- **RemediationFUInProcess** Result that shows whether the device is currently installing a feature update
+- **RemediationFURebootRequred** Indicates that a feature update reboot required was detected so the plugin will exit.
+- **RemediationScanInProcess** Result that shows whether the device is currently scanning for updates
+- **RemediationTargetMachine** Result that shows whether this device is a candidate for remediation(s) that will fix update issues
+- **SetupMutexAvailable** Result that shows whether setup mutex is available or not
+- **SysPowerStatusAC** Result that shows whether system is on AC power or not
+
### Microsoft.Windows.Remediation.Completed
-Enables tracking the completion of a process that remediates issues preventing security and quality updates.
+This event enables completion tracking of a process that remediates issues preventing security and quality updates.
The following fields are available:
-- **CV** Correlation vector.
-- **GlobalEventCounter** Client side counter which indicates ordering of events sent by the remediation system.
-- **PackageVersion** Current package version of Remediation.
-- **PluginName** Name of the specific remediation for each generic plugin event.
-- **RemediationNoisyHammerTaskKickOffIsSuccess** Event that indicates the Update Assistant task has been started successfully.
-- **Result** Indicates whether the remediation has completed.
+- **ActionName** Name of the action to be completed by the plug-in.
+- **AppraiserTaskCreationFailed** TRUE if the appraiser task creation failed to complete successfully.
+- **AppraiserTaskDeleteFailed** TRUE if deletion of appraiser task failed to complete successfully.
+- **AppraiserTaskExistFailed** TRUE if detection of the appraiser task failed to complete successfully.
+- **AppraiserTaskLoadXmlFailed** TRUE if the Appraiser XML Loader failed to complete successfully.
+- **AppraiserTaskMissing** TRUE if the Appraiser task is missing.
+- **AppraiserTaskTimeTriggerUpdateFailedId** TRUE if the Appraiser Task Time Trigger failed to update successfully.
+- **AppraiserTaskValidateTaskXmlFailed** TRUE if the Appraiser Task XML failed to complete successfully.
+- **branchReadinessLevel** Branch readiness level policy.
+- **cloudControlState** Value indicating whether the shell is enabled on the cloud control settings.
+- **CrossedDiskSpaceThreshold** Indicates if cleanup resulted in hard drive usage threshold required for feature update to be exceeded.
+- **CV** The Correlation Vector.
+- **DateTimeDifference** The difference between the local and reference clocks.
+- **DaysSinceOsInstallation** The number of days since the installation of the Operating System.
+- **DiskMbCleaned** The amount of space cleaned on the hard disk, measured in Megabytes.
+- **DiskMbFreeAfterCleanup** The amount of free hard disk space after cleanup, measured in Megabytes.
+- **DiskMbFreeBeforeCleanup** The amount of free hard disk space before cleanup, measured in Megabytes.
+- **ForcedAppraiserTaskTriggered** TRUE if Appraiser task ran from the plug-in.
+- **GlobalEventCounter** Client-side counter that indicates ordering of events sent by the active user.
+- **HandlerCleanupFreeDiskInMegabytes** The amount of hard disk space cleaned by the storage sense handlers, measured in Megabytes.
+- **hasRolledBack** Indicates whether the client machine has rolled back.
+- **hasUninstalled** Indicates whether the client machine has uninstalled a later version of the OS.
+- **hResult** The result of the event execution.
+- **HResult** The result of the event execution.
+- **installDate** The value of installDate registry key. Indicates the install date.
+- **isNetworkMetered** Indicates whether the client machine has uninstalled a later version of the OS.
+- **LatestState** The final state of the plug-in component.
+- **MicrosoftCompatibilityAppraiser** The name of the component targeted by the Appraiser plug-in.
+- **PackageVersion** The package version for the current Remediation.
+- **PageFileCount** The number of Windows Page files.
+- **PageFileCurrentSize** The size of the Windows Page file, measured in Megabytes.
+- **PageFileLocation** The storage location (directory path) of the Windows Page file.
+- **PageFilePeakSize** The maximum amount of hard disk space used by the Windows Page file, measured in Megabytes.
+- **PluginName** The name of the plug-in specified for each generic plug-in event.
+- **RanCleanup** TRUE if the plug-in ran disk cleanup.
+- **RemediationBatteryPowerBatteryLevel** Indicates the battery level at which it is acceptable to continue operation.
+- **RemediationBatteryPowerExitDueToLowBattery** True when we exit due to low battery power.
+- **RemediationBatteryPowerOnBattery** True if we allow execution on battery.
+- **RemediationConfigurationTroubleshooterExecuted** True/False based on whether the Remediation Configuration Troubleshooter executed successfully.
+- **RemediationConfigurationTroubleshooterIpconfigFix** TRUE if IPConfig Fix completed successfully.
+- **RemediationConfigurationTroubleshooterNetShFix** TRUE if network card cache reset ran successfully.
+- **RemediationDiskCleanSizeBtWindowsFolderInMegabytes** The size of the Windows BT folder (used to store Windows upgrade files), measured in Megabytes.
+- **RemediationDiskCleanupBTFolderEsdSizeInMB** The size of the Windows BT folder (used to store Windows upgrade files) ESD (Electronic Software Delivery), measured in Megabytes.
+- **RemediationDiskCleanupGetCurrentEsdSizeInMB** The size of any existing ESD (Electronic Software Delivery) folder, measured in Megabytes.
+- **RemediationDiskCleanupSearchFileSizeInMegabytes** The size of the Cleanup Search index file, measured in Megabytes.
+- **RemediationDiskCleanupUpdateAssistantSizeInMB** The size of the Update Assistant folder, measured in Megabytes.
+- **RemediationDoorstopChangeSucceeded** TRUE if Doorstop registry key was successfully modified.
+- **RemediationDoorstopExists** TRUE if there is a One Settings Doorstop value.
+- **RemediationDoorstopRegkeyError** TRUE if an error occurred accessing the Doorstop registry key.
+- **RemediationDRFKeyDeleteSucceeded** TRUE if the RecoveredFrom (Doorstop) registry key was successfully deleted.
+- **RemediationDUABuildNumber** The build number of the DUA.
+- **RemediationDUAKeyDeleteSucceeded** TRUE if the UninstallActive registry key was successfully deleted.
+- **RemediationDuplicateTokenSucceeded** TRUE if the user token was successfully duplicated.
+- **remediationExecution** Remediation shell is in "applying remediation" state.
+- **RemediationHibernationMigrated** TRUE if hibernation was migrated.
+- **RemediationHibernationMigrationSucceeded** TRUE if hibernation migration succeeded.
+- **RemediationImpersonateUserSucceeded** TRUE if the user was successfully impersonated.
+- **RemediationNoisyHammerTaskKickOffIsSuccess** TRUE if the NoisyHammer task started successfully.
+- **RemediationQueryTokenSucceeded** TRUE if the user token was successfully queried.
+- **RemediationRanHibernation** TRUE if the system entered Hibernation.
+- **RemediationRevertToSystemSucceeded** TRUE if reversion to the system context succeeded.
+- **RemediationShellHasUpgraded** TRUE if the device upgraded.
+- **RemediationShellMinimumTimeBetweenShellRuns** Indicates the time between shell runs exceeded the minimum required to execute plugins.
+- **RemediationShellRunFromService** TRUE if the shell driver was run from the service.
+- **RemediationShellSessionIdentifier** Unique identifier tracking a shell session.
+- **RemediationShellSessionTimeInSeconds** Indicates the time the shell session took in seconds.
+- **RemediationShellTaskDeleted** Indicates that the shell task has been deleted so no additional sediment pack runs occur for this installation.
+- **RemediationUpdateServiceHealthRemediationResult** The result of the Update Service Health plug-in.
+- **RemediationUpdateTaskHealthRemediationResult** The result of the Update Task Health plug-in.
+- **RemediationUpdateTaskHealthTaskList** A list of tasks fixed by the Update Task Health plug-in.
+- **RemediationWindowsLogSpaceFound** The size of the Windows log files found, measured in Megabytes.
+- **RemediationWindowsLogSpaceFreed** The amount of disk space freed by deleting the Windows log files, measured in Megabytes.
+- **RemediationWindowsSecondaryDriveFreeSpace** The amount of free space on the secondary drive, measured in Megabytes.
+- **RemediationWindowsSecondaryDriveLetter** The letter designation of the first secondary drive with a total capacity of 10GB or more.
+- **RemediationWindowsSecondaryDriveTotalSpace** The total storage capacity of the secondary drive, measured in Megabytes.
+- **RemediationWindowsTotalSystemDiskSize** The total storage capacity of the System Disk Drive, measured in Megabytes.
+- **Result** The HRESULT for Detection or Perform Action phases of the plug-in.
+- **RunResult** The HRESULT for Detection or Perform Action phases of the plug-in.
+- **ServiceHealthPlugin** The nae of the Service Health plug-in.
+- **StartComponentCleanupTask** TRUE if the Component Cleanup task started successfully.
+- **systemDriveFreeDiskSpace** Indicates the free disk space on system drive in MBs.
+- **systemUptimeInHours** Indicates the amount of time the system in hours has been on since the last boot.
+- **TotalSizeofOrphanedInstallerFilesInMegabytes** The size of any orphaned Windows Installer files, measured in Megabytes.
+- **TotalSizeofStoreCacheAfterCleanupInMegabytes** The size of the Windows Store cache after cleanup, measured in Megabytes.
+- **TotalSizeofStoreCacheBeforeCleanupInMegabytes** The size of the Windows Store cache (prior to cleanup), measured in Megabytes.
+- **uninstallActive** TRUE if previous uninstall has occurred for current OS
+- **usoScanDaysSinceLastScan** The number of days since the last USO (Update Session Orchestrator) scan.
+- **usoScanInProgress** TRUE if a USO (Update Session Orchestrator) scan is in progress, to prevent multiple simultaneous scans.
+- **usoScanIsAllowAutoUpdateKeyPresent** TRUE if the AllowAutoUpdate registry key is set.
+- **usoScanIsAllowAutoUpdateProviderSetKeyPresent** TRUE if AllowAutoUpdateProviderSet registry key is set.
+- **usoScanIsAuOptionsPresent** TRUE if Auto Update Options registry key is set.
+- **usoScanIsFeatureUpdateInProgress** TRUE if a USO (Update Session Orchestrator) scan is in progress, to prevent multiple simultaneous scans.
+- **usoScanIsNetworkMetered** TRUE if the device is currently connected to a metered network.
+- **usoScanIsNoAutoUpdateKeyPresent** TRUE if no Auto Update registry key is set/present.
+- **usoScanIsUserLoggedOn** TRUE if the user is logged on.
+- **usoScanPastThreshold** TRUE if the most recent USO (Update Session Orchestrator) scan is past the threshold (late).
+- **usoScanType** The type of USO (Update Session Orchestrator) scan (Interactive or Background).
+- **windows10UpgraderBlockWuUpdates** Event to report the value of Windows 10 Upgrader BlockWuUpdates Key.
+- **windowsEditionId** Event to report the value of Windows Edition ID.
+- **WindowsHyberFilSysSizeInMegabytes** The size of the Windows Hibernation file, measured in Megabytes.
+- **WindowsInstallerFolderSizeInMegabytes** The size of the Windows Installer folder, measured in Megabytes.
+- **WindowsOldFolderSizeInMegabytes** The size of the Windows.OLD folder, measured in Megabytes.
+- **WindowsOldSpaceCleanedInMB** The amount of disk space freed by removing the Windows.OLD folder, measured in Megabytes.
+- **WindowsPageFileSysSizeInMegabytes** The size of the Windows Page file, measured in Megabytes.
+- **WindowsSoftwareDistributionFolderSizeInMegabytes** The size of the SoftwareDistribution folder, measured in Megabytes.
+- **WindowsSwapFileSysSizeInMegabytes** The size of the Windows Swap file, measured in Megabytes.
+- **WindowsSxsFolderSizeInMegabytes** The size of the WinSxS (Windows Side-by-Side) folder, measured in Megabytes.
+- **WindowsSxsTempFolderSizeInMegabytes** The size of the WinSxS (Windows Side-by-Side) Temp folder, measured in Megabytes.
+- **windowsUpgradeRecoveredFromRs4** Event to report the value of the Windows Upgrade Recovered key.
+
### Microsoft.Windows.Remediation.RemediationShellMainExeEventId
-Enables tracking the ID of a process that remediates issues preventing security and quality updates.
+Enables tracking of completion of process that remediates issues preventing security and quality updates.
The following fields are available:
-- **CV** Correlation vector.
-- **GlobalEventCounter** Client side counter which indicates ordering of events sent by the remediation system.
-- **PackageVersion** Current package version of Remediation.
-- **RemediationShellCanAcquireSedimentMutex** True if the remediation was able to acquire the sediment mutex. False if it is already running.
-- **RemediationShellExecuteShellResult** Indicates if the remediation system completed without errors.
-- **RemediationShellFoundDriverDll** Indicates whether the remediation system found its component files to run properly.
-- **RemediationShellLoadedShellDriver** Indicates whether the remediation system loaded its component files to run properly.
-- **RemediationShellLoadedShellFunction** Indicates whether the remediation system loaded the functions from its component files to run properly.
+- **CV** Client side counter which indicates ordering of events sent by the remediation system.
+- **GlobalEventCounter** Client side counter which indicates ordering of events sent by the remediation system.
+- **PackageVersion** Current package version of Remediation.
+- **RemediationShellCanAcquireSedimentMutex** True if the remediation was able to acquire the sediment mutex. False if it is already running.
+- **RemediationShellExecuteShellResult** Indicates if the remediation system completed without errors.
+- **RemediationShellFoundDriverDll** Result whether the remediation system found its component files to run properly.
+- **RemediationShellLoadedShellDriver** Result whether the remediation system loaded its component files to run properly.
+- **RemediationShellLoadedShellFunction** Result whether the remediation system loaded the functions from its component files to run properly.
+
### Microsoft.Windows.Remediation.Started
-Enables tracking the start of a process that remediates issues preventing security and quality updates.
+This event reports whether a plug-in started, to help ensure Windows is up to date.
The following fields are available:
-- **CV** Correlation vector.
-- **GlobalEventCounter** Client side counter which indicates ordering of events sent by the remediation system.
-- **PackageVersion** Current package version of Remediation.
-- **PluginName** Name of the specific remediation for each generic plugin event.
-- **Result** Results of the detection or perform action phases of the remediation system.
+- **CV** Correlation vector.
+- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user.
+- **PackageVersion** Current package version of Remediation.
+- **PluginName** Name of the plugin specified for each generic plugin event.
+- **Result** This is the HRESULT for detection or perform action phases of the plugin.
-## Sediment Service events
->[!NOTE]
->Events from this provider are sent with the installation of KB4023057 and any subsequent Windows update. For details, see [this support article](https://support.microsoft.com/help/4023057).
+## Sediment events
-### Microsoft.Windows.SedimentService.Applicable
+### Microsoft.Windows.Sediment.OSRSS.UrlState
-Indicates whether a given plugin is applicable.
+This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL.
The following fields are available:
-- **CV** Correlation vector.
-- **DetectedCondition** Boolean true if detect condition is true and perform action will be run.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **IsSelfUpdateEnabledInOneSettings** True/False based on whether self update is enabled.
-- **IsSelfUpdateNeeded** True/False based on whether a newer version is available.
-- **PackageVersion** Version of the package.
-- **PluginName** Name of the plugin specified for each generic plugin event.
-- **Result** This is the HRESULT for detection or perform action phases of the plugin.
+- **Id** A number identifying the URL
+- **ServiceVersionMajor** Version info for the component
+- **ServiceVersionMinor** Version info for the component
+- **StateData** State-specific data, such as which attempt number for the download
+- **StateNumber** A number identifying which state the URL is in (found, downloading, extracted, etc.)
+- **Time** System timestamp the event was fired
-### Microsoft.Windows.SedimentService.Completed
-
-Indicates whether a given plugin has completed its work.
-
-The following fields are available:
-
-- **CV** Correlation vector.
-- **FailedReasons** String reason for any plugin failures.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **PackageVersion** Current package version of Remediation.
-- **PluginName** Name of the plugin specified for each generic plugin event.
-- **Result** Result of the service execution.
-- **SedimentServiceCheckTaskFunctional** Result of checking if the scheduled task is functional.
-- **SedimentServiceCurrentBytes** Current number of bytes the service is consuming.
-- **SedimentServiceKillService** True/False based on whether the service should be stopped.
-- **SedimentServiceMaximumBytes** Maximum bytes the service can consume.
-- **SedimentServiceRetrievedKillService** True/False whether the kill service information was retrieved.
-- **SedimentServiceStopping** True/False indicating whether the service was found to be stopping.
-- **SedimentServiceTaskFunctional** True/False if scheduled task is functional. If task is not functional this indicates plugins will be run.
-- **SedimentServiceTotalIterations** Number of iterations service will wait before running again.
-
-### Microsoft.Windows.SedimentService.Error
-
-Indicates whether an error condition occurs in the plugin.
-
-The following fields are available:
-
-- **Message** String message containing information from the service.
-- **PackageVersion** Version of the package.
-- **HResult** Return value from the plugin result.
-
-### Microsoft.Windows.SedimentService.FallbackError
-
-Indicates whether an error occurs for a fallback in the plugin.
-
-The following fields are available:
-
-- **s0** Fallback error level.
-- **wilResult** Result for Windows Installer Logging function.
-
-### Microsoft.Windows.SedimentService.Information
-
-General information returned from the plugin.
-
-The following fields are available:
-
-- **HResult** Result of the plugin execution.
-- **Message** Information collected from the plugin based on the purpose of the plugin.
-- **PackageVersion** Version of the package.
-
-### Microsoft.Windows.SedimentService.Started
-
-Indicates that a given plugin has started.
-
-The following fields are available:
-
-- **CV** Correlation vector
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **PackageVersion** Version of the package.
-- **PluginName** Name of the plugin running.
-- **Result** Return code from the plugin result.
-
-### Microsoft.Windows.SedimentService.wilResult
-
-Result from the windows internal library.
-
-The following fields are available:
-
-- **callContext** List of telemetry activities containing this error.
-- **currentContextId** Identifier for the newest telemetry activity containing this error.
-- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any).
-- **currentContextName** Name of the newest telemetry activity containing this error.
-- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast.
-- **failureId** Identifier assigned to this failure.
-- **filename** The name of the source file where the error occurred.
-- **hresult** Failure error code.
-- **lineNumber** Line number within the source file where the error occurred.
-- **message** Custom message associated with the failure (if any).
-- **module** Name of the binary where the error occurred.
-- **originatingContextId** Identifier for the oldest telemetry activity containing this error.
-- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any).
-- **originatingContextName** Name of the oldest telemetry activity containing this error.
-- **threadId** Identifier of the thread the error occurred on.
-
-## Sediment Launcher events
-
->[!NOTE]
->Events from this provider are sent with the installation of KB4023057 and any subsequent Windows update. For details, see [this support article](https://support.microsoft.com/help/4023057).
### Microsoft.Windows.SedimentLauncher.Applicable
@@ -2969,14 +2976,15 @@ Indicates whether a given plugin is applicable.
The following fields are available:
-- **CV** Correlation vector.
-- **DetectedCondition** Boolean true if detect condition is true and action will be run.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **IsSelfUpdateEnabledInOneSettings** True/False based on whether self update is enabled.
-- **IsSelfUpdateNeeded** True/False based on whether a newer version is available.
-- **PackageVersion** Version of the package.
-- **PluginName** Name of the plugin specified for each generic plugin event.
-- **Result** This is the HRESULT for detection or perform action phases of the plugin.
+- **CV** Correlation vector.
+- **DetectedCondition** Boolean true if detect condition is true and perform action will be run.
+- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user.
+- **IsSelfUpdateEnabledInOneSettings** True if self update enabled in Settings.
+- **IsSelfUpdateNeeded** True if self update needed by device.
+- **PackageVersion** Current package version of Remediation.
+- **PluginName** Name of the plugin specified for each generic plugin event.
+- **Result** This is the HRESULT for detection or perform action phases of the plugin.
+
### Microsoft.Windows.SedimentLauncher.Completed
@@ -2984,13 +2992,14 @@ Indicates whether a given plugin has completed its work.
The following fields are available:
-- **CV** Correlation vector.
-- **FailedReasons** String reason for any plugin failures.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **PackageVersion** Current package version of Remediation.
-- **PluginName** Name of the plugin specified for each generic plugin event.
-- **Result** Result of the service execution.
-- **SedLauncherExecutionResult** Final result of launcher running the plugins from the dll.
+- **CV** Correlation vector.
+- **FailedReasons** Concatenated list of failure reasons.
+- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user.
+- **PackageVersion** Current package version of Remediation.
+- **PluginName** Name of the plugin specified for each generic plugin event.
+- **Result** This is the HRESULT for detection or perform action phases of the plugin.
+- **SedLauncherExecutionResult** HRESULT for one execution of the Sediment Launcher.
+
### Microsoft.Windows.SedimentLauncher.Error
@@ -2998,89 +3007,180 @@ Error occurred during execution of the plugin.
The following fields are available:
-- **Message** Information message returned from a plugin containing only information internal to plugin execution.
-- **PackageVersion** Version of the package.
-- **HResult** Return value from the plugin result.
+- **HResult** The result for the Detection or Perform Action phases of the plug-in.
+- **Message** A message containing information about the error that occurred (if any).
+- **PackageVersion** The version number of the current remediation package.
+
### Microsoft.Windows.SedimentLauncher.FallbackError
-Error occurred during execution of the plugin fallback.
+This event indicates that an error occurred during execution of the plug-in fallback.
The following fields are available:
-- **s0** Fallback error level for plugin.
-- **wilResult** Result from executing Windows Installer Logging based function.
+- **s0** Error occurred during execution of the plugin fallback. See [Microsoft.Windows.SedimentLauncher.wilResult](#microsoftwindowssedimentlauncherwilresult).
+- **wilResult** Result from executing wil based function. See [wilResult](#wilresult).
+
### Microsoft.Windows.SedimentLauncher.Information
-General information returned from the plugin.
+This event provides general information returned from the plug-in.
The following fields are available:
-- **HResult** Result of the plugin execution.
-- **Message** Information collected from the plugin based on the purpose of the plugin.
-- **PackageVersion** Version of the package.
+- **HResult** This is the HRESULT for detection or perform action phases of the plugin.
+- **Message** Information message returned from a plugin containing only information internal to the plugins execution.
+- **PackageVersion** Current package version of Remediation.
+
### Microsoft.Windows.SedimentLauncher.Started
-Indicates that a given plugin has started.
+This event indicates that a given plug-in has started.
The following fields are available:
-- **CV** Correlation vector.
-- **GlobalEventCounter** Client side counter which indicates ordering of events.
-- **PackageVersion** Version of the package.
-- **PluginName** Name of the plugin running.
-- **Result** Return code from the plugin result.
+- **CV** Correlation vector.
+- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user.
+- **PackageVersion** Current package version of Remediation.
+- **PluginName** Name of the plugin specified for each generic plugin event.
+- **Result** This is the HRESULT for detection or perform action phases of the plugin.
+
### Microsoft.Windows.SedimentLauncher.wilResult
-Result from the windows internal library.
+This event provides the result from the Windows internal library.
The following fields are available:
-- **callContext** List of telemetry activities containing this error.
-- **currentContextId** Identifier for the newest telemetry activity containing this error.
-- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any).
-- **currentContextName** Name of the newest telemetry activity containing this error.
-- **failurecount** Number of failures seen.
-- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast.
-- **failureId** Identifier assigned to this failure.
-- **filename** The name of the source file where the error occurred.
-- **function** Name of the function where the error occurred.
-- **hresult** Failure error code.
-- **lineNumber** Line number within the source file where the error occurred.
-- **message** Custom message associated with the failure (if any).
-- **module** Name of the binary where the error occurred.
-- **originatingContextId** Identifier for the oldest telemetry activity containing this error.
-- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any).
-- **originatingContextName** Name of the oldest telemetry activity containing this error.
-- **threadId** Identifier of the thread the error occurred on.
+- **callContext** List of telemetry activities containing this error.
+- **currentContextId** Identifier for the newest telemetry activity containing this error.
+- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any).
+- **currentContextName** Name of the newest telemetry activity containing this error.
+- **failureCount** Number of failures seen within the binary where the error occurred.
+- **failureId** Identifier assigned to this failure.
+- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast).
+- **fileName** Source code file name where the error occurred.
+- **function** Name of the function where the error occurred.
+- **hresult** Failure error code.
+- **lineNumber** Line number within the source code file where the error occurred.
+- **message** Custom message associated with the failure (if any).
+- **module** Name of the binary where the error occurred.
+- **originatingContextId** Identifier for the oldest telemetry activity containing this error.
+- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any).
+- **originatingContextName** Name of the oldest telemetry activity containing this error.
+- **threadId** Identifier of the thread the error occurred on.
+
+
+### Microsoft.Windows.SedimentService.Applicable
+
+This event indicates whether a given plug-in is applicable.
+
+The following fields are available:
+
+- **CV** Correlation vector.
+- **DetectedCondition** Determine whether action needs to run based on device properties.
+- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user.
+- **IsSelfUpdateEnabledInOneSettings** Indicates if self update is enabled in One Settings.
+- **IsSelfUpdateNeeded** Indicates if self update is needed.
+- **PackageVersion** Current package version of Remediation.
+- **PluginName** Name of the plugin.
+- **Result** This is the HRESULT for detection or perform action phases of the plugin.
+
+
+### Microsoft.Windows.SedimentService.Completed
+
+This event indicates whether a given plug-in has completed its work.
+
+The following fields are available:
+
+- **CV** Correlation vector.
+- **FailedReasons** List of reasons when the plugin action failed.
+- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user.
+- **PackageVersion** Current package version of Remediation.
+- **PluginName** Name of the plugin specified for each generic plugin event.
+- **Result** This is the HRESULT for detection or perform action phases of the plugin.
+- **SedimentServiceCheckTaskFunctional** True/False if scheduled task check succeeded.
+- **SedimentServiceCurrentBytes** Number of current private bytes of memory consumed by sedsvc.exe.
+- **SedimentServiceKillService** True/False if service is marked for kill (Shell.KillService).
+- **SedimentServiceMaximumBytes** Maximum bytes allowed for the service.
+- **SedimentServiceRetrievedKillService** True/False if result of One Settings check for kill succeeded - we only send back one of these indicators (not for each call).
+- **SedimentServiceStopping** True/False indicating whether the service is stopping.
+- **SedimentServiceTaskFunctional** True/False if scheduled task is functional. If task is not functional this indicates plugins will be run.
+- **SedimentServiceTotalIterations** Number of 5 second iterations service will wait before running again.
+
+
+### Microsoft.Windows.SedimentService.Error
+
+This event indicates whether an error condition occurred in the plug-in.
+
+The following fields are available:
+
+- **HResult** This is the HRESULT for detection or perform action phases of the plugin.
+- **Message** Custom message associated with the failure (if any).
+- **PackageVersion** Current package version of Remediation.
+
+
+### Microsoft.Windows.SedimentService.FallbackError
+
+This event indicates whether an error occurred for a fallback in the plug-in.
+
+The following fields are available:
+
+- **s0** Event returned when an error occurs for a fallback in the plugin. See [Microsoft.Windows.SedimentService.wilResult](#microsoftwindowssedimentservicewilresult).
+- **wilResult** Result for wil based function. See [wilResult](#wilresult).
+
+
+### Microsoft.Windows.SedimentService.Information
+
+This event provides general information returned from the plug-in.
+
+The following fields are available:
+
+- **HResult** This is the HRESULT for detection or perform action phases of the plugin.
+- **Message** Custom message associated with the failure (if any).
+- **PackageVersion** Current package version of Remediation.
+
+
+### Microsoft.Windows.SedimentService.Started
+
+This event indicates a specified plug-in has started. This information helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **CV** The Correlation Vector.
+- **GlobalEventCounter** The client-side counter that indicates ordering of events.
+- **PackageVersion** The version number of the current remediation package.
+- **PluginName** Name of the plugin specified for each generic plugin event.
+- **Result** This is the HRESULT for Detection or Perform Action phases of the plugin.
+
+
+### Microsoft.Windows.SedimentService.wilResult
+
+This event provides the result from the Windows internal library.
+
+The following fields are available:
+
+- **callContext** List of telemetry activities containing this error.
+- **currentContextId** Identifier for the newest telemetry activity containing this error.
+- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any).
+- **currentContextName** Name of the newest telemetry activity containing this error.
+- **failureCount** Number of failures seen within the binary where the error occurred.
+- **failureId** Identifier assigned to this failure.
+- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast).
+- **fileName** Source code file name where the error occurred.
+- **function** Name of the function where the error occurred.
+- **hresult** Failure error code.
+- **lineNumber** Line number within the source code file where the error occurred.
+- **message** Custom message associated with the failure (if any).
+- **module** Name of the binary where the error occurred.
+- **originatingContextId** Identifier for the oldest telemetry activity containing this error.
+- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any).
+- **originatingContextName** Name of the oldest telemetry activity containing this error.
+- **threadId** Identifier of the thread the error occurred on.
+
## Setup events
-### SetupPlatformTel.SetupPlatformTelActivityStarted
-
-This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date.
-
-The following fields are available:
-
-- **Name** The name of the dynamic update type. Example: GDR driver
-
-
-### SetupPlatformTel.SetupPlatformTelActivityEvent
-
-This event sends basic metadata about the SetupPlatform update installation process, to help keep Windows up-to-date
-
-The following fields are available:
-
-- **ActivityId** Provides a unique Id to correlate events that occur between a activity start event, and a stop event
-- **ActivityName** Provides a friendly name of the package type that belongs to the ActivityId (Setup, LanguagePack, GDR, Driver, etc.)
-- **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc.
-- **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc.
-- **value** Value associated with the corresponding event name. For example, time-related events will include the system time
-
-
### SetupPlatformTel.SetupPlatformTelEvent
This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios.
@@ -3088,21 +3188,22 @@ This service retrieves events generated by SetupPlatform, the engine that drives
The following fields are available:
- **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc.
-- **Value** Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time.
- **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc.
+- **Value** Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time.
## Shared PC events
### Microsoft.Windows.SharedPC.AccountManager.DeleteUserAccount
-Activity for deletion of a user account for devices set up for Shared PC mode as part of the Transient Account Manager to help keep Windows up to date. Deleting unused user accounts on shared devices frees up disk space to improve Windows Update success rates.
+Activity for deletion of a user account for devices set up for Shared PC mode as part of the Transient Account Manager to help keep Windows up to date. Deleting un-used user accounts on Education/Shared PCs frees up disk space to improve Windows Update success rates.
The following fields are available:
- **accountType** The type of account that was deleted. Example: AD, AAD, or Local
+- **deleteState** Whether the attempted deletion of the user account was successful.
- **userSid** The security identifier of the account.
-- **wilActivity** Windows Error Reporting data collected when there is a failure in deleting a user account with the Transient Account Manager.
+- **wilActivity** Windows Error Reporting data collected when there is a failure in deleting a user account with the Transient Account Manager. See [wilActivity](#wilactivity).
### Microsoft.Windows.SharedPC.AccountManager.SinglePolicyEvaluation
@@ -3111,129 +3212,232 @@ Activity for run of the Transient Account Manager that determines if any user ac
The following fields are available:
-- **wilActivity** Windows Error Reporting data collected when there is a failure in evaluating accounts to be deleted with the Transient Account Manager.
-- **totalAccountCount** The number of accounts on a device after running the Transient Account Manager policies.
- **evaluationTrigger** When was the Transient Account Manager policies ran? Example: At log off or during maintenance hours
+- **totalAccountCount** The number of accounts on a device after running the Transient Account Manager policies.
+- **wilActivity** Windows Error Reporting data collected when there is a failure in evaluating accounts to be deleted with the Transient Account Manager. See [wilActivity](#wilactivity).
+
+
+### wilActivity
+
+This event provides a Windows Internal Library context used for Product and Service diagnostics.
+
+The following fields are available:
+
+- **callContext** The function where the failure occurred.
+- **currentContextId** The ID of the current call context where the failure occurred.
+- **currentContextMessage** The message of the current call context where the failure occurred.
+- **currentContextName** The name of the current call context where the failure occurred.
+- **failureCount** The number of failures for this failure ID.
+- **failureId** The ID of the failure that occurred.
+- **failureType** The type of the failure that occurred.
+- **fileName** The file name where the failure occurred.
+- **function** The function where the failure occurred.
+- **hresult** The HResult of the overall activity.
+- **lineNumber** The line number where the failure occurred.
+- **message** The message of the failure that occurred.
+- **module** The module where the failure occurred.
+- **originatingContextId** The ID of the originating call context that resulted in the failure.
+- **originatingContextMessage** The message of the originating call context that resulted in the failure.
+- **originatingContextName** The name of the originating call context that resulted in the failure.
+- **threadId** The ID of the thread on which the activity is executing.
+
+
+### wilResult
+
+This event provides a Windows Internal Library context used for Product and Service diagnostics.
+
+The following fields are available:
+
+- **callContext** The call context stack where failure occurred.
+- **currentContextId** The ID of the current call context where the failure occurred.
+- **currentContextMessage** The message of the current call context where the failure occurred.
+- **currentContextName** The name of the current call context where the failure occurred.
+- **failureCount** The number of failures for this failure ID.
+- **failureId** The ID of the failure that occurred.
+- **failureType** The type of the failure that occurred.
+- **fileName** The file name where the failure occurred.
+- **function** The function where the failure occurred.
+- **hresult** The HResult of the overall activity.
+- **lineNumber** The line number where the failure occurred.
+- **message** The message of the failure that occurred.
+- **module** The module where the failure occurred.
+- **originatingContextId** The ID of the originating call context that resulted in the failure.
+- **originatingContextMessage** The message of the originating call context that resulted in the failure.
+- **originatingContextName** The name of the originating call context that resulted in the failure.
+- **threadId** The ID of the thread on which the activity is executing.
+
+
+## SIH events
+
+### SIHEngineTelemetry.EvalApplicability
+
+This event is sent when targeting logic is evaluated to determine if a device is eligible a given action.
+
+The following fields are available:
+
+- **ActionReasons** If an action has been assessed as inapplicable, the additional logic prevented it.
+- **CachedEngineVersion** The engine DLL version that is being used.
+- **EventInstanceID** A unique identifier for event instance.
+- **EventScenario** Indicates the purpose of sending this event – whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **HandlerReasons** If an action has been assessed as inapplicable, the installer technology-specific logic prevented it.
+- **ServiceGuid** A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Windows Store, etc.)
+- **StandardReasons** If an action has been assessed as inapplicable, the standard logic the prevented it.
+- **StatusCode** Result code of the event (success, cancellation, failure code HResult).
+- **UpdateID** A unique identifier for the action being acted upon.
+- **WUDeviceID** The unique identifier controlled by the software distribution client.
+
+
+### SIHEngineTelemetry.ExecuteAction
+
+This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot.
+
+The following fields are available:
+
+- **CachedEngineVersion** The engine DLL version that is being used.
+- **EventInstanceID** A unique identifier for event instance.
+- **EventScenario** Indicates the purpose of sending this event, whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **RebootRequired** Indicates if a reboot was required to complete the action.
+- **ServiceGuid** A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Windows Store, etc.).
+- **StatusCode** Result code of the event (success, cancellation, failure code HResult).
+- **UpdateID** A unique identifier for the action being acted upon.
+- **WUDeviceID** The unique identifier controlled by the software distribution client.
+
+
+### SIHEngineTelemetry.PostRebootReport
+
+This event reports the status of an action following a reboot, should one have been required.
+
+The following fields are available:
+
+- **CachedEngineVersion** The engine DLL version that is being used.
+- **EventInstanceID** A unique identifier for event instance.
+- **EventScenario** Indicates the purpose of sending this event, whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **ServiceGuid** A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Windows Store, etc.).
+- **StatusCode** Result code of the event (success, cancellation, failure code HResult).
+- **UpdateID** A unique identifier for the action being acted upon.
+- **WUDeviceID** The unique identifier controlled by the software distribution client.
+
+
+### SIHEngineTelemetry.ServiceStateChange
+
+This event reports the status of attempts to stop or start a service as part of executing an action.
+
+The following fields are available:
+
+- **CachedEngineVersion** The engine DLL version that is being used.
+- **EventInstanceID** A unique identifier for event instance.
+- **EventScenario** Indicates the purpose of sending this event, whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **Service** The service that is being stopped/started.
+- **ServiceGuid** A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Windows Store, etc.).
+- **StateChange** The service operation (stop/start) is being attempted.
+- **StatusCode** Result code of the event (success, cancellation, failure code HResult).
+- **UpdateID** A unique identifier for the action being acted upon.
+- **WUDeviceID** The unique identifier controlled by the software distribution client.
+
+
+### SIHEngineTelemetry.SLSActionData
+
+This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated.
+
+The following fields are available:
+
+- **CachedEngineVersion** The engine DLL version that is being used.
+- **EventInstanceID** A unique identifier for event instance.
+- **EventScenario** Indicates the purpose of sending this event – whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **FailedParseActions** The list of actions that were not successfully parsed.
+- **ParsedActions** The list of actions that were successfully parsed.
+- **ServiceGuid** A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Windows Store, etc.)
+- **WUDeviceID** The unique identifier controlled by the software distribution client.
## Software update events
-### SoftwareUpdateClientTelemetry.UpdateDetected
+### SoftwareUpdateClientTelemetry.CheckForUpdates
-This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates.
+Scan process event on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded)
The following fields are available:
+- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion.
+- **AllowCachedResults** Indicates if the scan allowed using cached results.
- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
-- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
-- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **WUDeviceID** The unique device ID controlled by the software distribution client
-- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
-- **ServiceGuid** An ID which represents which service the software distribution client is connecting to (Windows Update, Microsoft Store, etc.)
-
-
-### SoftwareUpdateClientTelemetry.SLSDiscovery
-
-This event sends data about the ability of Windows to discover the location of a backend server with which it must connect to perform updates or content acquisition, in order to determine disruptions in availability of update services and provide context for Windows Update errors.
-
-The following fields are available:
-
-- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
-- **HResult** Indicates the result code of the event (success, cancellation, failure code HResult)
-- **IsBackground** Indicates whether the SLS discovery event took place in the foreground or background
-- **NextExpirationTime** Indicates when the SLS cab expires
-- **ServiceID** An ID which represents which service the software distribution client is connecting to (Windows Update, Microsoft Store, etc.)
-- **SusClientId** The unique device ID controlled by the software distribution client
-- **UrlPath** Path to the SLS cab that was downloaded
-- **WUAVersion** The version number of the software distribution client
-
-
-### SoftwareUpdateClientTelemetry.Commit
-
-This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date.
-
-The following fields are available:
-
- **BiosFamily** The family of the BIOS (Basic Input Output System).
- **BiosName** The name of the device BIOS.
- **BiosReleaseDate** The release date of the device BIOS.
- **BiosSKUNumber** The sku number of the device BIOS.
- **BIOSVendor** The vendor of the BIOS.
- **BiosVersion** The version of the BIOS.
-- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
+- **BranchReadinessLevel** The servicing branch configured on the device.
+- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
+- **CapabilityDetectoidGuid** The GUID for a hardware applicability detectoid that could not be evaluated.
+- **CDNCountryCode** Two letter country abbreviation for the Content Distribution Network (CDN) location.
+- **CDNId** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
- **ClientVersion** The version number of the software distribution client.
+- **Context** Gives context on where the error has occurred. Example: AutoEnable, GetSLSData, AddService, Misc, or Unknown
+- **CurrentMobileOperator** The mobile operator the device is currently connected to.
+- **DeferralPolicySources** Sources for any update deferral policies defined (GPO = 0x10, MDM = 0x100, Flight = 0x1000, UX = 0x10000).
+- **DeferredUpdates** Update IDs which are currently being deferred until a later time
- **DeviceModel** What is the device model.
+- **DriverError** The error code hit during a driver scan. This is 0 if no error was encountered.
+- **DriverExclusionPolicy** Indicates if the policy for not including drivers with Windows Update is enabled.
+- **DriverSyncPassPerformed** Were drivers scanned this time?
- **EventInstanceID** A globally unique identifier for event instance.
-- **EventScenario** State of call
-- **EventType** "Possible values are ""Child"", ""Bundle"", or ""Driver""."
-- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.)
-- **RevisionNumber** Unique revision number of Update
-- **ServerId** Identifier for the service to which the software distribution client is connecting, such as Windows Update and Microsoft Store.
+- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **ExtendedMetadataCabUrl** Hostname that is used to download an update.
+- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
+- **FailedUpdateGuids** The GUIDs for the updates that failed to be evaluated during the scan.
+- **FailedUpdatesCount** The number of updates that failed to be evaluated during the scan.
+- **FeatureUpdateDeferral** The deferral period configured for feature OS updates on the device (in days).
+- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
+- **FeatureUpdatePausePeriod** The pause duration configured for feature OS updates on the device (in days).
+- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
+- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
+- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
+- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
+- **IPVersion** Indicates whether the download took place over IPv4 or IPv6
+- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
+- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
+- **IsWUfBFederatedScanDisabled** Indicates if Windows Update for Business federated scan is disabled on the device.
+- **MetadataIntegrityMode** The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce
+- **MSIError** The last error that was encountered during a scan for updates.
+- **NetworkConnectivityDetected** Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6
+- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
+- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked
+- **NumberOfLoop** The number of round trips the scan required
+- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan
+- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan
+- **NumFailedMetadataSignatures** The number of metadata signatures checks which failed for new metadata synced down.
+- **Online** Indicates if this was an online scan.
+- **PausedUpdates** A list of UpdateIds which that currently being paused.
+- **PauseFeatureUpdatesEndTime** If feature OS updates are paused on the device, this is the date and time for the end of the pause time window.
+- **PauseFeatureUpdatesStartTime** If feature OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
+- **PauseQualityUpdatesEndTime** If quality OS updates are paused on the device, this is the date and time for the end of the pause time window.
+- **PauseQualityUpdatesStartTime** If quality OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
+- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced.
+- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
+- **QualityUpdateDeferral** The deferral period configured for quality OS updates on the device (in days).
+- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
+- **QualityUpdatePausePeriod** The pause duration configured for quality OS updates on the device (in days).
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
+- **ScanDurationInSeconds** The number of seconds a scan took
+- **ScanEnqueueTime** The number of seconds it took to initialize a scan
+- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Windows Store, etc.).
+- **ServiceUrl** The environment URL a device is configured to scan with
+- **ShippingMobileOperator** The mobile operator that a device shipped on.
+- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult).
+- **SyncType** Describes the type of scan the event was
- **SystemBIOSMajorRelease** Major version of the BIOS.
- **SystemBIOSMinorRelease** Minor version of the BIOS.
-- **UpdateId** Unique Update ID
-- **WUDeviceID** UniqueDeviceID
-- **BundleRevisionNumber** Identifies the revision number of the content bundle
-- **FlightId** The specific id of the flight the device is getting
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
-
-
-### SoftwareUpdateClientTelemetry.DownloadCheckpoint
-
-This event provides a checkpoint between each of the Windows Update download phases for UUP content
-
-The following fields are available:
-
-- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
-- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough
-- **FileId** A hash that uniquely identifies a file
-- **FileName** Name of the downloaded file
-- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult)
-- **EventType** "Possible values are ""Child"", ""Bundle"", ""Relase"" or ""Driver"""
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
-- **ClientVersion** The version number of the software distribution client
-- **FlightId** The unique identifier for each flight
-- **RevisionNumber** Unique revision number of Update
-- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.)
-- **UpdateId** Unique Update ID
-- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
-
-
-### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity
-
-This event identifies whether updates have been tampered with and protects against man-in-the-middle attacks.
-
-The following fields are available:
-
-- **EventScenario** The purpose of this event, such as scan started, scan succeeded, or scan failed.
-- **ExtendedStatusCode** The secondary status code of the event.
-- **LeafCertId** Integral ID from the FragmentSigning data for certificate that failed.
-- **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce
-- **MetadataSignature** A base64-encoded string of the signature associated with the update metadata (specified by revision ID).
-- **RevisionId** The revision ID for a specific piece of content.
-- **RevisionNumber** The revision number for a specific piece of content.
-- **ServiceGuid** Identifies the service to which the software distribution client is connected, Example: Windows Update or Microsoft Store
-- **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate.
-- **SHA256OfTimestampToken** A base64-encoded string of hash of the timestamp token blob.
-- **SignatureAlgorithm** The hash algorithm for the metadata signature.
-- **StatusCode** The status code of the event.
-- **TimestampTokenId** The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed.
-- **UpdateId** The update ID for a specific piece of content.
-- **TimestampTokenCertThumbprint** "The thumbprint of the encoded timestamp token. "
-- **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp.
-- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
-- **RawMode** The raw unparsed mode string from the SLS response. This field is null if not applicable.
-- **RawValidityWindowInDays** The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable.
-- **SHA256OfLeafCerData** A base64 encoding of the hash for the Base64CerData in the FragmentSigning data of the leaf certificate.
-- **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments.
-- **SLSPrograms** A test program to which a device may have opted in. Example: Insider Fast
+- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
+- **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down.
+- **WebServiceRetryMethods** Web service method requests that needed to be retried to complete operation.
+- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
### SoftwareUpdateClientTelemetry.Download
-This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date.
+Download process event for target update on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded)
The following fields are available:
@@ -3254,19 +3458,15 @@ The following fields are available:
- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
- **CbsDownloadMethod** Indicates whether the download was a full-file download or a partial/delta download.
-- **CDNCountryCode** Two letter country abbreviation for the CDN's location.
+- **CDNCountryCode** Two letter country abbreviation for the Content Distribution Network (CDN) location.
- **CDNId** ID which defines which CDN the software distribution client downloaded the content from.
-- **ClientManagedByWSUSServer** Indicates whether the client is managed by Windows Server Update Services (WSUS).
- **ClientVersion** The version number of the software distribution client.
- **CurrentMobileOperator** The mobile operator the device is currently connected to.
- **DeviceModel** What is the device model.
-- **DeviceOEM** What OEM does this device belong to.
- **DownloadPriority** Indicates whether a download happened at background, normal, or foreground priority.
- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
- **DownloadType** Differentiates the download type of SIH downloads between Metadata and Payload downloads.
-- **Edition** Indicates the edition of Windows being used.
- **EventInstanceID** A globally unique identifier for event instance.
-- **EventNamespaceID** Indicates whether the event succeeded or failed. Has the format EventType+Event where Event is Succeeded, Cancelled, Failed, etc.
- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started downloading content, or whether it was cancelled, succeeded, or failed.
- **EventType** Possible values are Child, Bundle, or Driver.
- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
@@ -3280,22 +3480,19 @@ The following fields are available:
- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
- **HostName** The hostname URL the content is downloading from.
- **IPVersion** Indicates whether the download took place over IPv4 or IPv6.
-- **IsAOACDevice** Is it Always On, Always Connected?
- **IsDependentSet** Indicates whether a driver is a part of a larger System Hardware/Firmware Update
- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
- **NetworkCostBitMask** Indicates what kind of network the device is connected to (roaming, metered, over data cap, etc.)
-- **NetworkRestrictionStatus** "More general version of NetworkCostBitMask, specifying whether Windows considered the current network to be ""metered."""
+- **NetworkRestrictionStatus** More general version of NetworkCostBitMask, specifying whether Windows considered the current network to be "metered."
- **PackageFullName** The package name of the content.
- **PhonePreviewEnabled** Indicates whether a phone was opted-in to getting preview builds, prior to flighting (pre-release builds) being introduced.
-- **PlatformRole** The PowerPlatformRole as defined on MSDN
- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
-- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM).
- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to download.
- **RevisionNumber** Identifies the revision number of this specific piece of content.
-- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Microsoft Store, etc.).
+- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Windows Store, etc.).
- **Setup360Phase** If the download is for an operating system upgrade, this datapoint indicates which phase of the upgrade is underway.
- **ShippingMobileOperator** The mobile operator that a device shipped on.
- **StatusCode** Indicates the result of a Download event (success, cancellation, failure code HResult).
@@ -3308,93 +3505,65 @@ The following fields are available:
- **TimeToEstablishConnection** Time (in ms) it took to establish the connection prior to beginning downloaded.
- **TotalExpectedBytes** The total count of bytes that the download is expected to be.
- **UpdateId** An identifier associated with the specific piece of content.
+- **UpdateID** An identifier associated with the specific piece of content.
- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
- **UsedDO** Whether the download used the delivery optimization service.
- **UsedSystemVolume** Indicates whether the content was downloaded to the device's main system storage drive, or an alternate storage drive.
- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **WUSetting** Indicates the users' current updating settings.
-### SoftwareUpdateClientTelemetry.CheckForUpdates
+### SoftwareUpdateClientTelemetry.DownloadCheckpoint
-This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date
+This event provides a checkpoint between each of the Windows Update download phases for UUP content
The following fields are available:
-- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion.
-- **AllowCachedResults** Indicates if the scan allowed using cached results.
-- **BiosFamily** The family of the BIOS (Basic Input Output System).
-- **BiosName** The name of the device BIOS.
-- **BiosReleaseDate** The release date of the device BIOS.
-- **BiosSKUNumber** The sku number of the device BIOS.
-- **BIOSVendor** The vendor of the BIOS.
-- **BiosVersion** The version of the BIOS.
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
-- **CapabilityDetectoidGuid** The GUID for a hardware applicability detectoid that could not be evaluated.
-- **CDNCountryCode** Two letter country abbreviation for the CDN's location.
-- **CDNId** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **ClientVersion** The version number of the software distribution client.
-- **CurrentMobileOperator** The mobile operator the device is currently connected to.
-- **DeviceModel** What is the device model.
-- **DriverError** The error code hit during a driver scan. This is 0 if no error was encountered.
-- **EventInstanceID** A globally unique identifier for event instance.
-- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
-- **ExtendedMetadataCabUrl** Hostname that is used to download an update.
-- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
-- **FailedUpdateGuids** The GUIDs for the updates that failed to be evaluated during the scan.
-- **FailedUpdatesCount** The number of updates that failed to be evaluated during the scan.
-- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
-- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
-- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
-- **IPVersion** Indicates whether the download took place over IPv4 or IPv6
-- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
-- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
-- **MetadataIntegrityMode** The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce
-- **MSIError** The last error that was encountered during a scan for updates.
-- **NetworkConnectivityDetected** Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6
-- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked
-- **NumberOfLoop** The number of round trips the scan required
-- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan
-- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan
-- **NumFailedMetadataSignatures** The number of metadata signatures checks which failed for new metadata synced down.
-- **Online** Indicates if this was an online scan.
-- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced.
-- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
+- **ClientVersion** The version number of the software distribution client
+- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
+- **EventType** Possible values are "Child", "Bundle", "Relase" or "Driver"
+- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough
+- **FileId** A hash that uniquely identifies a file
+- **FileName** Name of the downloaded file
+- **FlightId** The unique identifier for each flight
- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **ScanDurationInSeconds** The number of seconds a scan took
-- **ScanEnqueueTime** The number of seconds it took to initialize a scan
-- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.).
-- **ServiceUrl** The environment URL a device is configured to scan with
-- **ShippingMobileOperator** The mobile operator that a device shipped on.
-- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult).
-- **SyncType** Describes the type of scan the event was
-- **SystemBIOSMajorRelease** Major version of the BIOS.
-- **SystemBIOSMinorRelease** Minor version of the BIOS.
-- **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down.
-- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable
-- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
-- **WebServiceRetryMethods** Web service method requests that needed to be retried to complete operation.
-- **BranchReadinessLevel** The servicing branch configured on the device.
-- **DeferralPolicySources** Sources for any update deferral policies defined (GPO = 0x10, MDM = 0x100, Flight = 0x1000, UX = 0x10000).
-- **DeferredUpdates** Update IDs which are currently being deferred until a later time
-- **DriverExclusionPolicy** Indicates if the policy for not including drivers with Windows Update is enabled.
-- **FeatureUpdateDeferral** The deferral period configured for feature OS updates on the device (in days).
-- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
-- **FeatureUpdatePausePeriod** The pause duration configured for feature OS updates on the device (in days).
-- **QualityUpdateDeferral** The deferral period configured for quality OS updates on the device (in days).
-- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
-- **QualityUpdatePausePeriod** The pause duration configured for quality OS updates on the device (in days).
-- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
-- **PausedUpdates** A list of UpdateIds which that currently being paused.
-- **PauseFeatureUpdatesEndTime** If feature OS updates are paused on the device, this is the date and time for the end of the pause time window.
-- **PauseFeatureUpdatesStartTime** If feature OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
-- **PauseQualityUpdatesEndTime** If quality OS updates are paused on the device, this is the date and time for the end of the pause time window.
-- **PauseQualityUpdatesStartTime** If quality OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
-- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
-- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
-- **Context** Gives context on where the error has occurred. Example: AutoEnable, GetSLSData, AddService, Misc, or Unknown
-- **DriverSyncPassPerformed** Were drivers scanned this time?
+- **RevisionNumber** Unique revision number of Update
+- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.)
+- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult)
+- **UpdateId** Unique Update ID
+- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
+
+
+### SoftwareUpdateClientTelemetry.DownloadHeartbeat
+
+This event allows tracking of ongoing downloads and contains data to explain the current state of the download
+
+The following fields are available:
+
+- **BundleID** Identifier associated with the specific content bundle. If this value is found, it shouldn't report as all zeros
+- **BytesTotal** Total bytes to transfer for this content
+- **BytesTransferred** Total bytes transferred for this content at the time of heartbeat
+- **CallerApplicationName** Name provided by the caller who initiated API calls into the software distribution client
+- **ClientVersion** The version number of the software distribution client
+- **ConnectionStatus** Indicates the connectivity state of the device at the time of heartbeat
+- **CurrentError** Last (transient) error encountered by the active download
+- **DownloadFlags** Flags indicating if power state is ignored
+- **DownloadState** Current state of the active download for this content (queued, suspended, or progressing)
+- **EventType** Possible values are "Child", "Bundle", or "Driver"
+- **FlightId** The unique identifier for each flight
+- **IsNetworkMetered** Indicates whether Windows considered the current network to be ?metered"
+- **MOAppDownloadLimit** Mobile operator cap on size of application downloads, if any
+- **MOUpdateDownloadLimit** Mobile operator cap on size of operating system update downloads, if any
+- **PowerState** Indicates the power state of the device at the time of heartbeart (DC, AC, Battery Saver, or Connected Standby)
+- **RelatedCV** The previous correlation vector that was used by the client, before swapping with a new one
+- **ResumeCount** Number of times this active download has resumed from a suspended state
+- **RevisionNumber** Identifies the revision number of this specific piece of content
+- **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Windows Store, etc)
+- **ServiceID** Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc)
+- **SuspendCount** Number of times this active download has entered a suspended state
+- **SuspendReason** Last reason for why this active download entered a suspended state
+- **UpdateId** Identifier associated with the specific piece of content
+- **WUDeviceID** Unique device id controlled by the software distribution client
### SoftwareUpdateClientTelemetry.Install
@@ -3409,30 +3578,22 @@ The following fields are available:
- **BiosSKUNumber** The sku number of the device BIOS.
- **BIOSVendor** The vendor of the BIOS.
- **BiosVersion** The version of the BIOS.
-- **BundleBytesDownloaded** How many bytes were downloaded for the specific content bundle?
- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
- **BundleRepeatFailFlag** Has this particular update bundle previously failed to install?
- **BundleRevisionNumber** Identifies the revision number of the content bundle.
- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
-- **CbsDownloadMethod** Was the download a full download or a partial download?
-- **ClientManagedByWSUSServer** Is the client managed by Windows Server Update Services (WSUS)?
- **ClientVersion** The version number of the software distribution client.
- **CSIErrorType** The stage of CBS installation where it failed.
- **CurrentMobileOperator** Mobile operator that device is currently connected to.
- **DeviceModel** What is the device model.
-- **DeviceOEM** What OEM does this device belong to.
-- **DownloadPriority** The priority of the download activity.
-- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
- **DriverPingBack** Contains information about the previous driver and system state.
-- **Edition** Indicates the edition of Windows being used.
- **EventInstanceID** A globally unique identifier for event instance.
-- **EventNamespaceID** Indicates whether the event succeeded or failed. Has the format EventType+Event where Event is Succeeded, Cancelled, Failed, etc.
- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
- **EventType** Possible values are Child, Bundle, or Driver.
- **ExtendedErrorCode** The extended error code.
- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
-- **FeatureUpdatePause** Are feature OS updates paused on the device?
+- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
- **FlightBranch** The branch that a device is on if participating in the Windows Insider Program.
- **FlightBuildNumber** If this installation was for a Windows Insider build, this is the build number of that build.
- **FlightId** The specific ID of the Windows Insider build the device is getting.
@@ -3441,27 +3602,23 @@ The following fields are available:
- **HardwareId** If this install was for a driver targeted to a particular device model, this ID indicates the model of the device.
- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
-- **IsAOACDevice** Is it Always On, Always Connected? (Mobile device usage model)
- **IsDependentSet** Is the driver part of a larger System Hardware/Firmware update?
- **IsFinalOutcomeEvent** Does this event signal the end of the update/upgrade process?
- **IsFirmware** Is this update a firmware update?
- **IsSuccessFailurePostReboot** Did it succeed and then fail after a restart?
- **IsWUfBDualScanEnabled** Is Windows Update for Business dual scan enabled on the device?
-- **IsWUfBEnabled** Is Windows Update for Business enabled on the device?
+- **IsWUfBEnabled** Indicates whether Windows Update for Business is enabled on the device.
- **MergedUpdate** Was the OS update and a BSP update merged for installation?
- **MsiAction** The stage of MSI installation where it failed.
- **MsiProductCode** The unique identifier of the MSI installer.
- **PackageFullName** The package name of the content being installed.
- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting being introduced.
-- **PlatformRole** The PowerPlatformRole as defined on MSDN.
- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
-- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM).
- **QualityUpdatePause** Are quality OS updates paused on the device?
- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to install.
-- **RepeatSuccessInstallFlag** Indicates whether this specific piece of content had previously installed successful, for example if another user had already installed it.
- **RevisionNumber** The revision number of this specific piece of content.
-- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Microsoft Store, etc.).
+- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Windows Store, etc.).
- **Setup360Phase** If the install is for an operating system upgrade, indicates which phase of the upgrade is underway.
- **ShippingMobileOperator** The mobile operator that a device shipped on.
- **StatusCode** Indicates the result of an installation event (success, cancellation, failure code HResult).
@@ -3471,420 +3628,540 @@ The following fields are available:
- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
- **TransactionCode** The ID which represents a given MSI installation
- **UpdateId** Unique update ID
+- **UpdateID** An identifier associated with the specific piece of content.
- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
- **UsedSystemVolume** Indicates whether the content was downloaded and then installed from the device's main system storage drive, or an alternate storage drive.
- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **WUSetting** Indicates the user's current updating settings.
-### SoftwareUpdateClientTelemetry.DownloadHeartbeat
+### SoftwareUpdateClientTelemetry.UpdateDetected
-This event allows tracking of ongoing downloads and contains data to explain the current state of the download
+This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates.
The following fields are available:
-- **BundleID** Identifier associated with the specific content bundle. If this value is found, it shouldn't report as all zeros
-- **BytesTotal** Total bytes to transfer for this content
-- **BytesTransferred** Total bytes transferred for this content at the time of heartbeat
-- **ConnectionStatus** Indicates the connectivity state of the device at the time of heartbeat
-- **CurrentError** Last (transient) error encountered by the active download
-- **DownloadFlags** Flags indicating if power state is ignored
-- **DownloadState** Current state of the active download for this content (queued, suspended, or progressing)
-- **IsNetworkMetered** "Indicates whether Windows considered the current network to be ?metered"""
-- **MOAppDownloadLimit** Mobile operator cap on size of application downloads, if any
-- **MOUpdateDownloadLimit** Mobile operator cap on size of operating system update downloads, if any
-- **PowerState** Indicates the power state of the device at the time of heartbeart (DC, AC, Battery Saver, or Connected Standby)
-- **RelatedCV** "The previous correlation vector that was used by the client, before swapping with a new one "
-- **ResumeCount** Number of times this active download has resumed from a suspended state
-- **ServiceID** "Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc) "
-- **SuspendCount** Number of times this active download has entered a suspended state
-- **SuspendReason** Last reason for why this active download entered a suspended state
-- **CallerApplicationName** Name provided by the caller who initiated API calls into the software distribution client
-- **ClientVersion** The version number of the software distribution client
-- **EventType** "Possible values are ""Child"", ""Bundle"", or ""Driver"""
-- **FlightId** The unique identifier for each flight
-- **RevisionNumber** Identifies the revision number of this specific piece of content
-- **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc)
-- **UpdateId** "Identifier associated with the specific piece of content "
-- **WUDeviceID** "Unique device id controlled by the software distribution client "
+- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable.
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
+- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
+- **NumberOfApplicableUpdates** The number of updates ultimately deemed applicable to the system after the detection process is complete.
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one.
+- **ServiceGuid** An ID that represents which service the software distribution client is connecting to (Windows Update, Windows Store, etc.).
+- **WUDeviceID** The unique device ID controlled by the software distribution client.
-## Update Assistant Orchestrator events
->[!NOTE]
->Events from this provider are sent with the installation of KB4023814. For details, see [this support article](https://support.microsoft.com/help/4023814).
+### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity
+
+Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack.
+
+The following fields are available:
+
+- **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments.
+- **EventScenario** The purpose of this event, such as scan started, scan succeeded, or scan failed.
+- **ExtendedStatusCode** The secondary status code of the event.
+- **LeafCertId** Integral ID from the FragmentSigning data for certificate that failed.
+- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
+- **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce
+- **MetadataSignature** A base64-encoded string of the signature associated with the update metadata (specified by revision ID).
+- **RawMode** The raw unparsed mode string from the SLS response. This field is null if not applicable.
+- **RawValidityWindowInDays** The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable.
+- **RevisionId** The revision ID for a specific piece of content.
+- **RevisionNumber** The revision number for a specific piece of content.
+- **ServiceGuid** Identifies the service to which the software distribution client is connected, Example: Windows Update or Windows Store
+- **SHA256OfLeafCerData** A base64 encoding of the hash for the Base64CerData in the FragmentSigning data of the leaf certificate.
+- **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate.
+- **SHA256OfTimestampToken** A base64-encoded string of hash of the timestamp token blob.
+- **SignatureAlgorithm** The hash algorithm for the metadata signature.
+- **SLSPrograms** A test program to which a device may have opted in. Example: Insider Fast
+- **StatusCode** The status code of the event.
+- **TimestampTokenCertThumbprint** The thumbprint of the encoded timestamp token.
+- **TimestampTokenId** The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed.
+- **UpdateId** The update ID for a specific piece of content.
+- **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp.
+
+
+## Update Assistant events
### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId
-Event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies..
+The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies.
The following fields are available:
-- **ApplicabilityBlockedReason** Blocked due to an applicability issue.
-- **ClientId** Identification of the current installed version of Update Assistant.
-- **TriggerTaskSource** Describes which task launched this instance of Update Assistant.
+- **ApplicabilityBlockedReason** Blocked due to an applicability issue.
+- **BlockWuUpgrades** The upgrade assistant is currently blocked.
+- **clientID** An identification of the current release of Update Assistant.
+- **CloverTrail** This device is Clovertrail.
+- **DeviceIsMdmManaged** This device is MDM managed.
+- **IsNetworkAvailable** If the device network is not available.
+- **IsNetworkMetered** If network is metered.
+- **IsSccmManaged** This device is SCCM managed.
+- **NewlyInstalledOs** OS is newly installed quiet period.
+- **PausedByPolicy** Updates are paused by policy.
+- **RecoveredFromRS3** Previously recovered from RS3.
+- **RS1UninstallActive** Blocked due to an active RS1 uninstall.
+- **RS3RollBacks** Exceeded number of allowable RS3 rollbacks.
+- **triggerTaskSource** Describe which task launches this instance.
+- **WsusManaged** This device is WSUS managed.
+- **ZeroExhaust** This device is zero exhaust.
+
### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId
-Event sends basic info on the reason the Windows 10 update was blocked or prevented.
+The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version.
The following fields are available:
-- **ClientId** Identification of the current installed version of Update Assistant.
-- **DenyReason** Reasons why Update Assistant was prevented from launching.
-- **TriggerTaskSource** Describes which task launched this instance of Update Assistant.
+- **calendarRun** Indicates the calendar run task invoked the update assistant wrapper.
+- **clientID** An identification of the current release of Update Assistant.
+- **denyReason** All the reasons why the Update Assistant was prevented from launching. Bitmask with values from UpdateAssistant.cpp eUpgradeModeReason.
+- **triggerTaskSource** Describe which task launches this instance.
+
### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId
-Event sends basic info when the Windows 10 Update Assistant tool could not be launched due to an error..
+Event to mark that Update Assistant Orchestrator failed to launch Update Assistant.
The following fields are available:
-- **ClientId** Identification of the current installed version of Update Assistant.
-- **HResult** Error code of the Update Assistant Orchestrator error.
-- **TriggerTaskSource** Describes which task launched this instance of Update Assistant.
+- **clientID** An identification of the current release of Update Assistant.
+- **hResult** Error code of the Update Assistant Orchestrator failure.
+- **triggerTaskSource** Describe which task launches this instance.
+
### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId
-Event sends basic info to signal when the settings related to the Windows 10 update could not be downloaded.
+Event indicating One Settings was not queried by update assistant.
The following fields are available:
-- **ClientId** Identification of the current installed version of Update Assistant.
-- **HResult** Error code of the attempted query for the settings.
+- **clientID** An identification of the current release of Update Assistant.
+- **hResult** Error code of One Settings query failure.
+
### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId
-Event sends basic info on whether the device should or should not be updated to the latest Windows 10 version.
+This event sends basic information on whether the device should be updated to the latest Windows 10 version.
The following fields are available:
-- **ClientId** Identification of the current installed version of Update Assistant.
-- **LaunchMode** Type of launch performed.
-- **LaunchTypeReason** All of the reasons for the type of launch performed.
-- **TriggerTaskSource** Describes which task launched this instance of Update Assistant.
-- **UALaunchRunCount** Total number of times Update Assistant was launched.
+- **autoStartRunCount** The auto start run count of Update Assistant.
+- **clientID** The ID of the current release of Update Assistant.
+- **launchMode** Indicates the type of launch performed.
+- **launchTypeReason** A bitmask of all the reasons for type of launch.
+- **triggerTaskSource** Indicates which task launches this instance.
+- **UALaunchRunCount** Total number of times Update Assistant launched.
+
### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId
-Event sends basic info on whether the Windows 10 update notification had launched previously.
+The event sends basic info on whether the Windows 10 update notification has previously launched.
The following fields are available:
-- **ClientId** Identification of the current installed version of Update Assistant.
-- **RestoreReason** All of the reasons for being restored.
-- **TriggerTaskSource** Describes which task launched this instance of Update Assistant.
+- **calendarRun** Indicates the update assistant wrapper was started by the calendar run task.
+- **clientID** ID of the current release of Update Assistant.
+- **restoreReason** All the reasons for the restore.
+- **triggerTaskSource** Indicates which task launches this instance.
+
## Update events
-### Update360Telemetry.UpdateAgentPostRebootResult
+### Update360Telemetry.UpdateAgentCommit
-This event collects information for both Mobile and Desktop regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario
-
-The following fields are available:
-
-- **ErrorCode** The error code returned for the current post reboot phase
-- **FlightId** The unique identifier for each flight
-- **ObjectId** Unique value for each Update Agent mode
-- **RelatedCV** Correlation vector value generated from the latest USO scan
-- **Result** Indicates the Hresult
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **SessionId** Unique value for each Update Agent mode attempt
-- **UpdateId** Unique ID for each update
-- **PostRebootResult** Indicates the Hresult
-
-
-### Update360Telemetry.UpdateAgent_Initialize
-
-This event sends data during the initialize phase of updating Windows.
-
-The following fields are available:
-
-- **ErrorCode** The error code returned for the current initialize phase.
-- **FlightId** Unique ID for each flight.
-- **FlightMetadata** Contains the FlightId and the build being flighted.
-- **ObjectId** Unique value for each Update Agent mode.
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **SessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios).
-- **SessionId** Unique value for each Update Agent mode attempt .
-- **UpdateId** Unique ID for each update.
-- **Result** Result of the initialize phase of update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
-
-
-### Update360Telemetry.UpdateAgent_DownloadRequest
-
-This event sends data during the download request phase of updating Windows.
-
-The following fields are available:
-
-- **ErrorCode** The error code returned for the current download request phase.
-- **ObjectId** Unique value for each Update Agent mode.
-- **PackageCountOptional** Number of optional packages requested.
-- **PackageCountRequired** Number of required packages requested.
-- **PackageCountTotal** Total number of packages needed.
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **SessionId** Unique value for each Update Agent mode attempt.
-- **PackageSizeCanonical** Size of canonical packages in bytes
-- **PackageSizeDiff** Size of diff packages in bytes
-- **PackageSizeExpress** Size of express packages in bytes
-- **Result** Result of the download request phase of update.
-- **FlightId** Unique ID for each flight.
-- **UpdateId** Unique ID for each update.
-- **PackageCountTotalCanonical** Total number of canonical packages.
-- **PackageCountTotalDiff** Total number of diff packages.
-- **PackageCountTotalExpress** Total number of express packages.
-- **DeletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted.
-- **RangeRequestState** Represents the state of the download range request.
-
-
-### Update360Telemetry.UpdateAgent_Install
-
-This event sends data during the install phase of updating Windows.
+This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop.
The following fields are available:
- **ErrorCode** The error code returned for the current install phase.
-- **ObjectId** Unique value for each Update Agent mode.
-- **RelatedCV** Correlation vector value generated from the latest scan.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **SessionId** Unique value for each Update Agent mode attempt.
-- **Result** "Result of the install phase of update. 0 = Succeeded 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled "
- **FlightId** Unique ID for each flight.
+- **ObjectId** Unique value for each Update Agent mode.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **Result** Outcome of the install phase of the update.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each update attempt.
- **UpdateId** Unique ID for each update.
-### Update360Telemetry.UpdateAgent_ModeStart
+### Update360Telemetry.UpdateAgentDownloadRequest
-This event sends data for the start of each mode during the process of updating Windows.
+This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile.
The following fields are available:
-- **Mode** Indicates that the Update Agent mode that has started. 1 = Initialize, 2 = DownloadRequest, 3 = Install, 4 = Commit
-- **ObjectId** Unique value for each Update Agent mode.
-- **RelatedCV** The correlation vector value generated from the latest scan.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **SessionId** Unique value for each Update Agent mode attempt.
+- **DeletedCorruptFiles** Boolean indicating whether corrupt payload was deleted.
+- **DownloadRequests** Number of times a download was retried.
+- **ErrorCode** The error code returned for the current download request phase.
+- **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin.
- **FlightId** Unique ID for each flight.
-- **UpdateId** Unique ID for each update.
+- **InternalFailureResult** Indicates a non-fatal error from a plugin.
+- **ObjectId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360).
+- **PackageCountOptional** # of optional packages requested.
+- **PackageCountRequired** # of required packages requested.
+- **PackageCountTotal** Total # of packages needed.
+- **PackageCountTotalCanonical** Total number of canonical packages.
+- **PackageCountTotalDiff** Total number of diff packages.
+- **PackageCountTotalExpress** Total number of express packages.
+- **PackageExpressType** Type of express package.
+- **PackageSizeCanonical** Size of canonical packages in bytes.
+- **PackageSizeDiff** Size of diff packages in bytes.
+- **PackageSizeExpress** Size of express packages in bytes.
+- **RangeRequestState** Indicates the range request type used.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **Result** Outcome of the download request phase of update.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each attempt (same value for initialize, download, install commit phases).
+- **UpdateId** Unique ID for each Update.
-### Update360Telemetry.UpdateAgent_SetupBoxLaunch
+### Update360Telemetry.UpdateAgentExpand
-This event sends data during the launching of the setup box when updating Windows.
+This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop.
The following fields are available:
-- **ObjectId** Unique value for each Update Agent mode.
-- **Quiet** Indicates whether setup is running in quiet mode. 0 = false 1 = true
-- **RelatedCV** Correlation vector value generated from the latest scan.
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **SessionId** Unique value for each Update Agent mode attempt.
+- **ElapsedTickCount** Time taken for expand phase.
+- **EndFreeSpace** Free space after expand phase.
+- **EndSandboxSize** Sandbox size after expand phase.
+- **ErrorCode** The error code returned for the current install phase.
- **FlightId** Unique ID for each flight.
+- **ObjectId** Unique value for each Update Agent mode.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each update attempt.
+- **StartFreeSpace** Free space before expand phase.
+- **StartSandboxSize** Sandbox size after expand phase.
+- **UpdateId** Unique ID for each Update.
+
+
+### Update360Telemetry.UpdateAgentFellBackToCanonical
+
+This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop.
+
+The following fields are available:
+
+- **FlightId** Unique ID for each flight.
+- **ObjectId** Unique value for each Update Agent mode.
+- **PackageCount** Number of packages that feel back to canonical.
+- **PackageList** PackageIds which fell back to canonical.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each update attempt.
- **UpdateId** Unique ID for each update.
-- **SetupMode** Setup mode 1 = predownload, 2 = install, 3 = finalize
-- **SandboxSize** The size of the sandbox folder on the device.
+
+
+### Update360Telemetry.UpdateAgentInitialize
+
+This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile.
+
+The following fields are available:
+
+- **ErrorCode** The error code returned for the current install phase.
+- **FlightId** Unique ID for each flight.
+- **FlightMetadata** Contains the FlightId and the build being flighted.
+- **ObjectId** Unique value for each Update Agent mode.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **Result** Outcome of the install phase of the update.
+- **ScenarioId** Indicates the update scenario.
+- **SessionData** String containing instructions to update agent for processing FODs and DUICs (Null for other scenarios).
+- **SessionId** Unique value for each update attempt.
+- **UpdateId** Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentInstall
+
+This event sends data for the install phase of updating Windows.
+
+The following fields are available:
+
+- **ErrorCode** The error code returned for the current install phase.
+- **FlightId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360).
+- **ObjectId** Correlation vector value generated from the latest USO scan.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **Result** The result for the current install phase.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each update attempt.
+- **UpdateId** Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentMerge
+
+The UpdateAgentMerge event sends data on the merge phase when updating Windows.
+
+The following fields are available:
+
+- **ErrorCode** The error code returned for the current merge phase.
+- **FlightId** Unique ID for each flight.
+- **ObjectId** Unique value for each Update Agent mode.
+- **RelatedCV** Related correlation vector value.
+- **Result** Outcome of the merge phase of the update.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each attempt.
+- **UpdateId** Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentMitigationResult
+
+This event sends data indicating the result of each update agent mitigation.
+
+The following fields are available:
+
+- **Applicable** Indicates whether the mitigation is applicable for the current update.
+- **CommandCount** The number of command operations in the mitigation entry.
+- **CustomCount** The number of custom operations in the mitigation entry.
+- **FileCount** The number of file operations in the mitigation entry.
+- **FlightId** Unique identifier for each flight.
+- **Index** The mitigation index of this particular mitigation.
+- **MitigationScenario** The update scenario in which the mitigation was executed.
+- **Name** The friendly name of the mitigation.
+- **ObjectId** Unique value for each Update Agent mode.
+- **OperationIndex** The mitigation operation index (in the event of a failure).
+- **OperationName** The friendly name of the mitigation operation (in the event of failure).
+- **RegistryCount** The number of registry operations in the mitigation entry.
+- **RelatedCV** The correlation vector value generated from the latest USO scan.
+- **Result** The HResult of this operation.
+- **ScenarioId** The update agent scenario ID.
+- **SessionId** Unique value for each update attempt.
+- **TimeDiff** The amount of time spent performing the mitigation (in 100-nanosecond increments).
+- **UpdateId** Unique ID for each Update.
+
+
+### Update360Telemetry.UpdateAgentMitigationSummary
+
+This event sends a summary of all the update agent mitigations available for an this update.
+
+The following fields are available:
+
+- **Applicable** The count of mitigations that were applicable to the system and scenario.
+- **Failed** The count of mitigations that failed.
+- **FlightId** Unique identifier for each flight.
+- **MitigationScenario** The update scenario in which the mitigations were attempted.
+- **ObjectId** The unique value for each Update Agent mode.
+- **RelatedCV** The correlation vector value generated from the latest USO scan.
+- **Result** The HResult of this operation.
+- **ScenarioId** The update agent scenario ID.
+- **SessionId** Unique value for each update attempt.
+- **TimeDiff** The amount of time spent performing all mitigations (in 100-nanosecond increments).
+- **Total** Total number of mitigations that were available.
+- **UpdateId** Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentModeStart
+
+This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile.
+
+The following fields are available:
+
+- **FlightId** Unique ID for each flight.
+- **Mode** Indicates the mode that has started.
+- **ObjectId** Unique value for each Update Agent mode.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each update attempt.
+- **UpdateId** Unique ID for each update.
+- **Version** Version of update
+
+
+### Update360Telemetry.UpdateAgentPostRebootResult
+
+This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario.
+
+The following fields are available:
+
+- **ErrorCode** The error code returned for the current post reboot phase.
+- **FlightId** The specific ID of the Windows Insider build the device is getting.
+- **ObjectId** Unique value for each Update Agent mode.
+- **PostRebootResult** Indicates the Hresult.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **Result** Indicates the Hresult
+- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate.
+- **SessionId** Unique value for each update attempt.
+- **UpdateId** Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentSetupBoxLaunch
+
+The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs.
+
+The following fields are available:
+
+- **ContainsExpressPackage** Indicates whether the download package is express.
+- **FlightId** Unique ID for each flight.
+- **FreeSpace** Free space on OS partition.
+- **InstallCount** Number of install attempts using the same sandbox.
+- **ObjectId** Unique value for each Update Agent mode.
+- **Quiet** Indicates whether setup is running in quiet mode.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **SandboxSize** Size of the sandbox.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each update attempt.
+- **SetupMode** Mode of setup to be launched.
+- **UpdateId** Unique ID for each update.
+- **UserSession** Indicates whether install was invoked by user actions.
## Update notification events
### Microsoft.Windows.UpdateNotificationPipeline.JavascriptJavascriptCriticalGenericMessage
-This event indicates that Javascript is reporting a schema and a set of values for critical diagnostic data.
+This event indicates that Javascript is reporting a schema and a set of values for critical telemetry.
The following fields are available:
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Currently campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
+- **CampaignConfigVersion** Configuration version of the current campaign.
+- **CampaignID** ID of the currently running campaign.
+- **ConfigCatalogVersion** Current catalog version of the update notification.
+- **ContentVersion** Content version of the current update notification campaign.
+- **CV** Correlation vector.
+- **DetectorVersion** Most recently run detector version for the current campaign.
+- **GlobalEventCounter** Client side counter that indicates the ordering of events sent by this user.
- **key1** Interaction data for the UI
-- **key10** Interaction data for the UI
-- **key11** Interaction data for the UI
-- **key12** Interaction data for the UI
-- **key13** Interaction data for the UI
-- **key14** Interaction data for the UI
-- **key15** Interaction data for the UI
-- **key16** Interaction data for the UI
-- **key17** Interaction data for the UI
-- **key18** Interaction data for the UI
-- **key19** Interaction data for the UI
+- **key10** UI interaction data
+- **key11** UI interaction data
+- **key12** UI interaction data
+- **key13** UI interaction data
+- **key14** UI interaction data
+- **key15** UI interaction data
+- **key16** UI interaction data
+- **key17** UI interaction data
+- **key18** UI interaction data
+- **key19** UI interaction data
- **key2** Interaction data for the UI
-- **key20** Interaction data for the UI
+- **key20** UI interaction data
- **key21** Interaction data for the UI
-- **key22** Interaction data for the UI
-- **key23** Interaction data for the UI
-- **key24** Interaction data for the UI
-- **key25** Interaction data for the UI
-- **key26** Interaction data for the UI
-- **key27** Interaction data for the UI
-- **key28** Interaction data for the UI
-- **key29** Interaction data for the UI
+- **key22** UI interaction data
+- **key23** UI interaction data
+- **key24** UI interaction data
+- **key25** UI interaction data
+- **key26** UI interaction data
+- **key27** UI interaction data
+- **key28** UI interaction data
+- **key29** UI interaction data
- **key3** Interaction data for the UI
-- **key30** Interaction data for the UI
+- **key30** UI interaction data
- **key4** Interaction data for the UI
-- **key5** Interaction data for the UI
-- **key6** Interaction data for the UI
+- **key5** UI interaction data
+- **key6** UI interaction data
- **key7** Interaction data for the UI
- **key8** Interaction data for the UI
-- **key9** Interaction data for the UI
-- **PackageVersion** Current package version of UNP
-- **schema** Type of UI interaction
+- **key9** UI interaction data
+- **PackageVersion** Current package version of the update notification.
+- **schema** UI interaction type.
### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat
-This event is sent at the start of each campaign, to be used as a heartbeat
+This event is sent at the start of each campaign, to be used as a heartbeat.
The following fields are available:
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Currently campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **PackageVersion** Current UNP package version
+- **CampaignConfigVersion** Configuration version for the current campaign.
+- **CampaignID** Current campaign that is running on Update Notification Pipeline.
+- **ConfigCatalogVersion** Current catalog version of Update Notification Pipeline.
+- **ContentVersion** Content version for the current campaign on Update Notification Pipeline.
+- **CV** Correlation vector.
+- **DetectorVersion** Most recently run detector version for the current campaign on Update Notification Pipeline.
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user.
+- **PackageVersion** Current package version for Update Notification Pipeline.
### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerCleaningCampaign
-This event indicates that the Campaign Manager is cleaning up the campaign content
+This event indicates that the Campaign Manager is cleaning up the campaign content.
The following fields are available:
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Current campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
+- **CampaignConfigVersion** Configuration version for the current campaign.
+- **CampaignID** The current campaign that is running on Update Notification Pipeline (UNP).
+- **ConfigCatalogVersion** The current catalog version of the Update Notification Pipeline (UNP).
+- **ContentVersion** Content version for the current campaign on UNP.
- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **PackageVersion** Current UNP package version
+- **DetectorVersion** Most recently run detector version for the current campaign on UNP.
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user.
+- **PackageVersion** Current UNP package version.
### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerGetIsCamppaignCompleteFailed
-This event is sent when a campaign completion status query fails
+This event is sent when a campaign completion status query fails.
The following fields are available:
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Current campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **hresult** HRESULT of the failure
-- **PackageVersion** Current UNP package version
+- **CampaignConfigVersion** Configuration version for the current campaign.
+- **CampaignID** Current campaign that is running on Update Notification Pipeline (UNP).
+- **ConfigCatalogVersion** Current catalog version of UNP.
+- **ContentVersion** Content version for the current campaign on UNP.
+- **CV** Correlation vector.
+- **DetectorVersion** Most recently run detector version for the current campaign on UNP.
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user.
+- **hresult** HRESULT of the failure.
+- **PackageVersion** Current UNP package version.
### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat
-This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat
+This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat.
The following fields are available:
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Currently campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **PackageVersion** Current UNP package version
+- **CampaignConfigVersion** Configuration version for the current campaign.
+- **CampaignID** Currently campaign that is running on Update Notification Pipeline (UNP).
+- **ConfigCatalogVersion** Current catalog version of UNP.
+- **ContentVersion** Content version for the current campaign on UNP.
+- **CV** Correlation vector.
+- **DetectorVersion** Most recently run detector version for the current campaign on UNP.
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user.
+- **PackageVersion** Current UNP package version.
### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed
-This event is sent when the Campaign Manager encounters an unexpected error while running the campaign
+This event is sent when the Campaign Manager encounters an unexpected error while running the campaign.
The following fields are available:
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Currently campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **hresult** HRESULT of the failure#N#
-- **PackageVersion** Current UNP package version
+- **CampaignConfigVersion** Configuration version for the current campaign.
+- **CampaignID** Currently campaign that's running on Update Notification Pipeline (UNP).
+- **ConfigCatalogVersion** Current catalog version of UNP.
+- **ContentVersion** Content version for the current campaign on UNP.
+- **CV** Correlation vector.
+- **DetectorVersion** Most recently run detector version for the current campaign on UNP.
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user.
+- **hresult** HRESULT of the failure.
+- **PackageVersion** Current UNP package version.
## Upgrade events
-### Setup360Telemetry.PreDownloadUX
+### FacilitatorTelemetry.DCATDownload
-The event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.PredownloadUX indicates the outcome of the PredownloadUX portion of the update process.
+This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up-to-date and secure.
+
+
+
+### Setup360Telemetry.Downlevel
+
+This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up-to-date and secure.
The following fields are available:
-- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **HostOSBuildNumber** The build number of the previous operating system.
-- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system).
-- **InstanceId** Unique GUID that identifies each instance of setuphost.exe.
-- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type. Examplle: Boot, Media, Update, MCT
+- **ClientId** If using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but it can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the downlevel OS.
+- **HostOsSkuName** The operating system edition which is running Setup360 instance (downlevel OS).
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
+- **ReportId** In the Windows Update scenario, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Extended** More detailed information about phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360 (for example, Predownload, Install, Finalize, Rollback).
+- **Setup360Result** The result of Setup360 (HRESULT used to diagnose errors).
+- **Setup360Scenario** The Setup360 flow type (for example, Boot, Media, Update, MCT).
- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS).
-- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string to uniquely identify a group of events.
-- **WuId** Windows Update client ID.
-
-
-### Setup360Telemetry.UnexpectedEvent
-
-This event sends data indicating that the device has invoked the unexpected event phase of the upgrade, to help keep Windows up to date.
-
-The following fields are available:
-
-- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **HostOSBuildNumber** The build number of the previous OS.
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
-- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string to uniquely identify a group of events.
-- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
-
-
-### Setup360Telemetry.PreInstallQuiet
-
-This event sends data indicating that the device has invoked the preinstall quiet phase of the upgrade, to help keep Windows up to date.
-
-The following fields are available:
-
-- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **HostOSBuildNumber** The build number of the previous OS.
-- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
-- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback etc.
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
-- **Setup360Scenario** Setup360 flow type (Boot, Media, Update, MCT)
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string to uniquely identify a group of events.
-- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
+- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** An ID that uniquely identifies a group of events.
+- **WuId** This is the Windows Update Client ID. In the Windows Update scenario, this is the same as the clientId.
### Setup360Telemetry.Finalize
-This event sends data indicating that the device has invoked the finalize phase of the upgrade, to help keep Windows up-to-date.
+This event sends data indicating that the device has started the phase of finalizing the upgrade, to help keep Windows up-to-date and secure.
The following fields are available:
@@ -3893,19 +4170,40 @@ The following fields are available:
- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Extended** d
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string to uniquely identify a group of events.
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** ID that uniquely identifies a group of events.
- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
+### Setup360Telemetry.OsUninstall
+
+This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall.
+
+The following fields are available:
+
+- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
+- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
+- **Setup360Extended** Detailed information about the phase or action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** A string to uniquely identify a group of events.
+- **WuId** Windows Update client ID.
+
+
### Setup360Telemetry.PostRebootInstall
-This event sends data indicating that the device has invoked the postrebootinstall phase of the upgrade, to help keep Windows up-to-date.
+This event sends data indicating that the device has invoked the post reboot install phase of the upgrade, to help keep Windows up-to-date.
The following fields are available:
@@ -3933,63 +4231,63 @@ The following fields are available:
- **ClientId** Using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
- **HostOSBuildNumber** The build number of the previous OS.
- **HostOsSkuName** The OS edition which is running Setup360 instance (previous operating system).
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
- **ReportId** Using Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled
-- **TestId** A string to uniquely identify a group of events.
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled.
+- **TestId** ID that uniquely identifies a group of events.
- **WuId** This is the Windows Update Client ID. Using Windows Update, this is the same as the clientId.
-### Setup360Telemetry.OsUninstall
+### Setup360Telemetry.PreDownloadUX
-The event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.OSUninstall indicates the outcome of an OS uninstall.
+This event sends data regarding OS Updates and Upgrades from Windows 7.X, Windows 8.X, Windows 10 and RS, to help keep Windows up-to-date and secure. Specifically, it indicates the outcome of the PredownloadUX portion of the update process.
The following fields are available:
- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **HostOSBuildNumber** The build number of the previous OS.
-- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
+- **HostOSBuildNumber** The build number of the previous operating system.
+- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system).
+- **InstanceId** Unique GUID that identifies each instance of setuphost.exe.
- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS).
+- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled.
- **TestId** A string to uniquely identify a group of events.
- **WuId** Windows Update client ID.
-### Setup360Telemetry.Downlevel
+### Setup360Telemetry.PreInstallQuiet
-This event sends data indicating that the device has invoked the downlevel phase of the upgrade. It's used to help keep Windows up-to-date and secure.
+This event sends data indicating that the device has invoked the preinstall quiet phase of the upgrade, to help keep Windows up-to-date.
The following fields are available:
-- **ClientId** If using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but it can be overwritten by the caller to a unique value.
-- **HostOSBuildNumber** The build number of the downlevel OS.
-- **HostOsSkuName** The operating system edition which is running Setup360 instance (downlevel OS).
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
-- **ReportId** In the Windows Update scenario, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. It's an HRESULT error code that can be used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
-- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS).
-- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string that uniquely identifies a group of events.
-- **WuId** This is the Windows Update Client ID. In the Windows Update scenario, this is the same as the clientId.
+- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
+- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
+- **Setup360Scenario** Setup360 flow type (Boot, Media, Update, MCT).
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** A string to uniquely identify a group of events.
+- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
### Setup360Telemetry.PreInstallUX
-This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.PreinstallUX indicates the outcome of the PreinstallUX portion of the update process.
+This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10, to help keep Windows up-to-date. Specifically, it indicates the outcome of the PreinstallUX portion of the update process.
The following fields are available:
@@ -3998,12 +4296,12 @@ The following fields are available:
- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type, Example: Boot, Media, Update, MCT
+- **Setup360Scenario** The Setup360 flow type, Example: Boot, Media, Update, MCT.
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
- **TestId** A string to uniquely identify a group of events.
- **WuId** Windows Update client ID.
@@ -4014,37 +4312,56 @@ This event sends data about OS deployment scenarios, to help keep Windows up-to-
The following fields are available:
+- **ClientId** Retrieves the upgrade ID. In the Windows Update scenario, this will be the Windows Update client ID. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
- **FieldName** Retrieves the data point.
- **FlightData** Specifies a unique identifier for each group of Windows Insider builds.
- **InstanceId** Retrieves a unique identifier for each instance of a setup session.
- **ReportId** Retrieves the report ID.
- **ScenarioId** Retrieves the deployment scenario.
- **Value** Retrieves the value associated with the corresponding FieldName.
-- **ClientId** Retrieves the upgrade ID: Upgrades via Windows Update - specifies the WU clientID. All other deployment - static string.
-## Windows as a Service diagnostic events
+### Setup360Telemetry.Setup360DynamicUpdate
-### Microsoft.Windows.WaaSMedic.SummaryEvent
+This event helps determine whether the device received supplemental content during an operating system upgrade, to help keep Windows up-to-date.
-This event provides the results from the WaaSMedic engine
+
+
+### Setup360Telemetry.Setup360MitigationResult
+
+This event sends data indicating the result of each setup mitigation.
+
+
+
+### Setup360Telemetry.Setup360MitigationSummary
+
+This event sends a summary of all the setup mitigations available for this update.
+
+
+
+### Setup360Telemetry.UnexpectedEvent
+
+This event sends data indicating that the device has invoked the unexpected event phase of the upgrade, to help keep Windows up to date.
The following fields are available:
-- **detectionSummary** Result of each detection that ran
-- **featureAssessmentImpact** Windows as a Service (WaaS) Assessment impact on feature updates
-- **insufficientSessions** True, if the device has enough activity to be eligible for update diagnostics. False, if otherwise
-- **isManaged** Indicates the device is managed for updates
-- **isWUConnected** Indicates the device is connected to Windows Update
-- **noMoreActions** All available WaaSMedic diagnostics have run. There are no pending diagnostics and corresponding actions
-- **qualityAssessmentImpact** Windows as a Service (WaaS) Assessment impact for quality updates
-- **remediationSummary** Result of each operation performed on a device to fix an invalid state or configuration that's preventing the device from getting updates. For example, if Windows Update service is turned off, the fix is to turn the it back on
-- **usingBackupFeatureAssessment** The WaaSMedic engine contacts Windows as a Service (WaaS) Assessment to determine whether the device is up-to-date. If WaaS Assessment isn't available, the engine falls back to backup feature assessments, which are determined programmatically on the client#N#
-- **usingBackupQualityAssessment** The WaaSMedic engine contacts Windows as a Service (WaaS) Assessment to determine whether the device is up-to-date. If WaaS Assessment isn't available, the engine falls back to backup quality assessments, which are determined programmatically on the client#N#
-- **versionString** Installed version of the WaaSMedic engine
-- **hrEngineResult** Indicates the WaaSMedic engine operation error codes
+- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber** The build number of the previous OS.
+- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
+- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors.
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
+- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** A string to uniquely identify a group of events.
+- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
+## Windows as a Service diagnostic events
+
### Microsoft.Windows.WaaSMedic.Summary
This event provides the results of the WaaSMedic diagnostic run
@@ -4052,39 +4369,45 @@ This event provides the results of the WaaSMedic diagnostic run
The following fields are available:
- **detectionSummary** Result of each detection that ran
-- **remediationSummary** Result of each operation performed on a device to fix an invalid state or configuration that's preventing the device from getting updates. For example, if Windows Update service is turned off, the fix is to turn the it back on
-- **versionString** Installed version of the WaaSMedic engine
- **featureAssessmentImpact** Windows as a Service (WaaS) Assessment impact on feature updates
- **insufficientSessions** True, if the device has enough activity to be eligible for update diagnostics. False, if otherwise
- **isManaged** Indicates the device is managed for updates
- **isWUConnected** Indicates the device is connected to Windows Update
- **noMoreActions** All available WaaSMedic diagnostics have run. There are no pending diagnostics and corresponding actions
- **qualityAssessmentImpact** Windows as a Service (WaaS) Assessment impact for quality updates
+- **remediationSummary** Result of each operation performed on a device to fix an invalid state or configuration that's preventing the device from getting updates. For example, if Windows Update service is turned off, the fix is to turn the it back on
- **usingBackupFeatureAssessment** The WaaSMedic engine contacts Windows as a Service (WaaS) Assessment to determine whether the device is up-to-date. If WaaS Assessment isn't available, the engine falls back to backup feature assessments, which are determined programmatically on the client
- **usingBackupQualityAssessment** The WaaSMedic engine contacts Windows as a Service (WaaS) Assessment to determine whether the device is up-to-date. If WaaS Assessment isn't available, the engine falls back to backup quality assessments, which are determined programmatically on the client
+- **versionString** Installed version of the WaaSMedic engine
-## Windows Error Reporting events
+### Microsoft.Windows.WaaSMedic.SummaryEvent
-### Microsoft.Windows.WERVertical.OSCrash
-
-This event sends binary data from the collected dump file wheneveer a bug check occurs, to help keep Windows up to date. The is the OneCore version of this event.
+This event provides the results from the WaaSMedic engine
The following fields are available:
-- **BootId** Uint32 identifying the boot number for this device.
-- **BugCheckCode** "Uint64 ""bugcheck code"" that identifies a proximate cause of the bug check."
-- **BugCheckParameter1** Uint64 parameter providing additional information.
-- **BugCheckParameter2** Uint64 parameter providing additional information.
-- **BugCheckParameter3** Uint64 parameter providing additional information.
-- **BugCheckParameter4** Uint64 parameter providing additional information.
-- **DumpFileAttributes** Codes that identify the type of data contained in the dump file
-- **DumpFileSize** Size of the dump file
-- **IsValidDumpFile** True if the dump file is valid for the debugger, false otherwise
-- **ReportId** WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson).
+- **detectionSummary** Result of each applicable detection that was run.
+- **featureAssessmentImpact** WaaS Assessment impact for feature updates.
+- **hrEngineResult** Indicates the WaaSMedic engine operation error codes
+- **insufficientSessions** Device not eligible for diagnostics.
+- **isManaged** Device is managed for updates.
+- **isWUConnected** Device is connected to Windows Update.
+- **noMoreActions** No more applicable diagnostics.
+- **qualityAssessmentImpact** WaaS Assessment impact for quality updates.
+- **remediationSummary** Result of each operation performed on a device to fix an invalid state or configuration that's preventing the device from getting updates. For example, if Windows Update service is turned off, the fix is to turn the it back on.
+- **usingBackupFeatureAssessment** Relying on backup feature assessment.
+- **usingBackupQualityAssessment** Relying on backup quality assessment.
+- **versionString** Version of the WaaSMedic engine.
+
+
+## Windows Store events
+
+### Microsoft.Windows.Store.Partner.ReportApplication
+
+Report application event for Windows Store client.
-## Microsoft Store events
### Microsoft.Windows.StoreAgent.Telemetry.AbortedInstallation
@@ -4098,281 +4421,30 @@ The following fields are available:
- **CategoryId** The Item Category ID.
- **ClientAppId** The identity of the app that initiated this operation.
- **HResult** The result code of the last action performed before this operation.
-- **IntentPFNs** Intent Product Family Name
- **IsBundle** Is this a bundle?
- **IsInteractive** Was this requested by a user?
- **IsMandatory** Was this a mandatory update?
- **IsRemediation** Was this a remediation install?
- **IsRestore** Is this automatically restoring a previously acquired product?
- **IsUpdate** Flag indicating if this is an update.
-- **IsWin32** Flag indicating if this is a Win32 app (not used).
- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
- **PFN** The product family name of the product being installed.
- **ProductId** The identity of the package or packages being installed.
- **SystemAttemptNumber** The total number of automatic attempts at installation before it was canceled.
-- **UpdateId** Update ID (if this is an update)
- **UserAttemptNumber** The total number of user attempts at installation before it was canceled.
-- **WUContentId** The Windows Update content ID
+- **WUContentId** Licensing identity of this package.
-### Microsoft.Windows.StoreAgent.Telemetry.EndAcquireLicense
+### Microsoft.Windows.StoreAgent.Telemetry.BeginGetInstalledContentIds
-This event is sent after the license is acquired when a product is being installed. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set.
-- **AttemptNumber** The total number of attempts to acquire this product.
-- **BundleId** The bundle ID
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **HResult** HResult code to show the result of the operation (success/failure).
-- **IntentPFNs** Intent Product Family Name
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Did the user initiate the installation?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this happening after a device restore?
-- **IsUpdate** Is this an update?
-- **IsWin32** Flag indicating if this is a Win32app.
-- **ParentBundledId** The product's parent bundle ID.
-- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
-- **PFN** Product Family Name of the product being installed.
-- **ProductId** The Store Product ID for the product being installed.
-- **SystemAttemptNumber** The number of attempts by the system to acquire this product.
-- **UpdateId** The update ID (if this is an update)
-- **UserAttemptNumber** The number of attempts by the user to acquire this product
-- **WUContentId** The Windows Update content ID
+This event is sent when an inventory of the apps installed is started to determine whether updates for those apps are available. It's used to help keep Windows up-to-date and secure.
-### Microsoft.Windows.StoreAgent.Telemetry.EndDownload
-This event happens during the app update or installation when content is being downloaded at the end of the process to report success or failure. It's used to help keep Windows up-to-date and secure.
+### Microsoft.Windows.StoreAgent.Telemetry.BeginUpdateMetadataPrepare
-The following fields are available:
+This event is sent when the Store Agent cache is refreshed with any available package updates. It's used to help keep Windows up-to-date and secure.
-- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
-- **AttemptNumber** Number of retry attempts before it was canceled.
-- **BundleId** The identity of the Windows Insider build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **DownloadSize** The total size of the download.
-- **ExtendedHResult** Any extended HResult error codes.
-- **HResult** The result code of the last action performed.
-- **IntentPFNs** Intent Product Family Name
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this initiated by the user?
-- **IsMandatory** Is this a mandatory installation?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this a restore of a previously acquired product?
-- **IsUpdate** Is this an update?
-- **IsWin32** Flag indicating if this is a Win32 app (unused).
-- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
-- **PFN** The Product Family Name of the app being download.
-- **ProductId** The Store Product ID for the product being installed.
-- **SystemAttemptNumber** The number of attempts by the system to download.
-- **UpdateId** Update ID (if this is an update)
-- **UserAttemptNumber** The number of attempts by the user to download.
-- **WUContentId** The Windows Update content ID.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndFrameworkUpdate
-
-This event happens when an app update requires an updated Framework package and the process starts to download it. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **HResult** The result code of the last action performed before this operation.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndGetInstalledContentIds
-
-This event is sent after sending the inventory of the products installed to determine whether updates for those products are available. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **HResult** The result code of the last action performed before this operation.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndInstall
-
-This event is sent after a product has been installed. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-- **AttemptNumber** The number of retry attempts before it was canceled.
-- **BundleId** The identity of the build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **ExtendedHResult** The extended HResult error code.
-- **HResult** The result code of the last action performed.
-- **IntentPFNs** Intent Product Family Name
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this an interactive installation?
-- **IsMandatory** Is this a mandatory installation?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this automatically restoring a previously acquired product?
-- **IsUpdate** Is this an update?
-- **IsWin32** Flag indicating if this a Win32 app (unused).
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** Product Family Name of the product being installed.
-- **ProductId** The Store Product ID for the product being installed.
-- **SystemAttemptNumber** The total number of system attempts.
-- **UpdateId** Update ID (if this is an update)
-- **UserAttemptNumber** The total number of user attempts.
-- **WUContentId** The Windows Update content ID
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndScanForUpdates
-
-This event is sent after a scan for product updates to determine if there are packages to install. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **ClientAppId** The identity of the app that initiated this operation.
-- **HResult** The result code of the last action performed.
-- **IsApplicability** Is this request to only check if there are any applicable packages to install?
-- **IsInteractive** Is this user requested?
-- **IsOnline** Is the request doing an online check?
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndSearchUpdatePackages
-
-This event is sent after searching for update packages to install. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-- **AttemptNumber** The total number of retry attempts before it was canceled.
-- **BundleId** The identity of the build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **HResult** The result code of the last action performed.
-- **IntentPFNs** The licensing identity of this package.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this user requested?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this restoring previously acquired content?
-- **IsUpdate** Is this an update?
-- **IsWin32** Flag indicating if this a Win32 app (unused).
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** The name of the package or packages requested for install.
-- **ProductId** The Store Product ID for the product being installed.
-- **SystemAttemptNumber** The total number of system attempts.
-- **UpdateId** Update ID (if this is an update)
-- **UserAttemptNumber** The total number of user attempts.
-- **WUContentId** The Windows Update content ID
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndStageUserData
-
-This event is sent between download and installation to see if there is app data that needs to be restored from the cloud. It's used to keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AttemptNumber** The total number of retry attempts before it was canceled.
-- **BundleId** The identity of the build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **HResult** The result code of the last action performed.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this user requested?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this restoring previously acquired content?
-- **IsUpdate** Is this an update?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** The name of the package or packages requested for install.
-- **ProductId** The Store Product ID for the product being installed.
-- **SystemAttemptNumber** The total number of system attempts.
-- **UserAttemptNumber** The total number of system attempts.
-- **WUContentId** The Windows Update content ID
-- **IntentPFNs** The licensing identity of this package.
-- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.InstallOperationRequest
-
-This event happens at the beginning of the install process when an app update or new app is installed. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **BundleId** The identity of the build associated with this product.
-- **CatalogId** If this product is from a private catalog, the Store Product ID for the product being installed.
-- **ProductId** The Store Product ID for the product being installed.
-- **SkuId** Specific edition ID being installed.
-- **VolumePath** The disk path of the installation.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.PauseInstallation
-
-This event is sent when a product install or update is paused either by a user or the system. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AttemptNumber** The total number of retry attempts before it was canceled.
-- **BundleId** The identity of the build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this user requested?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this restoring previously acquired content?
-- **IsUpdate** Is this an update?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** The Product Full Name.
-- **PreviousHResult** The result code of the last action performed before this operation.
-- **PreviousInstallState** Previous state before the installation or update was paused.
-- **ProductId** The Store Product ID for the product being installed.
-- **RelatedCV** Correlation Vector of a previous performed action on this product.
-- **SystemAttemptNumber** The total number of system attempts.
-- **UserAttemptNumber** The total number of user attempts.
-- **WUContentId** The Windows Update content ID
-- **IntentPFNs** The licensing identity of this package.
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.ResumeInstallation
-
-This event happens when a product install or update is resumed either by a user or the system. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AttemptNumber** The number of retry attempts before it was canceled.
-- **BundleId** The identity of the build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this user requested?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this restoring previously acquired content?
-- **IsUpdate** Is this an update?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** The name of the package or packages requested for install.
-- **PreviousHResult** The previous HResult error code.
-- **PreviousInstallState** Previous state before the installation was paused.
-- **ProductId** The Store Product ID for the product being installed.
-- **RelatedCV** Correlation Vector for the original install before it was resumed.
-- **SystemAttemptNumber** The total number of system attempts.
-- **UserAttemptNumber** The total number of user attempts.
-- **WUContentId** The Windows Update content ID
-- **IntentPFNs** Intent Product Family Name
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-- **HResult** The result code of the last action performed before this operation.
-- **IsUserRetry** Did the user initiate the retry?
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.UpdateAppOperationRequest
-
-This event happens an app for a user needs to be updated. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **PFamN** The name of the product that is requested for update.
### Microsoft.Windows.StoreAgent.Telemetry.CancelInstallation
@@ -4381,6 +4453,7 @@ This event is sent when an app update or installation is canceled while in inter
The following fields are available:
+- **AggregatedPackageFullNames** The names of all package or packages to be downloaded and installed.
- **AttemptNumber** Total number of installation attempts.
- **BundleId** The identity of the Windows Insider build that is associated with this product.
- **CategoryId** The identity of the package or packages being installed.
@@ -4399,34 +4472,12 @@ The following fields are available:
- **RelatedCV** Correlation Vector of a previous performed action on this product.
- **SystemAttemptNumber** Total number of automatic attempts to install before it was canceled.
- **UserAttemptNumber** Total number of user attempts to install before it was canceled.
-- **WUContentId** The Windows Update content ID
-- **IntentPFNs** Intent Product Family Name
-- **AggregatedPackageFullNames** The names of all package or packages to be downloaded and installed.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.SearchForUpdateOperationRequest
-
-This event is sent when searching for update packages to install. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **CatalogId** The Store Product ID for the product being installed.
-- **ProductId** The Store Product ID for the product being installed.
-- **SkuId** Specfic edition of the app being updated.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndUpdateMetadataPrepare
-
-This event happens after a scan for available app updates. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **HResult** The result code of the last action performed.
+- **WUContentId** The Windows Update content ID.
### Microsoft.Windows.StoreAgent.Telemetry.CompleteInstallOperationRequest
-This event is sent after the app installations or updates. It's used to help keep Windows up-to-date and secure
+This event is sent at the end of the installs or updates. Store Agent events are needed to help keep Windows Apps up to date and secure, like the Mail and Calendar Apps. App install or update failures can be unique across devices and without this data from every device we will not be able to track failures and fix future vulnerabilities related to these Windows Apps.
The following fields are available:
@@ -4438,39 +4489,334 @@ The following fields are available:
- **SkuId** Specific edition of the item being installed.
+### Microsoft.Windows.StoreAgent.Telemetry.EndAcquireLicense
+
+This event is sent after the license is acquired when a product is being installed. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set.
+- **AttemptNumber** The total number of attempts to acquire this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** HResult code to show the result of the operation (success/failure).
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Did the user initiate the installation?
+- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this happening after a device restore?
+- **IsUpdate** Is this an update?
+- **PFN** Product Family Name of the product being installed.
+- **ProductId** The Store Product ID for the product being installed.
+- **SystemAttemptNumber** The number of attempts by the system to acquire this product.
+- **UserAttemptNumber** The number of attempts by the user to acquire this product
+- **WUContentId** Licensing identity of this package.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndDownload
+
+This event is sent after an app is downloaded to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
+- **AttemptNumber** Number of retry attempts before it was canceled.
+- **BundleId** The identity of the Windows Insider build associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **DownloadSize** The total size of the download.
+- **ExtendedHResult** Any extended HResult error codes.
+- **HResult** The result code of the last action performed.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this initiated by the user?
+- **IsMandatory** Is this a mandatory installation?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this a restore of a previously acquired product?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
+- **PFN** The Product Family Name of the app being download.
+- **ProductId** The Store Product ID for the product being installed.
+- **SystemAttemptNumber** The number of attempts by the system to download.
+- **UserAttemptNumber** The number of attempts by the user to download.
+- **WUContentId** The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndFrameworkUpdate
+
+This event is sent when an app update requires an updated Framework package and the process starts to download it. It is used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **HResult** The result code of the last action performed before this operation.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndGetInstalledContentIds
+
+This event is sent after sending the inventory of the products installed to determine whether updates for those products are available. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **HResult** The result code of the last action performed before this operation.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndInstall
+
+This event is sent after a product has been installed to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **AttemptNumber** The number of retry attempts before it was canceled.
+- **BundleId** The identity of the build associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **ExtendedHResult** The extended HResult error code.
+- **HResult** The result code of the last action performed.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this an interactive installation?
+- **IsMandatory** Is this a mandatory installation?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this automatically restoring a previously acquired product?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** Product Family Name of the product being installed.
+- **ProductId** The Store Product ID for the product being installed.
+- **SystemAttemptNumber** The total number of system attempts.
+- **UserAttemptNumber** The total number of user attempts.
+- **WUContentId** Licensing identity of this package.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndScanForUpdates
+
+This event is sent after a scan for product updates to determine if there are packages to install. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** The result code of the last action performed.
+- **IsApplicability** Is this request to only check if there are any applicable packages to install?
+- **IsInteractive** Is this user requested?
+- **IsOnline** Is the request doing an online check?
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndSearchUpdatePackages
+
+This event is sent after searching for update packages to install. It is used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **AttemptNumber** The total number of retry attempts before it was canceled.
+- **BundleId** The identity of the build associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** The result code of the last action performed.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this user requested?
+- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The name of the package or packages requested for install.
+- **ProductId** The Store Product ID for the product being installed.
+- **SystemAttemptNumber** The total number of system attempts.
+- **UserAttemptNumber** The total number of user attempts.
+- **WUContentId** The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndStageUserData
+
+This event is sent after restoring user data (if any) that needs to be restored following a product install. Store Agent events are needed to help keep Windows Apps up to date and secure, like the Mail and Calendar Apps. App install or update failures can be unique across devices and without this data from every device we will not be able to track failures and fix future vulnerabilities related to these Windows Apps.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
+- **AttemptNumber** The total number of retry attempts before it was canceled.
+- **BundleId** The identity of the build associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** The result code of the last action performed.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this user requested?
+- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The name of the package or packages requested for install.
+- **ProductId** The Store Product ID for the product being installed.
+- **SystemAttemptNumber** The total number of system attempts.
+- **UserAttemptNumber** The total number of system attempts.
+- **WUContentId** Licensing identity of this package.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndUpdateMetadataPrepare
+
+This event happens after a scan for available app updates. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **HResult** The result code of the last action performed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentComplete
+
+FulfillmentComplete event is fired at the end of an app install or update. We use this to track the very end of the install/update process. StoreAgent events are needed to help keep Windows pre-installed 1st party apps up to date and secure such as the mail and calendar apps. App update failure can be unique across devices and without this data from every device we will not be able to track the success/failure and fix any future vulnerabilities related to these built in Windows Apps.
+
+The following fields are available:
+
+- **FailedRetry** Tells us if the retry for an install or update was successful or not.
+- **HResult** Resulting HResult error/success code of this call
+- **PFN** Package Family Name of the app that being installed or updated
+- **ProductId** Product Id of the app that is being updated or installed
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentInitiate
+
+FulfillmentInitiate event is fired at the start of an app install or update. We use this to track the very beginning of the install/update process. StoreAgent events are needed to help keep Windows pre-installed 1st party apps up to date and secure such as the mail and calendar apps. App update failure can be unique across devices and without this data from every device we will not be able to track the success/failure and fix any future vulnerabilities related to these built in Windows Apps.
+
+The following fields are available:
+
+- **PFN** The Package Family Name of the app that is being installed or updated.
+- **ProductId** The product ID of the app that is being updated or installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.InstallOperationRequest
+
+This event is sent when a product install or update is initiated. Store Agent events are needed to help keep Windows Apps up to date and secure, like the Mail and Calendar Apps. App install or update failures can be unique across devices and without this data from every device we will not be able to track failures and fix future vulnerabilities related to these Windows Apps.
+
+The following fields are available:
+
+- **BundleId** The identity of the build associated with this product.
+- **CatalogId** If this product is from a private catalog, the Store Product ID for the product being installed.
+- **ProductId** The Store Product ID for the product being installed.
+- **SkuId** Specific edition ID being installed.
+- **VolumePath** The disk path of the installation.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.PauseInstallation
+
+This event is sent when a product install or update is paused either by a user or the system. Store Agent events are needed to help keep Windows Apps up to date and secure, like the Mail and Calendar Apps. App install or update failures can be unique across devices and without this data from every device we will not be able to track failures and fix future vulnerabilities related to these Windows Apps.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **AttemptNumber** The total number of retry attempts before it was canceled.
+- **BundleId** The identity of the build associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this user requested?
+- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The Product Full Name.
+- **PreviousHResult** The result code of the last action performed before this operation.
+- **PreviousInstallState** Previous state before the installation or update was paused.
+- **ProductId** The Store Product ID for the product being installed.
+- **RelatedCV** Correlation Vector of a previous performed action on this product.
+- **SystemAttemptNumber** The total number of system attempts.
+- **UserAttemptNumber** The total number of user attempts.
+- **WUContentId** Licensing identity of this package.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.ResumeInstallation
+
+This event is sent when a product install or update is resumed either by a user or the system. Store Agent events are needed to help keep Windows Apps up to date and secure, like the Mail and Calendar Apps. App install or update failures can be unique across devices and without this data from every device we will not be able to track failures and fix future vulnerabilities related to these Windows Apps.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **AttemptNumber** The number of retry attempts before it was canceled.
+- **BundleId** The identity of the build associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** The result code of the last action performed before this operation.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this user requested?
+- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **IsUserRetry** Did the user initiate the retry?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The name of the package or packages requested for install.
+- **PreviousHResult** The previous HResult error code.
+- **PreviousInstallState** Previous state before the installation was paused.
+- **ProductId** The Store Product ID for the product being installed.
+- **RelatedCV** Correlation Vector for the original install before it was resumed.
+- **SystemAttemptNumber** The total number of system attempts.
+- **UserAttemptNumber** The total number of user attempts.
+- **WUContentId** Licensing identity of this package.
+
+
### Microsoft.Windows.StoreAgent.Telemetry.ResumeOperationRequest
-This event happens when a product install or update is resumed by a user and on installation retries. It's used to help keep Windows up-to-date and secure.
+This event is sent when a product install or update is resumed by a user and on install retries. Store Agent events are needed to help keep Windows Apps up to date and secure, like the Mail and Calendar Apps. App install or update failures can be unique across devices and without this data from every device we will not be able to track failures and fix future vulnerabilities related to these Windows Apps.
The following fields are available:
- **ProductId** The Store Product ID for the product being installed.
-### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentComplete
+### Microsoft.Windows.StoreAgent.Telemetry.SearchForUpdateOperationRequest
-This event is sent at the end of an app install or update and is used to track the very end of the install or update process.
+This event is sent when searching for update packages to install. Store Agent events are needed to help keep Windows Apps up to date and secure, like the Mail and Calendar Apps. App install or update failures can be unique across devices and without this data from every device we will not be able to track failures and fix future vulnerabilities related to these Windows Apps.
The following fields are available:
-- **FailedRetry** Was the installation or update retry successful?
-- **HResult** The HResult code of the operation.
-- **PFN** The Package Family Name of the app that is being installed or updated.
-- **ProductId** The product ID of the app that is being updated or installed.
+- **CatalogId** The Store Catalog ID for the product being installed.
+- **ProductId** The Store Product ID for the product being installed.
+- **SkuId** Specfic edition of the app being updated.
-### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentInitiate
+### Microsoft.Windows.StoreAgent.Telemetry.UpdateAppOperationRequest
-This event is sent at the beginning of an app install or update and is used to track the very beginning of the install or update process.
+This event occurs when an update is requested for an app, to help keep Windows up-to-date and secure.
The following fields are available:
-- **PFN** The Package Family Name of the app that is being installed or updated.
-- **ProductId** The product ID of the app that is being updated or installed.
+- **PFamN** The name of the app that is requested for update.
## Windows Update Delivery Optimization events
+### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled
+
+This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads.
+
+The following fields are available:
+
+- **background** Is the download being done in the background?
+- **bytesFromCacheServer** Bytes received from a cache host.
+- **bytesFromCDN** The number of bytes received from a CDN source.
+- **bytesFromGroupPeers** The number of bytes received from a peer in the same group.
+- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same group.
+- **bytesFromLocalCache** Bytes copied over from local (on disk) cache.
+- **bytesFromPeers** The number of bytes received from a peer in the same LAN.
+- **callerName** Name of the API caller.
+- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event.
+- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered.
+- **clientTelId** A random number used for device sampling.
+- **dataSourcesTotal** Bytes received per source type, accumulated for the whole session.
+- **doErrorCode** The Delivery Optimization error code that was returned.
+- **errorCode** The error code that was returned.
+- **experimentId** When running a test, this is used to correlate events that are part of the same test.
+- **fileID** The ID of the file being downloaded.
+- **gCurMemoryStreamBytes** Current usage for memory streaming.
+- **gMaxMemoryStreamBytes** Maximum usage for memory streaming.
+- **isVpn** Is the device connected to a Virtual Private Network?
+- **jobID** Identifier for the Windows Update job.
+- **reasonCode** Reason the action or event occurred.
+- **scenarioID** The ID of the scenario.
+- **sessionID** The ID of the file download session.
+- **updateID** The ID of the update being downloaded.
+- **usedMemoryStream** Did the download use memory streaming?
+
+
### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted
This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads.
@@ -4478,24 +4824,35 @@ This event describes when a download has completed with Delivery Optimization. I
The following fields are available:
- **background** Is the download a background download?
+- **bytesFromCacheServer** Bytes received from a cache host.
- **bytesFromCDN** The number of bytes received from a CDN source.
- **bytesFromGroupPeers** The number of bytes received from a peer in the same domain group.
- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same domain group.
+- **bytesFromLocalCache** Bytes copied over from local (on disk) cache.
- **bytesFromPeers** The number of bytes received from a peer in the same LAN.
- **bytesRequested** The total number of bytes requested for download.
+- **cacheServerConnectionCount** Number of connections made to cache hosts.
+- **callerName** Name of the API caller.
- **cdnConnectionCount** The total number of connections made to the CDN.
- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event.
- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered.
- **cdnIp** The IP address of the source CDN.
- **clientTelId** A random number used for device sampling.
+- **dataSourcesTotal** Bytes received per source type, accumulated for the whole session.
- **doErrorCode** The Delivery Optimization error code that was returned.
- **downlinkBps** The maximum measured available download bandwidth (in bytes per second).
- **downlinkUsageBps** The download speed (in bytes per second).
- **downloadMode** The download mode used for this file download session.
+- **downloadModeSrc** Source of the DownloadMode setting (KvsProvider = 0, GeoProvider = 1, GeoVerProvider = 2, CpProvider = 3, DiscoveryProvider = 4, RegistryProvider = 5, GroupPolicyProvider = 6, MdmProvider = 7, SettingsProvider = 8, InvalidProviderType = 9).
+- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
- **fileID** The ID of the file being downloaded.
- **fileSize** The size of the file being downloaded.
+- **gCurMemoryStreamBytes** Current usage for memory streaming.
+- **gMaxMemoryStreamBytes** Maximum usage for memory streaming.
- **groupConnectionCount** The total number of connections made to peers in the same group.
- **internetConnectionCount** The total number of connections made to peers not in the same LAN or the same group.
+- **isVpn** Is the device connected to a Virtual Private Network?
+- **jobID** Identifier for the Windows Update job.
- **lanConnectionCount** The total number of connections made to peers in the same LAN.
- **numPeers** The total number of peers used for this download.
- **restrictedUpload** Is the upload restricted?
@@ -4505,8 +4862,6 @@ The following fields are available:
- **updateID** The ID of the update being downloaded.
- **uplinkBps** The maximum measured available upload bandwidth (in bytes per second).
- **uplinkUsageBps** The upload speed (in bytes per second).
-- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
-- **isVpn** Is the device connected to a Virtual Private Network?
- **usedMemoryStream** Did the download use memory streaming?
@@ -4517,15 +4872,77 @@ This event represents a temporary suspension of a download with Delivery Optimiz
The following fields are available:
- **background** Is the download a background download?
+- **callerName** The name of the API caller.
- **clientTelId** A random number used for device sampling.
- **errorCode** The error code that was returned.
+- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
- **fileID** The ID of the file being paused.
+- **isVpn** Is the device connected to a Virtual Private Network?
+- **jobID** Identifier for the Windows Update job.
- **reasonCode** The reason for pausing the download.
- **scenarioID** The ID of the scenario.
- **sessionID** The ID of the download session.
- **updateID** The ID of the update being paused.
+
+
+### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted
+
+This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads.
+
+The following fields are available:
+
+- **background** Indicates whether the download is happening in the background.
+- **bytesRequested** Number of bytes requested for the download.
+- **callerName** Name of the API caller.
+- **cdnUrl** The URL of the source CDN.
+- **clientTelId** Random number used for device selection
+- **costFlags** A set of flags representing network cost.
+- **deviceProfile** Identifies the usage or form factor (such as Desktop, Xbox, or VM).
+- **diceRoll** Random number used for determining if a client will use peering.
+- **doClientVersion** The version of the Delivery Optimization client.
+- **doErrorCode** The Delivery Optimization error code that was returned.
+- **downloadMode** The download mode used for this file download session (CdnOnly = 0, Lan = 1, Group = 2, Internet = 3, Simple = 99, Bypass = 100).
+- **downloadModeSrc** Source of the DownloadMode setting (KvsProvider = 0, GeoProvider = 1, GeoVerProvider = 2, CpProvider = 3, DiscoveryProvider = 4, RegistryProvider = 5, GroupPolicyProvider = 6, MdmProvider = 7, SettingsProvider = 8, InvalidProviderType = 9).
+- **errorCode** The error code that was returned.
+- **experimentId** ID used to correlate client/services calls that are part of the same test during A/B testing.
+- **fileID** The ID of the file being downloaded.
+- **filePath** The path to where the downloaded file will be written.
+- **fileSize** Total file size of the file that was downloaded.
+- **fileSizeCaller** Value for total file size provided by our caller.
+- **groupID** ID for the group.
+- **isVpn** Indicates whether the device is connected to a Virtual Private Network.
+- **jobID** The ID of the Windows Update job.
+- **minDiskSizeGB** The minimum disk size (in GB) policy set for the device to allow peering with delivery optimization.
+- **minDiskSizePolicyEnforced** Indicates whether there is an enforced minimum disk size requirement for peering.
+- **minFileSizePolicy** The minimum content file size policy to allow the download using peering with delivery optimization.
+- **peerID** The ID for this delivery optimization client.
+- **scenarioID** The ID of the scenario.
+- **sessionID** The ID for the file download session.
+- **updateID** The ID of the update being downloaded.
+- **usedMemoryStream** Indicates whether the download used memory streaming.
+
+
+### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication
+
+This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads.
+
+The following fields are available:
+
+- **cdnHeaders** The HTTP headers returned by the CDN.
+- **cdnIp** The IP address of the CDN.
+- **cdnUrl** The URL of the CDN.
+- **clientTelId** A random number used for device sampling.
+- **errorCode** The error code that was returned.
+- **errorCount** The total number of times this error code was seen since the last FailureCdnCommunication event was encountered.
- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
-- **isVpn** Is the device connected to a Virtual Private Network?
+- **fileID** The ID of the file being downloaded.
+- **httpStatusCode** The HTTP status code returned by the CDN.
+- **isHeadRequest** The type of HTTP request that was sent to the CDN. Example: HEAD or GET
+- **peerType** The type of peer (LAN, Group, Internet, CDN, Cache Host, etc.).
+- **requestOffset** The byte offset within the file in the sent request.
+- **requestSize** The size of the range requested from the CDN.
+- **responseSize** The size of the range response received from the CDN.
+- **sessionID** The ID of the download session.
### Microsoft.OSG.DU.DeliveryOptClient.JobError
@@ -4535,105 +4952,56 @@ This event represents a Windows Update job error. It allows for investigation of
The following fields are available:
- **clientTelId** A random number used for device sampling.
+- **doErrorCode** Error code returned for delivery optimization.
- **errorCode** The error code returned.
- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
- **fileID** The ID of the file being downloaded.
- **jobID** The Windows Update job ID.
-### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled
-
-This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads.
-
-The following fields are available:
-
-- **background** Is the download being done in the background?
-- **bytesFromCDN** The number of bytes received from a CDN source.
-- **bytesFromGroupPeers** The number of bytes received from a peer in the same group.
-- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same group.
-- **bytesFromPeers** The number of bytes received from a peer in the same LAN.
-- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event.
-- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered.
-- **clientTelId** A random number used for device sampling.
-- **doErrorCode** The Delivery Optimization error code that was returned.
-- **errorCode** The error code that was returned.
-- **experimentId** When running a test, this is used to correlate events that are part of the same test.
-- **fileID** The ID of the file being downloaded.
-- **isVpn** Is the device connected to a Virtual Private Network?
-- **scenarioID** The ID of the scenario.
-- **sessionID** The ID of the file download session.
-- **updateID** The ID of the update being downloaded.
-- **usedMemoryStream** Did the download use memory streaming?
-
-
-### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted
-
-This event describes the start of a new download with Delivery Optimization. It's used to understand and address problems regarding downloads.
-
-The following fields are available:
-
-- **background** Is the download a background download?
-- **cdnUrl** The URL of the CDN.
-- **clientTelId** A random number used for device sampling.
-- **deviceProfile** Identifies the usage or form factor. Example: Desktop or Xbox
-- **diceRoll** The dice roll value used in sampling events.
-- **doClientVersion** The version of the Delivery Optimization client.
-- **doErrorCode** The Delivery Optimization error code that was returned.
-- **downloadMode** The download mode used for this file download session.
-- **errorCode** The error code that was returned.
-- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
-- **fileID** The ID of the file being downloaded.
-- **filePath** The path where the file will be written.
-- **groupID** ID for the group.
-- **isVpn** Is the device connected to a Virtual Private Network?
-- **jobID** The ID of the Windows Update job.
-- **minDiskSizeGB** The minimum disk size (in GB) required for Peering.
-- **minDiskSizePolicyEnforced** Is the minimum disk size enforced via policy?
-- **minFileSizePolicy** The minimum content file size policy to allow the download using Peering.
-- **peerID** The ID for this Delivery Optimization client.
-- **scenarioID** The ID of the scenario.
-- **sessionID** The ID of the download session.
-- **updateID** The ID of the update being downloaded.
-- **usedMemoryStream** Did the download use memory streaming?
-- **costFlags** A set of flags representing network cost.
-
-
-### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication
-
-This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads.
-
-The following fields are available:
-
-- **cdnIp** The IP address of the CDN.
-- **cdnUrl** The URL of the CDN.
-- **clientTelId** A random number used for device sampling.
-- **errorCode** The error code that was returned.
-- **errorCount** The total number of times this error code was seen since the last FailureCdnCommunication event was encountered.
-- **httpStatusCode** The HTTP status code returned by the CDN.
-- **sessionID** The ID of the download session.
-- **cdnHeaders** The HTTP headers returned by the CDN.
-- **experimentId** When running a test, this is used to correlate with other events that are part of the same test.
-- **fileID** The ID of the file being downloaded.
-- **isHeadRequest** The type of HTTP request that was sent to the CDN. Example: HEAD or GET
-- **requestSize** The size of the range requested from the CDN.
-- **responseSize** The size of the range response received from the CDN.
-
-
## Windows Update events
-### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart
+### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit
-This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages.
+This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
The following fields are available:
-- **flightId** The unique identifier for each flight
-- **mode** Indicates that the Update Agent mode that has started. 1 = Initialize, 2 = DownloadRequest, 3 = Install, 4 = Commit
-- **objectId** Unique value for each Update Agent mode
-- **relatedCV** Correlation vector value generated from the latest scan
-- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **sessionId** Unique value for each Update Agent mode attempt
-- **updateId** Unique ID for each update
+- **errorCode** The error code returned for the current session initialization.
+- **flightId** The unique identifier for each flight.
+- **objectId** The unique GUID for each diagnostics session.
+- **relatedCV** A correlation vector value generated from the latest USO scan.
+- **result** Outcome of the initialization of the session.
+- **scenarioId** Identifies the Update scenario.
+- **sessionId** The unique value for each update session.
+- **updateId** The unique identifier for each Update.
+
+
+### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest
+
+This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
+
+The following fields are available:
+
+- **deletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted.
+- **errorCode** The error code returned for the current session initialization.
+- **flightId** The unique identifier for each flight.
+- **objectId** Unique value for each Update Agent mode.
+- **packageCountOptional** Number of optional packages requested.
+- **packageCountRequired** Number of required packages requested.
+- **packageCountTotal** Total number of packages needed.
+- **packageCountTotalCanonical** Total number of canonical packages.
+- **packageCountTotalDiff** Total number of diff packages.
+- **packageCountTotalExpress** Total number of express packages.
+- **packageSizeCanonical** Size of canonical packages in bytes.
+- **packageSizeDiff** Size of diff packages in bytes.
+- **packageSizeExpress** Size of express packages in bytes
+- **rangeRequestState** Represents the state of the download range request.
+- **relatedCV** Correlation vector value generated from the latest USO scan.
+- **result** Result of the download request phase of update.
+- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate.
+- **sessionId** Unique value for each Update Agent mode attempt.
+- **updateId** Unique ID for each update.
### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize
@@ -4642,32 +5010,16 @@ This event sends data for initializing a new update session for the new device m
The following fields are available:
-- **errorCode** The error code returned for the current initialize phase
-- **flightId** The unique identifier for each flight
-- **flightMetadata** Contains the FlightId and the build being flighted
-- **objectId** Unique value for each Update Agent mode
-- **relatedCV** Correlation vector value generated from the latest USO scan
-- **result** Result of the initialize phase of update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
-- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate#N#
-- **sessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios)
-- **sessionId** "Unique value for each Update Agent mode attempt "
-- **updateId** Unique ID for each update
-
-
-### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit
-
-This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
-
-The following fields are available:
-
-- **errorCode** The error code returned for the current session initialization
-- **flightId** The unique identifier for each flight
-- **objectId** The unique GUID for each diagnostics session
-- **relatedCV** A correlation vector value, generated from the latest USO scan
-- **result** Outcome of the initialization of the session
-- **scenarioId** Identifies the Update scenario
-- **sessionId** The unique value for each update session
-- **updateId** The unique identifier for each Update
+- **errorCode** The error code returned for the current session initialization.
+- **flightId** The unique identifier for each flight.
+- **flightMetadata** Contains the FlightId and the build being flighted.
+- **objectId** Unique value for each Update Agent mode.
+- **relatedCV** Correlation vector value generated from the latest USO scan.
+- **result** Result of the initialize phase of the update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled.
+- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate.
+- **sessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios).
+- **sessionId** Unique value for each Update Agent mode attempt.
+- **updateId** Unique ID for each update.
### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall
@@ -4686,252 +5038,143 @@ The following fields are available:
- **updateId** Unique ID for each update
-### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest
+### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart
-This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
+This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario. The update scenario is used to install a device manifest describing a set of driver packages.
The following fields are available:
-- **deletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted
-- **errorCode** The error code returned for the current session initialization
-- **flightId** The unique identifier for each flight
-- **objectId** Unique value for each Update Agent mode
-- **packageCountOptional** Number of optional packages requested
-- **packageCountRequired** Number of required packages requested
-- **packageCountTotal** Total number of packages needed
-- **packageCountTotalCanonical** Total number of canonical packages
-- **packageCountTotalDiff** Total number of diff packages
-- **packageCountTotalExpress** Total number of express packages
-- **packageSizeCanonical** Size of canonical packages in bytes
-- **packageSizeDiff** Size of diff packages in bytes
-- **packageSizeExpress** Size of express packages in bytes
-- **rangeRequestState** Represents the state of the download range request
-- **relatedCV** Correlation vector value generated from the latest USO scan
-- **result** Result of the download request phase of update
-- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **sessionId** Unique value for each Update Agent mode attempt
-- **updateId** Unique ID for each update
+- **flightId** Unique ID for each flight.
+- **mode** The mode that is starting.
+- **objectId** Unique value for each diagnostics session.
+- **relatedCV** Correlation vector value generated from the latest USO scan.
+- **scenarioId** Indicates the update scenario.
+- **sessionId** Unique value for each update session.
+- **updateId** Unique ID for each Update.
-### Microsoft.Windows.Update.Orchestrator.GameActive
+### Microsoft.Windows.Update.NotificationUx.RebootScheduled
-This event indicates that an enabled GameMode process prevented the device from restarting to complete an update
+Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update.
The following fields are available:
-- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
-- **gameModeReason** Name of the enabled GameMode process that prevented the device from restarting to complete an update
-- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
-
-
-### Microsoft.Windows.Update.DataMigrationFramework.DmfMigrationCompleted
-
-This event sends data collected at the end of the Data Migration Framework (DMF) and parameters involved in its invocation, to help keep Windows up to date.
-
-The following fields are available:
-
-- **MigrationDurationInMilliseconds** How long the DMF migration took (in milliseconds)
-- **MigrationEndTime** A system timestamp of when the DMF migration completed.
-- **RevisionNumbers** A collection of revision numbers for the updates associated with the DMF session.
-- **UpdateIds** A collection of GUIDs for updates that are associated with the DMF session.
-- **WuClientId** The GUID of the Windows Update client responsible for triggering the DMF migration
-
-
-### Microsoft.Windows.Update.DataMigrationFramework.DmfMigrationStarted
-
-This event sends data collected at the beginning of the Data Migration Framework (DMF) and parameters involved in its invocation, to help keep Windows up to date.
-
-The following fields are available:
-
-- **MigrationMicrosoftPhases** Revision numbers for the updates that were installed.
-- **MigrationOEMPhases** WU Update IDs for the updates that were installed.
-- **MigrationStartTime** The timestamp representing the beginning of the DMF migration
-- **WuClientId** The GUID of the Windows Update client invoking DMF
-- **RevisionNumbers** A collection of the revision numbers associated with the UpdateIds.
-- **UpdateIds** A collection of GUIDs identifying the upgrades that are running.
-
-
-### Microsoft.Windows.Update.DataMigrationFramework.MigratorResult
-
-This event sends DMF migrator data to help keep Windows up to date.
-
-The following fields are available:
-
-- **CurrentStep** This is the last step the migrator reported before returning a result. This tells us how far through the individual migrator the device was before failure.
-- **ErrorCode** The result (as an HRESULT) of the migrator that just completed.
-- **MigratorId** A GUID identifying the migrator that just completed.
-- **MigratorName** The name of the migrator that just completed.
-- **RunDurationInSeconds** The time it took for the migrator to complete.
-- **TotalSteps** Migrators report progress in number of completed steps against the total steps. This is the total number of steps.
-
-
-### Microsoft.Windows.Update.Orchestrator.Download
-
-This event sends launch data for a Windows Update download to help keep Windows up to date.
-
-The following fields are available:
-
-- **deferReason** Reason for download not completing
-- **detectionDeferreason** Reason for download not completing
-- **errorCode** An error code represented as a hexadecimal value
-- **eventScenario** End to end update session ID.
-- **flightID** Unique update ID.
-- **interactive** Identifies if session is user initiated.
-- **revisionNumber** Update revision number.
-- **updateId** Update ID.
-- **updateScenarioType** The update session type.
-- **wuDeviceid** Unique device ID used by Windows Update.
-
-
-### Microsoft.Windows.Update.Orchestrator.FlightInapplicable
-
-This event sends data on whether the update was applicable to the device, to help keep Windows up to date.
-
-The following fields are available:
-
-- **EventPublishedTime** time that the event was generated
-- **revisionNumber** Revision Number of the Update
-- **updateId** Unique Update ID
-- **UpdateStatus** Integer that describes Update state
-- **wuDeviceid** Unique Device ID
-- **flightID** Unique Update ID
-- **updateScenarioType** The update session type.
-
-
-### Microsoft.Windows.Update.Orchestrator.PostInstall
-
-This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date.
-
-The following fields are available:
-
-- **batteryLevel** Current battery capacity in mWh or percentage left.
-- **bundleId** Update grouping ID.
-- **bundleRevisionnumber** Bundle revision number.
-- **errorCode** Hex code for the error message, to allow lookup of the specific error.
-- **eventScenario** End to end update session ID.
-- **flightID** Unique update ID.
-- **sessionType** Interactive vs. Background.
-- **wuDeviceid** Unique device ID used by Windows Update.
-
-
-### Microsoft.Windows.Update.Orchestrator.RebootFailed
-
-This event sends information about whether an update required a reboot and reasons for failure to help keep Windows up to date.
-
-The following fields are available:
-
-- **batteryLevel** Current battery capacity in mWh or percentage left.
-- **deferReason** Reason for install not completing.
-- **EventPublishedTime** The time that the reboot failure occurred.
-- **flightID** Unique update ID.
-- **installRebootDeferreason** Reason for reboot not occurring.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
-- **RebootResults** Hex code indicating failure reason. Typically, we expect this to be a specific USO generated hex code.
-- **revisionNumber** Update revision number.
-- **updateId** Update ID.
-- **updateScenarioType** The update session type.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
-- **wuDeviceid** Unique device ID used by Windows Update.
-
-
-### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh
-
-This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date.
-
-The following fields are available:
-
-- **configuredPoliciescount** Policy Count
-- **policiesNamevaluesource** Policy Name
-- **policyCacherefreshtime** Refresh time
-- **updateInstalluxsetting** This shows whether a user has set policies via UX option
-- **wuDeviceid** Unique device ID used by Windows Update.
-
-
-### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired
-
-This event sends data about whether an update required a reboot to help keep Windows up to date.
-
-The following fields are available:
-
-- **revisionNumber** Update revision number.
-- **updateId** Update ID.
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **flightID** Unique update ID.
-- **interactive** Indicates the reboot initiation stage of the update process was entered as a result of user action or not.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
-- **updateScenarioType** The update session type.
-
-
-### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled
-
-This event sends data about a required reboot that is scheduled with no user interaction, to help keep Windows up to date.
-
-The following fields are available:
-
-- **activeHoursApplicable** True, If Active Hours applicable on this device. False, otherwise.
-- **forcedReboot** True, if a reboot is forced on the device. Otherwise, this is False
+- **activeHoursApplicable** Indicates whether an Active Hours policy is present on the device.
- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action.
-- **rebootOutsideOfActiveHours** True, if a reboot is scheduled outside of active hours. False, otherwise.
-- **rebootScheduledByUser** True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically.
-- **revisionNumber** Revision number of the update that is getting installed with this reboot.
-- **scheduledRebootTime** Time of the scheduled reboot
-- **updateId** Update ID of the update that is getting installed with this reboot.
+- **rebootOutsideOfActiveHours** Indicates whether a restart is scheduled outside of active hours.
+- **rebootScheduledByUser** Indicates whether the restart was scheduled by user (if not, it was scheduled automatically).
+- **rebootState** The current state of the restart.
+- **revisionNumber** Revision number of the update that is getting installed with this restart.
+- **scheduledRebootTime** Time of the scheduled restart.
+- **scheduledRebootTimeInUTC** Time of the scheduled restart in Coordinated Universal Time.
+- **updateId** ID of the update that is getting installed with this restart.
+- **wuDeviceid** Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.CommitFailed
+
+This event indicates that a device was unable to restart after an update.
+
+The following fields are available:
+
+- **errorCode** The error code that was returned.
+- **wuDeviceid** The Windows Update device GUID.
+
+
+### Microsoft.Windows.Update.Orchestrator.DeferRestart
+
+This event indicates that a restart required for installing updates was postponed.
+
+The following fields are available:
+
+- **eventScenario** Indicates the purpose of the event (scan started, succeeded, failed, etc.).
+- **filteredDeferReason** Applicable filtered reasons why reboot was postponed (such as user active, or low battery).
+- **raisedDeferReason** Indicates all potential reasons for postponing restart (such as user active, or low battery).
- **wuDeviceid** Unique device ID used by Windows Update.
-- **rebootState** The state of the reboot.
### Microsoft.Windows.Update.Orchestrator.Detection
-This event sends launch data for a Windows Update scan to help keep Windows up to date.
+This event indicates that a scan for a Windows Update occurred.
The following fields are available:
- **deferReason** Reason why the device could not check for updates.
- **detectionBlockreason** Reason for detection not completing.
-- **detectionDeferreason** A log of deferral reasons for every update state.
+- **detectionRetryMode** Indicates whether we will try to scan again.
- **errorCode** The returned error code.
-- **eventScenario** End to end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
-- **flightID** A unique update ID.
-- **interactive** Identifies if session is User Initiated.
+- **eventScenario** End-to-end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
+- **flightID** The specific ID of the Windows Insider build the device is getting.
+- **interactive** Indicates whether the session was user initiated.
- **revisionNumber** Update revision number.
- **updateId** Update ID.
-- **updateScenarioType** The update session type.
-- **wuDeviceid** Unique device ID used by Windows Update.
+- **updateScenarioType** Device ID
+- **wuDeviceid** Device ID
-### Microsoft.Windows.Update.Orchestrator.InitiatingReboot
+### Microsoft.Windows.Update.Orchestrator.DisplayNeeded
-This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date.
+This event indicates the reboot was postponed due to needing a display.
The following fields are available:
-- **EventPublishedTime** Time of the event.
+- **displayNeededReason** Reason the display is needed.
+- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **rebootOutsideOfActiveHours** Indicates whether the reboot was to occur outside of active hours.
- **revisionNumber** Revision number of the update.
- **updateId** Update ID.
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **flightID** Unique update ID
-- **interactive** Indicates the reboot initiation stage of the update process was entered as a result of user action or not.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
- **updateScenarioType** The update session type.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated.
+- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
-### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled
+### Microsoft.Windows.Update.Orchestrator.FlightInapplicable
-This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up-to-date.
+This event indicates that the update is no longer applicable to this device.
The following fields are available:
-- **activeHoursApplicable** Is the restart respecting Active Hours?
-- **rebootArgument** The arguments that are passed to the OS for the restarted.
-- **rebootOutsideOfActiveHours** Was the restart scheduled outside of Active Hours?
-- **rebootScheduledByUser** Was the restart scheduled by the user? If the value is false, the restart was scheduled by the device.
-- **rebootState** The state of the restart.
-- **revisionNumber** The revision number of the OS being updated.
-- **scheduledRebootTime** Time of the scheduled reboot
-- **updateId** The Windows Update device GUID.
-- **wuDeviceid** The Windows Update device GUID.
-- **forcedReboot** True, if a reboot is forced on the device. Otherwise, this is False
+- **EventPublishedTime** Time when this event was generated.
+- **flightID** The specific ID of the Windows Insider build.
+- **revisionNumber** Update revision number.
+- **updateId** Unique Windows Update ID.
+- **updateScenarioType** Update session type.
+- **UpdateStatus** Last status of update.
+- **UUPFallBackConfigured** Indicates whether UUP fallback is configured.
+- **wuDeviceid** Unique Device ID.
+
+
+### Microsoft.Windows.Update.Orchestrator.GameActive
+
+This event indicates that an enabled GameMode process prevented the device from restarting to complete an update.
+
+The following fields are available:
+
+- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **gameModeReason** Name of the enabled GameMode process that prevented the device from restarting to complete an update.
+- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+
+
+### Microsoft.Windows.Update.Orchestrator.LowUptimes
+
+This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure.
+
+The following fields are available:
+
+- **isLowUptimeMachine** Is the machine considered low uptime or not.
+- **lowUptimeMinHours** Current setting for the minimum number of hours needed to not be considered low uptime.
+- **lowUptimeQueryDays** Current setting for the number of recent days to check for uptime.
+- **uptimeMinutes** Number of minutes of uptime measured.
+- **wuDeviceid** Unique device ID for Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.PreShutdownStart
+
+This event is generated before the shutdown and commit operations.
+
+The following fields are available:
+
+- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded
@@ -4943,148 +5186,56 @@ The following fields are available:
- **UtcTime** The Coordinated Universal Time that the restart was no longer needed.
-### Microsoft.Windows.Update.Ux.MusNotification.ToastDisplayedToScheduleReboot
+### Microsoft.Windows.Update.Ux.MusNotification.RebootRequestReasonsToIgnore
-This event is sent when a toast notification is shown to the user about scheduling a device restart.
+This event is sent when the reboot can be deferred based on some reasons, before reboot attempts
The following fields are available:
-- **UtcTime** The Coordinated Universal Time when the toast notification was shown.
+- **Reason** The reason sent which will cause the reboot to defer.
-### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask
+### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerFirstReadyToReboot
-This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date.
+This event is fired the first time when the reboot is required.
+
+
+
+### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask
+
+This event is sent when MUSE broker schedules a task
The following fields are available:
-- **RebootTaskRestoredTime** Time at which this reboot task was restored.
-- **revisionNumber** Update revision number.
-- **updateId** Update ID.
-- **wuDeviceid** Device id on which the reboot is restored
+- **TaskArgument** The arguments which the task is scheduled with
+- **TaskName** Name of the task
-### Microsoft.Windows.Update.Orchestrator.SystemNeeded
+### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled
-This event sends data about why a device is unable to reboot, to help keep Windows up to date.
+This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up-to-date
The following fields are available:
-- **eventScenario** End to end update session ID.
-- **revisionNumber** Update revision number.
-- **systemNeededReason** Reason ID
-- **updateId** Update ID.
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
-- **updateScenarioType** The update session type.
-
-
-### Microsoft.Windows.Update.UpdateStackServicing.CheckForUpdates
-
-This event sends data about the UpdateStackServicing check for updates, to help keep Windows up to date.
-
-The following fields are available:
-
-- **BspVersion** The version of the BSP.
-- **CallerApplicationName** The name of the USS scheduled task. Example UssScheduled or UssBoot
-- **ClientVersion** The version of the client.
-- **CommercializationOperator** The name of the operator.
-- **DetectionVersion** The string returned from the GetDetectionVersion export of the downloaded detection DLL.
-- **DeviceName** The name of the device.
-- **EventInstanceID** The USS session ID.
-- **EventScenario** The scenario of the event. Example: Started, Failed, or Succeeded
-- **OemName** The name of the manufacturer.
-- **ServiceGuid** The GUID of the service.
-- **StatusCode** The HRESULT code of the operation.
-- **WUDeviceID** The Windows Update device ID.
-
-
-### Microsoft.Windows.Update.Orchestrator.CommitFailed
-
-This events tracks when a device needs to restart after an update but did not.
-
-The following fields are available:
-
-- **errorCode** The error code that was returned.
+- **activeHoursApplicable** Is the restart respecting Active Hours?
+- **forcedReboot** True, if a reboot is forced on the device. Otherwise, this is False
+- **rebootArgument** The arguments that are passed to the OS for the restarted.
+- **rebootOutsideOfActiveHours** Was the restart scheduled outside of Active Hours?
+- **rebootScheduledByUser** Was the restart scheduled by the user? If the value is false, the restart was scheduled by the device.
+- **rebootState** The state of the restart.
+- **revisionNumber** The revision number of the OS being updated.
+- **scheduledRebootTime** Time of the scheduled reboot
+- **scheduledRebootTimeInUTC** Time of the scheduled restart, in Coordinated Universal Time.
+- **updateId** The Windows Update device GUID.
- **wuDeviceid** The Windows Update device GUID.
-### Microsoft.Windows.Update.Orchestrator.Install
+## Winlogon events
-This event sends launch data for a Windows Update install to help keep Windows up to date.
+### Microsoft.Windows.Security.Winlogon.SetupCompleteLogon
-The following fields are available:
-
-- **batteryLevel** Current battery capacity in mWh or percentage left.
-- **deferReason** Reason for install not completing.
-- **eventScenario** End to end update session ID.
-- **interactive** Identifies if session is user initiated.
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **flightUpdate** Flight update
-- **installRebootinitiatetime** The time it took for a reboot to be attempted.
-- **minutesToCommit** The time it took to install updates.
-- **revisionNumber** Update revision number.
-- **updateId** Update ID.
-- **errorCode** The error code reppresented by a hexadecimal value.
-- **installCommitfailedtime** The time it took for a reboot to happen but the upgrade failed to progress.
-- **flightID** Unique update ID
-- **ForcedRebootReminderSet** A boolean value that indicates if a forced reboot will happen for updates.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
-- **updateScenarioType** The update session type.
+This event signals the completion of the setup process. It happens only once during the first logon.
-### Microsoft.Windows.Update.Orchestrator.PreShutdownStart
-
-This event is generated right before the shutdown and commit operations
-
-The following fields are available:
-
-- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
-### Microsoft.Windows.Update.Orchestrator.DeferRestart
-
-This event indicates that a restart required for installing updates was postponed
-
-The following fields are available:
-
-- **filteredDeferReason** Indicates the raised, but ignorable, reasons that the USO didn't restart (for example, user active or low battery)
-- **raisedDeferReason** Indicates the reason that the USO didn't restart. For example, user active or low battery
-- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
-- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
-
-
-### Microsoft.Windows.Update.Orchestrator.DisplayNeeded
-
-Reboot postponed due to needing a display
-
-The following fields are available:
-
-- **displayNeededReason** Reason the display is needed
-- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date
-- **revisionNumber** Revision number of the update
-- **updateId** Update ID
-- **updateScenarioType** The update session type
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date
-- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
-
-
-### Microsoft.Windows.Update.NotificationUx.RebootScheduled
-
-Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update
-
-The following fields are available:
-
-- **activeHoursApplicable** True, If Active Hours applicable on this device. False, otherwise
-- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action
-- **rebootOutsideOfActiveHours** True, if a reboot is scheduled outside of active hours. False, otherwise
-- **rebootScheduledByUser** True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically
-- **rebootState** The state of the reboot
-- **revisionNumber** Revision number of the update that is getting installed with this reboot
-- **scheduledRebootTime** Time of the scheduled reboot
-- **updateId** ID of the update that is getting installed with this reboot
-- **wuDeviceid** Unique device ID used by Windows Update
-- **scheduledRebootTimeInUTC** Time of the scheduled reboot in Coordinated Universal Time
diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md
index 84da766a22..55efbb3633 100644
--- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md
+++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md
@@ -1,27 +1,26 @@
---
description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level.
title: Windows 10, version 1803 basic diagnostic events and fields (Windows 10)
-keywords: privacy, telemetry, diagnostic data
+keywords: privacy, telemetry
ms.prod: w10
ms.mktglfcycl: manage
ms.sitesec: library
ms.pagetype: security
-ms.localizationpriority: high
+localizationpriority: high
author: brianlic-msft
ms.author: brianlic
-ms.date: 4/30/2018
+ms.date: 09/10/2018
---
# Windows 10, version 1803 basic level Windows diagnostic events and fields
-
**Applies to**
- Windows 10, version 1803
-The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. When the level is set to Basic, it also includes the Security level information.
+The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Windows Store. When the level is set to Basic, it also includes the Security level information.
The Basic level helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems.
@@ -33,227 +32,11 @@ You can learn more about Windows functional and diagnostic data through these ar
- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
- [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
-- [Manage Windows 10 connection endpoints](manage-windows-endpoints.md)
- [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
-## Common data extensions
-
-### Common Data Extensions.App
-
-
-
-The following fields are available:
-
-- **expId** Associates a flight, such as an OS flight, or an experiment, such as a web site UX experiment, with an event.
-- **userId** The userID as known by the application.
-- **env** The environment from which the event was logged.
-- **asId** An integer value that represents the app session. This value starts at 0 on the first app launch and increments after each subsequent app launch per boot session.
-- **id** Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application.
-- **ver** Represents the version number of the application. Used to understand errors by Version, Usage by Version across an app.
-
-
-### Common Data Extensions.CS
-
-
-
-The following fields are available:
-
-- **sig** A common schema signature that identifies new and modified event schemas.
-
-
-### Common Data Extensions.CUET
-
-
-
-The following fields are available:
-
-- **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID.
-- **aId** Represents the ETW ActivityId. Logged via TraceLogging or directly via ETW.
-- **raId** Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW.
-- **op** Represents the ETW Op Code.
-- **cat** Represents a bitmask of the ETW Keywords associated with the event.
-- **flags** Represents the bitmap that captures various Windows specific flags.
-- **cpId** The composer ID, such as Reference, Desktop, Phone, Holographic, Hub, IoT Composer.
-- **tickets** A list of strings that represent entries in the HTTP header of the web request that includes this event.
-- **bseq** Upload buffer sequence number in the format \:\
-- **mon** Combined monitor and event sequence numbers in the format \:\
-- **epoch** Represents the epoch and seqNum fields, which help track how many events were fired and how many events were uploaded, and enables identification of data lost during upload and de-duplication of events on the ingress server.
-- **seq** Represents the sequence field used to track absolute order of uploaded events. It is an incrementing identifier for each event added to the upload queue. The Sequence helps track how many events were fired and how many events were uploaded and enables identification of data lost during upload and de-duplication of events on the ingress server.
-
-
-### Common Data Extensions.Device
-
-
-
-The following fields are available:
-
-- **ver** Represents the major and minor version of the extension.
-- **localId** Represents a locally defined unique ID for the device, not the human readable device name. Most likely equal to the value stored at HKLM\Software\Microsoft\SQMClient\MachineId
-- **deviceClass** Represents the classification of the device, the device “family”. For example, Desktop, Server, or Mobile.
-
-
-### Common Data Extensions.Envelope
-
-
-
-The following fields are available:
-
-- **ver** Represents the major and minor version of the extension.
-- **name** Represents the uniquely qualified name for the event.
-- **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format.
-- **popSample** Represents the effective sample rate for this event at the time it was generated by a client.
-- **iKey** Represents an ID for applications or other logical groupings of events.
-- **flags** Represents a collection of bits that describe how the event should be processed by the Connected User Experience and Telemetry component pipeline. The lowest-order byte is the event persistence. The next byte is the event latency.
-- **cV** Represents the Correlation Vector: A single field for tracking partial order of related telemetry events across component boundaries.
-
-
-### Common Data Extensions.OS
-
-
-
-The following fields are available:
-
-- **ver** Represents the major and minor version of the extension.
-- **expId** Represents the experiment ID. The standard for associating a flight, such as an OS flight (pre-release build), or an experiment, such as a web site UX experiment, with an event is to record the flight / experiment IDs in Part A of the common schema.
-- **locale** Represents the locale of the operating system.
-- **bootId** An integer value that represents the boot session. This value starts at 0 on first boot after OS install and increments after every reboot.
-- **os** Represents the operating system name.
-- **ver** Represents the OS version, and its format is OS dependent.
-
-
-### Common Data Extensions.User
-
-
-
-The following fields are available:
-
-- **ver** Represents the major and minor version of the extension.
-- **localId** Represents a unique user identity that is created locally and added by the client. This is not the user's account ID.
-
-
-### Common Data Extensions.XBL
-
-
-
-The following fields are available:
-
-- **nbf** Not before time
-- **expId** Expiration time
-- **sbx** XBOX sandbox identifier
-- **dty** XBOX device type
-- **did** XBOX device ID
-- **xid** A list of base10-encoded XBOX User IDs.
-- **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts.
-
-
-### Common Data Extensions.Consent UI Event
-
-This User Account Control (UAC) telemetry point collects information on elevations that originate from low integrity levels. This occurs when a process running at low integrity level (IL) requires higher (administrator) privileges, and therefore requests for elevation via UAC (consent.exe). By better understanding the processes requesting these elevations, Microsoft can in turn improve the detection and handling of potentially malicious behavior in this path.
-
-The following fields are available:
-
-- **eventType** Represents the type of elevation: If it succeeded, was cancelled, or was auto-approved.
-- **splitToken** Represents the flag used to distinguish between administrators and standard users.
-- **friendlyName** Represents the name of the file requesting elevation from low IL.
-- **elevationReason** Represents the distinction between various elevation requests sources (appcompat, installer, COM, MSI and so on).
-- **exeName** Represents the name of the file requesting elevation from low IL.
-- **signatureState** Represents the state of the signature, if it signed, unsigned, OS signed and so on.
-- **publisherName** Represents the name of the publisher of the file requesting elevation from low IL.
-- **cmdLine** Represents the full command line arguments being used to elevate.
-- **Hash.Length** Represents the length of the hash of the file requesting elevation from low IL.
-- **Hash** Represents the hash of the file requesting elevation from low IL.
-- **HashAlgId** Represents the algorithm ID of the hash of the file requesting elevation from low IL.
-- **telemetryFlags** Represents the details about the elevation prompt for CEIP data.
-- **timeStamp** Represents the time stamp on the file requesting elevation.
-- **fileVersionMS** Represents the major version of the file requesting elevation.
-- **fileVersionLS** Represents the minor version of the file requesting elevation.
-
-
-## Common data fields
-
-### Common Data Fields.MS.Device.DeviceInventory.Change
-
-These fields are added whenever Ms.Device.DeviceInventoryChange is included in the event.
-
-The following fields are available:
-
-- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object.
-- **objectType** Indicates the object type that the event applies to.
-- **Action** The change that was invoked on a device inventory object.
-- **inventoryId** Device ID used for Compatibility testing
-
-
-### Common Data Fields.TelClientSynthetic.PrivacySettingsAfterCreatorsUpdate.PreUpgradeSettings
-
-These fields are added whenever PreUpgradeSettings is included in the event.
-
-The following fields are available:
-
-- **HKLM_SensorPermissionState.SensorPermissionState** The state of the Location service before the feature update completed.
-- **HKLM_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the device.
-- **HKCU_SensorPermissionState.SensorPermissionState** The state of the Location service when a user signs on before the feature update completed.
-- **HKCU_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the current user.
-- **HKLM_LocationPlatform.Status** The state of the location platform after the feature update has completed.
-- **HKLM_LocationPlatform.HRESULT** The error code returned when trying to query the location platform for the device.
-- **HKLM_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the device before the feature update completed.
-- **HKLM_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the device.
-- **HKCU_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the current user before the feature update completed.
-- **HKCU_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the current user.
-- **HKLM_AllowTelemetry.AllowTelemetry** The state of the Connected User Experiences and Telemetry component for the device before the feature update.
-- **HKLM_AllowTelemetry.HRESULT** The error code returned when trying to query the Connected User Experiences and Telemetry conponent for the device.
-- **HKLM_TIPC.Enabled** The state of TIPC for the device.
-- **HKLM_TIPC.HRESULT** The error code returned when trying to query TIPC for the device.
-- **HKCU_TIPC.Enabled** The state of TIPC for the current user.
-- **HKCU_TIPC.HRESULT** The error code returned when trying to query TIPC for the current user.
-- **HKLM_FlipAhead.FPEnabled** Is Flip Ahead enabled for the device before the feature update was completed?
-- **HKLM_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the device.
-- **HKCU_FlipAhead.FPEnabled** Is Flip Ahead enabled for the current user before the feature update was completed?
-- **HKCU_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the current user.
-- **HKLM_TailoredExperiences.TailoredExperiencesWithDiagnosticDataEnabled** Is Tailored Experiences with Diagnostics Data enabled for the current user after the feature update had completed?
-- **HKCU_TailoredExperiences.HRESULT** The error code returned when trying to query Tailored Experiences with Diagnostics Data for the current user.
-- **HKLM_AdvertisingID.Enabled** Is the adveristing ID enabled for the device?
-- **HKLM_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the device.
-- **HKCU_AdvertisingID.Enabled** Is the adveristing ID enabled for the current user?
-- **HKCU_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the user.
-
-
-### Common Data Fields.TelClientSynthetic.PrivacySettingsAfterCreatorsUpdate.PostUpgradeSettings
-
-These fields are added whenever PostUpgradeSettings is included in the event.
-
-The following fields are available:
-
-- **HKLM_SensorPermissionState.SensorPermissionState** The state of the Location service after the feature update has completed.
-- **HKLM_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the device.
-- **HKCU_SensorPermissionState.SensorPermissionState** The state of the Location service when a user signs on after a feature update has completed.
-- **HKCU_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the current user.
-- **HKLM_LocationPlatform.Status** The state of the location platform after the feature update has completed.
-- **HKLM_LocationPlatform.HRESULT** The error code returned when trying to query the location platform for the device.
-- **HKLM_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the device after the feature update has completed.
-- **HKLM_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the device.
-- **HKCU_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the current user after the feature update has completed.
-- **HKCU_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the current user.
-- **HKLM_AllowTelemetry.AllowTelemetry** The state of the Connected User Experiences and Telemetry component for the device after the feature update.
-- **HKLM_AllowTelemetry.HRESULT** The error code returned when trying to query the Connected User Experiences and Telemetry conponent for the device.
-- **HKLM_TIPC.Enabled** The state of TIPC for the device.
-- **HKLM_TIPC.HRESULT** The error code returned when trying to query TIPC for the device.
-- **HKCU_TIPC.Enabled** The state of TIPC for the current user.
-- **HKCU_TIPC.HRESULT** The error code returned when trying to query TIPC for the current user.
-- **HKLM_FlipAhead.FPEnabled** Is Flip Ahead enabled for the device after the feature update has completed?
-- **HKLM_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the device.
-- **HKCU_FlipAhead.FPEnabled** Is Flip Ahead enabled for the current user after the feature update has completed?
-- **HKCU_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the current user.
-- **HKLM_TailoredExperiences.TailoredExperiencesWithDiagnosticDataEnabled** Is Tailored Experiences with Diagnostics Data enabled for the current user after the feature update had completed?
-- **HKCU_TailoredExperiences.HRESULT** The error code returned when trying to query Tailored Experiences with Diagnostics Data for the current user.
-- **HKLM_AdvertisingID.Enabled** Is the adveristing ID enabled for the device?
-- **HKLM_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the device.
-- **HKCU_AdvertisingID.Enabled** Is the adveristing ID enabled for the current user?
-- **HKCU_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the user.
-
-
## Appraiser events
### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount
@@ -262,143 +45,82 @@ This event lists the types of objects and how many of each exist on the client d
The following fields are available:
-- **PCFP** An ID for the system, calculated by hashing hardware identifiers.
-- **SystemProcessorLahfSahf** The count of the number of this particular object type present on this device.
-- **SystemProcessorCompareExchange** The count of the number of this particular object type present on this device.
-- **SystemProcessorSse2** The count of the number of this particular object type present on this device.
-- **SystemProcessorNx** The count of the number of this particular object type present on this device.
-- **SystemWim** The count of the number of this particular object type present on this device.
-- **SystemWlan** The count of the number of this particular object type present on this device.
+- **DatasourceApplicationFile_RS1** An ID for the system, calculated by hashing hardware identifiers.
+- **DatasourceApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
- **DatasourceDevicePnp_RS1** The total DataSourceDevicePnp objects targeting Windows 10 version 1607 on this device.
-- **DecisionDevicePnp_RS1** The total DecisionDevicePnp objects targeting Windows 10 version 1607 on this device.
-- **InventorySystemBios** The count of the number of this particular object type present on this device.
-- **DataSourceMatchingInfoPostUpgrade_RS1** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device.
-- **DecisionMatchingInfoPostUpgrade_RS1** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device.
-- **SystemMemory** The count of the number of this particular object type present on this device.
-- **SystemProcessorPrefetchW** The count of the number of this particular object type present on this device.
-- **DatasourceSystemBios_RS1** The total DatasourceSystemBios objects targeting Windows 10 version 1607 present on this device.
-- **DecisionSystemBios_RS1** The total DecisionSystemBios objects targeting Windows 10 version 1607 on this device.
-- **DataSourceMatchingInfoPassive_RS1** The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1607 on this device.
-- **DecisionMatchingInfoPassive_RS1** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1607 on this device.
-- **InventoryUplevelDriverPackage** The count of the number of this particular object type present on this device.
-- **DatasourceDriverPackage_RS1** The total DataSourceDriverPackage objects targeting Windows 10 version 1607 on this device.
-- **DecisionDriverPackage_RS1** The total DecisionDriverPackage objects targeting Windows 10 version 1607 on this device.
-- **Wmdrm_RS1** An ID for the system, calculated by hashing hardware identifiers.
-- **DecisionTest_RS1** An ID for the system, calculated by hashing hardware identifiers.
-- **SystemWindowsActivationStatus** The count of the number of this particular object type present on this device.
-- **SystemTouch** The count of the number of this particular object type present on this device.
-- **InventoryApplicationFile** The count of the number of this particular object type present on this device.
-- **InventoryLanguagePack** The count of InventoryLanguagePack objects present on this machine.
-- **InventoryMediaCenter** The count of the number of this particular object type present on this device.
-- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
-- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device.
-- **DatasourceApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
- **DatasourceDevicePnp_RS3** The total DatasourceDevicePnp objects targeting the next release of Windows on this device.
+- **DatasourceDriverPackage_RS1** The total DataSourceDriverPackage objects targeting Windows 10 version 1607 on this device.
- **DatasourceDriverPackage_RS3** The total DatasourceDriverPackage objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoBlock_RS3** The total DataSourceMatchingInfoBlock objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
-- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
-- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
-- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
-- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
-- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device.
-- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device.
-- **DatasourceApplicationFile_RS1** An ID for the system, calculated by hashing hardware identifiers.
-- **DecisionApplicationFile_RS1** An ID for the system, calculated by hashing hardware identifiers.
- **DataSourceMatchingInfoBlock_RS1** The total DataSourceMatchingInfoBlock objects targeting Windows 10 version 1607 on this device.
+- **DataSourceMatchingInfoBlock_RS3** The total DataSourceMatchingInfoBlock objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoPassive_RS1** The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1607 on this device.
+- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS1** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
+- **DatasourceSystemBios_RS1** The total DatasourceSystemBios objects targeting Windows 10 version 1607 present on this device.
+- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
+- **DecisionApplicationFile_RS1** An ID for the system, calculated by hashing hardware identifiers.
+- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
+- **DecisionDevicePnp_RS1** The total DecisionDevicePnp objects targeting Windows 10 version 1607 on this device.
+- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
+- **DecisionDriverPackage_RS1** The total DecisionDriverPackage objects targeting Windows 10 version 1607 on this device.
+- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
- **DecisionMatchingInfoBlock_RS1** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1607 present on this device.
+- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoPassive_RS1** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1607 on this device.
+- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
+- **DecisionMatchingInfoPostUpgrade_RS1** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device.
+- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
- **DecisionMediaCenter_RS1** The total DecisionMediaCenter objects targeting Windows 10 version 1607 present on this device.
+- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device.
+- **DecisionSystemBios_RS1** The total DecisionSystemBios objects targeting Windows 10 version 1607 on this device.
+- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device.
+- **DecisionTest_RS1** An ID for the system, calculated by hashing hardware identifiers.
+- **InventoryApplicationFile** The count of the number of this particular object type present on this device.
+- **InventoryLanguagePack** The count of the number of this particular object type present on this device.
+- **InventoryMediaCenter** The count of the number of this particular object type present on this device.
+- **InventorySystemBios** The count of the number of this particular object type present on this device.
+- **InventoryTest** The count of the number of this particular object type present on this device.
+- **InventoryUplevelDriverPackage** The count of the number of this particular object type present on this device.
+- **PCFP** An ID for the system, calculated by hashing hardware identifiers.
+- **SystemMemory** The count of the number of this particular object type present on this device.
+- **SystemProcessorCompareExchange** The count of the number of this particular object type present on this device.
+- **SystemProcessorLahfSahf** The count of the number of this particular object type present on this device.
+- **SystemProcessorNx** The count of SystemProcessorNx objects present on this machine.
+- **SystemProcessorPrefetchW** The count of the number of this particular object type present on this device.
+- **SystemProcessorSse2** The count of SystemProcessorSse2 objects present on this machine.
+- **SystemTouch** The count of SystemTouch objects present on this machine.
+- **SystemWim** The count of SystemWim objects present on this machine.
+- **SystemWindowsActivationStatus** The count of SystemWindowsActivationStatus objects present on this machine.
+- **SystemWlan** The count of SystemWlan objects present on this machine.
+- **Wmdrm_RS1** An ID for the system, calculated by hashing hardware identifiers.
+- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device.
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
+### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd
-This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date.
+Represents the basic metadata about specific application files installed on the system.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **AppraiserVersion** The version of the appraiser file generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove
-
-This event indicates that the DataSourceMatchingInfoBlock object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync
-
-This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
-
-This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the appraiser file generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove
-
-This event indicates that the DataSourceMatchingInfoPassive object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync
-
-This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
-
-This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the appraiser file generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove
-
-This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
-
-### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync
-
-This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent.
-
-The following fields are available:
-
-- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-
+- **AppraiserVersion** The version of the appraiser file that is generating the events.
+- **AvDisplayName** If the app is an antivirus app, this is its display name.
+- **CompatModelIndex** The compatibility prediction for this file.
+- **HasCitData** Indicates whether the file is present in CIT data.
+- **HasUpgradeExe** Indicates whether the anti-virus app has an upgrade.exe file.
+- **IsAv** Is the file an antivirus reporting EXE?
+- **ResolveAttempted** This will always be an empty string when sent.
+- **SdbEntries** An array of fields that indicates the SDB entries that apply to this file.
### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove
This event indicates that the DatasourceApplicationFile object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -408,6 +130,8 @@ The following fields are available:
This event indicates that a new set of DatasourceApplicationFileAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -415,23 +139,26 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd
-This event sends compatibility data for a PNP device, to help keep Windows up-to-date.
+This event sends compatibility data for a Plug and Play device, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **ActiveNetworkConnection** Is the device an active network device?
+- **ActiveNetworkConnection** Indicates whether the device is an active network device.
- **AppraiserVersion** The version of the appraiser file generating the events.
-- **IsBootCritical** Is the device boot critical?
-- **SdbEntries** An array of fields indicating the SDB entries that apply to this device.
-- **WuDriverCoverage** Is there a driver uplevel for this device according to Windows Update?
-- **WuDriverUpdateId** The Windows Update ID of the applicable uplevel driver
-- **WuPopulatedFromId** The expected up-level driver matching ID based on driver coverage from Windows Update
+- **IsBootCritical** Indicates whether the device boot is critical.
+- **WuDriverCoverage** Indicates whether there is a driver uplevel for this device, according to Windows Update.
+- **WuDriverUpdateId** The Windows Update ID of the applicable uplevel driver.
+- **WuPopulatedFromId** The expected uplevel driver matching ID based on driver coverage from Windows Update.
### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove
This event indicates that the DatasourceDevicePnp object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -441,6 +168,8 @@ The following fields are available:
This event indicates that a new set of DatasourceDevicePnpAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -448,7 +177,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageAdd
-This event sends compatibility database data about driver packages to help keep Windows up-to-date.
+This event sends compatibility database data about driver packages to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -459,6 +190,8 @@ The following fields are available:
This event indicates that the DatasourceDriverPackage object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -468,6 +201,107 @@ The following fields are available:
This event indicates that a new set of DatasourceDriverPackageAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
+
+This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the appraiser file generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove
+
+This event indicates that the DataSourceMatchingInfoBlock object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync
+
+This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
+
+This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the appraiser file generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove
+
+This event indicates that the DataSourceMatchingInfoPassive object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync
+
+This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
+
+This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the appraiser file generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove
+
+This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion** The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync
+
+This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -477,16 +311,19 @@ The following fields are available:
This event sends compatibility database information about the BIOS to help keep Windows up-to-date.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **SdbEntries** An array of fields indicating the SDB entries that apply to this BIOS.
### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove
This event indicates that the DatasourceSystemBios object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -496,6 +333,8 @@ The following fields are available:
This event indicates that a new set of DatasourceSystemBiosAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -505,11 +344,13 @@ The following fields are available:
This event sends compatibility decision data about a file to help keep Windows up-to-date.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
-- **AppraiserVersion** The version of the appraiser file generating the events.
+- **AppraiserVersion** The version of the appraiser file that is generating the events.
- **BlockAlreadyInbox** The uplevel runtime block on the file already existed on the current OS.
-- **BlockingApplication** Are there any application issues that interfere with upgrade due to the file in question?
+- **BlockingApplication** Indicates whether there are any application issues that interfere with the upgrade due to the file in question.
- **DisplayGenericMessage** Will be a generic message be shown for this file?
- **HardBlock** This file is blocked in the SDB.
- **HasUxBlockOverride** Does the file have a block that is overridden by a tag in the SDB?
@@ -530,7 +371,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
-This event indicates that the DecisionApplicationFile object is no longer present.
+This event indicates Indicates that the DecisionApplicationFile object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -541,6 +384,8 @@ The following fields are available:
This event indicates that a new set of DecisionApplicationFileAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -548,7 +393,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd
-This event sends compatibility decision data about a PNP device to help keep Windows up-to-date.
+This event sends compatibility decision data about a PNP device to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -574,6 +421,8 @@ The following fields are available:
This event indicates that the DecisionDevicePnp object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -581,7 +430,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync
-This event indicates that the DecisionDevicePnp object is no longer present.
+The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -590,7 +441,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DecisionDriverPackageAdd
-This event sends decision data about driver package compatibility to help keep Windows up-to-date.
+This event sends decision data about driver package compatibility to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -606,6 +459,8 @@ The following fields are available:
This event indicates that the DecisionDriverPackage object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -615,6 +470,8 @@ The following fields are available:
This event indicates that a new set of DecisionDriverPackageAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -622,7 +479,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockAdd
-This event sends compatibility decision data about blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+This event sends compatibility decision data about blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -639,6 +498,8 @@ The following fields are available:
This event indicates that the DecisionMatchingInfoBlock object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -648,6 +509,8 @@ The following fields are available:
This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -657,6 +520,8 @@ The following fields are available:
This event sends compatibility decision data about non-blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -668,6 +533,8 @@ The following fields are available:
This event Indicates that the DecisionMatchingInfoPassive object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -677,6 +544,8 @@ The following fields are available:
This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -684,7 +553,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeAdd
-This event sends compatibility decision data about entries that require reinstall after upgrade. It's used to help keep Windows up-to-date.
+This event sends compatibility decision data about entries that require reinstall after upgrade. It's used to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -699,6 +570,8 @@ The following fields are available:
This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -706,7 +579,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DecisionMediaCenterAdd
-This event sends decision data about the presence of Windows Media Center, to help keep Windows up-to-date.
+This event sends decision data about the presence of Windows Media Center, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -723,6 +598,8 @@ The following fields are available:
This event indicates that the DecisionMediaCenter object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -732,6 +609,8 @@ The following fields are available:
This event indicates that a new set of DecisionMediaCenterAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -739,7 +618,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.DecisionSystemBiosAdd
-This event sends compatibility decision data about the BIOS to help keep Windows up-to-date.
+This event sends compatibility decision data about the BIOS to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -752,6 +633,8 @@ The following fields are available:
This event indicates that the DecisionSystemBios object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -761,6 +644,8 @@ The following fields are available:
This event indicates that a new set of DecisionSystemBiosAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -782,12 +667,14 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd
-This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or are part of an anti-virus program.
+This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file generating the events.
-- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64
+- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64.
- **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets.
- **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets.
- **BoeProgramId** If there is no entry in Add/Remove Programs, this is the ProgramID that is generated from the file metadata.
@@ -807,6 +694,8 @@ The following fields are available:
This event indicates that the InventoryApplicationFile object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -814,7 +703,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
-This event indicates that a new set of InventoryApplicationFileAdd events will be sent.
+This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -823,19 +714,23 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.InventoryLanguagePackAdd
-This event sends data about the number of language packs installed on the system, to help keep Windows up-to-date.
+This event sends data about the number of language packs installed on the system, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **HasLanguagePack** Does this device have 2 or more language packs?
-- **LanguagePackCount** How many language packs are installed?
+- **HasLanguagePack** Indicates whether this device has 2 or more language packs.
+- **LanguagePackCount** The number of language packs are installed.
### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove
This event indicates that the InventoryLanguagePack object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -845,6 +740,8 @@ The following fields are available:
This event indicates that a new set of InventoryLanguagePackAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -854,6 +751,8 @@ The following fields are available:
This event sends true/false data about decision points used to understand whether Windows Media Center is used on the system, to help keep Windows up to date.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file generating the events.
@@ -870,6 +769,8 @@ The following fields are available:
This event indicates that the InventoryMediaCenter object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -879,6 +780,8 @@ The following fields are available:
This event indicates that a new set of InventoryMediaCenterAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -888,6 +791,8 @@ The following fields are available:
This event sends basic metadata about the BIOS to determine whether it has a compatibility block.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -899,7 +804,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove
-This event indicates that the InventorySystemBios object is no longer present.
+This event indicates that the InventorySystemBios object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -910,6 +817,8 @@ The following fields are available:
This event indicates that a new set of InventorySystemBiosAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -919,6 +828,8 @@ The following fields are available:
This event indicates that the InventoryUplevelDriverPackage object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -928,6 +839,8 @@ The following fields are available:
This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -935,7 +848,7 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.RunContext
-This event indicates what should be expected in the data payload.
+This event indicates what should be expected in the data payload.
The following fields are available:
@@ -951,6 +864,8 @@ The following fields are available:
This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file generating the events.
@@ -967,6 +882,8 @@ The following fields are available:
This event that the SystemMemory object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -976,6 +893,8 @@ The following fields are available:
This event indicates that a new set of SystemMemoryAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -985,6 +904,8 @@ The following fields are available:
This event sends data indicating whether the system supports the CompareExchange128 CPU requirement, to help keep Windows up to date.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file generating the events.
@@ -994,7 +915,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove
-This event indicates that the SystemProcessorCompareExchange object is no longer present.
+This event indicates that the SystemProcessorCompareExchange object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -1005,6 +928,8 @@ The following fields are available:
This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1014,6 +939,8 @@ The following fields are available:
This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file generating the events.
@@ -1023,7 +950,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove
-This event indicates that the SystemProcessorLahfSahf object is no longer present.
+This event indicates that the SystemProcessorLahfSahf object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -1034,6 +963,8 @@ The following fields are available:
This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1043,6 +974,8 @@ The following fields are available:
This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1055,6 +988,8 @@ The following fields are available:
This event indicates that the SystemProcessorNx object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1064,6 +999,8 @@ The following fields are available:
This event indicates that a new set of SystemProcessorNxAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1071,7 +1008,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWAdd
-This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up-to-date.
+This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -1084,6 +1023,8 @@ The following fields are available:
This event indicates that the SystemProcessorPrefetchW object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1093,6 +1034,8 @@ The following fields are available:
This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1100,7 +1043,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Add
-This event sends data indicating whether the system supports the SSE2 CPU requirement, to help keep Windows up-to-date.
+This event sends data indicating whether the system supports the SSE2 CPU requirement, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -1113,6 +1058,8 @@ The following fields are available:
This event indicates that the SystemProcessorSse2 object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1122,6 +1069,8 @@ The following fields are available:
This event indicates that a new set of SystemProcessorSse2Add events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1129,7 +1078,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemTouchAdd
-This event sends data indicating whether the system supports touch, to help keep Windows up-to-date.
+This event sends data indicating whether the system supports touch, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -1140,7 +1091,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemTouchRemove
-This event indicates that the SystemTouch object is no longer present.
+This event indicates that the SystemTouch object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -1151,6 +1104,8 @@ The following fields are available:
This event indicates that a new set of SystemTouchAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1158,7 +1113,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemWimAdd
-This event sends data indicating whether the operating system is running from a compressed WIM file, to help keep Windows up-to-date.
+This event sends data indicating whether the operating system is running from a compressed Windows Imaging Format (WIM) file, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -1169,7 +1126,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemWimRemove
-This event indicates that the SystemWim object is no longer present.
+This event indicates that the SystemWim object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -1180,6 +1139,8 @@ The following fields are available:
This event indicates that a new set of SystemWimAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1187,7 +1148,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusAdd
-This event sends data indicating whether the current operating system is activated, to help keep Windows up-to-date.
+This event sends data indicating whether the current operating system is activated, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -1200,6 +1163,8 @@ The following fields are available:
This event indicates that the SystemWindowsActivationStatus object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1209,6 +1174,8 @@ The following fields are available:
This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1216,7 +1183,9 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.SystemWlanRemove
-This event indicates that the SystemWlan object is no longer present.
+This event indicates that the SystemWlan object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -1227,6 +1196,8 @@ The following fields are available:
This event indicates that a new set of SystemWlanAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1234,7 +1205,7 @@ The following fields are available:
### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
-A summary event indicating the parameters and result of a telemetry run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up-to-date.
+This event indicates the parameters and result of a telemetry (diagnostic) run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
The following fields are available:
@@ -1242,7 +1213,7 @@ The following fields are available:
- **AppraiserDataVersion** The version of the data files being used by the Appraiser telemetry run.
- **AppraiserProcess** The name of the process that launched Appraiser.
- **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots.
-- **AuxFinal** Obsolete, always set to false
+- **AuxFinal** Obsolete, always set to false.
- **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
- **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
- **EnterpriseRun** Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
@@ -1269,14 +1240,16 @@ The following fields are available:
This event sends data about the usage of older digital rights management on the system, to help keep Windows up to date. This data does not indicate the details of the media using the digital rights management, only whether any such files exist. Collecting this data was critical to ensuring the correct mitigation for customers, and should be able to be removed once all mitigations are in place.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
-- **BlockingApplication** Same as NeedsDismissAction
+- **BlockingApplication** Same as NeedsDismissAction.
- **NeedsDismissAction** Indicates if a dismissible message is needed to warn the user about a potential loss of data due to DRM deprecation.
- **WmdrmApiResult** Raw value of the API used to gather DRM state.
- **WmdrmCdRipped** Indicates if the system has any files encrypted with personal DRM, which was used for ripped CDs.
-- **WmdrmIndicators** WmdrmCdRipped OR WmdrmPurchased
+- **WmdrmIndicators** WmdrmCdRipped OR WmdrmPurchased.
- **WmdrmInUse** WmdrmIndicators AND dismissible block in setup was not dismissed.
- **WmdrmNonPermanent** Indicates if the system has any files with non-permanent licenses.
- **WmdrmPurchased** Indicates if the system has any files with permanent licenses.
@@ -1286,6 +1259,8 @@ The following fields are available:
This event indicates that the Wmdrm object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1295,6 +1270,8 @@ The following fields are available:
This event indicates that a new set of WmdrmAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
@@ -1304,10 +1281,18 @@ The following fields are available:
### Census.App
-This event sends version data about the Apps running on this device, to help keep Windows up to date.
+Provides information on IE and Census versions running on the device.
The following fields are available:
+- **AppraiserEnterpriseErrorCode** The error code of the last Appraiser enterprise run.
+- **AppraiserErrorCode** The error code of the last Appraiser run.
+- **AppraiserRunEndTimeStamp** The end time of the last Appraiser run.
+- **AppraiserRunIsInProgressOrCrashed** Flag that indicates if the Appraiser run is in progress or has crashed.
+- **AppraiserRunStartTimeStamp** The start time of the last Appraiser run.
+- **AppraiserTaskEnabled** Whether the Appraiser task is enabled.
+- **AppraiserTaskExitCode** The Appraiser task exist code.
+- **AppraiserTaskLastRun** The last runtime for the Appraiser task.
- **CensusVersion** The version of Census that generated the current data for this device.
- **IEVersion** Retrieves which version of Internet Explorer is running on this device.
@@ -1341,6 +1326,7 @@ This event sends data about Azure presence, type, and cloud domain use in order
The following fields are available:
+- **AADDeviceId** Azure Active Directory device ID.
- **AzureOSIDPresent** Represents the field used to identify an Azure machine.
- **AzureVMType** Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs.
- **CDJType** Represents the type of cloud domain joined for the machine.
@@ -1374,7 +1360,7 @@ The following fields are available:
### Census.Flighting
-This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up-to-date.
+This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date.
The following fields are available:
@@ -1389,7 +1375,7 @@ The following fields are available:
### Census.Hardware
-This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up-to-date.
+This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date.
The following fields are available:
@@ -1397,6 +1383,7 @@ The following fields are available:
- **ChassisType** Represents the type of device chassis, such as desktop or low profile desktop. The possible values can range between 1 - 36.
- **ComputerHardwareID** Identifies a device class that is represented by a hash of different SMBIOS fields.
- **D3DMaxFeatureLevel** Supported Direct3D version.
+- **DeviceColor** Indicates a color of the device.
- **DeviceForm** Indicates the form as per the device classification.
- **DeviceName** The device name that is set by the user.
- **DigitizerSupport** Is a digitizer supported?
@@ -1425,7 +1412,6 @@ The following fields are available:
- **TelemetrySettingAuthority** Determines who set the telemetry level, such as GP, MDM, or the user.
- **TPMVersion** The supported Trusted Platform Module (TPM) on the device. If no TPM is present, the value is 0.
- **VoiceSupported** Does the device have a cellular radio capable of making voice calls?
-- **DeviceColor** Indicates a color of the device.
### Census.Memory
@@ -1470,7 +1456,7 @@ The following fields are available:
- **ActivationChannel** Retrieves the retail license key or Volume license key for a machine.
- **AssignedAccessStatus** Kiosk configuration mode.
- **CompactOS** Indicates if the Compact OS feature from Win10 is enabled.
-- **DeveloperUnlockStatus** Represents if a device has been developer unlocked by the user or Group Policy.
+- **DeveloperUnlockStatus** Represents if a device has been developer unlocked by the user or Group Policy.
- **DeviceTimeZone** The time zone that is set on the device. Example: Pacific Standard Time
- **GenuineState** Retrieves the ID Value specifying the OS Genuine check.
- **InstallationType** Retrieves the type of OS installation. (Clean, Upgrade, Reset, Refresh, Update).
@@ -1505,38 +1491,42 @@ The following fields are available:
### Census.Processor
-This event sends data about the processor (architecture, speed, number of cores, manufacturer, and model number), to help keep Windows up to date.
+Provides information on several important data points about Processor settings.
The following fields are available:
- **KvaShadow** Microcode info of the processor.
- **MMSettingOverride** Microcode setting of the processor.
- **MMSettingOverrideMask** Microcode setting override of the processor.
-- **ProcessorArchitecture** Processor architecture of the installed operating system.
+- **PreviousUpdateRevision** Previous microcode revision.
+- **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system.
- **ProcessorClockSpeed** Clock speed of the processor in MHz.
- **ProcessorCores** Number of logical cores in the processor.
- **ProcessorIdentifier** Processor Identifier of a manufacturer.
- **ProcessorManufacturer** Name of the processor manufacturer.
- **ProcessorModel** Name of the processor model.
- **ProcessorPhysicalCores** Number of physical cores in the processor.
-- **ProcessorUpdateRevision** Microcode revision.
-- **ProcessorUpdateStatus** The status of the microcode update.
+- **ProcessorUpdateRevision** Microcode revision
+- **ProcessorUpdateStatus** Enum value that represents the processor microcode load status.
- **SocketCount** Count of CPU sockets.
- **SpeculationControl** If the system has enabled protections needed to validate the speculation control vulnerability.
### Census.Security
-This event provides information on about security settings used to help keep Windows up-to-date and secure.
+This event provides information on about security settings used to help keep Windows up to date and secure.
The following fields are available:
-- **AvailableSecurityProperties** This field helps to enumerate and report state on the relevant security properties for Device Guard
+- **AvailableSecurityProperties** This field helps to enumerate and report state on the relevant security properties for Device Guard.
- **CGRunning** Credential Guard isolates and hardens key system and user secrets against compromise, helping to minimize the impact and breadth of a Pass the Hash style attack in the event that malicious code is already running via a local or network based vector. This field tells if Credential Guard is running.
-- **DGState** This field summarizes Device Guard state
-- **HVCIRunning** Hypervisor Code Integrity (HVCI) enables Device Guard to help protect kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s functionality to force all software running in kernel mode to safely allocate memory. This field tells if HVCI is running
-- **RequiredSecurityProperties** This field describes the required security properties to enable virtualization-based security
+- **DGState** This field summarizes the Device Guard state.
+- **HVCIRunning** Hypervisor Code Integrity (HVCI) enables Device Guard to help protect kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s functionality to force all software running in kernel mode to safely allocate memory. This field tells if HVCI is running.
+- **IsSawGuest** Indicates whether the device is running as a Secure Admin Workstation Guest.
+- **IsSawHost** Indicates whether the device is running as a Secure Admin Workstation Host.
+- **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security.
- **SecureBootCapable** Systems that support Secure Boot can have the feature turned off via BIOS. This field tells if the system is capable of running Secure Boot, regardless of the BIOS setting.
+- **SModeState** The Windows S mode trail state.
- **VBSState** Virtualization-based security (VBS) uses the hypervisor to help protect the kernel and other parts of the operating system. Credential Guard and Hypervisor Code Integrity (HVCI) both depend on VBS to isolate/protect secrets, and kernel-mode code integrity validation. VBS has a tri-state that can be Disabled, Enabled, or Running.
@@ -1568,6 +1558,16 @@ The following fields are available:
- **SystemVolumeTotalCapacity** Retrieves the size of the partition that the System volume is installed on in MB.
+### Census.Userdefault
+
+This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date.
+
+The following fields are available:
+
+- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf.
+- **DefaultBrowserProgId** The ProgramId of the current user's default browser.
+
+
### Census.UserDisplay
This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date.
@@ -1602,16 +1602,6 @@ The following fields are available:
- **SpeechInputLanguages** The Speech Input languages installed on the device.
-### Census.Userdefault
-
-This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date.
-
-The following fields are available:
-
-- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html,.htm,.jpg,.jpeg,.png,.mp3,.mp4, .mov,.pdf
-- **DefaultBrowserProgId** The ProgramId of the current user's default browser
-
-
### Census.VM
This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date.
@@ -1650,11 +1640,11 @@ The following fields are available:
- **OSWUAutoUpdateOptions** Retrieves the auto update settings on the device.
- **UninstallActive** A flag that represents when a device has uninstalled a previous upgrade recently.
- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
-- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates
-- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades
+- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates.
+- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades.
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
-- **WUPauseState** Retrieves WU setting to determine if updates are paused
+- **WUPauseState** Retrieves WU setting to determine if updates are paused.
- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
@@ -1666,102 +1656,279 @@ The following fields are available:
- **XboxConsolePreferredLanguage** Retrieves the preferred language selected by the user on Xbox console.
- **XboxConsoleSerialNumber** Retrieves the serial number of the Xbox console.
-- **XboxLiveDeviceId** Retrieves the unique device id of the console.
-- **XboxLiveSandboxId** Retrieves the developer sandbox id if the device is internal to MS.
+- **XboxLiveDeviceId** Retrieves the unique device ID of the console.
+- **XboxLiveSandboxId** Retrieves the developer sandbox ID if the device is internal to Microsoft.
-## Deployment events
+## Common data extensions
-### DeploymentTelemetry.Deployment_End
+### Common Data Extensions.app
-Event to indicate that a Deployment 360 API has completed.
+Describes the properties of the running application. This extension could be populated by a client app or a web app.
The following fields are available:
-- **ClientId** Client ID of user utilizing the D360 API
-- **ErrorCode** Error code of action
-- **FlightId** Flight being used
-- **Mode** Phase in upgrade
-- **RelatedCV** CV of any other related events
-- **Result** End result of action
+- **asId** An integer value that represents the app session. This value starts at 0 on the first app launch and increments after each subsequent app launch per boot session.
+- **env** The environment from which the event was logged.
+- **expId** Associates a flight, such as an OS flight, or an experiment, such as a web site UX experiment, with an event.
+- **id** Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application.
+- **locale** The locale of the app.
+- **name** The name of the app.
+- **userId** The userID as known by the application.
+- **ver** Represents the version number of the application. Used to understand errors by Version, Usage by Version across an app.
+
+
+### Common Data Extensions.container
+
+Describes the properties of the container for events logged within a container.
+
+The following fields are available:
+
+- **epoch** An ID that's incremented for each SDK initialization.
+- **localId** The device ID as known by the client.
+- **osVer** The operating system version.
+- **seq** An ID that's incremented for each event.
+- **type** The container type. Examples: Process or VMHost
+
+
+### Common Data Extensions.cs
+
+Describes properties related to the schema of the event.
+
+The following fields are available:
+
+- **sig** A common schema signature that identifies new and modified event schemas.
+
+
+### Common Data Extensions.device
+
+Describes the device-related fields.
+
+The following fields are available:
+
+- **deviceClass** The device classification. For example, Desktop, Server, or Mobile.
+- **localId** A locally-defined unique ID for the device. This is not the human-readable device name. Most likely equal to the value stored at HKLM\Software\Microsoft\SQMClient\MachineId
+- **make** Device manufacturer.
+- **model** Device model.
+
+
+### Common Data Extensions.Envelope
+
+Represents an envelope that contains all of the common data extensions.
+
+The following fields are available:
+
+- **cV** Represents the Correlation Vector: A single field for tracking partial order of related telemetry events across component boundaries.
+- **data** Represents the optional unique diagnostic data for a particular event schema.
+- **ext_app** Describes the properties of the running application. This extension could be populated by either a client app or a web app. See [Common Data Extensions.app](#common-data-extensionsapp).
+- **ext_container** Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer).
+- **ext_cs** Describes properties related to the schema of the event. See [Common Data Extensions.cs](#common-data-extensionscs).
+- **ext_device** Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice).
+- **ext_os** Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos).
+- **ext_receipts** Describes the fields related to time as provided by the client for debugging purposes. See [Common Data Extensions.receipts](#common-data-extensionsreceipts).
+- **ext_sdk** Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk).
+- **ext_user** Describes the fields related to a user. See [Common Data Extensions.user](#common-data-extensionsuser).
+- **ext_utc** Describes the fields that might be populated by a logging library on Windows. See [Common Data Extensions.utc](#common-data-extensionsutc).
+- **ext_xbl** Describes the fields related to XBOX Live. See [Common Data Extensions.xbl](#common-data-extensionsxbl).
+- **flags** Represents a collection of bits that describe how the event should be processed by the Connected User Experience and Telemetry component pipeline. The lowest-order byte is the event persistence. The next byte is the event latency.
+- **iKey** Represents an ID for applications or other logical groupings of events.
+- **name** Represents the uniquely qualified name for the event.
+- **popSample** Represents the effective sample rate for this event at the time it was generated by a client.
+- **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format.
+- **ver** Represents the major and minor version of the extension.
+
+
+### Common Data Extensions.os
+
+Describes some properties of the operating system.
+
+The following fields are available:
+
+- **bootId** An integer value that represents the boot session. This value starts at 0 on first boot after OS install and increments after every reboot.
+- **expId** Represents the experiment ID. The standard for associating a flight, such as an OS flight (pre-release build), or an experiment, such as a web site UX experiment, with an event is to record the flight / experiment IDs in Part A of the common schema.
+- **locale** Represents the locale of the operating system.
+- **name** Represents the operating system name.
+- **ver** Represents the major and minor version of the extension.
+
+
+### Common Data Extensions.receipts
+
+Represents various time information as provided by the client and helps for debugging purposes.
+
+The following fields are available:
+
+- **originalTime** The original event time.
+- **uploadTime** The time the event was uploaded.
+
+
+### Common Data Extensions.sdk
+
+Used by platform specific libraries to record fields that are required for a specific SDK.
+
+The following fields are available:
+
+- **epoch** An ID that is incremented for each SDK initialization.
+- **installId** An ID that's created during the initialization of the SDK for the first time.
+- **libVer** The SDK version.
+- **seq** An ID that is incremented for each event.
+
+
+### Common Data Extensions.user
+
+Describes the fields related to a user.
+
+The following fields are available:
+
+- **authId** This is an ID of the user associated with this event that is deduced from a token such as a Microsoft Account ticket or an XBOX token.
+- **locale** The language and region.
+- **localId** Represents a unique user identity that is created locally and added by the client. This is not the user's account ID.
+
+
+### Common Data Extensions.utc
+
+Describes the properties that could be populated by a logging library on Windows.
+
+The following fields are available:
+
+- **aId** Represents the ETW ActivityId. Logged via TraceLogging or directly via ETW.
+- **bSeq** Upload buffer sequence number in the format: buffer identifier:sequence number
+- **cat** Represents a bitmask of the ETW Keywords associated with the event.
+- **cpId** The composer ID, such as Reference, Desktop, Phone, Holographic, Hub, IoT Composer.
+- **epoch** Represents the epoch and seqNum fields, which help track how many events were fired and how many events were uploaded, and enables identification of data lost during upload and de-duplication of events on the ingress server.
+- **flags** Represents the bitmap that captures various Windows specific flags.
+- **mon** Combined monitor and event sequence numbers in the format: monitor sequence : event sequence
+- **op** Represents the ETW Op Code.
+- **raId** Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW.
+- **seq** Represents the sequence field used to track absolute order of uploaded events. It is an incrementing identifier for each event added to the upload queue. The Sequence helps track how many events were fired and how many events were uploaded and enables identification of data lost during upload and de-duplication of events on the ingress server.
+- **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID.
+
+
+### Common Data Extensions.xbl
+
+Describes the fields that are related to XBOX Live.
+
+The following fields are available:
+
+- **claims** Any additional claims whose short claim name hasn't been added to this structure.
+- **did** XBOX device ID
+- **dty** XBOX device type
+- **dvr** The version of the operating system on the device.
+- **eid** A unique ID that represents the developer entity.
+- **exp** Expiration time
+- **ip** The IP address of the client device.
+- **nbf** Not before time
+- **pid** A comma separated list of PUIDs listed as base10 numbers.
+- **sbx** XBOX sandbox identifier
+- **sid** The service instance ID.
+- **sty** The service type.
+- **tid** The XBOX Live title ID.
+- **tvr** The XBOX Live title version.
+- **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts.
+- **xid** A list of base10-encoded XBOX User IDs.
+
+
+## Common data fields
+
+### Ms.Device.DeviceInventoryChange
+
+Describes the installation state for all hardware and software components available on a particular device.
+
+The following fields are available:
+
+- **action** The change that was invoked on a device inventory object.
+- **inventoryId** Device ID used for Compatibility testing
+- **objectInstanceId** Object identity which is unique within the device scope.
+- **objectType** Indicates the object type that the event applies to.
+- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object.
+
+
+## Compatibility events
+
+### Microsoft.Windows.Compatibility.Apphelp.SdbFix
+
+Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components.
+
+The following fields are available:
+
+- **AppName** Name of the application impacted by SDB.
+- **FixID** SDB GUID.
+- **Flags** List of flags applied.
+- **ImageName** Name of file.
+
+
+## Deployment extensions
+
+### DeploymentTelemetry.Deployment_End
+
+This event indicates that a Deployment 360 API has completed.
+
+The following fields are available:
+
+- **ClientId** Client ID of the user utilizing the D360 API.
+- **ErrorCode** Error code of action.
+- **FlightId** The specific ID of the Windows Insider build the device is getting.
+- **Mode** Phase in upgrade.
+- **RelatedCV** The correction vector (CV) of any other related events
+- **Result** End result of the action.
### DeploymentTelemetry.Deployment_Initialize
-Event to indicate that the Deployment 360 APIs have been initialized for use.
+This event indicates that the Deployment 360 APIs have been initialized for use.
The following fields are available:
-- **ClientId** Client ID of user utilizing the D360 API
-- **ErrorCode** Error code of action
-- **FlightId** Flight being used
-- **RelatedCV** CV of any other related events
-- **Result** Phase Setup is in
+- **ClientId** Client ID of user utilizing the D360 API.
+- **ErrorCode** Error code of the action.
+- **FlightId** The specific ID of the Windows Insider build the device is getting.
+- **RelatedCV** The correlation vector of any other related events.
+- **Result** End result of the action.
### DeploymentTelemetry.Deployment_SetupBoxLaunch
-Event to indicate that the Deployment 360 APIs have launched Setup Box.
+This event indicates that the Deployment 360 APIs have launched Setup Box.
The following fields are available:
-- **ClientId** Client ID of user utilizing the D360 API
-- **FlightId** Flight being used
-- **Quiet** Whether Setup will run in quiet mode or in full
-- **RelatedCV** CV of any other related events
-- **SetupMode** Phase Setup is in
+- **ClientId** The client ID of the user utilizing the D360 API.
+- **FlightId** The specific ID of the Windows Insider build the device is getting.
+- **Quiet** Whether Setup will run in quiet mode or full mode.
+- **RelatedCV** The correlation vector (CV) of any other related events.
+- **SetupMode** The current setup phase.
### DeploymentTelemetry.Deployment_SetupBoxResult
-Event to indicate that the Deployment 360 APIs have received a return from Setup Box.
+This event indicates that the Deployment 360 APIs have received a return from Setup Box.
The following fields are available:
-- **ClientId** Client ID of user utilizing the D360 API
-- **ErrorCode** Error code of action
-- **FlightId** Flight being used
-- **Quiet** Whether Setup will run in quiet mode or in full
-- **RelatedCV** Correlation vector of any other related events
-- **SetupMode** Phase that Setup is in
+- **ClientId** Client ID of the user utilizing the D360 API.
+- **ErrorCode** Error code of the action.
+- **FlightId** The specific ID of the Windows Insider build the device is getting.
+- **Quiet** Indicates whether Setup will run in quiet mode or full mode.
+- **RelatedCV** The correlation vector (CV) of any other related events.
+- **SetupMode** The current Setup phase.
### DeploymentTelemetry.Deployment_Start
-Event to indicate that a Deployment 360 API has been called.
+This event indicates that a Deployment 360 API has been called.
The following fields are available:
-- **ClientId** Client ID of user utilizing the D360 API
-- **FlightId** Flight being used
-- **Mode** Phase in upgrade
-- **RelatedCV** CV of any other related events
+- **ClientId** Client ID of the user utilizing the D360 API.
+- **FlightId** The specific ID of the Windows Insider build the device is getting.
+- **Mode** The current phase of the upgrade.
+- **RelatedCV** The correlation vector (CV) of any other related events.
## Diagnostic data events
-### TelClientSynthetic.AuthorizationInfo_RuntimeTransition
-
-Fired by UTC at state transitions to signal what data we are allowed to collect.
-
-The following fields are available:
-
-- **CanAddMsaToMsTelemetry** True if we can add MSA PUID and CID to telemetry, false otherwise.
-- **CanCollectAnyTelemetry** True if we are allowed to collect partner telemetry, false otherwise.
-- **CanCollectCoreTelemetry** True if we can collect CORE/Basic telemetry, false otherwise.
-- **CanCollectHeartbeats** True if we can collect heartbeat telemetry, false otherwise.
-- **CanCollectOsTelemetry** True if we can collect diagnostic data telemetry, false otherwise.
-- **CanCollectWindowsAnalyticsEvents** True if we can collect Windows Analytics data, false otherwise.
-- **CanPerformDiagnosticEscalations** True if we can perform diagnostic escalation collection, false otherwise.
-- **CanPerformTraceEscalations** True if we can perform trace escalation collection, false otherwise.
-- **CanReportScenarios** True if we can report scenario completions, false otherwise.
-- **PreviousPermissions** Bitmask of previous telemetry state.
-- **TransitionFromEverythingOff** True if we are transitioning from all telemetry being disabled, false otherwise.
-
-
### TelClientSynthetic.AuthorizationInfo_Startup
-Fired by UTC at startup to signal what data we are allowed to collect.
+This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect.
The following fields are available:
@@ -1780,18 +1947,18 @@ The following fields are available:
### TelClientSynthetic.HeartBeat_5
-Fired by UTC as a heartbeat signal.
+This event sends data about the health and quality of the diagnostic data from the given device, to help keep Windows up to date. It also enables data analysts to determine how 'trusted' the data is from a given device.
The following fields are available:
- **AgentConnectionErrorsCount** Number of non-timeout errors associated with the host/agent channel.
-- **CensusExitCode** Last exit code of Census task.
+- **CensusExitCode** The last exit code of the Census task.
- **CensusStartTime** Time of last Census run.
- **CensusTaskEnabled** True if Census is enabled, false otherwise.
- **CompressedBytesUploaded** Number of compressed bytes uploaded.
- **ConsumerDroppedCount** Number of events dropped at consumer layer of telemetry client.
- **CriticalDataDbDroppedCount** Number of critical data sampled events dropped at the database layer.
-- **CriticalDataThrottleDroppedCount** Number of critical data sampled events dropped due to�throttling.
+- **CriticalDataThrottleDroppedCount** The number of critical data sampled events that were dropped because of throttling.
- **CriticalOverflowEntersCounter** Number of times critical overflow mode was entered in event DB.
- **DbCriticalDroppedCount** Total number of dropped critical events in event DB.
- **DbDroppedCount** Number of events dropped due to DB fullness.
@@ -1802,6 +1969,9 @@ The following fields are available:
- **EtwDroppedBufferCount** Number of buffers dropped in the UTC ETW session.
- **EtwDroppedCount** Number of events dropped at ETW layer of telemetry client.
- **EventsPersistedCount** Number of events that reached the PersistEvent stage.
+- **EventStoreLifetimeResetCounter** Number of times event DB was reset for the lifetime of UTC.
+- **EventStoreResetCounter** Number of times event DB was reset.
+- **EventStoreResetSizeSum** Total size of event DB across all resets reports in this instance.
- **EventSubStoreResetCounter** Number of times event DB was reset.
- **EventSubStoreResetSizeSum** Total size of event DB across all resets reports in this instance.
- **EventsUploaded** Number of events uploaded.
@@ -1812,41 +1982,38 @@ The following fields are available:
- **LastAgentConnectionError** Last non-timeout error encountered in the host/agent channel.
- **LastEventSizeOffender** Event name of last event which exceeded max event size.
- **LastInvalidHttpCode** Last invalid HTTP code received from Vortex.
-- **MaxActiveAgentConnectionCount** Maximum number of active agents during this heartbeat timeframe.
+- **MaxActiveAgentConnectionCount** The maximum number of active agents during this heartbeat timeframe.
- **MaxInUseScenarioCounter** Soft maximum number of scenarios loaded by UTC.
- **PreviousHeartBeatTime** Time of last heartbeat event (allows chaining of events).
- **SettingsHttpAttempts** Number of attempts to contact OneSettings service.
-- **SettingsHttpFailures** Number of failures from contacting OneSettings service.
+- **SettingsHttpFailures** The number of failures from contacting the OneSettings service.
- **ThrottledDroppedCount** Number of events dropped due to throttling of noisy providers.
- **UploaderDroppedCount** Number of events dropped at the uploader layer of telemetry client.
-- **VortexFailuresTimeout** Number of time out failures received from Vortex.
+- **VortexFailuresTimeout** The number of timeout failures received from Vortex.
- **VortexHttpAttempts** Number of attempts to contact Vortex.
- **VortexHttpFailures4xx** Number of 400-499 error codes received from Vortex.
- **VortexHttpFailures5xx** Number of 500-599 error codes received from Vortex.
- **VortexHttpResponseFailures** Number of Vortex responses that are not 2XX or 400.
- **VortexHttpResponsesWithDroppedEvents** Number of Vortex responses containing at least 1 dropped event.
-- **EventStoreLifetimeResetCounter** Number of times event DB was reset for the lifetime of UTC.
-- **EventStoreResetCounter** Number of times event DB was reset.
-- **EventStoreResetSizeSum** Total size of event DB across all resets reports in this instance.
### TelClientSynthetic.HeartBeat_Aria_5
-Telemetry client ARIA heartbeat event.
+This event is the telemetry client ARIA heartbeat.
The following fields are available:
- **CompressedBytesUploaded** Number of compressed bytes uploaded.
- **CriticalDataDbDroppedCount** Number of critical data sampled events dropped at the database layer.
-- **CriticalOverflowEntersCounter** Number of times critical overflow mode was entered in event DB.
-- **DbCriticalDroppedCount** Total number of dropped critical events in event DB.
-- **DbDroppedCount** Number of events dropped at the DB layer.
-- **DbDroppedFailureCount** Number of events dropped due to DB failures.
-- **DbDroppedFullCount** Number of events dropped due to DB fullness.
+- **CriticalOverflowEntersCounter** Number of times critical overflow mode was entered in event database.
+- **DbCriticalDroppedCount** Total number of dropped critical events in event database.
+- **DbDroppedCount** Number of events dropped at the database layer.
+- **DbDroppedFailureCount** Number of events dropped due to database failures.
+- **DbDroppedFullCount** Number of events dropped due to database being full.
- **EnteringCriticalOverflowDroppedCounter** Number of events dropped due to critical overflow mode being initiated.
- **EventsPersistedCount** Number of events that reached the PersistEvent stage.
-- **EventSubStoreResetCounter** Number of times event DB was reset.
-- **EventSubStoreResetSizeSum** Total size of event DB across all resets reports in this instance.
+- **EventSubStoreResetCounter** Number of times event database was reset.
+- **EventSubStoreResetSizeSum** Total size of event database across all resets reports in this instance.
- **EventsUploaded** Number of events uploaded.
- **HeartBeatSequenceNumber** The sequence number of this heartbeat.
- **InvalidHttpCodeCount** Number of invalid HTTP codes received from contacting Vortex.
@@ -1854,7 +2021,7 @@ The following fields are available:
- **LastInvalidHttpCode** Last invalid HTTP code received from Vortex.
- **PreviousHeartBeatTime** The FILETIME of the previous heartbeat fire.
- **SettingsHttpAttempts** Number of attempts to contact OneSettings service.
-- **SettingsHttpFailures** Number of failures from contacting OneSettings service.
+- **SettingsHttpFailures** Number of failures from contacting OneSettings service.
- **UploaderDroppedCount** Number of events dropped at the uploader layer of telemetry client.
- **VortexFailuresTimeout** Number of time out failures received from Vortex.
- **VortexHttpAttempts** Number of attempts to contact Vortex.
@@ -1864,21 +2031,11 @@ The following fields are available:
- **VortexHttpResponsesWithDroppedEvents** Number of Vortex responses containing at least 1 dropped event.
-### TelClientSynthetic.PrivacySettingsAfterCreatorsUpdate
-
-This event sends basic data on privacy settings before and after a feature update. This is used to ensure that customer privacy settings are correctly migrated across feature updates.
-
-The following fields are available:
-
-- **PostUpgradeSettings** The privacy settings after a feature update.
-- **PreUpgradeSettings** The privacy settings before a feature update.
-
-
## Direct to update events
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicability
-Event to indicate that the Coordinator CheckApplicability call succeeded.
+This event indicates that the Coordinator CheckApplicability call succeeded.
The following fields are available:
@@ -1891,11 +2048,36 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Coordinators CheckApplicability call.
+This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call.
The following fields are available:
+- **CampaignID** ID of the campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
- **hResult** HRESULT of the failure.
+
+
+### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupGenericFailure
+
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call.
+
+The following fields are available:
+
+- **CampaignID** Campaign ID being run.
+- **ClientID** Client ID being run.
+- **CoordinatorVersion** Coordinator version of DTU.
+- **CV** Correlation vector.
+- **hResult** HRESULT of the failure.
+
+
+### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupSuccess
+
+This event indicates that the Coordinator Cleanup call succeeded.
+
+The following fields are available:
+
- **CampaignID** Campaign ID being run.
- **ClientID** Client ID being run.
- **CoordinatorVersion** Coordinator version of DTU.
@@ -1904,20 +2086,20 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitGenericFailure
-Commit call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call.
The following fields are available:
-- **hResult** HRESULT of the failure.
- **CampaignID** Campaign ID being run.
- **ClientID** Client ID being run.
- **CoordinatorVersion** Coordinator version of DTU.
- **CV** Correlation vector.
+- **hResult** HRESULT of the failure.
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitSuccess
-Event to indicate that the Coordinator Commit call succeeded.
+This event indicates that the Coordinator Commit call succeeded.
The following fields are available:
@@ -1929,7 +2111,7 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Coordinator Download call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call.
The following fields are available:
@@ -1942,7 +2124,7 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadIgnoredFailure
-Event to indicate that we have received an error in the DTU Coordinator Download call that will be ignored.
+This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored.
The following fields are available:
@@ -1955,7 +2137,7 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadSuccess
-Event to indicate that the Coordinator Download call succeeded.
+This event indicates that the Coordinator Download call succeeded.
The following fields are available:
@@ -1967,7 +2149,7 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Coordinator HandleShutdown call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call.
The following fields are available:
@@ -1980,7 +2162,7 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownSuccess
-Event to indicate that the Coordinator HandleShutdown call succeeded.
+This event indicates that the Coordinator HandleShutdown call succeeded.
The following fields are available:
@@ -1992,20 +2174,20 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Coordinator Initialize call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call.
The following fields are available:
-- **hResult** HRESULT of the failure.
- **CampaignID** Campaign ID being run.
- **ClientID** Client ID being run.
- **CoordinatorVersion** Coordinator version of DTU.
- **CV** Correlation vector.
+- **hResult** HRESULT of the failure.
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeSuccess
-Event to indicate that the Coordinator Initialize call succeeded.
+This event indicates that the Coordinator Initialize call succeeded.
The following fields are available:
@@ -2017,7 +2199,7 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Coordinator Install call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call.
The following fields are available:
@@ -2030,7 +2212,7 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallIgnoredFailure
-Event to indicate that we have received an error in the DTU Coordinator Install call that will be ignored.
+This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored.
The following fields are available:
@@ -2043,7 +2225,7 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallSuccess
-Event to indicate that the Coordinator Install call succeeded.
+This event indicates that the Coordinator Install call succeeded.
The following fields are available:
@@ -2055,21 +2237,20 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorProgressCallBack
-Event to indicate Coordinator's progress callback has been called.
+This event indicates that the Coordinator's progress callback has been called.
The following fields are available:
-- **Current Deploy Phase's percentage completed** Trigger which fired UXLauncher.
-- **DeployPhase** Current Deploy Phase.
- **CampaignID** Campaign ID being run.
- **ClientID** Client ID being run.
- **CoordinatorVersion** Coordinator version of DTU.
- **CV** Correlation vector.
+- **DeployPhase** Current Deploy Phase.
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorSetCommitReadyGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Coordinator SetCommitReady call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator SetCommitReady call.
The following fields are available:
@@ -2082,19 +2263,19 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorSetCommitReadySuccess
-Event to indicate that the Coordinator SetCommitReady call succeeded.
+This event indicates that the Coordinator SetCommitReady call succeeded.
The following fields are available:
-- **CampaignID** Campaign ID being run.
-- **ClientID** Client ID being run.
-- **CoordinatorVersion** Coordinator version of DTU.
+- **CampaignID** ID of the update campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
- **CV** Correlation vector.
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Coordinator WaitForRebootUi call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator WaitForRebootUi call.
The following fields are available:
@@ -2107,99 +2288,99 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiNotShown
-Event to indicate that the Coordinator WaitForRebootUi call succeeded.
+This event indicates that the Coordinator WaitForRebootUi call succeeded.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
-- **hResult** HRESULT of the failure
+- **CampaignID** Campaign ID being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
+- **hResult** HRESULT of the failure.
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSelection
-Event to indicate the user selected an option on the Reboot UI.
+This event indicates that the user selected an option on the Reboot UI.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
-- **rebootUiSelection** Selection on the Reboot UI
+- **CampaignID** ID of the update campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
+- **rebootUiSelection** Selection on the Reboot UI.
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSuccess
-Event to indicate that the Coordinator WaitForRebootUi call succeeded.
+This event indicates that the Coordinator WaitForRebootUi call succeeded.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
+- **CampaignID** ID of the update campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Handler CheckApplicability call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call.
The following fields are available:
-- **hResult** HRESULT of the failure
- **CampaignID** Campaign ID being run
- **ClientID** Client ID being run
- **CoordinatorVersion** Coordinator version of DTU
- **CV** Correlation vector
- **CV_new** New correlation vector
+- **hResult** HRESULT of the failure
### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Handler CheckApplicabilityInternal call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
-- **hResult** HRESULT of the failure
+- **CampaignID** ID of the campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
+- **hResult** HRESULT of the failure.
### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalSuccess
-Event to indicate that the Handler CheckApplicabilityInternal call succeeded.
+This event indicates that the Handler CheckApplicabilityInternal call succeeded.
The following fields are available:
-- **ApplicabilityResult** Result of CheckApplicability function
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
+- **ApplicabilityResult** The result of the applicability check.
+- **CampaignID** ID of the update campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilitySuccess
-Event to indicate that the Handler CheckApplicability call succeeded.
+This event indicates that the Handler CheckApplicability call succeeded.
The following fields are available:
-- **ApplicabilityResult** Result of CheckApplicability function
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
-- **CV_new** New correlation vector
+- **ApplicabilityResult** The result code indicating whether the update is applicable.
+- **CampaignID** ID of the update campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
+- **CV_new** New correlation vector.
### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Handler CheckIfCoordinatorMinApplicableVersion call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckIfCoordinatorMinApplicableVersion call.
The following fields are available:
@@ -2212,47 +2393,47 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionSuccess
-Event to indicate that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded.
+This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **CheckIfCoordinatorMinApplicableVersionResult** Result of CheckIfCoordinatorMinApplicableVersion function
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
+- **CampaignID** ID of the update campaign being run.
+- **CheckIfCoordinatorMinApplicableVersionResult** Result of CheckIfCoordinatorMinApplicableVersion function.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Handler Commit call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
-- **CV_new** New correlation vector
-- **hResult** HRESULT of the failure
+- **CampaignID** ID of the update campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
+- **CV_new** New correlation vector.
+- **hResult** HRESULT of the failure.
### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitSuccess
-Event to indicate that the Handler Commit call succeeded.
+This event indicates that the Handler Commit call succeeded.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
-- **CV_new** New correlation vector
+- **CampaignID** ID of the update campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
+- **CV_new** New correlation vector.
### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabAlreadyDownloaded
-Event to indicate that the Handler Download and Extract cab returned a value indicating that the cab trying to be downloaded has already been downloaded.
+This event indicates that the Handler Download and Extract cab returned a value indicating that the cab has already been downloaded.
The following fields are available:
@@ -2264,199 +2445,215 @@ The following fields are available:
### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabFailure
-Event to indicate that the Handler Download and Extract cab call failed.
+This event indicates that the Handler Download and Extract cab call failed.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
-- **DownloadAndExtractCabFunction_failureReason** Reason why the DownloadAndExtractCab function failed
-- **hResult** HRESULT of the failure
+- **CampaignID** ID of the update campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
+- **DownloadAndExtractCabFunction_failureReason** Reason why the update download and extract process failed.
+- **hResult** HRESULT of the failure.
### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabSuccess
-Event to indicate that the Handler Download and Extract cab call succeeded.
+This event indicates that the Handler Download and Extract cab call succeeded.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
+- **CampaignID** ID of the update campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Handler Download call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
-- **hResult** HRESULT of the failure
+- **CampaignID** ID of the update campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
+- **hResult** HRESULT of the failure.
### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadSuccess
-Event to indicate that the Handler Download call succeeded.
+This event indicates that the Handler Download call succeeded.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
+- **CampaignID** ID of the update campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Handler Initialize call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
-- **DownloadAndExtractCabFunction_hResult** HRESULT of the DownloadAndExtractCab function
-- **hResult** HRESULT of the failure
+- **CampaignID** ID of the update campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
+- **DownloadAndExtractCabFunction_hResult** HRESULT of the download and extract.
+- **hResult** HRESULT of the failure.
### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeSuccess
-Event to indicate that the Handler Initialize call succeeded.
+This event indicates that the Handler Initialize call succeeded.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
-- **DownloadAndExtractCabFunction_hResult** HRESULT of the DownloadAndExtractCab function
+- **CampaignID** ID of the update campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
+- **DownloadAndExtractCabFunction_hResult** HRESULT of the download and extraction.
### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Handler Install call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
-- **hResult** HRESULT of the failure
+- **CampaignID** ID of the update campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
+- **hResult** HRESULT of the failure.
### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallSuccess
-Event to indicate that the Coordinator Install call succeeded.
+This event indicates that the Coordinator Install call succeeded.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
+- **CampaignID** ID of the update campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadyGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Handler SetCommitReady call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler SetCommitReady call.
The following fields are available:
-- **hResult** HRESULT of the failure
- **CampaignID** Campaign ID being run
- **ClientID** Client ID being run
- **CoordinatorVersion** Coordinator version of DTU
- **CV** Correlation vector
+- **hResult** HRESULT of the failure
### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadySuccess
-Event to indicate that the Handler SetCommitReady call succeeded.
+This event indicates that the Handler SetCommitReady call succeeded.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
+- **CampaignID** ID of the campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiGenericFailure
-Event to indicate that we have received an unexpected error in the DTU Handler WaitForRebootUi call.
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call.
The following fields are available:
-- **hResult** HRESULT of the failure
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
+- **CampaignID** The ID of the campaigning being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
+- **hResult** The HRESULT of the failure.
### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiSuccess
-Event to indicate that the Handler WaitForRebootUi call succeeded.
+This event indicates that the Handler WaitForRebootUi call succeeded.
The following fields are available:
-- **CampaignID** Campaign ID being run
-- **ClientID** Client ID being run
-- **CoordinatorVersion** Coordinator version of DTU
-- **CV** Correlation vector
+- **CampaignID** ID of the campaign being run.
+- **ClientID** ID of the client receiving the update.
+- **CoordinatorVersion** Coordinator version of Direct to Update.
+- **CV** Correlation vector.
## Feature update events
### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed
-This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state
+This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state.
The following fields are available:
-- **failureReason** Provides data about the uninstall initialization operation failure
-- **hr** Provides the Win32 error code for the operation failure
+- **failureReason** Provides data about the uninstall initialization operation failure.
+- **hr** Provides the Win32 error code for the operation failure.
### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered
-Indicates that the uninstall was properly configured and that a system reboot was initiated
+This event indicates that the uninstall was properly configured and that a system reboot was initiated.
### Microsoft.Windows.Upgrade.Uninstall.UninstallGoBackButtonClicked
-This event sends basic metadata about the starting point of uninstalling a feature update which helps us ensure customers can safely revert to a well-known state if the update caused any problems.
+This event sends basic metadata about the starting point of uninstalling a feature update, which helps ensure customers can safely revert to a well-known state if the update caused any problems.
+
## Inventory events
### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum
-This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object.
+This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object.
The following fields are available:
-- **DriverPackageExtended** A count of driverpackageextended objects in cache
-- **FileSigningInfo** A count of file signing objects in cache
-- **InventoryApplication** A count of application objects in cache
-- **InventoryApplicationFile** A count of application file objects in cache
-- **InventoryDeviceContainer** A count of device container objects in cache
-- **InventoryDeviceInterface** A count of PNP device interface objects in cache
-- **InventoryDeviceMediaClass** A count of device media objects in cache
-- **InventoryDevicePnp** A count of devicepnp objects in cache
+- **DeviceCensus** A count of devicecensus objects in cache.
+- **DriverPackageExtended** A count of driverpackageextended objects in cache.
+- **FileSigningInfo** A count of file signing objects in cache.
+- **InventoryApplication** A count of application objects in cache.
+- **InventoryApplicationAppV** A count of application AppV objects in cache.
+- **InventoryApplicationDriver** A count of application driver objects in cache.
+- **InventoryApplicationFile** A count of application file objects in cache.
+- **InventoryApplicationFramework** A count of application framework objects in cache.
+- **InventoryApplicationShortcut** A count of application shortcut objects in cache.
+- **InventoryDeviceContainer** A count of device container objects in cache.
+- **InventoryDeviceInterface** A count of Plug and Play device interface objects in cache.
+- **InventoryDeviceMediaClass** A count of device media objects in cache.
+- **InventoryDevicePnp** A count of device Plug and Play objects in cache.
- **InventoryDeviceUsbHubClass** A count of device usb objects in cache
-- **InventoryDriverBinary** A count of driver binary objects in cache
-- **InventoryDriverPackage** A count of device objects in cache
+- **InventoryDriverBinary** A count of driver binary objects in cache.
+- **InventoryDriverPackage** A count of device objects in cache.
+- **InventoryMiscellaneousOfficeAddIn** A count of office add-in objects in cache.
+- **InventoryMiscellaneousOfficeAddInUsage** A count of office add-in usage objects in cache.
+- **InventoryMiscellaneousOfficeIdentifiers** A count of office identifier objects in cache.
+- **InventoryMiscellaneousOfficeIESettings** A count of office IE settings objects in cache.
+- **InventoryMiscellaneousOfficeInsights** A count of office insights objects in cache.
+- **InventoryMiscellaneousOfficeProducts** A count of office products objects in cache.
+- **InventoryMiscellaneousOfficeSettings** A count of office settings objects in cache.
+- **InventoryMiscellaneousOfficeVBA** A count of office VBA objects in cache.
+- **InventoryMiscellaneousOfficeVBARuleViolations** A count of office VBA rule violations objects in cache.
+- **InventoryMiscellaneousUUPInfo** A count of UUP info objects in cache.
### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions
@@ -2473,24 +2670,26 @@ The following fields are available:
This event sends basic metadata about an application on the system to help keep Windows up to date.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **HiddenArp** Indicates whether a program hides itself from showing up in ARP.
- **InstallDate** The date the application was installed (a best guess based on folder creation date heuristics).
- **InstallDateArpLastModified** The date of the registry ARP key for a given application. Hints at install date but not always accurate. Passed as an array. Example: 4/11/2015 00:00:00
- **InstallDateFromLinkFile** The estimated date of install based on the links to the files. Passed as an array.
-- **InstallDateMsi** The install date if the application was installed via MSI. Passed as an array.
+- **InstallDateMsi** The install date if the application was installed via Microsoft Installer (MSI). Passed as an array.
- **InventoryVersion** The version of the inventory file generating the events.
- **Language** The language code of the program.
- **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage.
- **MsiProductCode** A GUID that describe the MSI Product.
-- **Name** The name of the application
+- **Name** The name of the application.
- **OSVersionAtInstallTime** The four octets from the OS version at the time of the application's install.
- **PackageFullName** The package full name for a Store application.
- **ProgramInstanceId** A hash of the file IDs in an app.
- **Publisher** The Publisher of the application. Location pulled from depends on the 'Source' field.
- **RootDirPath** The path to the root directory where the program was installed.
-- **Source** How the program was installed (ARP, MSI, Appx, etc...)
+- **Source** How the program was installed (for example, ARP, MSI, Appx).
- **StoreAppType** A sub-classification for the type of Microsoft Store app, such as UWP or Win8StoreApp.
- **Type** One of ("Application", "Hotfix", "BOE", "Service", "Unknown"). Application indicates Win32 or Appx app, Hotfix indicates app updates (KBs), BOE indicates it's an app with no ARP or MSI entry, Service indicates that it is a service. Application and BOE are the ones most likely seen.
- **Version** The version number of the program.
@@ -2498,28 +2697,34 @@ The following fields are available:
### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd
-This event provides the basic metadata about the frameworks an application may depend on
+This event provides the basic metadata about the frameworks an application may depend on.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **FileId** A hash that uniquely identifies a file
-- **Frameworks** The list of frameworks this file depends on
-- **InventoryVersion** The version of the inventory file generating the events
+- **FileId** A hash that uniquely identifies a file.
+- **Frameworks** The list of frameworks this file depends on.
+- **InventoryVersion** The version of the inventory file generating the events.
### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync
-This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent
+This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **InventoryVersion** The version of the inventory file generating the events
+- **InventoryVersion** The version of the inventory file generating the events.
### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove
This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2529,6 +2734,8 @@ The following fields are available:
This event indicates that a new set of InventoryApplicationAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2536,7 +2743,9 @@ The following fields are available:
### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd
-This event sends basic metadata about a device container (such as a monitor or printer as opposed to a PNP device) to help keep Windows up-to-date.
+This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -2550,7 +2759,7 @@ The following fields are available:
- **IsNetworked** Is this a networked device?
- **IsPaired** Does the device container require pairing?
- **Manufacturer** The manufacturer name for the device container.
-- **ModelId** A model GUID.
+- **ModelId** A unique model ID.
- **ModelName** The model name.
- **ModelNumber** The model number for the device container.
- **PrimaryCategory** The primary category for the device container.
@@ -2560,6 +2769,8 @@ The following fields are available:
This event indicates that the InventoryDeviceContainer object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2569,6 +2780,8 @@ The following fields are available:
This event indicates that a new set of InventoryDeviceContainerAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2578,6 +2791,8 @@ The following fields are available:
This event retrieves information about what sensor interfaces are available on the device.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **Accelerometer3D** Indicates if an Accelerator3D sensor is found.
@@ -2606,6 +2821,8 @@ The following fields are available:
This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2613,7 +2830,9 @@ The following fields are available:
### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd
-This event sends additional metadata about a PNP device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload.
+This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -2626,6 +2845,8 @@ The following fields are available:
This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2633,7 +2854,9 @@ The following fields are available:
### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd
-This event represents the basic metadata about a PNP device and its associated driver
+This event represents the basic metadata about a plug and play (PNP) device and its associated driver.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -2650,7 +2873,7 @@ The following fields are available:
- **DriverVerDate** Name of the .sys image file (or wudfrd.sys if using user mode driver framework).
- **DriverVerVersion** The immediate parent directory name in the Directory field of InventoryDriverPackage.
- **Enumerator** The date of the driver loaded for the device.
-- **HWID** The version of the driver loaded for the device.
+- **HWID** The version of the driver loaded for the device.
- **Inf** The bus that enumerated the device.
- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx
- **InventoryVersion** List of hardware ids for the device.
@@ -2672,6 +2895,8 @@ The following fields are available:
This event indicates that the InventoryDevicePnpRemove object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2681,6 +2906,8 @@ The following fields are available:
This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2688,27 +2915,33 @@ The following fields are available:
### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd
-This event sends basic metadata about the USB hubs on the device
+This event sends basic metadata about the USB hubs on the device.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **InventoryVersion** The version of the inventory file generating the events
-- **TotalUserConnectablePorts** Total number of connectable USB ports
-- **TotalUserConnectableTypeCPorts** Total number of connectable USB Type C ports
+- **InventoryVersion** The version of the inventory file generating the events.
+- **TotalUserConnectablePorts** Total number of connectable USB ports.
+- **TotalUserConnectableTypeCPorts** Total number of connectable USB Type C ports.
### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync
-This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent
+This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **InventoryVersion** The version of the inventory file generating the events
+- **InventoryVersion** The version of the inventory file generating the events.
### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd
-This event provides the basic metadata about driver binaries running on the system
+This event provides the basic metadata about driver binaries running on the system.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -2727,7 +2960,7 @@ The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
- **Product** The product name that is included in the driver file.
- **ProductVersion** The product version that is included in the driver file.
-- **Service** The device service name
+- **Service** The name of the service that is installed for the device.
- **WdfVersion** The Windows Driver Framework version.
@@ -2735,6 +2968,8 @@ The following fields are available:
This event indicates that the InventoryDriverBinary object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2744,6 +2979,8 @@ The following fields are available:
This event indicates that a new set of InventoryDriverBinaryAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2751,7 +2988,9 @@ The following fields are available:
### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd
-This event sends basic metadata about drive packages installed on the system to help keep Windows up-to-date.
+This event sends basic metadata about drive packages installed on the system to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
@@ -2771,6 +3010,8 @@ The following fields are available:
This event indicates that the InventoryDriverPackageRemove object is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2780,6 +3021,8 @@ The following fields are available:
This event indicates that a new set of InventoryDriverPackageAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
@@ -2789,22 +3032,32 @@ The following fields are available:
Provides data on the installed Office Add-ins
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
+- **AddinCLSID** The CLSID for the Office addin
- **AddInCLSID** CLSID key for the office addin
- **AddInId** Office addin ID
+- **AddinType** The type of the Office addin.
- **BinFileTimestamp** Timestamp of the Office addin
- **BinFileVersion** Version of the Office addin
- **Description** Office addin description
- **FileId** FileId of the Office addin
+- **FileSize** File size of the Office addin
- **FriendlyName** Friendly name for office addin
- **FullPath** Unexpanded path to the office addin
+- **InventoryVersion** The version of the inventory binary generating the events.
- **LoadBehavior** Uint32 that describes the load behavior
- **LoadTime** Load time for the office addin
- **OfficeApplication** The office application for this addin
- **OfficeArchitecture** Architecture of the addin
- **OfficeVersion** The office version for this addin
- **OutlookCrashingAddin** Boolean that indicates if crashes have been found for this addin
+- **ProductCompany** The name of the company associated with the Office addin
+- **ProductName** The product name associated with the Office addin
+- **ProductVersion** The version associated with the Office addin
+- **ProgramId** The unique program identifier of the Office addin
- **Provider** Name of the provider for this addin
@@ -2812,20 +3065,59 @@ The following fields are available:
Indicates that this particular data object represented by the objectInstanceId is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync
This event indicates that a new sync is being generated for this object type.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory binary generating the events.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd
+
+Provides data on the Office identifiers
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory binary generating the events.
+- **OAudienceData** Sub-identifier for Microsoft Office release management, identifying the pilot group for a device
+- **OAudienceId** Microsoft Office identifier for Microsoft Office release management, identifying the pilot group for a device
+- **OMID** Identifier for the Office SQM Machine
+- **OPlatform** Whether the installed Microsoft Office product is 32-bit or 64-bit
+- **OTenantId** Unique GUID representing the Microsoft O365 Tenant
+- **OVersion** Installed version of Microsoft Office. For example, 16.0.8602.1000
+- **OWowMID** Legacy Microsoft Office telemetry identifier (SQM Machine ID) for WoW systems (32-bit Microsoft Office on 64-bit Windows)
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync
+
+Diagnostic event to indicate a new sync is being generated for this object type.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory binary generating the events.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd
-This event includes the Office-related Internet Explorer features
+Office-related Internet Explorer features
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
+- **InventoryVersion** The version of the inventory binary generating the events.
- **OIeFeatureAddon** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_ADDON_MANAGEMENT feature lets applications hosting the WebBrowser Control to respect add-on management selections made using the Add-on Manager feature of Internet Explorer. Add-ons disabled by the user or by administrative group policy will also be disabled in applications that enable this feature.
- **OIeMachineLockdown** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_LOCALMACHINE_LOCKDOWN feature is enabled, Internet Explorer applies security restrictions on content loaded from the user's local machine, which helps prevent malicious behavior involving local files.
- **OIeMimeHandling** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_MIME_HANDLING feature control is enabled, Internet Explorer handles MIME types more securely. Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2)
@@ -2847,62 +3139,55 @@ The following fields are available:
Diagnostic event to indicate a new sync is being generated for this object type.
-
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd
-
-This event provides data on the Office identifiers
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **OAudienceData** Sub-identifier for Microsoft Office release management, identifying the pilot group for a device
-- **OAudienceId** Microsoft Office identifier for Microsoft Office release management, identifying the pilot group for a device
-- **OMID** Identifier for the Office SQM Machine
-- **OPlatform** Whether the installed Microsoft Office product is 32-bit or 64-bit
-- **OTenantId** Unique GUID representing the Microsoft O365 Tenant
-- **OVersion** Installed version of Microsoft Office. For example, 16.0.8602.1000
-- **OWowMID** Legacy Microsoft Office telemetry identifier (SQM Machine ID) for WoW systems (32-bit Microsoft Office on 64-bit Windows)
-
-
-### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync
-
-Diagnostic event to indicate a new sync is being generated for this object type.
-
+- **InventoryVersion** The version of the inventory binary generating the events.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd
This event provides insight data on the installed Office products
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **OfficeApplication** The name of the Office application.
- **OfficeArchitecture** The bitness of the Office application.
- **OfficeVersion** The version of the Office application.
-- **Value** The insights collected about this entity.
+- **Value** The insights collected about this entity.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove
Indicates that this particular data object represented by the objectInstanceId is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync
This diagnostic event indicates that a new sync is being generated for this object type.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd
-This event list all installed Office products
+Describes Office Products installed
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
+- **InventoryVersion** The version of the inventory binary generating the events.
- **OC2rApps** A GUID the describes the Office Click-To-Run apps
-- **OC2rSkus** Comma-delimited list (CSV) of Office Click-To-Run products installed on the device. For example, Office 2016 ProPlus
-- **OMsiApps** Comma-delimited list (CSV) of Office MSI products installed on the device. For example, Microsoft Word
+- **OC2rSkus** Comma-delimited list (CSV) of Office Click-To-Run products installed on the device. For example, Office 2016 ProPlus
+- **OMsiApps** Comma-delimited list (CSV) of Office MSI products installed on the device. For example, Microsoft Word
- **OProductCodes** A GUID that describes the Office MSI products
@@ -2910,16 +3195,24 @@ The following fields are available:
Diagnostic event to indicate a new sync is being generated for this object type.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory binary generating the events.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd
This event describes various Office settings
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **BrowserFlags** Browser flags for Office-related products
- **ExchangeProviderFlags** Provider policies for Office Exchange
+- **InventoryVersion** The version of the inventory binary generating the events.
- **SharedComputerLicensing** Office shared computer licensing policies
@@ -2927,12 +3220,19 @@ The following fields are available:
Diagnostic event to indicate a new sync is being generated for this object type.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory binary generating the events.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd
This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **Design** Count of files with design issues found
@@ -2962,12 +3262,16 @@ The following fields are available:
Indicates that this particular data object represented by the objectInstanceId is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd
This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **Count** Count of total Microsoft Office VBA rule violations
@@ -2977,24 +3281,35 @@ The following fields are available:
Indicates that this particular data object represented by the objectInstanceId is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync
This event indicates that a new sync is being generated for this object type.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync
Diagnostic event to indicate a new sync is being generated for this object type.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion** The version of the inventory binary generating the events.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd
Provides data on Unified Update Platform (UUP) products and what version they are at.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
The following fields are available:
- **Identifier** UUP identifier
@@ -3008,12 +3323,16 @@ The following fields are available:
Indicates that this particular data object represented by the objectInstanceId is no longer present.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync
Diagnostic event to indicate a new sync is being generated for this object type.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
### Microsoft.Windows.Inventory.Indicators.Checksum
@@ -3028,402 +3347,97 @@ The following fields are available:
### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd
-These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up-to-date.
+These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
-- **IndicatorValue** The indicator value
+- **IndicatorValue** The indicator value.
### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove
This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync
This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent.
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
-## Microsoft Store events
-### Microsoft.Windows.StoreAgent.Telemetry.AbortedInstallation
+## Kernel events
-This event is sent when an installation or update is canceled by a user or the system and is used to help keep Windows Apps up to date and secure.
+### IO
+
+This event indicates the number of bytes read from or read by the OS and written to or written by the OS upon system startup.
The following fields are available:
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-- **AttemptNumber** Number of retry attempts before it was canceled.
-- **BundleId** The Item Bundle ID.
-- **CategoryId** The Item Category ID.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **HResult** The result code of the last action performed before this operation.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Was this requested by a user?
-- **IsMandatory** Was this a mandatory update?
-- **IsRemediation** Was this a remediation install?
-- **IsRestore** Is this automatically restoring a previously acquired product?
-- **IsUpdate** Flag indicating if this is an update.
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** The product family name of the product being installed.
-- **ProductId** The identity of the package or packages being installed.
-- **SystemAttemptNumber** The total number of automatic attempts at installation before it was canceled.
-- **UserAttemptNumber** The total number of user attempts at installation before it was canceled.
-- **WUContentId** The Windows Update content ID
+- **BytesRead** The total number of bytes read from or read by the OS upon system startup.
+- **BytesWritten** The total number of bytes written to or written by the OS upon system startup.
-### Microsoft.Windows.StoreAgent.Telemetry.BeginGetInstalledContentIds
+### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch
-This event is sent when an inventory of the apps installed is started to determine whether updates for those apps are available. It's used to help keep Windows up-to-date and secure.
-
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.BeginUpdateMetadataPrepare
-
-This event is sent when the Store Agent cache is refreshed with any available package updates. It's used to help keep Windows up-to-date and secure.
-
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.CancelInstallation
-
-This event is sent when an app update or installation is canceled while in interactive mode. This can be canceled by the user or the system. It's used to help keep Windows up-to-date and secure.
+OS information collected during Boot, used to evaluate the success of the upgrade process.
The following fields are available:
-- **AggregatedPackageFullNames** The names of all package or packages to be downloaded and installed.
-- **AttemptNumber** Total number of installation attempts.
-- **BundleId** The identity of the Windows Insider build that is associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Was this requested by a user?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this an automatic restore of a previously acquired product?
-- **IsUpdate** Is this a product update?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** The name of all packages to be downloaded and installed.
-- **PreviousHResult** The previous HResult code.
-- **PreviousInstallState** Previous installation state before it was canceled.
-- **ProductId** The name of the package or packages requested for installation.
-- **RelatedCV** Correlation Vector of a previous performed action on this product.
-- **SystemAttemptNumber** Total number of automatic attempts to install before it was canceled.
-- **UserAttemptNumber** Total number of user attempts to install before it was canceled.
-- **WUContentId** The Windows Update content ID
+- **BootApplicationId** This field tells us what the OS Loader Application Identifier is.
+- **BootAttemptCount** The number of consecutive times the boot manager has attempted to boot into this operating system.
+- **BootSequence** The current Boot ID, used to correlate events related to a particular boot session.
+- **BootStatusPolicy** Identifies the applicable Boot Status Policy.
+- **BootType** Identifies the type of boot (e.g.: "Cold", "Hiber", "Resume").
+- **EventTimestamp** Seconds elapsed since an arbitrary time point. This can be used to identify the time difference in successive boot attempts being made.
+- **FirmwareResetReasonEmbeddedController** Reason for system reset provided by firmware.
+- **FirmwareResetReasonEmbeddedControllerAdditional** Additional information on system reset reason provided by firmware if needed.
+- **FirmwareResetReasonPch** Reason for system reset provided by firmware.
+- **FirmwareResetReasonPchAdditional** Additional information on system reset reason provided by firmware if needed.
+- **FirmwareResetReasonSupplied** Flag indicating that a reason for system reset was provided by firmware.
+- **IO** Amount of data written to and read from the disk by the OS Loader during boot. See [IO](#io).
+- **LastBootSucceeded** Flag indicating whether the last boot was successful.
+- **LastShutdownSucceeded** Flag indicating whether the last shutdown was successful.
+- **MaxAbove4GbFreeRange** This field describes the largest memory range available above 4Gb.
+- **MaxBelow4GbFreeRange** This field describes the largest memory range available below 4Gb.
+- **MeasuredLaunchPrepared** This field tells us if the OS launch was initiated using Measured/Secure Boot over DRTM (Dynamic Root of Trust for Measurement).
+- **MenuPolicy** Type of advanced options menu that should be shown to the user (Legacy, Standard, etc.).
+- **RecoveryEnabled** Indicates whether recovery is enabled.
+- **SecureLaunchPrepared** This field indicates if DRTM was prepared during boot.
+- **UserInputTime** The amount of time the loader application spent waiting for user input.
-### Microsoft.Windows.StoreAgent.Telemetry.CompleteInstallOperationRequest
+### Microsoft.Windows.Kernel.Power.OSStateChange
-This event is sent after the app installations or updates. It's used to help keep Windows up-to-date and secure
+This event indicates an OS state change.
The following fields are available:
-- **CatalogId** The Store Product ID of the app being installed.
-- **HResult** HResult code of the action being performed.
-- **IsBundle** Is this a bundle?
-- **PackageFamilyName** The name of the package being installed.
-- **ProductId** The Store Product ID of the product being installed.
-- **SkuId** Specific edition of the item being installed.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndAcquireLicense
-
-This event is sent after the license is acquired when a product is being installed. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set.
-- **AttemptNumber** The total number of attempts to acquire this product.
-- **BundleId** The bundle ID
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **HResult** HResult code to show the result of the operation (success/failure).
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Did the user initiate the installation?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this happening after a device restore?
-- **IsUpdate** Is this an update?
-- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
-- **PFN** Product Family Name of the product being installed.
-- **ProductId** The Store Product ID for the product being installed.
-- **SystemAttemptNumber** The number of attempts by the system to acquire this product.
-- **UserAttemptNumber** The number of attempts by the user to acquire this product
-- **WUContentId** The Windows Update content ID
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndDownload
-
-This event happens during the app update or installation when content is being downloaded at the end of the process to report success or failure. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
-- **AttemptNumber** Number of retry attempts before it was canceled.
-- **BundleId** The identity of the Windows Insider build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **DownloadSize** The total size of the download.
-- **ExtendedHResult** Any extended HResult error codes.
-- **HResult** The result code of the last action performed.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this initiated by the user?
-- **IsMandatory** Is this a mandatory installation?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this a restore of a previously acquired product?
-- **IsUpdate** Is this an update?
-- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
-- **PFN** The Product Family Name of the app being download.
-- **ProductId** The Store Product ID for the product being installed.
-- **SystemAttemptNumber** The number of attempts by the system to download.
-- **UserAttemptNumber** The number of attempts by the user to download.
-- **WUContentId** The Windows Update content ID.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndFrameworkUpdate
-
-This event happens when an app update requires an updated Framework package and the process starts to download it. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **HResult** The result code of the last action performed before this operation.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndGetInstalledContentIds
-
-This event is sent after sending the inventory of the products installed to determine whether updates for those products are available. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **HResult** The result code of the last action performed before this operation.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndInstall
-
-This event is sent after a product has been installed. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-- **AttemptNumber** The number of retry attempts before it was canceled.
-- **BundleId** The identity of the build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **ExtendedHResult** The extended HResult error code.
-- **HResult** The result code of the last action performed.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this an interactive installation?
-- **IsMandatory** Is this a mandatory installation?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this automatically restoring a previously acquired product?
-- **IsUpdate** Is this an update?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** Product Family Name of the product being installed.
-- **ProductId** The Store Product ID for the product being installed.
-- **SystemAttemptNumber** The total number of system attempts.
-- **UserAttemptNumber** The total number of user attempts.
-- **WUContentId** The Windows Update content ID
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndScanForUpdates
-
-This event is sent after a scan for product updates to determine if there are packages to install. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **ClientAppId** The identity of the app that initiated this operation.
-- **HResult** The result code of the last action performed.
-- **IsApplicability** Is this request to only check if there are any applicable packages to install?
-- **IsInteractive** Is this user requested?
-- **IsOnline** Is the request doing an online check?
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndSearchUpdatePackages
-
-This event is sent after searching for update packages to install. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-- **AttemptNumber** The total number of retry attempts before it was canceled.
-- **BundleId** The identity of the build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **HResult** The result code of the last action performed.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this user requested?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this restoring previously acquired content?
-- **IsUpdate** Is this an update?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** The name of the package or packages requested for install.
-- **ProductId** The Store Product ID for the product being installed.
-- **SystemAttemptNumber** The total number of system attempts.
-- **UserAttemptNumber** The total number of user attempts.
-- **WUContentId** The Windows Update content ID
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndStageUserData
-
-This event is sent between download and installation to see if there is app data that needs to be restored from the cloud. It's used to keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
-- **AttemptNumber** The total number of retry attempts before it was canceled.
-- **BundleId** The identity of the build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **HResult** The result code of the last action performed.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this user requested?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this restoring previously acquired content?
-- **IsUpdate** Is this an update?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** The name of the package or packages requested for install.
-- **ProductId** The Store Product ID for the product being installed.
-- **SystemAttemptNumber** The total number of system attempts.
-- **UserAttemptNumber** The total number of system attempts.
-- **WUContentId** The Windows Update content ID
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.EndUpdateMetadataPrepare
-
-This event happens after a scan for available app updates. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **HResult** The result code of the last action performed.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentComplete
-
-The FulfillmentComplete event is fired at the end of an app install or update. We use this to track the very end of the install/update process. StoreAgent events are needed to help keep Windows pre-installed 1st party apps up to date and secure, such as the mail and calendar apps. App update failure can be unique across devices and without this data from every device we will not be able to track the success/failure and fix any future vulnerabilities related to these built in Windows Apps.
-
-The following fields are available:
-
-- **CatalogId** The CatalogId is the name of the product catalog from which this app was chosen.
-- **FailedRetry** Was the installation or update retry successful?
-- **HResult** The HResult code of the operation.
-- **PFN** The Package Family Name of the app that is being installed or updated.
-- **ProductId** The product ID of the app that is being updated or installed.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentInitiate
-
-The FulfillmentInitiate event is fired at the start of an app install or update. We use this to track the very beginning of the install/update process. StoreAgent events are needed to help keep Windows pre-installed 1st party apps up to date and secure, such as the mail and calendar apps. App update failure can be unique across devices and without this data from every device we will not be able to track the success/failure and fix any future vulnerabilities related to these built in Windows Apps.
-
-The following fields are available:
-
-- **PFN** The Package Family Name of the app that is being installed or updated.
-- **ProductId** The product ID of the app that is being updated or installed.
-- **CatalogId** The CatalogId is the name of the product catalog from which this app was chosen.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.InstallOperationRequest
-
-This event happens at the beginning of the install process when an app update or new app is installed. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **BundleId** The identity of the build associated with this product.
-- **CatalogId** If this product is from a private catalog, the Store Product ID for the product being installed.
-- **ProductId** The Store Product ID for the product being installed.
-- **SkuId** Specific edition ID being installed.
-- **VolumePath** The disk path of the installation.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.PauseInstallation
-
-This event is sent when a product install or update is paused either by a user or the system. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-- **AttemptNumber** The total number of retry attempts before it was canceled.
-- **BundleId** The identity of the build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this user requested?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this restoring previously acquired content?
-- **IsUpdate** Is this an update?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** The Product Full Name.
-- **PreviousHResult** The result code of the last action performed before this operation.
-- **PreviousInstallState** Previous state before the installation or update was paused.
-- **ProductId** The Store Product ID for the product being installed.
-- **RelatedCV** Correlation Vector of a previous performed action on this product.
-- **SystemAttemptNumber** The total number of system attempts.
-- **UserAttemptNumber** The total number of user attempts.
-- **WUContentId** The Windows Update content ID
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.ResumeInstallation
-
-This event happens when a product install or update is resumed either by a user or the system. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
-- **AttemptNumber** The number of retry attempts before it was canceled.
-- **BundleId** The identity of the build associated with this product.
-- **CategoryId** The identity of the package or packages being installed.
-- **ClientAppId** The identity of the app that initiated this operation.
-- **HResult** The result code of the last action performed before this operation.
-- **IsBundle** Is this a bundle?
-- **IsInteractive** Is this user requested?
-- **IsMandatory** Is this a mandatory update?
-- **IsRemediation** Is this repairing a previous installation?
-- **IsRestore** Is this restoring previously acquired content?
-- **IsUpdate** Is this an update?
-- **IsUserRetry** Did the user initiate the retry?
-- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
-- **PFN** The name of the package or packages requested for install.
-- **PreviousHResult** The previous HResult error code.
-- **PreviousInstallState** Previous state before the installation was paused.
-- **ProductId** The Store Product ID for the product being installed.
-- **RelatedCV** Correlation Vector for the original install before it was resumed.
-- **SystemAttemptNumber** The total number of system attempts.
-- **UserAttemptNumber** The total number of user attempts.
-- **WUContentId** The Windows Update content ID
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.ResumeOperationRequest
-
-This event happens when a product install or update is resumed by a user and on installation retries. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **ProductId** The Store Product ID for the product being installed.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.SearchForUpdateOperationRequest
-
-This event is sent when searching for update packages to install. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **CatalogId** The Store Product ID for the product being installed.
-- **ProductId** The Store Product ID for the product being installed.
-- **SkuId** Specfic edition of the app being updated.
-
-
-### Microsoft.Windows.StoreAgent.Telemetry.UpdateAppOperationRequest
-
-This event happens an app for a user needs to be updated. It's used to help keep Windows up-to-date and secure.
-
-The following fields are available:
-
-- **PFamN** The name of the product that is requested for update.
+- **AcPowerOnline** If "TRUE," the device is using AC power. If "FALSE," the device is using battery power.
+- **ActualTransitions** The number of transitions between operating system states since the last system boot
+- **BatteryCapacity** Maximum battery capacity in mWh
+- **BatteryCharge** Current battery charge as a percentage of total capacity
+- **BatteryDischarging** Flag indicating whether the battery is discharging or charging
+- **BootId** Total boot count since the operating system was installed
+- **BootTimeUTC** Date and time of a particular boot event (identified by BootId)
+- **EnergyChangeV2** A snapshot value in mWh reflecting a change in power usage
+- **EnergyChangeV2Flags** Flags for disambiguating EnergyChangeV2 context
+- **EventSequence** Indicates the sequence order for this event instance, relative to previous instances of OSStateChange events that have occurred since boot
+- **LastStateTransition** ID of the last operating system state transition
+- **LastStateTransitionSub** ID of the last operating system sub-state transition
+- **StateDurationMS** Number of milliseconds spent in the last operating system state
+- **StateTransition** ID of the operating system state the system is transitioning to
+- **StateTransitionSub** ID of the operating system sub-state the system is transitioning to
+- **TotalDurationMS** Total time (in milliseconds) spent in all states since the last boot
+- **TotalUptimeMS** Total time (in milliseconds) the device was in Up or Running states since the last boot
+- **TransitionsToOn** Number of transitions to the Powered On state since the last boot
+- **UptimeDeltaMS** Total time (in milliseconds) added to Uptime since the last event
## Privacy consent logging events
@@ -3446,13 +3460,29 @@ Event tells us effectiveness of new privacy experience.
The following fields are available:
-- **isAdmin** Whether the current user is an administrator or not
+- **isAdmin** whether the person who is logging in is an admin
- **isLaunching** Whether or not the privacy consent experience will be launched
-- **isSilentElevation** Whether the current user has enabled silent elevation
-- **privacyConsentState** The current state of the privacy consent experience
+- **isSilentElevation** whether the user has most restrictive UAC controls
+- **privacyConsentState** whether the user has completed privacy experience
- **userRegionCode** The current user's region setting
+## Sediment events
+
+### Microsoft.Windows.Sediment.OSRSS.UrlState
+
+This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL.
+
+The following fields are available:
+
+- **Id** A number identifying the URL.
+- **ServiceVersionMajor** Version information for the component.
+- **ServiceVersionMinor** Version information for the component.
+- **StateData** State-specific data, such as the attempt number for the download.
+- **StateNumber** A number identifying the current state of the URL (for example, found, downloading, extracted).
+- **Time** System timestamp when the event was started.
+
+
## Setup events
### SetupPlatformTel.SetupPlatformTelEvent
@@ -3477,7 +3507,7 @@ The following fields are available:
- **accountType** The type of account that was deleted. Example: AD, AAD, or Local
- **deleteState** Whether the attempted deletion of the user account was successful.
- **userSid** The security identifier of the account.
-- **wilActivity** Windows Error Reporting data collected when there is a failure in deleting a user account with the Transient Account Manager.
+- **wilActivity** Windows Error Reporting data collected when there is a failure in deleting a user account with the Transient Account Manager. See [wilActivity](#wilactivity).
### Microsoft.Windows.SharedPC.AccountManager.SinglePolicyEvaluation
@@ -3486,9 +3516,59 @@ Activity for run of the Transient Account Manager that determines if any user ac
The following fields are available:
-- **totalAccountCount** The number of accounts on a device after running the Transient Account Manager policies.
-- **wilActivity** Windows Error Reporting data collected when there is a failure in evaluating accounts to be deleted with the Transient Account Manager.
- **evaluationTrigger** When was the Transient Account Manager policies ran? Example: At log off or during maintenance hours
+- **totalAccountCount** The number of accounts on a device after running the Transient Account Manager policies.
+- **wilActivity** Windows Error Reporting data collected when there is a failure in evaluating accounts to be deleted with the Transient Account Manager. See [wilActivity](#wilactivity).
+
+
+### wilActivity
+
+This event provides a Windows Internal Library context used for Product and Service diagnostics.
+
+The following fields are available:
+
+- **callContext** The function where the failure occurred.
+- **currentContextId** The ID of the current call context where the failure occurred.
+- **currentContextMessage** The message of the current call context where the failure occurred.
+- **currentContextName** The name of the current call context where the failure occurred.
+- **failureCount** The number of failures for this failure ID.
+- **failureId** The ID of the failure that occurred.
+- **failureType** The type of the failure that occurred.
+- **fileName** The file name where the failure occurred.
+- **function** The function where the failure occurred.
+- **hresult** The HResult of the overall activity.
+- **lineNumber** The line number where the failure occurred.
+- **message** The message of the failure that occurred.
+- **module** The module where the failure occurred.
+- **originatingContextId** The ID of the originating call context that resulted in the failure.
+- **originatingContextMessage** The message of the originating call context that resulted in the failure.
+- **originatingContextName** The name of the originating call context that resulted in the failure.
+- **threadId** The ID of the thread on which the activity is executing.
+
+
+### wilResult
+
+This event provides a Windows Internal Library context used for Product and Service diagnostics.
+
+The following fields are available:
+
+- **callContext** The call context stack where failure occurred.
+- **currentContextId** The ID of the current call context where the failure occurred.
+- **currentContextMessage** The message of the current call context where the failure occurred.
+- **currentContextName** The name of the current call context where the failure occurred.
+- **failureCount** The number of failures for this failure ID.
+- **failureId** The ID of the failure that occurred.
+- **failureType** The type of the failure that occurred.
+- **fileName** The file name where the failure occurred.
+- **function** The function where the failure occurred.
+- **hresult** The HResult of the overall activity.
+- **lineNumber** The line number where the failure occurred.
+- **message** The message of the failure that occurred.
+- **module** The module where the failure occurred.
+- **originatingContextId** The ID of the originating call context that resulted in the failure.
+- **originatingContextMessage** The message of the originating call context that resulted in the failure.
+- **originatingContextName** The name of the originating call context that resulted in the failure.
+- **threadId** The ID of the thread on which the activity is executing.
## SIH events
@@ -3546,37 +3626,6 @@ The following fields are available:
- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion.
- **AllowCachedResults** Indicates if the scan allowed using cached results.
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
-- **CurrentMobileOperator** The mobile operator the device is currently connected to.
-- **DriverSyncPassPerformed** Were drivers scanned this time?
-- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
-- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
-- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
-- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
-- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
-- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
-- **IPVersion** Indicates whether the download took place over IPv4 or IPv6
-- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
-- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
-- **MetadataIntegrityMode** The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce
-- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked
-- **NumberOfLoop** The number of round trips the scan required
-- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan
-- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan
-- **NumFailedMetadataSignatures** The number of metadata signatures checks which failed for new metadata synced down.
-- **Online** Indicates if this was an online scan.
-- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced.
-- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
-- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
-- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **ScanDurationInSeconds** The number of seconds a scan took
-- **ScanEnqueueTime** The number of seconds it took to initialize a scan
-- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Windows Store, etc.).
-- **ServiceUrl** The environment URL a device is configured to scan with
-- **ShippingMobileOperator** The mobile operator that a device shipped on.
-- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult).
-- **SyncType** Describes the type of scan the event was
-- **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down.
- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable
- **BiosFamily** The family of the BIOS (Basic Input Output System).
- **BiosName** The name of the device BIOS.
@@ -3585,40 +3634,71 @@ The following fields are available:
- **BIOSVendor** The vendor of the BIOS.
- **BiosVersion** The version of the BIOS.
- **BranchReadinessLevel** The servicing branch configured on the device.
+- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
+- **CapabilityDetectoidGuid** The GUID for a hardware applicability detectoid that could not be evaluated.
+- **CDNCountryCode** Two letter country abbreviation for the Content Distribution Network (CDN) location.
+- **CDNId** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
- **ClientVersion** The version number of the software distribution client.
+- **Context** Gives context on where the error has occurred. Example: AutoEnable, GetSLSData, AddService, Misc, or Unknown
+- **CurrentMobileOperator** The mobile operator the device is currently connected to.
- **DeferralPolicySources** Sources for any update deferral policies defined (GPO = 0x10, MDM = 0x100, Flight = 0x1000, UX = 0x10000).
- **DeferredUpdates** Update IDs which are currently being deferred until a later time
- **DeviceModel** What is the device model.
+- **DriverError** The error code hit during a driver scan. This is 0 if no error was encountered.
- **DriverExclusionPolicy** Indicates if the policy for not including drivers with Windows Update is enabled.
+- **DriverSyncPassPerformed** Were drivers scanned this time?
- **EventInstanceID** A globally unique identifier for event instance.
+- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **ExtendedMetadataCabUrl** Hostname that is used to download an update.
+- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
+- **FailedUpdateGuids** The GUIDs for the updates that failed to be evaluated during the scan.
+- **FailedUpdatesCount** The number of updates that failed to be evaluated during the scan.
- **FeatureUpdateDeferral** The deferral period configured for feature OS updates on the device (in days).
+- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
- **FeatureUpdatePausePeriod** The pause duration configured for feature OS updates on the device (in days).
+- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
+- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
+- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
+- **IPVersion** Indicates whether the download took place over IPv4 or IPv6
+- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device.
+- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device.
+- **IsWUfBFederatedScanDisabled** Indicates if Windows Update for Business federated scan is disabled on the device.
+- **MetadataIntegrityMode** The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce
+- **MSIError** The last error that was encountered during a scan for updates.
+- **NetworkConnectivityDetected** Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6
- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
+- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked
+- **NumberOfLoop** The number of round trips the scan required
+- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan
+- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan
+- **NumFailedMetadataSignatures** The number of metadata signatures checks which failed for new metadata synced down.
+- **Online** Indicates if this was an online scan.
- **PausedUpdates** A list of UpdateIds which that currently being paused.
- **PauseFeatureUpdatesEndTime** If feature OS updates are paused on the device, this is the date and time for the end of the pause time window.
- **PauseFeatureUpdatesStartTime** If feature OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
- **PauseQualityUpdatesEndTime** If quality OS updates are paused on the device, this is the date and time for the end of the pause time window.
- **PauseQualityUpdatesStartTime** If quality OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
+- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced.
+- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
- **QualityUpdateDeferral** The deferral period configured for quality OS updates on the device (in days).
+- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
- **QualityUpdatePausePeriod** The pause duration configured for quality OS updates on the device (in days).
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
+- **ScanDurationInSeconds** The number of seconds a scan took
+- **ScanEnqueueTime** The number of seconds it took to initialize a scan
+- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Windows Store, etc.).
+- **ServiceUrl** The environment URL a device is configured to scan with
+- **ShippingMobileOperator** The mobile operator that a device shipped on.
+- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult).
+- **SyncType** Describes the type of scan the event was
- **SystemBIOSMajorRelease** Major version of the BIOS.
- **SystemBIOSMinorRelease** Minor version of the BIOS.
+- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
+- **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down.
- **WebServiceRetryMethods** Web service method requests that needed to be retried to complete operation.
- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
-- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
-- **IsWUfBFederatedScanDisabled** Indicates if Windows Update for Business federated scan is disabled on the device.
-- **CapabilityDetectoidGuid** The GUID for a hardware applicability detectoid that could not be evaluated.
-- **CDNCountryCode** Two letter country abbreviation for the CDN's location.
-- **CDNId** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **DriverError** The error code hit during a driver scan. This is 0 if no error was encountered.
-- **ExtendedMetadataCabUrl** Hostname that is used to download an update.
-- **FailedUpdateGuids** The GUIDs for the updates that failed to be evaluated during the scan.
-- **FailedUpdatesCount** The number of updates that failed to be evaluated during the scan.
-- **MSIError** The last error that was encountered during a scan for updates.
-- **NetworkConnectivityDetected** Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6
-- **Context** Gives context on where the error has occurred. Example: AutoEnable, GetSLSData, AddService, Misc, or Unknown
### SoftwareUpdateClientTelemetry.Commit
@@ -3633,31 +3713,31 @@ The following fields are available:
- **BiosSKUNumber** Device SKU as defined in the system BIOS
- **BIOSVendor** Vendor of the system BIOS
- **BiosVersion** Version of the system BIOS
-- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
-- **BundleRevisionNumber** Identifies the revision number of the content bundle
-- **CallerApplicationName** Name provided by the caller who initiated API calls into the software distribution client
+- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
+- **BundleRevisionNumber** Identifies the revision number of the content bundle
+- **CallerApplicationName** Name provided by the caller who initiated API calls into the software distribution client
- **ClientVersion** Version number of the software distribution client
-- **DeviceModel** Device model as defined in the system bios
+- **DeviceModel** Device model as defined in the system bios
- **EventInstanceID** A globally unique identifier for event instance
- **EventScenario** Indicates the purpose of the event - whether because scan started, succeded, failed, etc.
- **EventType** Possible values are "Child", "Bundle", "Relase" or "Driver".
-- **FlightId** The specific id of the flight the device is getting
-- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.)
+- **FlightId** The specific id of the flight the device is getting
+- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.)
- **RevisionNumber** Identifies the revision number of this specific piece of content
- **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Windows Store, etc)
-- **SystemBIOSMajorRelease** Major release version of the system bios
-- **SystemBIOSMinorRelease** Minor release version of the system bios
-- **UpdateId** Identifier associated with the specific piece of content
-- **WUDeviceID** Unique device id controlled by the software distribution client
+- **SystemBIOSMajorRelease** Major release version of the system bios
+- **SystemBIOSMinorRelease** Minor release version of the system bios
+- **UpdateId** Identifier associated with the specific piece of content
+- **WUDeviceID** Unique device id controlled by the software distribution client
### SoftwareUpdateClientTelemetry.Download
-Download process event for target update on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded)
+Download process event for target update on Windows Update client. See EventScenario field for specifics (started/failed/succeeded).
The following fields are available:
-- **ActiveDownloadTime** How long the download took, in seconds, excluding time where the update wasn't actively being downloaded.
+- **ActiveDownloadTime** Number of seconds the update was actively being downloaded.
- **AppXBlockHashValidationFailureCount** A count of the number of blocks that have failed validation after being downloaded.
- **AppXDownloadScope** Indicates the scope of the download for application content. For streaming install scenarios, AllContent - non-streaming download, RequiredOnly - streaming download requested content required for launch, AutomaticOnly - streaming download requested automatic streams for the app, and Unknown - for events sent before download scope is determined by the Windows Update client.
- **BiosFamily** The family of the BIOS (Basic Input Output System).
@@ -3666,19 +3746,20 @@ The following fields are available:
- **BiosSKUNumber** The sku number of the device BIOS.
- **BIOSVendor** The vendor of the BIOS.
- **BiosVersion** The version of the BIOS.
-- **BundleBytesDownloaded** How many bytes were downloaded for the specific content bundle.
+- **BundleBytesDownloaded** Number of bytes downloaded for the specific content bundle.
- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
-- **BundleRepeatFailFlag** Indicates whether this particular update bundle had previously failed to download.
+- **BundleRepeatFailFlag** Indicates whether this particular update bundle previously failed to download.
- **BundleRevisionNumber** Identifies the revision number of the content bundle.
-- **BytesDownloaded** How many bytes were downloaded for an individual piece of content (not the entire bundle).
+- **BytesDownloaded** Number of bytes that were downloaded for an individual piece of content (not the entire bundle).
- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
- **CbsDownloadMethod** Indicates whether the download was a full-file download or a partial/delta download.
-- **CDNCountryCode** Two letter country abbreviation for the CDN's location.
+- **CDNCountryCode** Two letter country abbreviation for the Content Distribution Network (CDN) location.
- **CDNId** ID which defines which CDN the software distribution client downloaded the content from.
- **ClientVersion** The version number of the software distribution client.
- **CurrentMobileOperator** The mobile operator the device is currently connected to.
- **DeviceModel** What is the device model.
- **DownloadPriority** Indicates whether a download happened at background, normal, or foreground priority.
+- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
- **EventInstanceID** A globally unique identifier for event instance.
- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started downloading content, or whether it was cancelled, succeeded, or failed.
- **EventType** Possible values are Child, Bundle, or Driver.
@@ -3686,7 +3767,7 @@ The following fields are available:
- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds).
- **FlightBuildNumber** If this download was for a flight (pre-release build), this indicates the build number of that flight.
-- **FlightId** The specific id of the flight (pre-release build) the device is getting.
+- **FlightId** The specific ID of the flight (pre-release build) the device is getting.
- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
- **HandlerType** Indicates what kind of content is being downloaded (app, driver, windows patch, etc.).
- **HardwareId** If this download was for a driver targeted to a particular device model, this ID indicates the model of the device.
@@ -3703,10 +3784,10 @@ The following fields are available:
- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
- **RegulationReason** The reason that the update is regulated
-- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one.
- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to download.
- **RevisionNumber** Identifies the revision number of this specific piece of content.
-- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Windows Store, etc.).
+- **ServiceGuid** An ID that represents which service the software distribution client is installing content for (Windows Update, Windows Store, etc.).
- **Setup360Phase** If the download is for an operating system upgrade, this datapoint indicates which phase of the upgrade is underway.
- **ShippingMobileOperator** The mobile operator that a device shipped on.
- **StatusCode** Indicates the result of a Download event (success, cancellation, failure code HResult).
@@ -3722,7 +3803,6 @@ The following fields are available:
- **UsedDO** Whether the download used the delivery optimization service.
- **UsedSystemVolume** Indicates whether the content was downloaded to the device's main system storage drive, or an alternate storage drive.
- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
-- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events.
### SoftwareUpdateClientTelemetry.DownloadCheckpoint
@@ -3755,7 +3835,7 @@ The following fields are available:
- **BytesTotal** Total bytes to transfer for this content
- **BytesTransferred** Total bytes transferred for this content at the time of heartbeat
-- **CallerApplicationName** Name provided by the caller who initiated API calls into the software distribution client
+- **CallerApplicationName** Name provided by the caller who initiated API calls into the software distribution client
- **ClientVersion** The version number of the software distribution client
- **ConnectionStatus** Indicates the connectivity state of the device at the time of heartbeat
- **CurrentError** Last (transient) error encountered by the active download
@@ -3770,11 +3850,11 @@ The following fields are available:
- **RelatedCV** The previous correlation vector that was used by the client, before swapping with a new one
- **ResumeCount** Number of times this active download has resumed from a suspended state
- **RevisionNumber** Identifies the revision number of this specific piece of content
-- **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc)
+- **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc)
- **SuspendCount** Number of times this active download has entered a suspended state
- **SuspendReason** Last reason for why this active download entered a suspended state
-- **UpdateId** Identifier associated with the specific piece of content
-- **WUDeviceID** Unique device id controlled by the software distribution client
+- **UpdateId** Identifier associated with the specific piece of content
+- **WUDeviceID** Unique device id controlled by the software distribution client
### SoftwareUpdateClientTelemetry.Install
@@ -3790,43 +3870,43 @@ The following fields are available:
- **BIOSVendor** The vendor of the BIOS.
- **BiosVersion** The version of the BIOS.
- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
-- **BundleRepeatFailFlag** Has this particular update bundle previously failed to install?
+- **BundleRepeatFailFlag** Indicates whether this particular update bundle previously failed to install.
- **BundleRevisionNumber** Identifies the revision number of the content bundle.
- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
- **ClientVersion** The version number of the software distribution client.
- **CSIErrorType** The stage of CBS installation where it failed.
-- **CurrentMobileOperator** Mobile operator that device is currently connected to.
-- **DeviceModel** What is the device model.
+- **CurrentMobileOperator** The mobile operator to which the device is currently connected.
+- **DeviceModel** The device model.
- **DriverPingBack** Contains information about the previous driver and system state.
- **EventInstanceID** A globally unique identifier for event instance.
- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
- **EventType** Possible values are Child, Bundle, or Driver.
- **ExtendedErrorCode** The extended error code.
-- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough.
-- **FeatureUpdatePause** Are feature OS updates paused on the device?
+- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode is not specific enough.
+- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device.
- **FlightBranch** The branch that a device is on if participating in the Windows Insider Program.
- **FlightBuildNumber** If this installation was for a Windows Insider build, this is the build number of that build.
- **FlightId** The specific ID of the Windows Insider build the device is getting.
- **FlightRing** The ring that a device is on if participating in the Windows Insider Program.
-- **HandlerType** Indicates what kind of content is being installed. Example: app, driver, Windows update
+- **HandlerType** Indicates what kind of content is being installed (for example, app, driver, Windows update).
- **HardwareId** If this install was for a driver targeted to a particular device model, this ID indicates the model of the device.
- **HomeMobileOperator** The mobile operator that the device was originally intended to work with.
- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
-- **IsDependentSet** Is the driver part of a larger System Hardware/Firmware update?
-- **IsFinalOutcomeEvent** Does this event signal the end of the update/upgrade process?
-- **IsFirmware** Is this update a firmware update?
-- **IsSuccessFailurePostReboot** Did it succeed and then fail after a restart?
-- **IsWUfBDualScanEnabled** Is Windows Update for Business dual scan enabled on the device?
-- **IsWUfBEnabled** Is Windows Update for Business enabled on the device?
-- **MergedUpdate** Was the OS update and a BSP update merged for installation?
+- **IsDependentSet** Indicates whether the driver is part of a larger System Hardware/Firmware update.
+- **IsFinalOutcomeEvent** Indicates whether this event signals the end of the update/upgrade process.
+- **IsFirmware** Indicates whether this update is a firmware update.
+- **IsSuccessFailurePostReboot** Indicates whether the update succeeded and then failed after a restart.
+- **IsWUfBDualScanEnabled** Indicates whether Windows Update for Business dual scan is enabled on the device.
+- **IsWUfBEnabled** Indicates whether Windows Update for Business is enabled on the device.
+- **MergedUpdate** Indicates whether the OS update and a BSP update merged for installation.
- **MsiAction** The stage of MSI installation where it failed.
- **MsiProductCode** The unique identifier of the MSI installer.
- **PackageFullName** The package name of the content being installed.
- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting being introduced.
-- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
-- **QualityUpdatePause** Are quality OS updates paused on the device?
+- **ProcessName** The process name of the caller who initiated API calls, in the event that CallerApplicationName was not provided.
+- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device.
- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to install.
+- **RepeatFailFlag** Indicates whether this specific piece of content previously failed to install.
- **RevisionNumber** The revision number of this specific piece of content.
- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Windows Store, etc.).
- **Setup360Phase** If the install is for an operating system upgrade, indicates which phase of the upgrade is underway.
@@ -3836,8 +3916,8 @@ The following fields are available:
- **SystemBIOSMinorRelease** Minor version of the BIOS.
- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
-- **TransactionCode** The ID which represents a given MSI installation
-- **UpdateId** Unique update ID
+- **TransactionCode** The ID that represents a given MSI installation.
+- **UpdateId** Unique update ID.
- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional.
- **UsedSystemVolume** Indicates whether the content was downloaded and then installed from the device's main system storage drive, or an alternate storage drive.
- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
@@ -3849,13 +3929,13 @@ This event sends data about an AppX app that has been updated from the Microsoft
The following fields are available:
-- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable
-- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client
+- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable.
+- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
- **IntentPFNs** Intended application-set metadata for atomic update scenarios.
-- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete
-- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one
-- **ServiceGuid** An ID which represents which service the software distribution client is connecting to (Windows Update, Windows Store, etc.)
-- **WUDeviceID** The unique device ID controlled by the software distribution client
+- **NumberOfApplicableUpdates** The number of updates ultimately deemed applicable to the system after the detection process is complete.
+- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one.
+- **ServiceGuid** An ID that represents which service the software distribution client is connecting to (Windows Update, Windows Store, etc.).
+- **WUDeviceID** The unique device ID controlled by the software distribution client.
### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity
@@ -3864,145 +3944,150 @@ Ensures Windows Updates are secure and complete. Event helps to identify whether
The following fields are available:
+- **CallerApplicationName** Name of application making the Windows Update request. Used to identify context of request.
- **EndpointUrl** URL of the endpoint where client obtains update metadata. Used to identify test vs staging vs production environments.
- **EventScenario** Indicates the purpose of the event - whether because scan started, succeded, failed, etc.
-- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough.
-- **LeafCertId** Integral id from the FragmentSigning data for certificate which failed.
-- **MetadataIntegrityMode** Mode of update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce
+- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough.
+- **LeafCertId** Integral id from the FragmentSigning data for certificate which failed.
+- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
+- **MetadataIntegrityMode** Mode of update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce
- **MetadataSignature** Base64 string of the signature associated with the update metadata (specified by revision id)
+- **RawMode** Raw unparsed mode string from the SLS response. May be null if not applicable.
+- **RawValidityWindowInDays** The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable.
- **RevisionId** Identifies the revision of this specific piece of content
- **RevisionNumber** Identifies the revision number of this specific piece of content
- **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Windows Store, etc)
-- **SHA256OfLeafCertPublicKey** Base64 encoding of hash of the Base64CertData in the FragmentSigning data of leaf certificate.
+- **SHA256OfLeafCerData** A base64 encoding of the hash for the Base64CerData in the FragmentSigning data of the leaf certificate.
+- **SHA256OfLeafCertPublicKey** Base64 encoding of hash of the Base64CertData in the FragmentSigning data of leaf certificate.
- **SHA256OfTimestampToken** Base64 string of hash of the timestamp token blob
- **SignatureAlgorithm** Hash algorithm for the metadata signature
- **SLSPrograms** A test program a machine may be opted in. Examples include "Canary" and "Insider Fast".
- **StatusCode** Result code of the event (success, cancellation, failure code HResult)
-- **TimestampTokenId** Created time encoded in the timestamp blob. This will be zeroed if the token is itself malformed and decoding failed.
-- **UpdateId** Identifier associated with the specific piece of content
-- **RawMode** Raw unparsed mode string from the SLS response. May be null if not applicable.
-- **TimestampTokenCertThumbprint** The thumbprint of the encoded timestamp token.
+- **TimestampTokenCertThumbprint** The thumbprint of the encoded timestamp token.
+- **TimestampTokenId** Created time encoded in the timestamp blob. This will be zeroed if the token is itself malformed and decoding failed.
+- **UpdateId** Identifier associated with the specific piece of content
- **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp.
-- **CallerApplicationName** Name of application making the Windows Update request. Used to identify context of request.
-- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
-- **RawValidityWindowInDays** The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable.
-- **SHA256OfLeafCerData** A base64 encoding of the hash for the Base64CerData in the FragmentSigning data of the leaf certificate.
## Update events
### Update360Telemetry.UpdateAgentCommit
-This event collects information regarding the commit phase of the new UUP (Unified Update Platform) update scenario, which is leveraged by both Mobile and Desktop.
-
-The following fields are available:
-
-- **ErrorCode** The error code returned for the current install phase.
-- **FlightId** Unique ID for each flight.
-- **ObjectId** Unique value for each Update Agent mode.
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
-- **Result** Outcome of the install phase of the update.
-- **ScenarioId** Indicates the update scenario.
-- **SessionId** Unique value for each update attempt.
-- **UpdateId** Unique ID for each update.
-
-
-### Update360Telemetry.UpdateAgentDownloadRequest
-
- The UpdateAgent_DownloadRequest event sends data for the download request phase of updating Windows via the new UUP (Unified Update Platform) scenario. Applicable to PC and Mobile.
-
-The following fields are available:
-
-- **DeletedCorruptFiles** Boolean indicating whether corrupt payload was deleted.
-- **ErrorCode** The error code returned for the current download request phase.
-- **FlightId** Unique ID for each flight.
-- **ObjectId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360)
-- **PackageCountOptional** Number of optional packages requested.
-- **PackageCountRequired** Number of required packages requested.
-- **PackageCountTotal** Total number of packages needed.
-- **PackageCountTotalCanonical** Total number of canonical packages.
-- **PackageCountTotalDiff** Total number of diff packages.
-- **PackageCountTotalExpress** Total number of express packages.
-- **PackageSizeCanonical** Size of canonical packages in bytes.
-- **PackageSizeDiff** Size of diff packages in bytes.
-- **PackageSizeExpress** Size of express packages in bytes.
-- **RangeRequestState** Indicates the range request type used.
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
-- **Result** Outcome of the download request phase of update.
-- **ScenarioId** Indicates the update scenario.
-- **SessionId** Unique value for each attempt (same value for initialize, download, install commit phases)
-- **UpdateId** Unique ID for each update.
-- **PackageExpressType** Type of express package.
-
-
-### Update360Telemetry.UpdateAgentExpand
-
- This event collects information regarding the expansion phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop.
-
-The following fields are available:
-
-- **ElapsedTickCount** Time taken for expand phase.
-- **EndFreeSpace** Free space after expand phase.
-- **EndSandboxSize** Sandbox size after expand phase.
-- **ErrorCode** The error code returned for the current install phase.
-- **FlightId** Unique ID for each flight.
-- **ObjectId** Unique value for each Update Agent mode.
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
-- **ScenarioId** Indicates the update scenario.
-- **SessionId** Unique value for each update attempt.
-- **StartFreeSpace** Free space before expand phase.
-- **StartSandboxSize** Sandbox size after expand phase.
-- **UpdateId** Unique ID for each update.
-
-
-### Update360Telemetry.UpdateAgentFellBackToCanonical
-
-This event collects information when express could not be used and we fall back to canonical during the new UUP (Unified Update Platform) update scenario, which is leveraged by both Mobile and Desktop.
-
-The following fields are available:
-
-- **FlightId** Unique ID for each flight.
-- **ObjectId** Unique value for each Update Agent mode.
-- **PackageCount** Number of packages that feel back to canonical.
-- **PackageList** PackageIds which fell back to canonical.
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
-- **ScenarioId** Indicates the update scenario.
-- **SessionId** Unique value for each update attempt.
-- **UpdateId** Unique ID for each update.
-
-
-### Update360Telemetry.UpdateAgentInitialize
-
- The UpdateAgentInitialize event sends data for the initialize phase of updating Windows via the new UUP (Unified Update Platform) scenario. Applicable to both PCs and Mobile.
-
-The following fields are available:
-
-- **ErrorCode** The error code returned for the current install phase.
-- **FlightId** Unique ID for each flight.
-- **FlightMetadata** Contains the FlightId and the build being flighted.
-- **ObjectId** Unique value for each Update Agent mode.
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
-- **Result** Outcome of the install phase of the update.
-- **ScenarioId** Indicates the update scenario.
-- **SessionData** String containing instructions to update agent for processing FODs and DUICs (Null for other scenarios).
-- **SessionId** Unique value for each update attempt.
-- **UpdateId** Unique ID for each update.
-
-
-### Update360Telemetry.UpdateAgentInstall
-
-The UpdateAgentInstall event sends data for the install phase of updating Windows.
+This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop.
The following fields are available:
- **ErrorCode** The error code returned for the current install phase.
-- **FlightId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360).
-- **ObjectId** Correlation vector value generated from the latest USO scan.
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **FlightId** Unique ID for each flight.
+- **ObjectId** Unique value for each Update Agent mode.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **Result** Outcome of the install phase of the update.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each update attempt.
+- **UpdateId** Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentDownloadRequest
+
+This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile.
+
+The following fields are available:
+
+- **DeletedCorruptFiles** Boolean indicating whether corrupt payload was deleted.
+- **DownloadRequests** Number of times a download was retried.
+- **ErrorCode** The error code returned for the current download request phase.
+- **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin.
+- **FlightId** Unique ID for each flight.
+- **InternalFailureResult** Indicates a non-fatal error from a plugin.
+- **ObjectId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360).
+- **PackageCountOptional** Number of optional packages requested.
+- **PackageCountRequired** Number of required packages requested.
+- **PackageCountTotal** Total number of packages needed.
+- **PackageCountTotalCanonical** Total number of canonical packages.
+- **PackageCountTotalDiff** Total number of diff packages.
+- **PackageCountTotalExpress** Total number of express packages.
+- **PackageExpressType** Type of express package.
+- **PackageSizeCanonical** Size of canonical packages in bytes.
+- **PackageSizeDiff** Size of diff packages in bytes.
+- **PackageSizeExpress** Size of express packages in bytes.
+- **RangeRequestState** Indicates the range request type used.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **Result** Outcome of the download request phase of update.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each attempt (same value for initialize, download, install commit phases).
+- **UpdateId** Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentExpand
+
+This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop.
+
+The following fields are available:
+
+- **ElapsedTickCount** Time taken for expand phase.
+- **EndFreeSpace** Free space after expand phase.
+- **EndSandboxSize** Sandbox size after expand phase.
+- **ErrorCode** The error code returned for the current install phase.
+- **FlightId** Unique ID for each flight.
+- **ObjectId** Unique value for each Update Agent mode.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each update attempt.
+- **StartFreeSpace** Free space before expand phase.
+- **StartSandboxSize** Sandbox size after expand phase.
+- **UpdateId** Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentFellBackToCanonical
+
+This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop.
+
+The following fields are available:
+
+- **FlightId** Unique ID for each flight.
+- **ObjectId** Unique value for each Update Agent mode.
+- **PackageCount** Number of packages that feel back to canonical.
+- **PackageList** PackageIds which fell back to canonical.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each update attempt.
+- **UpdateId** Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentInitialize
+
+This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile.
+
+The following fields are available:
+
+- **ErrorCode** The error code returned for the current install phase.
+- **FlightId** Unique ID for each flight.
+- **FlightMetadata** Contains the FlightId and the build being flighted.
+- **ObjectId** Unique value for each Update Agent mode.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **Result** Outcome of the install phase of the update.
+- **ScenarioId** Indicates the update scenario.
+- **SessionData** String containing instructions to update agent for processing FODs and DUICs (Null for other scenarios).
+- **SessionId** Unique value for each update attempt.
+- **UpdateId** Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentInstall
+
+This event sends data for the install phase of updating Windows.
+
+The following fields are available:
+
+- **ErrorCode** The error code returned for the current install phase.
+- **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin.
+- **FlightId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360).
+- **InternalFailureResult** Indicates a non-fatal error from a plugin.
+- **ObjectId** Correlation vector value generated from the latest USO scan.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
- **Result** The result for the current install phase.
-- **ScenarioId** Indicates the update scenario.
-- **SessionId** Unique value for each update attempt.
-- **UpdateId** Unique ID for each update.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each update attempt.
+- **UpdateId** Unique ID for each update.
### Update360Telemetry.UpdateAgentMerge
@@ -4011,85 +4096,85 @@ The UpdateAgentMerge event sends data on the merge phase when updating Windows.
The following fields are available:
-- **ErrorCode** The error code returned for the current merge phase.
+- **ErrorCode** The error code returned for the current merge phase.
- **FlightId** Unique ID for each flight.
-- **ObjectId** Unique value for each Update Agent mode.
-- **RelatedCV** Related correlation vector value.
-- **Result** Outcome of the merge phase of the update.
-- **ScenarioId** Indicates the update scenario.
-- **SessionId** Unique value for each attempt.
-- **UpdateId** Unique ID for each update.
+- **ObjectId** Unique value for each Update Agent mode.
+- **RelatedCV** Related correlation vector value.
+- **Result** Outcome of the merge phase of the update.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each attempt.
+- **UpdateId** Unique ID for each update.
### Update360Telemetry.UpdateAgentModeStart
-The UpdateAgentModeStart event sends data for the start of each mode during the process of updating Windows via the new UUP (Unified Update Platform) scenario. Applicable to both PCs and Mobile.
+This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile.
The following fields are available:
-- **FlightId** Unique ID for each flight.
-- **Mode** Indicates the mode that has started.
+- **FlightId** Unique ID for each flight.
+- **Mode** Indicates the mode that has started.
- **ObjectId** Unique value for each Update Agent mode.
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
-- **ScenarioId** Indicates the update scenario.
-- **SessionId** Unique value for each update attempt.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each update attempt.
- **UpdateId** Unique ID for each update.
- **Version** Version of update
### Update360Telemetry.UpdateAgentPostRebootResult
-This event collects information for both Mobile and Desktop regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario
+This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario.
The following fields are available:
-- **ErrorCode** The error code returned for the current post reboot phase
-- **FlightId** The unique identifier for each flight
-- **ObjectId** Unique value for each Update Agent mode
-- **PostRebootResult** Indicates the Hresult
-- **RelatedCV** Correlation vector value generated from the latest USO scan
-- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
+- **ErrorCode** The error code returned for the current post reboot phase.
+- **FlightId** The specific ID of the Windows Insider build the device is getting.
+- **ObjectId** Unique value for each Update Agent mode.
+- **PostRebootResult** Indicates the Hresult.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate.
- **SessionId** Unique value for each update attempt.
-- **UpdateId** Unique ID for each update
+- **UpdateId** Unique ID for each update.
### Update360Telemetry.UpdateAgentSetupBoxLaunch
-The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new UUP (Unified Update Plaform) scenario. This event is only applicable to PCs.
+The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs.
The following fields are available:
-- **FlightId** Unique ID for each flight.
-- **FreeSpace** Free space on OS partition.
-- **InstallCount** Number of install attempts using the same sandbox.
-- **ObjectId** Unique value for each Update Agent mode.
-- **Quiet** Indicates whether setup is running in quiet mode.
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
-- **SandboxSize** Size of the sandbox.
-- **ScenarioId** Indicates the update scenario.
-- **SessionId** Unique value for each update attempt.
-- **SetupMode** Mode of setup to be launched.
-- **UpdateId** Unique ID for each Update.
-- **UserSession** Indicates whether install was invoked by user actions.
- **ContainsExpressPackage** Indicates whether the download package is express.
+- **FlightId** Unique ID for each flight.
+- **FreeSpace** Free space on OS partition.
+- **InstallCount** Number of install attempts using the same sandbox.
+- **ObjectId** Unique value for each Update Agent mode.
+- **Quiet** Indicates whether setup is running in quiet mode.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **SandboxSize** Size of the sandbox.
+- **ScenarioId** Indicates the update scenario.
+- **SessionId** Unique value for each update attempt.
+- **SetupMode** Mode of setup to be launched.
+- **UpdateId** Unique ID for each update.
+- **UserSession** Indicates whether install was invoked by user actions.
## Update notification events
### Microsoft.Windows.UpdateNotificationPipeline.JavascriptJavascriptCriticalGenericMessage
-Event to indicate that Javascript is reporting a schema and a set of values for critical telemetry.
+This event indicates that Javascript is reporting a schema and a set of values for critical telemetry.
The following fields are available:
-- **CampaignConfigVersion** Config version of current campaign
-- **CampaignID** Currently running campaign on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version of the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user
-- **key1** UI interaction data
+- **CampaignConfigVersion** Configuration version of the current campaign.
+- **CampaignID** ID of the currently running campaign.
+- **ConfigCatalogVersion** Current catalog version of the update notification.
+- **ContentVersion** Content version of the current update notification campaign.
+- **CV** Correlation vector.
+- **DetectorVersion** Most recently run detector version for the current campaign.
+- **GlobalEventCounter** Client side counter that indicates the ordering of events sent by this user.
+- **key1** Interaction data for the UI
- **key10** UI interaction data
- **key11** UI interaction data
- **key12** UI interaction data
@@ -4098,18 +4183,9 @@ The following fields are available:
- **key15** UI interaction data
- **key16** UI interaction data
- **key17** UI interaction data
-- **key2** UI interaction data
-- **key3** UI interaction data
-- **key4** UI interaction data
-- **key5** UI interaction data
-- **key6** UI interaction data
-- **key7** Interaction data for the UI
-- **key8** Interaction data for the UI
-- **key9** UI interaction data
-- **PackageVersion** Current package version of UNP
-- **schema** UI interaction type
- **key18** UI interaction data
- **key19** UI interaction data
+- **key2** Interaction data for the UI
- **key20** UI interaction data
- **key21** Interaction data for the UI
- **key22** UI interaction data
@@ -4118,120 +4194,156 @@ The following fields are available:
- **key25** UI interaction data
- **key26** UI interaction data
- **key27** UI interaction data
-- **key28** Interaction data for the UI
+- **key28** UI interaction data
- **key29** UI interaction data
+- **key3** Interaction data for the UI
- **key30** UI interaction data
+- **key4** Interaction data for the UI
+- **key5** UI interaction data
+- **key6** UI interaction data
+- **key7** Interaction data for the UI
+- **key8** Interaction data for the UI
+- **key9** UI interaction data
+- **PackageVersion** Current package version of the update notification.
+- **schema** UI interaction type.
### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat
-This event is sent at the start of each campaign, to be used as a heartbeat
+This event is sent at the start of each campaign, to be used as a heartbeat.
The following fields are available:
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Currently campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **PackageVersion** Current UNP package version
+- **CampaignConfigVersion** Configuration version for the current campaign.
+- **CampaignID** Current campaign that is running on Update Notification Pipeline.
+- **ConfigCatalogVersion** Current catalog version of Update Notification Pipeline.
+- **ContentVersion** Content version for the current campaign on Update Notification Pipeline.
+- **CV** Correlation vector.
+- **DetectorVersion** Most recently run detector version for the current campaign on Update Notification Pipeline.
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user.
+- **PackageVersion** Current package version for Update Notification Pipeline.
### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerCleaningCampaign
-This event indicates that the Campaign Manager is cleaning up the campaign content
+This event indicates that the Campaign Manager is cleaning up the campaign content.
The following fields are available:
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Current campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
+- **CampaignConfigVersion** Configuration version for the current campaign.
+- **CampaignID** The current campaign that is running on Update Notification Pipeline (UNP).
+- **ConfigCatalogVersion** The current catalog version of the Update Notification Pipeline (UNP).
+- **ContentVersion** Content version for the current campaign on UNP.
- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **PackageVersion** Current UNP package version
-
-
-### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat
-
-This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat
-
-The following fields are available:
-
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Currently campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **PackageVersion** Current UNP package version
+- **DetectorVersion** Most recently run detector version for the current campaign on UNP.
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user.
+- **PackageVersion** Current UNP package version.
### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerGetIsCamppaignCompleteFailed
-This event is sent when a campaign completion status query fails
+This event is sent when a campaign completion status query fails.
The following fields are available:
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Current campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **hresult** HRESULT of the failure
-- **PackageVersion** Current UNP package version
+- **CampaignConfigVersion** Configuration version for the current campaign.
+- **CampaignID** Current campaign that is running on Update Notification Pipeline (UNP).
+- **ConfigCatalogVersion** Current catalog version of UNP.
+- **ContentVersion** Content version for the current campaign on UNP.
+- **CV** Correlation vector.
+- **DetectorVersion** Most recently run detector version for the current campaign on UNP.
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user.
+- **hresult** HRESULT of the failure.
+- **PackageVersion** Current UNP package version.
+
+
+### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat
+
+This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat.
+
+The following fields are available:
+
+- **CampaignConfigVersion** Configuration version for the current campaign.
+- **CampaignID** Currently campaign that is running on Update Notification Pipeline (UNP).
+- **ConfigCatalogVersion** Current catalog version of UNP.
+- **ContentVersion** Content version for the current campaign on UNP.
+- **CV** Correlation vector.
+- **DetectorVersion** Most recently run detector version for the current campaign on UNP.
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user.
+- **PackageVersion** Current UNP package version.
### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed
-This event is sent when the Campaign Manager encounters an unexpected error while running the campaign
+This event is sent when the Campaign Manager encounters an unexpected error while running the campaign.
The following fields are available:
-- **CampaignConfigVersion** Configuration version for the current campaign
-- **CampaignID** Currently campaign that's running on UNP
-- **ConfigCatalogVersion** Current catalog version of UNP
-- **ContentVersion** Content version for the current campaign on UNP
-- **CV** Correlation vector
-- **DetectorVersion** Most recently run detector version for the current campaign on UNP
-- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user
-- **hresult** HRESULT of the failure
-- **PackageVersion** Current UNP package version
+- **CampaignConfigVersion** Configuration version for the current campaign.
+- **CampaignID** Currently campaign that's running on Update Notification Pipeline (UNP).
+- **ConfigCatalogVersion** Current catalog version of UNP.
+- **ContentVersion** Content version for the current campaign on UNP.
+- **CV** Correlation vector.
+- **DetectorVersion** Most recently run detector version for the current campaign on UNP.
+- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user.
+- **hresult** HRESULT of the failure.
+- **PackageVersion** Current UNP package version.
## Upgrade events
+### FacilitatorTelemetry.DCATDownload
+
+This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **DownloadSize** Download size of payload.
+- **ElapsedTime** Time taken to download payload.
+- **MediaFallbackUsed** Used to determine if we used Media CompDBs to figure out package requirements for the upgrade.
+- **ResultCode** Result returned by the Facilitator DCAT call.
+- **Scenario** Dynamic Update scenario (Image DU, or Setup DU).
+- **Type** Type of package that was downloaded.
+
+
+### FacilitatorTelemetry.InitializeDU
+
+This event determines whether devices received additional or critical supplemental content during an OS upgrade.
+
+The following fields are available:
+
+- **DCATUrl** The Delivery Catalog (DCAT) URL we send the request to.
+- **DownloadRequestAttributes** The attributes we send to DCAT.
+- **ResultCode** The result returned from the initialization of Facilitator with the URL/attributes.
+- **Scenario** Dynamic Update scenario (Image DU, or Setup DU).
+- **Version** Version of Facilitator.
+
+
### Setup360Telemetry.Downlevel
-This event sends data indicating that the device has invoked the downlevel phase of the upgrade. It's used to help keep Windows up-to-date and secure.
+This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up-to-date and secure.
The following fields are available:
- **ClientId** If using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but it can be overwritten by the caller to a unique value.
+- **FlightData** Unique value that identifies the flight.
- **HostOSBuildNumber** The build number of the downlevel OS.
- **HostOsSkuName** The operating system edition which is running Setup360 instance (downlevel OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
- **ReportId** In the Windows Update scenario, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. It's an HRESULT error code that can be used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **Setup360Extended** More detailed information about phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360 (for example, Predownload, Install, Finalize, Rollback).
+- **Setup360Result** The result of Setup360 (HRESULT used to diagnose errors).
+- **Setup360Scenario** The Setup360 flow type (for example, Boot, Media, Update, MCT).
- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS).
-- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string that uniquely identifies a group of events.
+- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** An ID that uniquely identifies a group of events.
- **WuId** This is the Windows Update Client ID. In the Windows Update scenario, this is the same as the clientId.
-- **FlightData** Unique value that identifies the flight.
### Setup360Telemetry.Finalize
-This event sends data indicating that the device has invoked the finalize phase of the upgrade, to help keep Windows up-to-date.
+This event sends data indicating that the device has started the phase of finalizing the upgrade, to help keep Windows up-to-date and secure.
The following fields are available:
@@ -4241,45 +4353,46 @@ The following fields are available:
- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Extended** More detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string to uniquely identify a group of events.
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** ID that uniquely identifies a group of events.
- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
### Setup360Telemetry.OsUninstall
-The event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.OSUninstall indicates the outcome of an OS uninstall.
+This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall.
The following fields are available:
- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightData** Unique value that identifies the flight.
- **HostOSBuildNumber** The build number of the previous OS.
- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Extended** Detailed information about the phase or action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string to uniquely identify a group of events.
+- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** ID that uniquely identifies a group of events.
- **WuId** Windows Update client ID.
-- **FlightData** Unique value that identifies the flight.
### Setup360Telemetry.PostRebootInstall
-This event sends data indicating that the device has invoked the postrebootinstall phase of the upgrade, to help keep Windows up-to-date.
+This event sends data indicating that the device has invoked the post reboot install phase of the upgrade, to help keep Windows up-to-date.
The following fields are available:
- **ClientId** With Windows Update, this is the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightData** Unique value that identifies the flight.
- **HostOSBuildNumber** The build number of the previous OS.
- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
@@ -4292,7 +4405,6 @@ The following fields are available:
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
- **TestId** A string to uniquely identify a group of events.
- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as ClientId.
-- **FlightData** Unique value that identifies the flight.
### Setup360Telemetry.PreDownloadQuiet
@@ -4305,82 +4417,82 @@ The following fields are available:
- **FlightData** Unique value that identifies the flight.
- **HostOSBuildNumber** The build number of the previous OS.
- **HostOsSkuName** The OS edition which is running Setup360 instance (previous operating system).
-- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
+- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
- **ReportId** Using Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled
-- **TestId** A string to uniquely identify a group of events.
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled.
+- **TestId** ID that uniquely identifies a group of events.
- **WuId** This is the Windows Update Client ID. Using Windows Update, this is the same as the clientId.
### Setup360Telemetry.PreDownloadUX
-This event sends data regarding OS Updates and Upgrades from Windows 7.X, Windows 8.X, Windows 10 and RS. Specifically the Setup360Telemetry.PredownloadUX indicates the outcome of the PredownloadUX portion of the update process
+This event sends data regarding OS Updates and Upgrades from Windows 7.X, Windows 8.X, Windows 10 and RS, to help keep Windows up-to-date and secure. Specifically, it indicates the outcome of the PredownloadUX portion of the update process.
The following fields are available:
- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightData** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
- **HostOSBuildNumber** The build number of the previous operating system.
- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system).
- **InstanceId** Unique GUID that identifies each instance of setuphost.exe.
- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type. Examplle: Boot, Media, Update, MCT
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS).
-- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled
-- **TestId** A string to uniquely identify a group of events.
+- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId** ID that uniquely identifies a group of events.
- **WuId** Windows Update client ID.
-- **FlightData** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
### Setup360Telemetry.PreInstallQuiet
-This event sends data indicating that the device has invoked the preinstall quiet phase of the upgrade, to help keep Windows up to date.
+This event sends data indicating that the device has invoked the preinstall quiet phase of the upgrade, to help keep Windows up-to-date.
The following fields are available:
- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightData** Unique value that identifies the flight.
- **HostOSBuildNumber** The build number of the previous OS.
- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback etc.
+- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
-- **Setup360Scenario** Setup360 flow type (Boot, Media, Update, MCT)
+- **Setup360Scenario** Setup360 flow type (Boot, Media, Update, MCT).
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
- **TestId** A string to uniquely identify a group of events.
- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
-- **FlightData** Unique value that identifies the flight.
### Setup360Telemetry.PreInstallUX
-This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.PreinstallUX indicates the outcome of the PreinstallUX portion of the update process.
+This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10, to help keep Windows up-to-date. Specifically, it indicates the outcome of the PreinstallUX portion of the update process.
The following fields are available:
- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightData** Unique value that identifies the flight.
- **HostOSBuildNumber** The build number of the previous OS.
- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe.
- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type, Example: Boot, Media, Update, MCT
+- **Setup360Scenario** The Setup360 flow type, Example: Boot, Media, Update, MCT.
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
- **TestId** A string to uniquely identify a group of events.
- **WuId** Windows Update client ID.
-- **FlightData** Unique value that identifies the flight.
### Setup360Telemetry.Setup360
@@ -4389,13 +4501,29 @@ This event sends data about OS deployment scenarios, to help keep Windows up-to-
The following fields are available:
+- **ClientId** Retrieves the upgrade ID. In the Windows Update scenario, this will be the Windows Update client ID. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
- **FieldName** Retrieves the data point.
- **FlightData** Specifies a unique identifier for each group of Windows Insider builds.
- **InstanceId** Retrieves a unique identifier for each instance of a setup session.
- **ReportId** Retrieves the report ID.
- **ScenarioId** Retrieves the deployment scenario.
- **Value** Retrieves the value associated with the corresponding FieldName.
-- **ClientId** Retrieves the upgrade ID: Upgrades via Windows Update - specifies the WU clientID. All other deployment - static string.
+
+
+### Setup360Telemetry.Setup360DynamicUpdate
+
+This event helps determine whether the device received supplemental content during an operating system upgrade, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **FlightData** Specifies a unique identifier for each group of Windows Insider builds.
+- **InstanceId** Retrieves a unique identifier for each instance of a setup session.
+- **Operation** Facilitator’s last known operation (scan, download, etc.).
+- **ReportId** ID for tying together events stream side.
+- **ResultCode** Result returned by setup for the entire operation.
+- **Scenario** Dynamic Update scenario (Image DU, or Setup DU).
+- **TargetBranch** Branch of the target OS.
+- **TargetBuild** Build of the target OS.
### Setup360Telemetry.UnexpectedEvent
@@ -4405,19 +4533,19 @@ This event sends data indicating that the device has invoked the unexpected even
The following fields are available:
- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightData** Unique value that identifies the flight.
- **HostOSBuildNumber** The build number of the previous OS.
- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS).
- **InstanceId** A unique GUID that identifies each instance of setuphost.exe
- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
-- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened
-- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
-- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
-- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
+- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors.
+- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
-- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
- **TestId** A string to uniquely identify a group of events.
- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
-- **FlightData** Unique value that identifies the flight.
## Windows as a Service diagnostic events
@@ -4428,116 +4556,505 @@ Result of the WaaSMedic operation.
The following fields are available:
-- **detectionSummary** Result of each applicable detection that was ran.
+- **detectionSummary** Result of each applicable detection that was run.
- **featureAssessmentImpact** WaaS Assessment impact for feature updates.
- **hrEngineResult** Error code from the engine operation.
+- **insufficientSessions** Device not eligible for diagnostics.
- **isManaged** Device is managed for updates.
- **isWUConnected** Device is connected to Windows Update.
- **noMoreActions** No more applicable diagnostics.
-- **qualityAssessmentImpact** WaaS Assessment impact for quality updates.
-- **remediationSummary** Result of each applicable resolution that was ran.
-- **usingBackupFeatureAssessment** Relying on backup feature assessment.
+- **qualityAssessmentImpact** WaaS Assessment impact for quality updates.
+- **remediationSummary** Result of each operation performed on a device to fix an invalid state or configuration that's preventing the device from getting updates. For example, if Windows Update service is turned off, the fix is to turn the it back on.
+- **usingBackupFeatureAssessment** Relying on backup feature assessment.
- **usingBackupQualityAssessment** Relying on backup quality assessment.
-- **versionString** Version of the WaaSMedic engine.
- **usingCachedFeatureAssessment** WaaS Medic run did not get OS build age from the network on the previous run.
- **usingCachedQualityAssessment** WaaS Medic run did not get OS revision age from the network on the previous run.
-- **insufficientSessions** Device not eligible for diagnostics.
+- **versionString** Version of the WaaSMedic engine.
-## Windows Error Reporting events
-
## Windows Error Reporting MTT events
### Microsoft.Windows.WER.MTT.Denominator
-This event provides a denominator to calculate MTTF (mean-time-to-failure) for crashes and other errors to help keep Windows up to date.
+This event provides a denominator to calculate MTTF (mean-time-to-failure) for crashes and other errors, to help keep Windows up to date.
The following fields are available:
-- **Value** Standard UTC emitted DP value structure
+- **Value** Standard UTC emitted DP value structure See [Microsoft.Windows.WER.MTT.Value](#microsoftwindowswermttvalue).
+
+
+### Microsoft.Windows.WER.MTT.Value
+
+This event is used for differential privacy.
+
+The following fields are available:
+
+- **Algorithm** Privacy protecting algorithm used for randomization.
+- **DPRange** Maximum mean value range.
+- **DPValue** Randomized bit value (0 or 1) that can be reconstituted over a large population to estimate mean.
+- **Epsilon** Constant used in algorithm for randomization.
+- **HistType** Histogram type.
+- **PertProb** Constant used in algorithm for randomization.
+
+
+## Windows Store events
+
+### Microsoft.Windows.StoreAgent.Telemetry.AbortedInstallation
+
+This event is sent when an installation or update is canceled by a user or the system and is used to help keep Windows Apps up to date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **AttemptNumber** Number of retry attempts before it was canceled.
+- **BundleId** The Item Bundle ID.
+- **CategoryId** The Item Category ID.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** The result code of the last action performed before this operation.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Was this requested by a user?
+- **IsMandatory** Was this a mandatory update?
+- **IsRemediation** Was this a remediation install?
+- **IsRestore** Is this automatically restoring a previously acquired product?
+- **IsUpdate** Flag indicating if this is an update.
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The product family name of the product being installed.
+- **ProductId** The identity of the package or packages being installed.
+- **SystemAttemptNumber** The total number of automatic attempts at installation before it was canceled.
+- **UserAttemptNumber** The total number of user attempts at installation before it was canceled.
+- **WUContentId** Licensing identity of this package.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.BeginGetInstalledContentIds
+
+This event is sent when an inventory of the apps installed is started to determine whether updates for those apps are available. It's used to help keep Windows up-to-date and secure.
+
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.BeginUpdateMetadataPrepare
+
+This event is sent when the Store Agent cache is refreshed with any available package updates. It's used to help keep Windows up-to-date and secure.
+
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.CancelInstallation
+
+This event is sent when an app update or installation is canceled while in interactive mode. This can be canceled by the user or the system. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** The names of all package or packages to be downloaded and installed.
+- **AttemptNumber** Total number of installation attempts.
+- **BundleId** The identity of the Windows Insider build that is associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Was this requested by a user?
+- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this an automatic restore of a previously acquired product?
+- **IsUpdate** Is this a product update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The name of all packages to be downloaded and installed.
+- **PreviousHResult** The previous HResult code.
+- **PreviousInstallState** Previous installation state before it was canceled.
+- **ProductId** The name of the package or packages requested for installation.
+- **RelatedCV** Correlation Vector of a previous performed action on this product.
+- **SystemAttemptNumber** Total number of automatic attempts to install before it was canceled.
+- **UserAttemptNumber** Total number of user attempts to install before it was canceled.
+- **WUContentId** The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.CompleteInstallOperationRequest
+
+This event is sent at the end of app installations or updates to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **CatalogId** The Store Product ID of the app being installed.
+- **HResult** HResult code of the action being performed.
+- **IsBundle** Is this a bundle?
+- **PackageFamilyName** The name of the package being installed.
+- **ProductId** The Store Product ID of the product being installed.
+- **SkuId** Specific edition of the item being installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndAcquireLicense
+
+This event is sent after the license is acquired when a product is being installed. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set.
+- **AttemptNumber** The total number of attempts to acquire this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** HResult code to show the result of the operation (success/failure).
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Did the user initiate the installation?
+- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this happening after a device restore?
+- **IsUpdate** Is this an update?
+- **PFN** Product Family Name of the product being installed.
+- **ProductId** The Store Product ID for the product being installed.
+- **SystemAttemptNumber** The number of attempts by the system to acquire this product.
+- **UserAttemptNumber** The number of attempts by the user to acquire this product
+- **WUContentId** The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndDownload
+
+This event is sent after an app is downloaded to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
+- **AttemptNumber** Number of retry attempts before it was canceled.
+- **BundleId** The identity of the Windows Insider build associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **DownloadSize** The total size of the download.
+- **ExtendedHResult** Any extended HResult error codes.
+- **HResult** The result code of the last action performed.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this initiated by the user?
+- **IsMandatory** Is this a mandatory installation?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this a restore of a previously acquired product?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
+- **PFN** The Product Family Name of the app being download.
+- **ProductId** The Store Product ID for the product being installed.
+- **SystemAttemptNumber** The number of attempts by the system to download.
+- **UserAttemptNumber** The number of attempts by the user to download.
+- **WUContentId** The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndFrameworkUpdate
+
+This event is sent when an app update requires an updated Framework package and the process starts to download it. It is used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **HResult** The result code of the last action performed before this operation.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndGetInstalledContentIds
+
+This event is sent after sending the inventory of the products installed to determine whether updates for those products are available. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **HResult** The result code of the last action performed before this operation.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndInstall
+
+This event is sent after a product has been installed to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **AttemptNumber** The number of retry attempts before it was canceled.
+- **BundleId** The identity of the build associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **ExtendedHResult** The extended HResult error code.
+- **HResult** The result code of the last action performed.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this an interactive installation?
+- **IsMandatory** Is this a mandatory installation?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this automatically restoring a previously acquired product?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** Product Family Name of the product being installed.
+- **ProductId** The Store Product ID for the product being installed.
+- **SystemAttemptNumber** The total number of system attempts.
+- **UserAttemptNumber** The total number of user attempts.
+- **WUContentId** The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndScanForUpdates
+
+This event is sent after a scan for product updates to determine if there are packages to install. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** The result code of the last action performed.
+- **IsApplicability** Is this request to only check if there are any applicable packages to install?
+- **IsInteractive** Is this user requested?
+- **IsOnline** Is the request doing an online check?
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndSearchUpdatePackages
+
+This event is sent after searching for update packages to install. It is used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **AttemptNumber** The total number of retry attempts before it was canceled.
+- **BundleId** The identity of the build associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** The result code of the last action performed.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this user requested?
+- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The name of the package or packages requested for install.
+- **ProductId** The Store Product ID for the product being installed.
+- **SystemAttemptNumber** The total number of system attempts.
+- **UserAttemptNumber** The total number of user attempts.
+- **WUContentId** The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndStageUserData
+
+This event is sent after restoring user data (if any) that needs to be restored following a product install. It is used to keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed.
+- **AttemptNumber** The total number of retry attempts before it was canceled.
+- **BundleId** The identity of the build associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** The result code of the last action performed.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this user requested?
+- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The name of the package or packages requested for install.
+- **ProductId** The Store Product ID for the product being installed.
+- **SystemAttemptNumber** The total number of system attempts.
+- **UserAttemptNumber** The total number of system attempts.
+- **WUContentId** The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndUpdateMetadataPrepare
+
+This event happens after a scan for available app updates. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **HResult** The result code of the last action performed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentComplete
+
+This event is sent at the end of an app install or update to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **CatalogId** The name of the product catalog from which this app was chosen.
+- **FailedRetry** Indicates whether the installation or update retry was successful.
+- **HResult** The HResult code of the operation.
+- **PFN** The Package Family Name of the app that is being installed or updated.
+- **ProductId** The product ID of the app that is being updated or installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentInitiate
+
+This event is sent at the beginning of an app install or update to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **CatalogId** The name of the product catalog from which this app was chosen.
+- **PFN** The Package Family Name of the app that is being installed or updated.
+- **ProductId** The product ID of the app that is being updated or installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.InstallOperationRequest
+
+This event is sent when a product install or update is initiated, to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **BundleId** The identity of the build associated with this product.
+- **CatalogId** If this product is from a private catalog, the Store Product ID for the product being installed.
+- **ProductId** The Store Product ID for the product being installed.
+- **SkuId** Specific edition ID being installed.
+- **VolumePath** The disk path of the installation.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.PauseInstallation
+
+This event is sent when a product install or update is paused (either by a user or the system), to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **AttemptNumber** The total number of retry attempts before it was canceled.
+- **BundleId** The identity of the build associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this user requested?
+- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The Product Full Name.
+- **PreviousHResult** The result code of the last action performed before this operation.
+- **PreviousInstallState** Previous state before the installation or update was paused.
+- **ProductId** The Store Product ID for the product being installed.
+- **RelatedCV** Correlation Vector of a previous performed action on this product.
+- **SystemAttemptNumber** The total number of system attempts.
+- **UserAttemptNumber** The total number of user attempts.
+- **WUContentId** The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.ResumeInstallation
+
+This event is sent when a product install or update is resumed (either by a user or the system), to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed.
+- **AttemptNumber** The number of retry attempts before it was canceled.
+- **BundleId** The identity of the build associated with this product.
+- **CategoryId** The identity of the package or packages being installed.
+- **ClientAppId** The identity of the app that initiated this operation.
+- **HResult** The result code of the last action performed before this operation.
+- **IsBundle** Is this a bundle?
+- **IsInteractive** Is this user requested?
+- **IsMandatory** Is this a mandatory update?
+- **IsRemediation** Is this repairing a previous installation?
+- **IsRestore** Is this restoring previously acquired content?
+- **IsUpdate** Is this an update?
+- **IsUserRetry** Did the user initiate the retry?
+- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
+- **PFN** The name of the package or packages requested for install.
+- **PreviousHResult** The previous HResult error code.
+- **PreviousInstallState** Previous state before the installation was paused.
+- **ProductId** The Store Product ID for the product being installed.
+- **RelatedCV** Correlation Vector for the original install before it was resumed.
+- **SystemAttemptNumber** The total number of system attempts.
+- **UserAttemptNumber** The total number of user attempts.
+- **WUContentId** The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.ResumeOperationRequest
+
+This event is sent when a product install or update is resumed by a user or on installation retries, to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **ProductId** The Store Product ID for the product being installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.SearchForUpdateOperationRequest
+
+This event is sent when searching for update packages to install, to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **CatalogId** The Store Catalog ID for the product being installed.
+- **ProductId** The Store Product ID for the product being installed.
+- **SkuId** Specfic edition of the app being updated.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.UpdateAppOperationRequest
+
+This event occurs when an update is requested for an app, to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **PFamN** The name of the app that is requested for update.
## Windows Update CSP events
### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureFailed
-The Execute Rollback Feature Failed event sends basic telemetry on the failure of the Feature Rollback. This functionality supports our feature by providing IT Admins the ability to see the operation failed, allowing them to do further triage of the device.
+This event sends basic telemetry on the failure of the Feature Rollback.
The following fields are available:
-- **current** Result of currency check
-- **dismOperationSucceeded** Dism uninstall operation status
-- **hResult** Failure Error code
-- **oSVersion** Build number of the machine
-- **paused** Machine's pause status
-- **rebootRequestSucceeded** Reboot CSP call success status
-- **wUfBConnected** Result of WUfB connection check
+- **current** Result of currency check.
+- **dismOperationSucceeded** Dism uninstall operation status.
+- **hResult** Failure error code.
+- **oSVersion** Build number of the device.
+- **paused** Indicates whether the device is paused.
+- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status.
+- **wUfBConnected** Result of WUfB connection check.
### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureNotApplicable
-The Execute Rollback Feature Not Applicable event sends basic telemetry on the applicability of the Feature Rollback, to support the functionality of Feature Rollback. This event provides critical information for the feature because it will alert IT Admins that devices they are attempting to rollback Features updates are not applicable.
+This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device.
The following fields are available:
-- **current** Result of currency check
-- **dismOperationSucceeded** Dism uninstall operation status
-- **oSVersion** Build number of the machine
-- **paused** Machine's pause status
-- **rebootRequestSucceeded** Reboot CSP call success status
-- **wUfBConnected** Result of WUfB connection check
+- **current** Result of currency check.
+- **dismOperationSucceeded** Dism uninstall operation status.
+- **oSVersion** Build number of the device.
+- **paused** Indicates whether the device is paused.
+- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status.
+- **wUfBConnected** Result of WUfB connection check.
### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted
-The Execute Rollback Feature Started event sends basic information on the start process to provide information that the Feature Rollback has started.
+This event sends basic information indicating that Feature Rollback has started.
### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureSucceeded
-The Execute Rollback Feature Succeed event sends basic telemetry on the success of the Rollback of the Feature updates. This functionality supports our feature by providing insights to IT Admins of the success of the Feature rollback.
+This event sends basic telemetry on the success of the rollback of feature updates.
### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityFailed
-The Execute Rollback Quality Failed event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. This functionality supports our feature by providing IT Admins the ability to see the operation failed allowing them to do further triage of the device.
+This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds.
The following fields are available:
-- **current** Result of currency check
-- **dismOperationSucceeded** Dism uninstall operation status
-- **hResult** Failure Error code
-- **oSVersion** Build number of the machine
-- **paused** Machine's pause status
-- **rebootRequestSucceeded** Reboot CSP call success status
-- **wUfBConnected** Result of WUfB connection check
+- **current** Result of currency check.
+- **dismOperationSucceeded** Dism uninstall operation status.
+- **hResult** Failure error code.
+- **oSVersion** Build number of the device.
+- **paused** Indicates whether the device is paused.
+- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status.
+- **wUfBConnected** Result of Windows Update for Business connection check.
### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable
-The Execute Rollback Quality Not Applicable event sends basic telemetry on the applicability of the Quality Rollback, to support the functionality of Quality Rollback. This event provides critical information for feature because it will alert IT Admins that devices they are attempting to rollback Quality updates are not applicable.
+This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback.
The following fields are available:
-- **current** Result of currency check
-- **dismOperationSucceeded** Dism uninstall operation status
-- **oSVersion** Build number of the machine
-- **paused** Machine's pause status
-- **rebootRequestSucceeded** Reboot CSP call success status
-- **wUfBConnected** Result of WUfB connection check
+- **current** Result of currency check.
+- **dismOperationSucceeded** Dism uninstall operation status.
+- **oSVersion** Build number of the device.
+- **paused** Indicates whether the device is paused.
+- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status.
+- **wUfBConnected** Result of WUfB connection check.
### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityStarted
-The Execute Rollback Quality Started event sends basic information on the start process to provide information that the Quality Rollback has started.
+This event indicates that the Quality Rollback process has started.
### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualitySucceeded
-The Execute Rollback Quality Succeed event sends basic telemetry on the success of the rollback of the Quality/LCU builds. This functionality supports our feature by providing insights to IT Admins of the success of the Quality rollback.
+This event sends basic telemetry on the success of the rollback of the Quality/LCU builds.
@@ -4549,37 +5066,37 @@ This event sends data describing the start of a new download to enable Delivery
The following fields are available:
-- **background** If the download is happening in the background
-- **bytesRequested** Number of bytes requested for download.
-- **cdnUrl** Url of the source CDN
-- **costFlags** Network cost flags
-- **deviceProfile** Identifies the usage or form factor (Desktop, Xbox, VM, etc)
-- **diceRoll** Random number used for determining if a client will use peering
-- **doClientVersion** Version of the Delivery Optimization client
-- **doErrorCode** Delivery Optimization error code returned
-- **downloadMode** DownloadMode used (CdnOnly = 0, Lan = 1, Group = 2, Internet = 3, Simple = 99, Bypass = 100)
-- **downloadModeSrc** Source of the DownloadMode setting (KvsProvider: 0, GeoProvider: 1, GeoVerProvider: 2, CpProvider: 3, DiscoveryProvider: 4, RegistryProvider: 5, GroupPolicyProvider: 6, MdmProvider: 7, SettingsProvider: 8, InvalidProviderType: 9)
-- **errorCode** Error code returned
-- **experimentId** Used to correlate client/services calls that are part of the same test during A/B testing
-- **fileID** ID of the File being downloaded
-- **filePath** Path to where the downloaded file will be written
-- **fileSize** Total filesize of the file that was downloaded
-- **fileSizeCaller** Value for total file size provided by our caller
-- **groupID** ID for the group
-- **isVpn** If the machine is connected to a Virtual Private Network
-- **jobID** Identifier for the Windows Update Job
-- **peerID** ID for this Delivery Optimization client
-- **predefinedCallerName** Name of the API caller
-- **sessionID** ID for the file download session
-- **setConfigs** ID of the update being downloaded
-- **updateID** ID for the file download session
-- **usedMemoryStream** If the download is using memory streaming in App downloads
-- **callerName** Name of the API Caller
-- **minDiskSizeGB** The minimum disk size policy set for the device to allow Peering with Delivery Optimization
-- **minDiskSizePolicyEnforced** If there is an enforced mininum disk size requirement for peering
-- **minFileSizePolicy** The minimum file size policy set for the device to allow Peering with Delivery Optimization
-- **scenarioID** ID for the Scenario
-- **isEncrypted** Whether the download is encrypted
+- **background** Indicates whether the download is happening in the background.
+- **bytesRequested** Number of bytes requested for the download.
+- **callerName** Name of the API caller.
+- **cdnUrl** The URL of the source CDN
+- **costFlags** A set of flags representing network cost.
+- **deviceProfile** Identifies the usage or form factor (such as Desktop, Xbox, or VM).
+- **diceRoll** Random number used for determining if a client will use peering.
+- **doClientVersion** The version of the Delivery Optimization client.
+- **doErrorCode** The Delivery Optimization error code that was returned.
+- **downloadMode** The download mode used for this file download session (CdnOnly = 0, Lan = 1, Group = 2, Internet = 3, Simple = 99, Bypass = 100).
+- **downloadModeSrc** Source of the DownloadMode setting (KvsProvider = 0, GeoProvider = 1, GeoVerProvider = 2, CpProvider = 3, DiscoveryProvider = 4, RegistryProvider = 5, GroupPolicyProvider = 6, MdmProvider = 7, SettingsProvider = 8, InvalidProviderType = 9).
+- **errorCode** The error code that was returned.
+- **experimentId** ID used to correlate client/services calls that are part of the same test during A/B testing.
+- **fileID** The ID of the file being downloaded.
+- **filePath** The path to where the downloaded file will be written.
+- **fileSize** Total file size of the file that was downloaded.
+- **fileSizeCaller** Value for total file size provided by our caller.
+- **groupID** ID for the group.
+- **isEncrypted** Indicates whether the download is encrypted.
+- **isVpn** Indicates whether the device is connected to a Virtual Private Network.
+- **jobID** The ID of the Windows Update job.
+- **minDiskSizeGB** The minimum disk size (in GB) policy set for the device to allow peering with delivery optimization.
+- **minDiskSizePolicyEnforced** Indicates whether there is an enforced minimum disk size requirement for peering.
+- **minFileSizePolicy** The minimum content file size policy to allow the download using peering with delivery optimization.
+- **peerID** The ID for this delivery optimization client.
+- **predefinedCallerName** Name of the API caller.
+- **scenarioID** The ID of the scenario.
+- **sessionID** The ID for the file download session.
+- **setConfigs** A JSON representation of the configurations that have been set, and their sources.
+- **updateID** The ID of the update being downloaded.
+- **usedMemoryStream** Indicates whether the download used memory streaming.
## Windows Update events
@@ -4591,328 +5108,328 @@ This event collects information regarding the state of devices and drivers on th
The following fields are available:
- **activated** Whether the entire device manifest update is considered activated and in use.
-- **analysisErrorCount** How many driver packages that could not be analyzed because errors were hit during the analysis.
-- **flightId** Unique ID for each flight.
-- **missingDriverCount** How many driver packages that were delivered by the device manifest that are missing from the system.
-- **missingUpdateCount** How many updates that were part of the device manifest that are missing from the system.
-- **objectId** Unique value for each diagnostics session.
-- **publishedCount** How many drivers packages that were delivered by the device manifest that are published and available to be used on devices.
-- **relatedCV** Correlation vector value generated from the latest USO scan.
-- **scenarioId** Indicates the update scenario.
-- **sessionId** Unique value for each update session.
-- **summary** A summary string that contains some basic information about driver packages that are part of the device manifest and any devices on the system that those driver packages match on.
+- **analysisErrorCount** How many driver packages could not be analyzed because errors were hit during the analysis.
+- **flightId** Unique ID for each flight.
+- **missingDriverCount** How many driver packages that were delivered by the device manifest are missing from the system.
+- **missingUpdateCount** How many updates that were part of the device manifest are missing from the system.
+- **objectId** Unique value for each diagnostics session.
+- **publishedCount** How many drivers packages that were delivered by the device manifest are published and available to be used on devices.
+- **relatedCV** Correlation vector value generated from the latest USO scan.
+- **scenarioId** Indicates the update scenario.
+- **sessionId** Unique value for each update session.
+- **summary** A summary string that contains some basic information about driver packages that are part of the device manifest and any devices on the system that those driver packages match.
- **summaryAppendError** A Boolean indicating if there was an error appending more information to the summary string.
-- **truncatedDeviceCount** How many devices are missing from the summary string due to there not being enough room in the string.
-- **truncatedDriverCount** How many driver packages are missing from the summary string due to there not being enough room in the string.
+- **truncatedDeviceCount** How many devices are missing from the summary string because there is not enough room in the string.
+- **truncatedDriverCount** How many driver packages are missing from the summary string because there is not enough room in the string.
- **unpublishedCount** How many drivers packages that were delivered by the device manifest that are still unpublished and unavailable to be used on devices.
-- **updateId** Unique ID for each Update.
+- **updateId** Unique ID for each update.
### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit
-This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
+This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages.
The following fields are available:
-- **errorCode** The error code returned for the current session initialization
-- **flightId** The unique identifier for each flight
-- **objectId** The unique GUID for each diagnostics session
-- **relatedCV** A correlation vector value, generated from the latest USO scan
-- **result** Outcome of the initialization of the session
-- **scenarioId** Identifies the Update scenario
-- **sessionId** The unique value for each update session
-- **updateId** The unique identifier for each Update
+- **errorCode** The error code returned for the current session initialization.
+- **flightId** The unique identifier for each flight.
+- **objectId** The unique GUID for each diagnostics session.
+- **relatedCV** A correlation vector value generated from the latest USO scan.
+- **result** Outcome of the initialization of the session.
+- **scenarioId** Identifies the Update scenario.
+- **sessionId** The unique value for each update session.
+- **updateId** The unique identifier for each Update.
### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest
-This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
+This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages.
The following fields are available:
-- **deletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted
-- **errorCode** The error code returned for the current session initialization
-- **flightId** The unique identifier for each flight
-- **objectId** Unique value for each Update Agent mode
-- **packageCountOptional** Number of optional packages requested
-- **packageCountRequired** Number of required packages requested
-- **packageCountTotal** Total number of packages needed
-- **packageCountTotalCanonical** Total number of canonical packages
-- **packageCountTotalDiff** Total number of diff packages
-- **packageCountTotalExpress** Total number of express packages
-- **packageSizeCanonical** Size of canonical packages in bytes
-- **packageSizeDiff** Size of diff packages in bytes
-- **packageSizeExpress** Size of express packages in bytes
-- **rangeRequestState** Represents the state of the download range request
-- **relatedCV** Correlation vector value generated from the latest USO scan
-- **result** Result of the download request phase of update
-- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **sessionId** Unique value for each Update Agent mode attempt
-- **updateId** Unique ID for each update
+- **deletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted.
+- **errorCode** The error code returned for the current session initialization.
+- **flightId** The unique identifier for each flight.
+- **objectId** Unique value for each Update Agent mode.
+- **packageCountOptional** Number of optional packages requested.
+- **packageCountRequired** Number of required packages requested.
+- **packageCountTotal** Total number of packages needed.
+- **packageCountTotalCanonical** Total number of canonical packages.
+- **packageCountTotalDiff** Total number of diff packages.
+- **packageCountTotalExpress** Total number of express packages.
+- **packageSizeCanonical** Size of canonical packages in bytes.
+- **packageSizeDiff** Size of diff packages in bytes.
+- **packageSizeExpress** Size of express packages in bytes.
+- **rangeRequestState** Represents the state of the download range request.
+- **relatedCV** Correlation vector value generated from the latest USO scan.
+- **result** Result of the download request phase of update.
+- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate.
+- **sessionId** Unique value for each Update Agent mode attempt.
+- **updateId** Unique ID for each update.
### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize
-This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
+This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages.
The following fields are available:
-- **errorCode** The error code returned for the current initialize phase
-- **flightId** The unique identifier for each flight
-- **flightMetadata** Contains the FlightId and the build being flighted
-- **objectId** Unique value for each Update Agent mode
-- **relatedCV** Correlation vector value generated from the latest USO scan
-- **result** Result of the initialize phase of update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
-- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **sessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios)
-- **sessionId** Unique value for each Update Agent mode attempt
-- **updateId** Unique ID for each update
+- **errorCode** The error code returned for the current session initialization.
+- **flightId** The unique identifier for each flight.
+- **flightMetadata** Contains the FlightId and the build being flighted.
+- **objectId** Unique value for each Update Agent mode.
+- **relatedCV** Correlation vector value generated from the latest USO scan.
+- **result** Result of the initialize phase of the update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled.
+- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate.
+- **sessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios).
+- **sessionId** Unique value for each Update Agent mode attempt.
+- **updateId** Unique ID for each update.
### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall
-This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages
+This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages.
The following fields are available:
-- **errorCode** The error code returned for the current install phase
-- **flightId** The unique identifier for each flight
-- **objectId** Unique value for each Update Agent mode
-- **relatedCV** Correlation vector value generated from the latest scan
-- **result** Result of the install phase of update. 0 = Succeeded 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled
-- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **sessionId** Unique value for each Update Agent mode attempt
-- **updateId** Unique ID for each update
+- **errorCode** The error code returned for the current install phase.
+- **flightId** Unique ID for each flight.
+- **objectId** Unique value for each diagnostics session.
+- **relatedCV** Correlation vector value generated from the latest USO scan.
+- **result** Outcome of the install phase of the update.
+- **scenarioId** Indicates the update scenario.
+- **sessionId** Unique value for each update session.
+- **updateId** Unique ID for each Update.
### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart
-This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages.
+This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages.
The following fields are available:
-- **flightId** The unique identifier for each flight
-- **mode** Indicates that the Update Agent mode that has started. 1 = Initialize, 2 = DownloadRequest, 3 = Install, 4 = Commit
-- **objectId** Unique value for each Update Agent mode
-- **relatedCV** Correlation vector value generated from the latest scan
-- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate
-- **sessionId** Unique value for each Update Agent mode attempt
-- **updateId** Unique ID for each update
+- **flightId** Unique ID for each flight.
+- **mode** The mode that is starting.
+- **objectId** Unique value for each diagnostics session.
+- **relatedCV** Correlation vector value generated from the latest USO scan.
+- **scenarioId** Indicates the update scenario.
+- **sessionId** Unique value for each update session.
+- **updateId** Unique ID for each Update.
### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed
-Dialog notification about to be displayed to user.
+This event indicates that a notification dialog box is about to be displayed to user.
The following fields are available:
-- **AcceptAutoModeLimit** Maximum number of days for a device to automatically enter Auto Reboot mode
-- **AutoToAutoFailedLimit** Maximum number of days for Auto Reboot mode to fail before RebootFailed dialog will be shown
-- **DeviceLocalTime** Time of dialog shown on local device
-- **EngagedModeLimit** Number of days to switch between DTE dialogs
-- **EnterAutoModeLimit** Maximum number of days for a device to enter Auto Reboot mode
-- **ETag** OneSettings versioning value
-- **IsForcedEnabled** Is Forced Reboot mode enabled for this device?
-- **IsUltimateForcedEnabled** Is Ultimate Forced Reboot mode enabled for this device?
-- **NotificationUxState** Which dialog is shown (ENUM)?
-- **NotificationUxStateString** Which dialog is shown (string mapping)?
-- **RebootUxState** Engaged/Auto/Forced/UltimateForced
-- **RebootUxStateString** Engaged/Auto/Forced/UltimateForced
-- **RebootVersion** Version of DTE
-- **SkipToAutoModeLimit** The minimum length of time to pass in reboot pending before a machine can be put into auto mode
-- **UpdateId** The ID of the update that is pending reboot to finish installation
-- **UpdateRevision** The revision of the update that is pending reboot to finish installation
-- **UtcTime** The Coordinated Universal Time when the dialog notification will be displayed.
-- **DaysSinceRebootRequired** Number of days since reboot was required.
+- **AcceptAutoModeLimit** The maximum number of days for a device to automatically enter Auto Reboot mode.
+- **AutoToAutoFailedLimit** The maximum number of days for Auto Reboot mode to fail before the RebootFailed dialog box is shown.
+- **DaysSinceRebootRequired** Number of days since restart was required.
+- **DeviceLocalTime** The local time on the device sending the event.
+- **EngagedModeLimit** The number of days to switch between DTE dialog boxes.
+- **EnterAutoModeLimit** The maximum number of days for a device to enter Auto Reboot mode.
+- **ETag** OneSettings versioning value.
+- **IsForcedEnabled** Indicates whether Forced Reboot mode is enabled for this device.
+- **IsUltimateForcedEnabled** Indicates whether Ultimate Forced Reboot mode is enabled for this device.
+- **NotificationUxState** Indicates which dialog box is shown.
+- **NotificationUxStateString** Indicates which dialog box is shown.
+- **RebootUxState** Indicates the state of the restart (Engaged, Auto, Forced, or UltimateForced).
+- **RebootUxStateString** Indicates the state of the restart (Engaged, Auto, Forced, or UltimateForced).
+- **RebootVersion** Version of DTE.
+- **SkipToAutoModeLimit** The minimum length of time to pass in restart pending before a device can be put into auto mode.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UtcTime** The time the dialog box notification will be displayed, in Coordinated Universal Time.
### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog
-Enhanced Engaged reboot accept auto dialog was displayed.
+This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed.
The following fields are available:
-- **DeviceLocalTime** Local time of the device sending the event
-- **ETag** OneSettings ETag
-- **ExitCode** Dialog exit code - user response
-- **RebootVersion** Reboot flow version
-- **UpdateId** Id of pending update
-- **UpdateRevision** Revision number of the pending update
-- **UserResponseString** User response to the reboot dialog
-- **UtcTime** The Coordinated Universal Time that dialog was displayed
+- **DeviceLocalTime** The local time on the device sending the event.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that user chose on this dialog box.
+- **UtcTime** The time that the dialog box was displayed, in Coordinated Universal Time.
### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog
-Enhanced Engaged reboot first reminder dialog was displayed.
+This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed.
The following fields are available:
-- **DeviceLocalTime** Time of dialog shown on local device
-- **ETag** OneSettings versioning value
-- **ExitCode** Indicates how users exited the dialog
-- **RebootVersion** Version of DTE
-- **UpdateId** The id of the update that is pending reboot to finish installation
-- **UpdateRevision** The revision of the update that is pending reboot to finish installation
-- **UserResponseString** The option that user chose on this dialog
-- **UtcTime** The Coordinated Universal Time that dialog was displayed
+- **DeviceLocalTime** The local time on the device sending the event.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that user chose in this dialog box.
+- **UtcTime** The time that the dialog box was displayed, in Coordinated Universal Time.
### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedPrecursorDialog
-Enhanced Engaged reboot forced precursor dialog was displayed.
+This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed.
The following fields are available:
-- **DeviceLocalTime** Time of dialog shown on local device
-- **ETag** OneSettings versioning value
-- **ExitCode** Indicates how users exited the dialog
-- **RebootVersion** Version of DTE
-- **UpdateId** The id of the update that is pending reboot to finish installation
-- **UpdateRevision** The revision of the update that is pending reboot to finish installation
-- **UserResponseString** The option that user chose on this dialog
-- **UtcTime** The Coordinated Universal Time that dialog was displayed
+- **DeviceLocalTime** The local time on the device sending the event.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that the user chose in this dialog box.
+- **UtcTime** The time the dialog box was displayed, in Coordinated Universal Time.
### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedWarningDialog
-Enhanced Engaged forced warning dialog was displayed.
+This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed.
The following fields are available:
-- **DeviceLocalTime** Time of dialog shown on local device
-- **ETag** OneSettings versioning value
-- **ExitCode** Indicates how users exited the dialog
-- **RebootVersion** Version of DTE
-- **UpdateId** The id of the update that is pending reboot to finish installation
-- **UpdateRevision** The revision of the update that is pending reboot to finish installation
-- **UserResponseString** The option that user chose on this dialog
-- **UtcTime** The Coordinated Universal Time that dialog was displayed
+- **DeviceLocalTime** The local time on the device sending the event.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that the user chose in this dialog box.
+- **UtcTime** The time that the dialog box was displayed, in Coordinated Universal Time.
### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog
-Enhanced Engaged reboot reboot failed dialog was displayed.
+This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed.
The following fields are available:
-- **DeviceLocalTime** Dialog exit code - user response
-- **ETag** OneSettings versioning value
-- **ExitCode** Indicates how users exited the dialog
-- **RebootVersion** Version of DTE
-- **UpdateId** The ID of the update that is pending reboot to finish installation
-- **UpdateRevision** The revision of the update that is pending reboot to finish installation
-- **UserResponseString** The option that user chose on this dialog
-- **UtcTime** The Coordinated Universal Time that dialog was displayed
+- **DeviceLocalTime** The local time of the device sending the event.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that the user chose in this dialog box.
+- **UtcTime** The time that the dialog box was displayed, in Coordinated Universal Time.
### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog
-Enhanced Engaged reboot reboot imminent dialog was displayed.
+This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed..
The following fields are available:
-- **DeviceLocalTime** Time of dialog shown on local device
-- **ETag** OneSettings versioning value
-- **ExitCode** Indicates how users exited the dialog
-- **RebootVersion** Version of DTE
-- **UpdateId** The ID of the update that is pending reboot to finish installation
-- **UpdateRevision** The revision of the update that is pending reboot to finish installation
-- **UserResponseString** The option that user chose on this dialog
-- **UtcTime** The Coordinated Universal Time that dialog was displayed
+- **DeviceLocalTime** Time the dialog box was shown on the local device.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that user chose in this dialog box.
+- **UtcTime** The time that dialog box was displayed, in Coordinated Universal Time.
### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog
-Enhanced Engaged reboot second reminder dialog was displayed.
+This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart.
The following fields are available:
-- **DeviceLocalTime** Time of dialog shown on local device
-- **ETag** OneSettings versioning value
-- **ExitCode** Indicates how users exited the dialog
-- **RebootVersion** Version of DTE
-- **UpdateId** The ID of the update that is pending reboot to finish installation
-- **UpdateRevision** The revision of the update that is pending reboot to finish installation
-- **UserResponseString** The option that user chose on this dialog
-- **UtcTime** The Coordinated Universal Time that dialog was displayed
+- **DeviceLocalTime** The time the dialog box was shown on the local device.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that the user chose in this dialog box.
+- **UtcTime** The time that the dialog box was displayed, in Coordinated Universal Time.
### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog
-Enhanced Engaged reboot third reminder dialog was displayed.
+This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed.
The following fields are available:
-- **DeviceLocalTime** Time of dialog shown on local device
-- **ETag** OneSettings versioning value
-- **ExitCode** Indicates how users exited the dialog
-- **RebootVersion** Version of DTE
-- **UpdateId** The ID of the update that is pending reboot to finish installation
-- **UpdateRevision** The revision of the update that is pending reboot to finish installation
-- **UserResponseString** The option that user chose on this dialog
-- **UtcTime** The Coordinated Universal Time that dialog was displayed
+- **DeviceLocalTime** The time the dialog box was shown on the local device.
+- **ETag** OneSettings versioning value.
+- **ExitCode** Indicates how users exited the dialog box.
+- **RebootVersion** Version of DTE.
+- **UpdateId** The ID of the update that is pending restart to finish installation.
+- **UpdateRevision** The revision of the update that is pending restart to finish installation.
+- **UserResponseString** The option that the user chose in this dialog box.
+- **UtcTime** The time that the dialog box was displayed, in Coordinated Universal Time.
### Microsoft.Windows.Update.NotificationUx.RebootScheduled
-Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update
+Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update.
The following fields are available:
-- **activeHoursApplicable** True, If Active Hours applicable on this device. False, otherwise
-- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action
-- **rebootOutsideOfActiveHours** True, if a reboot is scheduled outside of active hours. False, otherwise
-- **rebootScheduledByUser** True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically
-- **rebootState** The state of the reboot
-- **revisionNumber** Revision number of the update that is getting installed with this reboot
-- **scheduledRebootTime** Time of the scheduled reboot
-- **scheduledRebootTimeInUTC** Time of the scheduled reboot in Coordinated Universal Time
-- **updateId** ID of the update that is getting installed with this reboot
-- **wuDeviceid** Unique device ID used by Windows Update
-- **IsEnhancedEngagedReboot** Whether this is an Enhanced Engaged reboot
+- **activeHoursApplicable** Indicates whether an Active Hours policy is present on the device.
+- **IsEnhancedEngagedReboot** Indicates whether this is an Enhanced Engaged reboot.
+- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action.
+- **rebootOutsideOfActiveHours** Indicates whether a restart is scheduled outside of active hours.
+- **rebootScheduledByUser** Indicates whether the restart was scheduled by user (if not, it was scheduled automatically).
+- **rebootState** The current state of the restart.
+- **revisionNumber** Revision number of the update that is getting installed with this restart.
+- **scheduledRebootTime** Time of the scheduled restart.
+- **scheduledRebootTimeInUTC** Time of the scheduled restart in Coordinated Universal Time.
+- **updateId** ID of the update that is getting installed with this restart.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy
-A policy is present that may restrict update activity to outside of active hours.
+This event indicates a policy is present that may restrict update activity to outside of active hours.
The following fields are available:
-- **activeHoursEnd** The end of the active hours window
-- **activeHoursStart** The start of the active hours window
-- **wuDeviceid** Device ID
+- **activeHoursEnd** The end of the active hours window.
+- **activeHoursStart** The start of the active hours window.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours
-Update activity blocked due to active hours being currently active.
+This event indicates that update activity was blocked because it is within the active hours window.
The following fields are available:
-- **blockReason** The current state of the update process
-- **updatePhase** The current state of the update process
-- **wuDeviceid** Device ID
-- **activeHoursEnd** The end of the active hours window
-- **activeHoursStart** The start of the active hours window
+- **activeHoursEnd** The end of the active hours window.
+- **activeHoursStart** The start of the active hours window.
+- **blockReason** Reason for stopping the update activity.
+- **updatePhase** The current state of the update process.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel
-Update activity blocked due to low battery level.
+This event indicates that Windows Update activity was blocked due to low battery level.
The following fields are available:
-- **batteryLevel** The current battery charge capacitity
-- **batteryLevelThreshold** The battery capacity threshold to stop update activity
-- **blockReason** The current state of the update process
-- **updatePhase** The current state of the update process
-- **wuDeviceid** Device ID
+- **batteryLevel** The current battery charge capacity.
+- **batteryLevelThreshold** The battery capacity threshold to stop update activity.
+- **blockReason** Reason for stopping Windows Update activity.
+- **updatePhase** The current state of the update process.
+- **wuDeviceid** Device ID.
### Microsoft.Windows.Update.Orchestrator.CommitFailed
-This events tracks when a device needs to restart after an update but did not.
+This event indicates that a device was unable to restart after an update.
The following fields are available:
@@ -4920,89 +5437,60 @@ The following fields are available:
- **wuDeviceid** The Windows Update device GUID.
-### Microsoft.Windows.Update.Orchestrator.DTUCompletedWhenWuFlightPendingCommit
-
-Event to indicate that DTU completed installation of the ESD, when WU was already Pending Commit of the feature update.
-
-The following fields are available:
-
-- **wuDeviceid** Device ID used by WU
-
-
-### Microsoft.Windows.Update.Orchestrator.DTUEnabled
-
-Inbox DTU functionality enabled.
-
-The following fields are available:
-
-- **wuDeviceid** Device ID.
-
-
-### Microsoft.Windows.Update.Orchestrator.DTUInitiated
-
-Inbox DTU functionality intiated.
-
-The following fields are available:
-
-- **dtuErrorCode** Return code from creating the DTU Com Server.
-- **isDtuApplicable** Determination of whether DTU is applicable to the machine it is running on.
-- **wuDeviceid** Return code from creating the DTU Com Server.
-
-
### Microsoft.Windows.Update.Orchestrator.DeferRestart
-Indicates that a restart required for installing updates was postponed.
+This event indicates that a restart required for installing updates was postponed.
The following fields are available:
-- **displayNeededReason** Semicolon-separated list of reasons reported for display needed
-- **eventScenario** Indicates the purpose of the event - whether because scan started, succeded, failed, etc
-- **filteredDeferReason** The raised reason that the USO did not restart (e.g. user active, low battery) that were ignorable
-- **gameModeReason** Name of the executable that caused the game mode state check to trigger.
-- **ignoredReason** Semicolon-separated list of reasons that were intentionally ignored.
-- **revisionNumber** Update ID revision number
-- **systemNeededReason** Semicolon-separated list of reasons reported for system needed.
-- **updateId** Update ID
-- **updateScenarioType** Update session type
-- **wuDeviceid** Windows Update Device GUID
-- **raisedDeferReason** The reason that the USO did not restart (e.g. user active, low battery)
+- **displayNeededReason** List of reasons for needing display.
+- **eventScenario** Indicates the purpose of the event (scan started, succeeded, failed, etc.).
+- **filteredDeferReason** Applicable filtered reasons why reboot was postponed (such as user active, or low battery).
+- **gameModeReason** Name of the executable that caused the game mode state check to start.
+- **ignoredReason** List of reasons that were intentionally ignored.
+- **raisedDeferReason** Indicates all potential reasons for postponing restart (such as user active, or low battery).
+- **revisionNumber** Update ID revision number.
+- **systemNeededReason** List of reasons why system is needed.
+- **updateId** Update ID.
+- **updateScenarioType** Update session type.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.Detection
-A scan for an update occurred.
+This event indicates that a scan for a Windows Update occurred.
The following fields are available:
-- **detectionBlockingPolicy** State of update action
-- **detectionBlockreason** Reason for detection not completing.
-- **eventScenario** End to end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
-- **interactive** Identifies if session is User Initiated.
-- **scanTriggerSource** Source of the triggered scan.
-- **updateScenarioType** The update session type.
-- **wuDeviceid** Unique device ID used by Windows Update.
-- **detectionRetryMode** If we retry to scan
-- **errorCode** The returned error code.
-- **deferReason** Reason for postponing detection
-- **flightID** Flight info
-- **revisionNumber** Update version
-- **updateId** Update ID - GUID
+- **deferReason** Reason why the device could not check for updates.
+- **detectionBlockingPolicy** State of update action.
+- **detectionBlockreason** Reason for blocking detection
+- **detectionRetryMode** Indicates whether we will try to scan again.
+- **errorCode** Error info
+- **eventScenario** End-to-end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
+- **flightID** The specific ID of the Windows Insider build the device is getting.
+- **interactive** Indicates whether the session was user initiated.
- **networkStatus** Error info
+- **revisionNumber** Update revision number.
+- **scanTriggerSource** Source of the triggered scan.
+- **updateId** Update ID.
+- **updateScenarioType** Source of the triggered scan
+- **wuDeviceid** Device ID
### Microsoft.Windows.Update.Orchestrator.DisplayNeeded
-Reboot postponed due to needing a display
+This event indicates the reboot was postponed due to needing a display.
The following fields are available:
-- **displayNeededReason** Reason the display is needed
-- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date
-- **revisionNumber** Revision number of the update
-- **updateId** Update ID
-- **updateScenarioType** The update session type
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date
+- **displayNeededReason** Reason the display is needed.
+- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **rebootOutsideOfActiveHours** Indicates whether the reboot was to occur outside of active hours.
+- **revisionNumber** Revision number of the update.
+- **updateId** Update ID.
+- **updateScenarioType** The update session type.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated.
- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
@@ -5012,83 +5500,112 @@ This event sends launch data for a Windows Update download to help keep Windows
The following fields are available:
-- **deferReason** Reason for download not completing
-- **errorCode** An error code represented as a hexadecimal value
-- **eventScenario** End to end update session ID.
-- **flightID** Unique update ID.
-- **interactive** Identifies if session is user initiated.
+- **deferReason** Reason for download not completing.
+- **errorCode** An error code represented as a hexadecimal value.
+- **eventScenario** End-to-end update session ID.
+- **flightID** The specific ID of the Windows Insider build the device is getting.
+- **interactive** Indicates whether the session is user initiated.
- **revisionNumber** Update revision number.
- **updateId** Update ID.
- **updateScenarioType** The update session type.
- **wuDeviceid** Unique device ID used by Windows Update.
-### Microsoft.Windows.Update.Orchestrator.Escalation
+### Microsoft.Windows.Update.Orchestrator.DTUCompletedWhenWuFlightPendingCommit
-Event sent when USO takes an Escalation action on device.
+This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update.
The following fields are available:
-- **configVersion** Escalation config version on device
-- **escalationAction** Indicate the specific escalation action that took place on device
-- **updateClassificationGUID** GUID of the update the device is offered
-- **updateId** ID of the update the device is offered
-- **wuDeviceid** Device ID used by WU
+- **wuDeviceid** Device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.DTUEnabled
+
+This event indicates that Inbox DTU functionality was enabled.
+
+The following fields are available:
+
+- **wuDeviceid** Device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.DTUInitiated
+
+This event indicates that Inbox DTU functionality was intiated.
+
+The following fields are available:
+
+- **dtuErrorCode** Return code from creating the DTU Com Server.
+- **isDtuApplicable** Determination of whether DTU is applicable to the machine it is running on.
+- **wuDeviceid** Device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.Escalation
+
+This event is sent when USO takes an Escalation action on a device.
+
+The following fields are available:
+
+- **configVersion** Escalation config version on device.
+- **escalationAction** Indicate the specific escalation action that took place on device.
+- **updateClassificationGUID** GUID of the update the device is offered.
+- **updateId** ID of the update the device is offered.
+- **wuDeviceid** Device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels
-Event sent during update scan, download, install. Indicates that the device is at risk of being out-of-date.
+This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date.
The following fields are available:
-- **configVersion** Escalation config version on device
-- **downloadElapsedTime** How long since the download is required on device
-- **downloadRiskLevel** At-risk level of download phase
-- **installElapsedTime** How long since the install is required on device
-- **installRiskLevel** At-risk level of install phase
-- **isSediment** WaaSmedic's assessment of whether is device is at risk or not
-- **scanElapsedTime** How long since the scan is required on device
-- **scanRiskLevel** At-risk level of scan phase
-- **wuDeviceid** Device id used by WU
+- **configVersion** Escalation config version on device .
+- **downloadElapsedTime** Indicates how long since the download is required on device.
+- **downloadRiskLevel** At-risk level of download phase.
+- **installElapsedTime** Indicates how long since the install is required on device.
+- **installRiskLevel** The at-risk level of install phase.
+- **isSediment** Assessment of whether is device is at risk.
+- **scanElapsedTime** Indicates how long since the scan is required on device.
+- **scanRiskLevel** At-risk level of the scan phase.
+- **wuDeviceid** Device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.EscalationsRefreshFailed
-USO has a set of escalation actions to prevent a device from becoming out-of-date, and the actions are triggered based on the Escalation config that USO obtains from OneSettings. This event is sent when USO fails to refresh the escalation config from OneSettings.
+USO has a set of escalation actions to prevent a device from becoming out-of-date, and the actions are triggered based on the Escalation configuration that USO obtains from OneSettings. This event is sent when USO fails to refresh the escalation configuration from OneSettings.
The following fields are available:
-- **configVersion** Current escalation config version on device
-- **errorCode** Error code for the refresh failure
-- **wuDeviceid** Device ID used by WU
+- **configVersion** Current escalation config version on device.
+- **errorCode** Error code for the refresh failure.
+- **wuDeviceid** Device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.FlightInapplicable
-The Update is no longer Applicable to this device
+This event indicates that the update is no longer applicable to this device.
The following fields are available:
-- **EventPublishedTime** Flight specific info
-- **flightID** Update ID revision number
-- **revisionNumber** Update ID - GUID
-- **updateId** Update session type
-- **updateScenarioType** Last status of update
-- **UpdateStatus** Is UUP fallback configured?
-- **UUPFallBackConfigured** Windows Update Device GUID
-- **wuDeviceid** Windows Update Device GUID
+- **EventPublishedTime** Time when this event was generated
+- **flightID** The specific ID of the Windows Insider build.
+- **revisionNumber** Update revision number.
+- **updateId** Unique Windows Update ID.
+- **updateScenarioType** Update session type.
+- **UpdateStatus** Last status of update.
+- **UUPFallBackConfigured** Indicates whether UUP fallback is configured.
+- **wuDeviceid** Unique Device ID.
### Microsoft.Windows.Update.Orchestrator.GameActive
-This event indicates that an enabled GameMode process prevented the device from restarting to complete an update
+This event indicates that an enabled GameMode process prevented the device from restarting to complete an update.
The following fields are available:
-- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
-- **gameModeReason** Name of the enabled GameMode process that prevented the device from restarting to complete an update
-- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
+- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **gameModeReason** Name of the enabled GameMode process that prevented the device from restarting to complete an update.
+- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
### Microsoft.Windows.Update.Orchestrator.InitiatingReboot
@@ -5099,12 +5616,12 @@ The following fields are available:
- **EventPublishedTime** Time of the event.
- **flightID** Unique update ID
-- **interactive** Indicates the reboot initiation stage of the update process was entered as a result of user action or not.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
+- **interactive** Indicates whether the reboot initiation stage of the update process was entered as a result of user action.
+- **rebootOutsideOfActiveHours** Indicates whether the reboot was to occur outside of active hours.
- **revisionNumber** Revision number of the update.
- **updateId** Update ID.
- **updateScenarioType** The update session type.
-- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated.
- **wuDeviceid** Unique device ID used by Windows Update.
@@ -5116,82 +5633,82 @@ The following fields are available:
- **batteryLevel** Current battery capacity in mWh or percentage left.
- **deferReason** Reason for install not completing.
-- **eventScenario** End to end update session ID.
+- **errorCode** The error code reppresented by a hexadecimal value.
+- **eventScenario** End-to-end update session ID.
+- **flightID** The specific ID of the Windows Insider build the device is getting.
+- **flightUpdate** Indicates whether the update is a Windows Insider build.
+- **ForcedRebootReminderSet** A boolean value that indicates if a forced reboot will happen for updates.
+- **installCommitfailedtime** The time it took for a reboot to happen but the upgrade failed to progress.
+- **installRebootinitiatetime** The time it took for a reboot to be attempted.
- **interactive** Identifies if session is user initiated.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
+- **minutesToCommit** The time it took to install updates.
+- **rebootOutsideOfActiveHours** Indicates whether a reboot is scheduled outside of active hours.
+- **revisionNumber** Update revision number.
+- **updateId** Update ID.
- **updateScenarioType** The update session type.
- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
- **wuDeviceid** Unique device ID used by Windows Update.
-- **flightID** Unique update ID
-- **flightUpdate** Flight update
-- **ForcedRebootReminderSet** A boolean value that indicates if a forced reboot will happen for updates.
-- **installRebootinitiatetime** The time it took for a reboot to be attempted.
-- **minutesToCommit** The time it took to install updates.
-- **revisionNumber** Update revision number.
-- **updateId** Update ID.
-- **errorCode** The error code reppresented by a hexadecimal value.
-- **installCommitfailedtime** The time it took for a reboot to happen but the upgrade failed to progress.
### Microsoft.Windows.Update.Orchestrator.PostInstall
-Event sent after Update install completes.
+This event is sent after a Windows update install completes.
The following fields are available:
-- **batteryLevel** Battery level percentage
-- **bundleId** Update ID - GUID
-- **bundleRevisionnumber** Update ID revision number
-- **errorCode** Error value
-- **eventScenario** State of update action
-- **sessionType** Update session type
-- **wuDeviceid** Windows Update device GUID
+- **batteryLevel** Current battery capacity in mWh or percentage left.
+- **bundleId** Identifier associated with the specific content bundle.
+- **bundleRevisionnumber** Identifies the revision number of the content bundle.
+- **errorCode** The error code returned for the current phase.
+- **eventScenario** State of update action.
- **flightID** The flight ID of the device
-- **updateScenarioType** The scenario type of this update
+- **sessionType** The Windows Update session type (Interactive or Background).
+- **updateScenarioType** The update session type.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged
-This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed.
+This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed.
The following fields are available:
-- **powermenuNewOptions** The new options after the power menu changed
-- **powermenuOldOptions** The old options before the power menu changed
-- **rebootPendingMinutes** If the power menu changed because a reboot is pending due to a update, how long that reboot has been pending
-- **wuDeviceid** If the power menu changed because a reboot is pending due to a update, the device ID recorded by WU
+- **powermenuNewOptions** The new options after the power menu changed.
+- **powermenuOldOptions** The old options before the power menu changed.
+- **rebootPendingMinutes** If the power menu changed because a reboot is pending due to a update, this indicates how long that reboot has been pending.
+- **wuDeviceid** The device ID recorded by Windows Update if the power menu changed because a reboot is pending due to an update.
### Microsoft.Windows.Update.Orchestrator.PreShutdownStart
-This event is generated right before the shutdown and commit operations
+This event is generated before the shutdown and commit operations.
The following fields are available:
-- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
+- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
### Microsoft.Windows.Update.Orchestrator.Progress
-Event sent when the download of a update reaches a milestone change, such as network cost policy changed, a internal phase has completed, or a transient state has changed.
+This event is sent when the download of a update reaches a milestone change, such as a change in network cost policy, completion of an internal phase, or change in a transient state.
The following fields are available:
-- **errorCode** Error info
-- **flightID** Flight info
-- **interactive** Is USO session interactive or non-interactive?
-- **networkCostPolicy** The current network cost policy on device
-- **revisionNumber** Update ID revision number
-- **updateId** Update ID - GUID
-- **updateScenarioType** Update Session type
-- **updateState** Subphase of the download
-- **UpdateStatus** Subphase of the update
-- **wuDeviceid** Device ID
+- **errorCode** Error code returned.
+- **flightID** The specific ID of the Windows Insider build the device is getting.
+- **interactive** Identifies whether the session is user initiated.
+- **networkCostPolicy** The current network cost policy on device.
+- **revisionNumber** Update ID revision number.
+- **updateId** Unique ID for each update.
+- **updateScenarioType** Update Session type.
+- **updateState** Subphase of the download.
+- **UpdateStatus** Subphase of the update.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.RebootFailed
-This event sends information about whether an update required a reboot and reasons for failure to help keep Windows up to date.
+This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date.
The following fields are available:
@@ -5199,7 +5716,7 @@ The following fields are available:
- **deferReason** Reason for install not completing.
- **EventPublishedTime** The time that the reboot failure occurred.
- **flightID** Unique update ID.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
+- **rebootOutsideOfActiveHours** Indicates whether a reboot was scheduled outside of active hours.
- **RebootResults** Hex code indicating failure reason. Typically, we expect this to be a specific USO generated hex code.
- **revisionNumber** Update revision number.
- **updateId** Update ID.
@@ -5215,25 +5732,25 @@ This event sends data indicating that a reboot task is missing unexpectedly on a
The following fields are available:
- **RebootTaskRestoredTime** Time at which this reboot task was restored.
-- **wuDeviceid** Device id on which the reboot is restored
+- **wuDeviceid** Device ID for the device on which the reboot is restored.
### Microsoft.Windows.Update.Orchestrator.ScanTriggered
-Indicates that Update Orchestrator has started a scan operation.
+This event indicates that Update Orchestrator has started a scan operation.
The following fields are available:
-- **errorCode** Error info
-- **eventScenario** Indicates the purpose of sending this event
-- **interactive** Whether or not the scan is interactive.
-- **isScanPastSla** Has the SLA elapsed for scanning?
-- **isScanPastTriggerSla** Has the SLA elapsed for triggering a scan?
-- **minutesOverScanSla** How many minutes over the scan SLA is the scan?
-- **minutesOverScanTriggerSla** How many minutes over the scan trigger SLA is the scan?
-- **scanTriggerSource** What caused the scan?
-- **updateScenarioType** The type of scenario we are in.
-- **wuDeviceid** WU Device ID of the machine.
+- **errorCode** The error code returned for the current scan operation.
+- **eventScenario** Indicates the purpose of sending this event.
+- **interactive** Indicates whether the scan is interactive.
+- **isScanPastSla** Indicates whether the SLA has elapsed for scanning.
+- **isScanPastTriggerSla** Indicates whether the SLA has elapsed for triggering a scan.
+- **minutesOverScanSla** Indicates how many minutes the scan exceeded the scan SLA.
+- **minutesOverScanTriggerSla** Indicates how many minutes the scan exceeded the scan trigger SLA.
+- **scanTriggerSource** Indicates what caused the scan.
+- **updateScenarioType** The update session type.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Orchestrator.SystemNeeded
@@ -5242,10 +5759,10 @@ This event sends data about why a device is unable to reboot, to help keep Windo
The following fields are available:
-- **eventScenario** End to end update session ID.
-- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date.
+- **eventScenario** End-to-end update session ID.
+- **rebootOutsideOfActiveHours** Indicates whether a reboot is scheduled outside of active hours.
- **revisionNumber** Update revision number.
-- **systemNeededReason** Reason ID
+- **systemNeededReason** List of apps or tasks that are preventing the system from restarting.
- **updateId** Update ID.
- **updateScenarioType** The update session type.
- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
@@ -5254,26 +5771,26 @@ The following fields are available:
### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours
-Update activity was stopped due to active hours starting.
+This event indicates that update activity was stopped due to active hours starting.
The following fields are available:
-- **activeHoursEnd** The end of the active hours window
-- **activeHoursStart** The start of the active hours window
-- **updatePhase** The current state of the update process
-- **wuDeviceid** Device ID
+- **activeHoursEnd** The end of the active hours window.
+- **activeHoursStart** The start of the active hours window.
+- **updatePhase** The current state of the update process.
+- **wuDeviceid** The device identifier.
### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel
-Update activity was stopped due to a low battery level.
+This event is sent when update activity was stopped due to a low battery level.
The following fields are available:
-- **batteryLevel** The current battery charge capacity
-- **batteryLevelThreshold** The battery capacity threshold to stop update activity
-- **updatePhase** The current state of the update process
-- **wuDeviceid** Device ID
+- **batteryLevel** The current battery charge capacity.
+- **batteryLevelThreshold** The battery capacity threshold to stop update activity.
+- **updatePhase** The current state of the update process.
+- **wuDeviceid** The device identifier.
### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh
@@ -5282,10 +5799,10 @@ This event sends data on whether Update Management Policies were enabled on a de
The following fields are available:
-- **configuredPoliciescount** Policy Count
-- **policiesNamevaluesource** Policy Name
-- **policyCacherefreshtime** Refresh time
-- **updateInstalluxsetting** This shows whether a user has set policies via UX option
+- **configuredPoliciescount** Number of policies on the device.
+- **policiesNamevaluesource** Policy name and source of policy (group policy, MDM or flight).
+- **policyCacherefreshtime** Time when policy cache was refreshed.
+- **updateInstalluxsetting** Indicates whether a user has set policies via a user experience option.
- **wuDeviceid** Unique device ID used by Windows Update.
@@ -5295,8 +5812,8 @@ This event sends data about whether an update required a reboot to help keep Win
The following fields are available:
-- **flightID** Unique update ID.
-- **interactive** Indicates the reboot initiation stage of the update process was entered as a result of user action or not.
+- **flightID** The specific ID of the Windows Insider build the device is getting.
+- **interactive** Indicates whether the reboot initiation stage of the update process was entered as a result of user action.
- **revisionNumber** Update revision number.
- **updateId** Update ID.
- **updateScenarioType** The update session type.
@@ -5324,21 +5841,21 @@ The following fields are available:
### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled
-The RebootScheduled event sends basic information for scheduling a update related reboot to facilitate the flow of getting security updates and keeping Windows up to date.
+This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date.
The following fields are available:
-- **activeHoursApplicable** Whether Active Hours applies.
-- **rebootArgument** The reboot arguments
-- **rebootOutsideOfActiveHours** If reboot was outside of Active Hours
-- **rebootScheduledByUser** If the reboot was scheduled by the user, or the system.
-- **rebootState** Which state the reboot is in
-- **revisionNumber** Revision number of the OS
-- **scheduledRebootTime** Time the reboot was scheduled for.
-- **scheduledRebootTimeInUTC** Time the reboot was scheduled for in UTC
-- **updateId** UpdateId to identify which update is being scheduled.
-- **wuDeviceid** Unique DeviceID
-- **IsEnhancedEngagedReboot** If Enhanced reboot was enabled.
+- **activeHoursApplicable** Indicates whether Active Hours applies on this device.
+- **IsEnhancedEngagedReboot** Indicates whether Enhanced reboot was enabled.
+- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action.
+- **rebootOutsideOfActiveHours** True, if a reboot is scheduled outside of active hours. False, otherwise.
+- **rebootScheduledByUser** True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically.
+- **rebootState** Current state of the reboot.
+- **revisionNumber** Revision number of the OS.
+- **scheduledRebootTime** Time scheduled for the reboot.
+- **scheduledRebootTimeInUTC** Time scheduled for the reboot, in UTC.
+- **updateId** Identifies which update is being scheduled.
+- **wuDeviceid** Unique device ID used by Windows Update.
### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerFirstReadyToReboot
@@ -5353,34 +5870,34 @@ This event is sent when MUSE broker schedules a task.
The following fields are available:
-- **TaskArgument** The arguments with which the task is scheduled.
-- **TaskName** Name of the task.
+- **TaskArgument** The arguments which the task is scheduled with
+- **TaskName** Name of the task
## Windows Update mitigation events
### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages
-This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates.
+This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates.
The following fields are available:
-- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
-- **FlightId** Unique identifier for each flight.
-- **InstanceId** Unique GUID that identifies each instances of setuphost.exe.
-- **MitigationScenario** The update scenario in which the mitigation was executed.
-- **MountedImageCount** Number of mounted images.
-- **MountedImageMatches** Number of mounted images that were under %systemdrive%\$Windows.~BT.
-- **MountedImagesFailed** Number of mounted images under %systemdrive%\$Windows.~BT that could not be removed.
-- **MountedImagesRemoved** Number of mounted images under %systemdrive%\$Windows.~BT that were successfully removed.
-- **MountedImagesSkipped** Number of mounted images that were not under %systemdrive%\$Windows.~BT.
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
-- **Result** HResult of this operation.
-- **ScenarioId** ID indicating the mitigation scenario.
-- **ScenarioSupported** Indicates whether the scenario was supported.
-- **SessionId** Unique value for each update attempt.
-- **UpdateId** Unique ID for each Update.
-- **WuId** Unique ID for the Windows Update client.
+- **ClientId** Unique identifier for each flight.
+- **FlightId** Unique GUID that identifies each instances of setuphost.exe.
+- **InstanceId** The update scenario in which the mitigation was executed.
+- **MitigationScenario** Number of mounted images.
+- **MountedImageCount** Number of mounted images that were under %systemdrive%\$Windows.~BT.
+- **MountedImageMatches** Number of mounted images under %systemdrive%\$Windows.~BT that could not be removed.
+- **MountedImagesFailed** Number of mounted images under %systemdrive%\$Windows.~BT that were successfully removed.
+- **MountedImagesRemoved** Number of mounted images that were not under %systemdrive%\$Windows.~BT.
+- **MountedImagesSkipped** Correlation vector value generated from the latest USO scan.
+- **RelatedCV** HResult of this operation.
+- **Result** ID indicating the mitigation scenario.
+- **ScenarioId** Indicates whether the scenario was supported.
+- **ScenarioSupported** Unique value for each update attempt.
+- **SessionId** Unique ID for each Update.
+- **UpdateId** Unique ID for the Windows Update client.
+- **WuId** Unique ID for the Windows Update client.
### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints
@@ -5389,19 +5906,19 @@ This event sends data specific to the FixAppXReparsePoints mitigation used for O
The following fields are available:
-- **ClientId** Unique identifier for each flight.
-- **FlightId** Unique GUID that identifies each instances of setuphost.exe.
-- **InstanceId** The update scenario in which the mitigation was executed.
-- **MitigationScenario** Correlation vector value generated from the latest USO scan.
-- **RelatedCV** Number of reparse points that are corrupted but we failed to fix them.
-- **ReparsePointsFailed** Number of reparse points that were corrupted and were fixed by this mitigation.
-- **ReparsePointsFixed** Number of reparse points that are not corrupted and no action is required.
-- **ReparsePointsSkipped** HResult of this operation.
-- **Result** ID indicating the mitigation scenario.
-- **ScenarioId** Indicates whether the scenario was supported.
-- **ScenarioSupported** Unique value for each update attempt.
-- **SessionId** Unique ID for each Update.
-- **UpdateId** Unique ID for the Windows Update client.
+- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightId** Unique identifier for each flight.
+- **InstanceId** Unique GUID that identifies each instances of setuphost.exe.
+- **MitigationScenario** The update scenario in which the mitigation was executed.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **ReparsePointsFailed** Number of reparse points that are corrupted but we failed to fix them.
+- **ReparsePointsFixed** Number of reparse points that were corrupted and were fixed by this mitigation.
+- **ReparsePointsSkipped** Number of reparse points that are not corrupted and no action is required.
+- **Result** HResult of this operation.
+- **ScenarioId** ID indicating the mitigation scenario.
+- **ScenarioSupported** Indicates whether the scenario was supported.
+- **SessionId** Unique value for each update attempt.
+- **UpdateId** Unique ID for each Update.
- **WuId** Unique ID for the Windows Update client.
@@ -5411,20 +5928,29 @@ This event sends data specific to the FixupEditionId mitigation used for OS upda
The following fields are available:
-- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
- **EditionIdUpdated** Determine whether EditionId was changed.
-- **FlightId** Unique identifier for each flight.
-- **InstanceId** Unique GUID that identifies each instances of setuphost.exe.
-- **MitigationScenario** The update scenario in which the mitigation was executed.
+- **FlightId** Unique identifier for each flight.
+- **InstanceId** Unique GUID that identifies each instances of setuphost.exe.
+- **MitigationScenario** The update scenario in which the mitigation was executed.
- **ProductEditionId** Expected EditionId value based on GetProductInfo.
- **ProductType** Value returned by GetProductInfo.
- **RegistryEditionId** EditionId value in the registry.
-- **RelatedCV** Correlation vector value generated from the latest USO scan.
-- **Result** HResult of this operation.
-- **ScenarioId** ID indicating the mitigation scenario.
-- **ScenarioSupported** Indicates whether the scenario was supported.
+- **RelatedCV** Correlation vector value generated from the latest USO scan.
+- **Result** HResult of this operation.
+- **ScenarioId** ID indicating the mitigation scenario.
+- **ScenarioSupported** Indicates whether the scenario was supported.
- **SessionId** Unique value for each update attempt.
-- **UpdateId** Unique ID for each update.
-- **WuId** Unique ID for the Windows Update client.
+- **UpdateId** Unique ID for each update.
+- **WuId** Unique ID for the Windows Update client.
+
+
+## Winlogon events
+
+### Microsoft.Windows.Security.Winlogon.SetupCompleteLogon
+
+This event signals the completion of the setup process. It happens only once during the first logon.
+
+
diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
index 80ab6e72d3..946372eb72 100644
--- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
+++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
@@ -46,7 +46,7 @@ For Windows 10, we invite IT pros to join the [Windows Insider Program](http://
Windows as a Service is a fundamental change in how Microsoft plans, builds, and delivers the operating system. Historically, we released a major Windows version every few years. The effort required to deploy large and infrequent Windows versions was substantial. That effort included updating the infrastructure to support the upgrade. Windows as a Service accelerates the cadence to provide rich updates more frequently, and these updates require substantially less effort to roll out than earlier versions of Windows. Since it provides more value to organizations in a shorter timeframe, delivering Windows as a Service is a top priority for us.
-The release cadence of Windows may be fast, so feedback is critical to its success. We rely on diagnostic data at each stage of the process to inform our decisions and prioritize our efforts.
+The release cadence of Windows may be fast, so feedback is critical to its success. We rely on diagnostic data at each stage of the process to inform our decisions and prioritize our efforts.
### What is Windows diagnostic data?
Windows diagnostic data is vital technical data from Windows devices about the device and how Windows and related software are performing. It's used in the following ways:
@@ -104,21 +104,21 @@ Sharing information with Microsoft helps make Windows and other products better,
#### Upgrade Readiness
-Upgrading to new operating system versions has traditionally been a challenging, complex, and slow process for many enterprises. Discovering applications and drivers and then testing them for potential compatibility issues have been among the biggest pain points.
-
-To better help customers through this difficult process, Microsoft developed Upgrade Readiness to give enterprises the tools to plan and manage the upgrade process end to end and allowing them to adopt new Windows releases more quickly and on an ongoing basis.
+Upgrading to new operating system versions has traditionally been a challenging, complex, and slow process for many enterprises. Discovering applications and drivers and then testing them for potential compatibility issues have been among the biggest pain points.
-With Windows diagnostic data enabled, Microsoft collects computer, application, and driver compatibility-related information for analysis. We then identify compatibility issues that can block your upgrade and suggest fixes when they are known to Microsoft.
+To better help customers through this difficult process, Microsoft developed Upgrade Readiness to give enterprises the tools to plan and manage the upgrade process end to end and allowing them to adopt new Windows releases more quickly and on an ongoing basis.
+
+With Windows diagnostic data enabled, Microsoft collects computer, application, and driver compatibility-related information for analysis. We then identify compatibility issues that can block your upgrade and suggest fixes when they are known to Microsoft.
Use Upgrade Readiness to get:
- A visual workflow that guides you from pilot to production
- Detailed computer, driver, and application inventory
-- Powerful computer level search and drill-downs
-- Guidance and insights into application and driver compatibility issues with suggested fixes
+- Powerful computer level search and drill-downs
+- Guidance and insights into application and driver compatibility issues with suggested fixes
- Data driven application rationalization tools
- Application usage information, allowing targeted validation; workflow to track validation progress and decisions
-- Data export to commonly used software deployment tools
+- Data export to commonly used software deployment tools
The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded.
@@ -157,8 +157,8 @@ The following table defines the endpoints for other diagnostic data services:
| Service | Endpoint |
| - | - |
-| [Windows Error Reporting](http://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) | watson.telemetry.microsoft.com |
-| [Online Crash Analysis](http://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) | oca.telemetry.microsoft.com |
+| [Windows Error Reporting](https://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) | watson.telemetry.microsoft.com |
+| [Online Crash Analysis](https://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) | oca.telemetry.microsoft.com |
| OneDrive app for Windows 10 | vortex.data.microsoft.com/collect/v1 |
### Data use and access
@@ -167,7 +167,7 @@ The principle of least privileged access guides access to diagnostic data. Micro
### Retention
-Microsoft believes in and practices information minimization. We strive to gather only the info we need and to store it only for as long as it’s needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, such as error reporting data or Microsoft Store purchase history.
+Microsoft believes in and practices information minimization. We strive to gather only the info we need and to store it only for as long as it’s needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, such as error reporting data or Microsoft Store purchase history.
## Diagnostic data levels
This section explains the different diagnostic data levels in Windows 10, Windows Server 2016, and System Center. These levels are available on all desktop and mobile editions of Windows 10, except for the **Security** level, which is limited to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016.
@@ -190,7 +190,7 @@ The levels are cumulative and are illustrated in the following diagram. Also, th
The Security level gathers only the diagnostic data info that is required to keep Windows devices, Windows Server, and guests protected with the latest security updates. This level is only available on Windows Server 2016, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and Windows IoT Core editions.
-> [!NOTE]
+> [!NOTE]
> If your organization relies on Windows Update for updates, you shouldn’t use the **Security** level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates.
Windows Server Update Services (WSUS) and System Center Configuration Manager functionality is not affected at this level, nor is diagnostic data about Windows Server features or System Center gathered.
@@ -201,12 +201,12 @@ The data gathered at this level includes:
- **Malicious Software Removal Tool (MSRT)** The MSRT infection report contains information, including device info and IP address.
- > [!NOTE]
- > You can turn off the MSRT infection report. No MSRT information is included if MSRT is not used. If Windows Update is turned off, MSRT will not be offered to users. For more info, see Microsoft KB article [891716](http://support.microsoft.com/kb/891716).
+ > [!NOTE]
+ > You can turn off the MSRT infection report. No MSRT information is included if MSRT is not used. If Windows Update is turned off, MSRT will not be offered to users. For more info, see Microsoft KB article [891716](https://support.microsoft.com/kb/891716).
- **Windows Defender/Endpoint Protection**. Windows Defender and System Center Endpoint Protection requires some information to function, including: anti-malware signatures, diagnostic information, User Account Control settings, Unified Extensible Firmware Interface (UEFI) settings, and IP address.
- > [!NOTE]
+ > [!NOTE]
> This reporting can be turned off and no information is included if a customer is using third-party antimalware software, or if Windows Defender is turned off. For more info, see [Windows Defender](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender).
Microsoft recommends that Windows Update, Windows Defender, and MSRT remain enabled unless the enterprise uses alternative solutions such as Windows Server Update Services, System Center Configuration Manager, or a third-party antimalware solution. Windows Update, Windows Defender, and MSRT provide core Windows functionality such as driver and OS updates, including security updates.
@@ -304,7 +304,7 @@ In Windows 10, version 1709, we introduce the **Limit Enhanced diagnostic data t
2. Enable the **LimitEnhancedDiagnosticDataWindowsAnalytics** setting, using either Group Policy or MDM.
a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data collection and Preview builds/Limit Enhanced diagnostic data to the minimum required by Windows Analytics** setting to **Enabled**.
-
+
-OR-
b. Using MDM, use the Policy CSP to set the **System/LimitEnhancedDiagnosticDataWindowsAnalytics** value to **1**.
@@ -338,8 +338,8 @@ IT pros can use various methods, including Group Policy and Mobile Device Manage
We do not recommend that you turn off diagnostic data in your organization as valuable functionality may be impacted, but we recognize that in some scenarios this may be required. Use the steps in this section to do so for Windows, Windows Server, and System Center.
-> [!IMPORTANT]
-> These diagnostic data levels only apply to Windows, Windows Server, and System Center components and apps that use the Connected User Experiences and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these diagnostic data levels. You should work with your app vendors to understand their diagnostic data policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of Office Telemetry](http://technet.microsoft.com/library/jj863580.aspx).
+> [!IMPORTANT]
+> These diagnostic data levels only apply to Windows, Windows Server, and System Center components and apps that use the Connected User Experiences and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these diagnostic data levels. You should work with your app vendors to understand their diagnostic data policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of Office Telemetry](https://technet.microsoft.com/library/jj863580.aspx).
You can turn on or turn off System Center diagnostic data gathering. The default is on and the data gathered at this level represents what is gathered by default when System Center diagnostic data is turned on. However, setting the operating system diagnostic data level to **Basic** will turn off System Center diagnostic data, even if the System Center diagnostic data switch is turned on.
@@ -358,7 +358,7 @@ Use the appropriate value in the table below when you configure the management p
| Enhanced | Security data, basic system and quality data, and enhanced insights and advanced reliability data. | **2** |
| Full | Security data, basic system and quality data, enhanced insights and advanced reliability data, and full diagnostics data. | **3** |
- > [!NOTE]
+ > [!NOTE]
> When the User Configuration policy is set for Diagnostic Data, this will override the Computer Configuration setting.
### Use Group Policy to set the diagnostic data level
@@ -373,7 +373,7 @@ Use a Group Policy object to set your organization’s diagnostic data level.
### Use MDM to set the diagnostic data level
-Use the [Policy Configuration Service Provider (CSP)](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) to apply the System/AllowTelemetry MDM policy.
+Use the [Policy Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) to apply the System/AllowTelemetry MDM policy.
### Use Registry Editor to set the diagnostic data level
@@ -401,15 +401,15 @@ For System Center 2016 Technical Preview, you can turn off System Center diagnos
There are a few more settings that you can turn off that may send diagnostic data information:
-- To turn off Windows Update diagnostic data, you have two choices. Either turn off Windows Update, or set your devices to be managed by an on premises update server, such as [Windows Server Update Services (WSUS)](http://technet.microsoft.com/library/hh852345.aspx) or [System Center Configuration Manager](http://www.microsoft.com/server-cloud/products/system-center-2012-r2-configuration-manager/).
+- To turn off Windows Update diagnostic data, you have two choices. Either turn off Windows Update, or set your devices to be managed by an on premises update server, such as [Windows Server Update Services (WSUS)](https://technet.microsoft.com/library/hh852345.aspx) or [System Center Configuration Manager](https://www.microsoft.com/server-cloud/products/system-center-2012-r2-configuration-manager/).
- Turn off **Windows Defender Cloud-based Protection** and **Automatic sample submission** in **Settings** > **Update & security** > **Windows Defender**.
-- Manage the Malicious Software Removal Tool in your organization. For more info, see Microsoft KB article [891716](http://support.microsoft.com/kb/891716).
+- Manage the Malicious Software Removal Tool in your organization. For more info, see Microsoft KB article [891716](https://support.microsoft.com/kb/891716).
- Turn off **Linguistic Data Collection** in **Settings** > **Privacy**. At diagnostic data levels **Enhanced** and **Full**, Microsoft uses Linguistic Data Collection info to improve language model features such as autocomplete, spellcheck, suggestions, input pattern recognition, and dictionary.
- > [!NOTE]
+ > [!NOTE]
> Microsoft does not intend to gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information.
## Additional resources
@@ -440,6 +440,6 @@ TechNet
Web Pages
-- [Privacy at Microsoft](http://privacy.microsoft.com)
+- [Privacy at Microsoft](https://privacy.microsoft.com)
+
-
diff --git a/windows/privacy/diagnostic-data-viewer-overview.md b/windows/privacy/diagnostic-data-viewer-overview.md
index 23b6540574..c0ca7c819c 100644
--- a/windows/privacy/diagnostic-data-viewer-overview.md
+++ b/windows/privacy/diagnostic-data-viewer-overview.md
@@ -31,9 +31,7 @@ Before you can use this tool, you must turn on data viewing in the **Settings**
**To turn on data viewing**
1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**.
-2. Under **Diagnostic data**, turn on the **If data viewing is enabled, you can see your diagnostics data** option.
-
- 
+2. Under **Diagnostic data**, turn on the **If data viewing is enabled, you can see your diagnostics data** option.
### Download the Diagnostic Data Viewer
Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/en-us/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page.
@@ -44,11 +42,7 @@ You must start this app from the **Settings** panel.
**To start the Diagnostic Data Viewer**
1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**.
-2. Under **Diagnostic data**, select the **Diagnostic Data Viewer** button.
-
- 
-OR-
-
- Go to **Start** and search for _Diagnostic Data Viewer_.
+2. Under **Diagnostic data**, select the **Diagnostic Data Viewer** button.
-OR-
Go to **Start** and search for _Diagnostic Data Viewer_.
3. Close the Diagnostic Data Viewer app, use your device as you normally would for a few days, and then open Diagnostic Data Viewer again to review the updated list of diagnostic data.
@@ -58,28 +52,18 @@ You must start this app from the **Settings** panel.
### Use the Diagnostic Data Viewer
The Diagnostic Data Viewer provides you with the following features to view and filter your device's diagnostic data.
-- **View your diagnostic events.** In the left column, you can review your diagnostic events. These events reflect activities that occurred and were sent to Microsoft.
+- **View your diagnostic events.** In the left column, you can review your diagnostic events. These events reflect activities that occurred and were sent to Microsoft.
Selecting an event opens the detailed JSON view, which provides the exact details uploaded to Microsoft. Microsoft uses this info to continually improve the Windows operating system.
- Selecting an event opens the detailed JSON view, which provides the exact details uploaded to Microsoft. Microsoft uses this info to continually improve the Windows operating system.
+- **Search your diagnostic events.** The **Search** box at the top of the screen lets you search amongst all of the diagnostic event details. The returned search results include any diagnostic event that contains the matching text.
Selecting an event opens the detailed JSON view, with the matching text highlighted.
-- **Search your diagnostic events.** The **Search** box at the top of the screen lets you search amongst all of the diagnostic event details. The returned search results include any diagnostic event that contains the matching text.
+- **Filter your diagnostic event categories.** The apps Menu button opens the detailed menu. In here, you'll find a list of diagnostic event categories, which define how the events are used by Microsoft.
Selecting a check box lets you filter between the diagnostic event categories.
- Selecting an event opens the detailed JSON view, with the matching text highlighted.
+- **Help to make your Windows experience better.** Microsoft samples diagnostic data from a small amount of devices to make big improvements to the Windows operating system and ultimately, your experience. If you’re a part of this small device group and you experience issues, Microsoft will collect the associated event diagnostic data, allowing your info to potentially help fix the issue for others.
To signify your contribution, you’ll see this icon () if your device is part of the sampling group. In addition, if any of your diagnostic data events are sent from your device to Microsoft to help make improvements, you’ll see this icon ().
-- **Filter your diagnostic event categories.** The apps Menu button opens the detailed menu. In here, you'll find a list of diagnostic event categories, which define how the events are used by Microsoft.
-
- Selecting a check box lets you filter between the diagnostic event categories.
-
-- **Help to make your Windows experience better.** Microsoft samples diagnostic data from a small amount of devices to make big improvements to the Windows operating system and ultimately, your experience. If you’re a part of this small device group and you experience issues, Microsoft will collect the associated event diagnostic data, allowing your info to potentially help fix the issue for others.
-
- To signify your contribution, you’ll see this icon () if your device is part of the sampling group. In addition, if any of your diagnostic data events are sent from your device to Microsoft to help make improvements, you’ll see this icon ().
-
-- **Provide diagnostic event feedback.** The **Feedback** icon opens the Feedback Hub app, letting you provide feedback about the Diagnostic Data Viewer and the diagnostic events.
-
- Selecting a specific event in the Diagnostic Data Viewer automatically fills in the field in the Feedback Hub. You can add your comments to the box labeled, **Give us more detail (optional)**.
+- **Provide diagnostic event feedback.** The **Feedback** icon opens the Feedback Hub app, letting you provide feedback about the Diagnostic Data Viewer and the diagnostic events.
Selecting a specific event in the Diagnostic Data Viewer automatically fills in the field in the Feedback Hub. You can add your comments to the box labeled, **Give us more detail (optional)**.
- >[!Important]
- >All content in the Feedback Hub is publicly viewable. Therefore, make sure you don't put any personal info into your feedback comments.
+ >[!Important]
+ >All content in the Feedback Hub is publicly viewable. Therefore, make sure you don't put any personal info into your feedback comments.
## Turn off data viewing
When you're done reviewing your diagnostic data, you should turn of data viewing.
@@ -87,17 +71,10 @@ When you're done reviewing your diagnostic data, you should turn of data viewing
**To turn off data viewing**
1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**.
-2. Under **Diagnostic data**, turn off the **If data viewing is enabled, you can see your diagnostics data** option.
-
- 
+2. Under **Diagnostic data**, turn off the **If data viewing is enabled, you can see your diagnostics data** option.
## View additional diagnostic data in the View problem reports tool
You can review additional Windows Error Reporting diagnostic data in the **View problem reports** tool. This tool provides you with a summary of various crash reports that are sent to Microsoft as part of Windows Error Reporting. We use this data to find and fix specific issues that are hard to replicate and to improve the Windows operating system.
**To view your Windows Error Reporting diagnostic data**
-1. Go to **Start**, select **Control Panel** > **All Control Panel Items** > **Security and Maintenance** > **Problem Reports**.
-OR-
- Go to **Start** and search for _Problem Reports_.
-
- The **Review problem reports** tool opens, showing you your Windows Error Reporting reports, along with a status about whether it was sent to Microsoft.
-
- 
+1. Go to **Start**, select **Control Panel** > **All Control Panel Items** > **Security and Maintenance** > **Problem Reports**.
-OR-
Go to **Start** and search for _Problem Reports_.
The **Review problem reports** tool opens, showing you your Windows Error Reporting reports, along with a status about whether it was sent to Microsoft.
diff --git a/windows/privacy/gdpr-it-guidance.md b/windows/privacy/gdpr-it-guidance.md
index 1e8232c373..90fc1a209c 100644
--- a/windows/privacy/gdpr-it-guidance.md
+++ b/windows/privacy/gdpr-it-guidance.md
@@ -151,10 +151,10 @@ The following table lists in what GDPR mode – controller or processor – Wind
Windows diagnostic data collection level can be set by a user in Windows (*Start > Settings > Privacy > Diagnostics & feedback*) or by the IT department of an organization, using Group Policy or Mobile Device Management (MDM) techniques.
-* For Windows 10, version 1803, Microsoft recommends setting the Windows diagnostic level to “Enhanced”. This enables organizations to get the full functionality of [Windows Analytics](#windows-analytics). Those organizations who wish to share the smallest set of events for Windows Analytics can use the “Limit Enhanced diagnostic data to the minimum required by Windows Analytics” filtering mechanism that Microsoft introduced in Windows 10, version 1709. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by Windows Analytics.
+* For Windows 10, version 1803, Microsoft recommends setting the Windows diagnostic level to “Enhanced”. This enables organizations to get the full functionality of [Windows Analytics](#windows-analytics). Those organizations who wish to share the smallest set of events for Windows Analytics can use the “Limit Enhanced diagnostic data to the minimum required by Windows Analytics” filtering mechanism that Microsoft introduced in Windows 10, version 1709. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by Windows Analytics.
>[!NOTE]
->For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
+>For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
* For Windows 10, version 1709, and Windows 10, version 1703, the recommended Windows diagnostic level configuration for EEA and Switzerland commercial users is “Basic”.
@@ -247,4 +247,4 @@ Please visit our [GDPR section of the Microsoft Trust Center](https://www.micros
#### Other resources
-* [Privacy at Microsoft](http://privacy.microsoft.com/)
\ No newline at end of file
+* [Privacy at Microsoft](https://privacy.microsoft.com/)
\ No newline at end of file
diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md
index 379b8c9e13..7287abf932 100644
--- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md
+++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md
@@ -13,7 +13,7 @@ ms.date: 06/05/2018
---
# Manage connections from Windows operating system components to Microsoft services
-
+
**Applies to**
- Windows 10 Enterprise, version 1607 and newer
@@ -27,18 +27,18 @@ If you want to minimize connections from Windows to Microsoft services, or confi
You can configure diagnostic data at the Security/Basic level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all other connections to Microsoft network endpoints as described in this article to help prevent Windows from sending any data to Microsoft. There are many reasons why these communications are enabled by default, such as updating malware definitions and maintain current certificate revocation lists, which is why we strongly recommend against this. This data helps us deliver a secure, reliable, and more delightful personalized experience.
-To help make it easier to deploy settings to restrict connections from Windows 10 to Microsoft, you can apply the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887).
-This baseline was created in the same way as the [Windows security baselines](/windows/device-security/windows-security-baselines) that are often used to efficiently configure Windows to a known secure state.
-Running the Windows Restricted Traffic Limited Functionality Baseline on devices in your organization will allow you to quickly configure all of the settings covered in this document.
-However, some of the settings reduce the functionality and security configuration of your device and are therefore not recommended.
-Make sure should you've chosen the right settings configuration for your environment before applying.
+To help make it easier to deploy settings to restrict connections from Windows 10 to Microsoft, you can apply the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887).
+This baseline was created in the same way as the [Windows security baselines](/windows/device-security/windows-security-baselines) that are often used to efficiently configure Windows to a known secure state.
+Running the Windows Restricted Traffic Limited Functionality Baseline on devices in your organization will allow you to quickly configure all of the settings covered in this document.
+However, some of the settings reduce the functionality and security configuration of your device and are therefore not recommended.
+Make sure should you've chosen the right settings configuration for your environment before applying.
You should not extract this package to the windows\\system32 folder because it will not apply correctly.
>[!IMPORTANT]
> As part of the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887), MDM functionallity is disabled. If you manage devices through MDM, make sure [cloud notifications are enabled](#bkmk-priv-notifications).
-Applying the Windows Restricted Traffic Limited Functionality Baseline is the same as applying each setting covered in this article.
-It is recommended that you restart a device after making configuration changes to it.
+Applying the Windows Restricted Traffic Limited Functionality Baseline is the same as applying each setting covered in this article.
+It is recommended that you restart a device after making configuration changes to it.
Note that **Get Help** and **Give us Feedback** links no longer work after the Windows Restricted Traffic Limited Functionality Baseline is applied.
We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com.
@@ -90,7 +90,7 @@ Here's a list of changes that were made to this article for Windows 10, version
The following sections list the components that make network connections to Microsoft services by default. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure diagnostic data at the Security level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all of these connections.
-### Settings for Windows 10 Enterprise edition
+### Settings for Windows 10 Enterprise edition
The following table lists management options for each setting, beginning with Windows 10 Enterprise version 1607.
@@ -100,7 +100,7 @@ The following table lists management options for each setting, beginning with Wi
| Setting | UI | Group Policy | MDM policy | Registry | Command line |
| - | :-: | :-: | :-: | :-: | :-: |
| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | |  | | | |
-| [2. Cortana and Search](#bkmk-cortana) |  |  |  |  | |
+| [2. Cortana and Search](#bkmk-cortana) |  |  |  |  | |
| [3. Date & Time](#bkmk-datetime) |  |  | |  | |
| [4. Device metadata retrieval](#bkmk-devinst) | |  | |  | |
| [5. Find My Device](#find-my-device) | |  | | | |
@@ -208,11 +208,11 @@ Use the following sections for more information about how to configure each sett
### 1. Automatic Root Certificates Update
-The Automatic Root Certificates Update component is designed to automatically check the list of trusted authorities on Windows Update to see if an update is available.
-For more information, see [Automatic Root Certificates Update Configuration](https://technet.microsoft.com/library/cc733922.aspx).
+The Automatic Root Certificates Update component is designed to automatically check the list of trusted authorities on Windows Update to see if an update is available.
+For more information, see [Automatic Root Certificates Update Configuration](https://technet.microsoft.com/library/cc733922.aspx).
Although not recommended, you can turn off Automatic Root Certificates Update, which also prevents updates to the disallowed certificate list and the pin rules list.
-> [!CAUTION]
+> [!CAUTION]
> By not automatically downloading the root certificates, the device might have not be able to connect to some websites.
For Windows 10, Windows Server 2016 with Desktop Experience, and Windows Server 2016 Server Core:
@@ -242,7 +242,7 @@ On Windows Server 2016 Nano Server:
- Create the registry path **HKEY\_LOCAL\_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot** and then add a REG\_DWORD registry setting, named **DisableRootAutoUpdate**, with a value of 1.
->[!NOTE]
+>[!NOTE]
>CRL and OCSP network traffic is currently whitelisted and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of them, but there are many others, such as DigiCert, Thawte, Google, Symantec, and VeriSign.
### 2. Cortana and Search
@@ -274,7 +274,7 @@ You can also apply the Group Policies using the following registry keys:
In Windows 10, version 1507 and Windows 10, version 1511, when you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic.
>[!IMPORTANT]
->These steps are not required for devices running Windows 10, version 1607 or Windows Server 2016.
+>These steps are not required for devices running Windows 10, version 1607 or Windows Server 2016.
1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** > **Windows Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**.
@@ -305,7 +305,7 @@ If your organization tests network traffic, do not use a network proxy as Window
### 2.2 Cortana and Search MDM policies
-For Windows 10 only, the following Cortana MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
+For Windows 10 only, the following Cortana MDM policies are available in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
| Policy | Description |
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
@@ -325,8 +325,8 @@ You can prevent Windows from setting the time automatically.
After that, configure the following:
- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Enable Windows NTP Server** > **Windows Time Service** > **Configure Windows NTP Client**
-
- > [!NOTE]
+
+ > [!NOTE]
> This is only available on Windows 10, version 1703 and later. If you're using Windows 10, version 1607, the Group Policy setting is **Computer Configuration** > **Administrative Templates** > **System** > **Windows Time Service** > **Time Providers** > **Enable Windows NTP Client**
-or -
@@ -362,7 +362,7 @@ If you're running Windows 10, version 1607, Windows Server 2016, or later:
- Create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\System\\EnableFontProviders** to 0 (zero).
-- In Windows 10, version 1703, you can apply the System/AllowFontProviders MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where:
+- In Windows 10, version 1703, you can apply the System/AllowFontProviders MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where:
- **false**. Font streaming is disabled.
@@ -370,18 +370,18 @@ If you're running Windows 10, version 1607, Windows Server 2016, or later:
If you're running Windows 10, version 1507 or Windows 10, version 1511, create a REG\_DWORD registry setting named **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters** with a value of 1.
-> [!NOTE]
+> [!NOTE]
> After you apply this policy, you must restart the device for it to take effect.
### 7. Insider Preview builds
The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10.
-This setting stops communication with the Windows Insider Preview service that checks for new builds.
+This setting stops communication with the Windows Insider Preview service that checks for new builds.
Windows Insider Preview builds only apply to Windows 10 and are not available for Windows Server 2016.
-> [!NOTE]
+> [!NOTE]
> If you upgrade a device that is configured to minimize connections from Windows to Microsoft services (that is, a device configured for zero exhaust) to a Windows Insider Preview build, the Feedback & Diagnostic setting will automatically be set to **Full**. Although the diagnostic data level may initially appear as **Basic**, a few hours after the UI is refreshed or the machine is rebooted, the setting will become **Full**.
To turn off Insider Preview builds for a released version of Windows 10:
@@ -390,7 +390,7 @@ To turn off Insider Preview builds for a released version of Windows 10:
To turn off Insider Preview builds for Windows 10:
-> [!NOTE]
+> [!NOTE]
> If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds.
- Turn off the feature in the UI: **Settings** > **Update & security** > **Windows Insider Program** > **Stop Insider Preview builds**.
@@ -405,7 +405,7 @@ To turn off Insider Preview builds for Windows 10:
-or-
-- Apply the System/AllowBuildPreview MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where:
+- Apply the System/AllowBuildPreview MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where:
- **0**. Users cannot make their devices available for downloading and installing preview software.
@@ -479,7 +479,7 @@ You can turn this off by:
- Changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero).
-For more info, see [Out-of-date ActiveX control blocking](http://technet.microsoft.com/library/dn761713.aspx).
+For more info, see [Out-of-date ActiveX control blocking](https://technet.microsoft.com/library/dn761713.aspx).
### 9. Live Tiles
@@ -488,7 +488,7 @@ To turn off Live Tiles:
- Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn Off notifications network usage**
-or-
-
+
- Create a REG\_DWORD registry setting named **NoCloudApplicationNotification** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications** with a value of 1 (one).
In Windows 10 Mobile, you must also unpin all tiles that are pinned to Start.
@@ -505,14 +505,14 @@ To turn off mail synchronization for Microsoft Accounts that are configured on a
-or-
-- Apply the Accounts/AllowMicrosoftAccountConnection MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed. This does not apply to Microsoft Accounts that have already been configured on the device.
+- Apply the Accounts/AllowMicrosoftAccountConnection MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed. This does not apply to Microsoft Accounts that have already been configured on the device.
To turn off the Windows Mail app:
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Mail** > **Turn off Windows Mail application**
-or-
-
+
- Create a REG\_DWORD registry setting named **ManualLaunchAllowed** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Mail** with a value of 0 (zero).
### 11. Microsoft Account
@@ -526,7 +526,7 @@ To prevent communication to the Microsoft Account cloud authentication service.
- Create a REG\_DWORD registry setting named **NoConnectedUser** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System** with a value of 3.
To disable the Microsoft Account Sign-In Assistant:
-- Apply the Accounts/AllowMicrosoftAccountSignInAssistant MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on.
+- Apply the Accounts/AllowMicrosoftAccountSignInAssistant MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on.
- Change the Start REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\wlidsvc** to a value of **4**.
@@ -583,7 +583,7 @@ Alternatively, you can configure the Microsoft Group Policies using the followin
### 12.2 Microsoft Edge MDM policies
-The following Microsoft Edge MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
+The following Microsoft Edge MDM policies are available in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
| Policy | Description |
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
@@ -602,7 +602,7 @@ For a complete list of the Microsoft Edge policies, see [Available policies for
Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. For more info about NCSI, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx).
-In versions of Windows 10 prior to Windows 10, version 1607 and Windows Server 2016, the URL was [http://www.msftncsi.com]().
+In versions of Windows 10 prior to Windows 10, version 1607 and Windows Server 2016, the URL was [http://www.msftncsi.com]().
You can turn off NCSI by doing one of the following:
@@ -610,7 +610,7 @@ You can turn off NCSI by doing one of the following:
- In Windows 10, version 1703 and later, apply the Connectivity/DisallowNetworkConnectivityActiveTests MDM policy.
-> [!NOTE]
+> [!NOTE]
> After you apply this policy, you must restart the device for the policy setting to take effect.
-or-
@@ -624,7 +624,7 @@ You can turn off the ability to download and update offline maps.
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data**
-or-
-
+
- Create a REG\_DWORD registry setting named **AutoDownloadAndUpdateMapData** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Maps** with a value of 0 (zero).
-and-
@@ -647,7 +647,7 @@ To turn off OneDrive in your organization:
-and-
-- Create a REG\_DWORD registry setting named **PreventNetworkTrafficPreUserSignIn** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\OneDrive** with a value of 1 (one).
+- Create a REG\_DWORD registry setting named **PreventNetworkTrafficPreUserSignIn** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\OneDrive** with a value of 1 (one).
### 16. Preinstalled apps
@@ -819,7 +819,7 @@ Use Settings > Privacy to configure some settings that may be important to yo
To turn off **Let apps use advertising ID to make ads more interesting to you based on your app usage (turning this off will reset your ID)**:
-> [!NOTE]
+> [!NOTE]
> When you turn this feature off in the UI, it turns off the advertising ID, not just resets it.
- Turn off the feature in the UI.
@@ -856,7 +856,7 @@ To turn off **Let Windows track app launches to improve Start and search results
To turn off **Let apps use my advertising ID for experiences across apps (turning this off will reset your ID)**:
-> [!NOTE]
+> [!NOTE]
> When you turn this feature off in the UI, it turns off the advertising ID, not just resets it.
- Turn off the feature in the UI.
@@ -887,7 +887,7 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Micros
-or-
-- Apply the Browser/AllowSmartScreen MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on.
+- Apply the Browser/AllowSmartScreen MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on.
-or-
@@ -907,16 +907,16 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Micros
To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**:
-> [!NOTE]
+> [!NOTE]
> If the diagnostic data level is set to either **Basic** or **Security**, this is turned off automatically.
-
+
- Turn off the feature in the UI.
-or-
-- Apply the TextInput/AllowLinguisticDataCollection MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where:
+- Apply the TextInput/AllowLinguisticDataCollection MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where:
- **0**. Not allowed
@@ -964,7 +964,7 @@ To turn off **Location for this device**:
-or-
-- Apply the System/AllowLocation MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where:
+- Apply the System/AllowLocation MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where:
- **0**. Turned off and the employee can't turn it back on.
@@ -972,8 +972,8 @@ To turn off **Location for this device**:
- **2**. Turned on and the employee can't turn it off.
- > [!NOTE]
- > You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx).
+ > [!NOTE]
+ > You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](https://msdn.microsoft.com/library/dn905224.aspx).
-or-
@@ -1025,15 +1025,15 @@ To turn off **Let apps use my camera**:
-or-
-- Apply the Camera/AllowCamera MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where:
+- Apply the Camera/AllowCamera MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where:
- **0**. Apps can't use the camera.
- **1**. Apps can use the camera.
> [!NOTE]
- > You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](http://msdn.microsoft.com/library/dn905224.aspx).
-
+ > You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](https://msdn.microsoft.com/library/dn905224.aspx).
+
-or-
- Create a provisioning package with use Windows ICD, using **Runtime settings** > **Policies** > **Camera** > **AllowCamera**, where:
@@ -1067,7 +1067,7 @@ To turn off **Let apps use my microphone**:
- **0**. User in control
- **1**. Force allow
- **2**. Force deny
-
+
-or-
- Create a REG\_DWORD registry setting named **LetAppsAccessMicrophone** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two)
@@ -1098,7 +1098,7 @@ To turn off notifications network usage:
- **0**. WNS notifications allowed
- **1**. No WNS notifications allowed
-
+
In the **Notifications** area, you can also choose which apps have access to notifications.
To turn off **Let apps access my notifications**:
@@ -1127,7 +1127,7 @@ To turn off **Let apps access my notifications**:
In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees.
-> [!NOTE]
+> [!NOTE]
> For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article.
To turn off the functionality:
@@ -1178,7 +1178,7 @@ To turn off **Let apps access my name, picture, and other account info**:
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access account information**
- Set the **Select a setting** box to **Force Deny**.
-
+
-or-
- Apply the Privacy/LetAppsAccessAccountInfo MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessaccountinfo), where:
@@ -1186,7 +1186,7 @@ To turn off **Let apps access my name, picture, and other account info**:
- **0**. User in control
- **1**. Force allow
- **2**. Force deny
-
+
-or-
- Create a REG\_DWORD registry setting named **LetAppsAccessAccountInfo** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
@@ -1211,8 +1211,8 @@ To turn off **Choose apps that can access contacts**:
-or-
-- Apply the Privacy/LetAppsAccessContacts MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccesscontacts), where:
-
+- Apply the Privacy/LetAppsAccessContacts MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccesscontacts), where:
+
- **0**. User in control
- **1**. Force allow
- **2**. Force deny
@@ -1242,7 +1242,7 @@ To turn off **Let apps access my calendar**:
- **0**. User in control
- **1**. Force allow
- **2**. Force deny
-
+
-or-
- Create a REG\_DWORD registry setting named **LetAppsAccessCalendar** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
@@ -1346,7 +1346,7 @@ To turn off **Let apps make phone calls**:
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps make phone calls**
- Set the **Select a setting** box to **Force Deny**.
-
+
-or-
- Apply the Privacy/LetAppsAccessPhone MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessphone), where:
@@ -1377,7 +1377,7 @@ To turn off **Let apps control radios**:
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps control radios**
- Set the **Select a setting** box to **Force Deny**.
-
+
-or-
- Apply the Privacy/LetAppsAccessRadios MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessradios), where:
@@ -1409,13 +1409,13 @@ To turn off **Let apps automatically share and sync info with wireless devices t
-or-
-- Apply the Privacy/LetAppsSyncWithDevices MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappssyncwithdevices), where:
+- Apply the Privacy/LetAppsSyncWithDevices MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappssyncwithdevices), where:
- **0**. User in control
- **1**. Force allow
- - **2**. Force deny
+ - **2**. Force deny
+
-
-or-
- Create a REG\_DWORD registry setting named **LetAppsSyncWithDevices** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
@@ -1433,11 +1433,11 @@ To turn off **Let your apps use your trusted devices (hardware you've already co
-or-
- Apply the **Privacy/LetAppsAccessTrustedDevices** MDM policy from the [Policy CSP](/windows/client-management/mdm/policy-csp-privacy.md#privacy-letappsaccesstrusteddevices
-), where:
+), where:
- **0**. User in control
- **1**. Force allow
- - **2**. Force deny
+ - **2**. Force deny
### 17.16 Feedback & diagnostics
@@ -1446,10 +1446,10 @@ In the **Feedback & Diagnostics** area, you can choose how often you're asked fo
To change how frequently **Windows should ask for my feedback**:
-> [!NOTE]
+> [!NOTE]
> Feedback frequency only applies to user-generated feedback, not diagnostic and usage data sent from the device.
-
+
- To change from **Automatically (Recommended)**, use the drop-down list in the UI.
@@ -1479,25 +1479,25 @@ To change how frequently **Windows should ask for my feedback**:
| Once a day | 864000000000 | 1 |
| Once a week | 6048000000000 | 1 |
-
+
To change the level of diagnostic and usage data sent when you **Send your device data to Microsoft**:
- Click either the **Basic** or **Full** options.
-or-
-- Apply the Group Policy: **Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection And Preview Builds\\Allow Telemetry** and select the appropriate option for your deployment.
+- Apply the Group Policy: **Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection And Preview Builds\\Allow Telemetry** and select the appropriate option for your deployment.
-or-
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry** with a value of 0-3, as appropriate for your deployment (see below for the values for each level).
+- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry** with a value of 0-3, as appropriate for your deployment (see below for the values for each level).
-> [!NOTE]
+> [!NOTE]
> If the **Security** option is configured by using Group Policy or the Registry, the value will not be reflected in the UI. The **Security** option is only available in Windows 10 Enterprise edition.
-or-
-- Apply the System/AllowTelemetry MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where:
+- Apply the System/AllowTelemetry MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where:
- **0**. Maps to the **Security** level.
@@ -1538,7 +1538,7 @@ To turn off **Let apps run in the background**:
-or-
- In **Background apps**, turn off the feature for each app.
-
+
-or-
- Apply the Group Policy (only applicable for Windows 10, version 1703): **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps run in the background**
@@ -1575,7 +1575,7 @@ To turn off **Let Windows and your apps use your motion data and collect motion
- **0**. User in control
- **1**. Force allow
- **2**. Force deny
-
+
-or-
- Create a REG\_DWORD registry setting named **LetAppsAccessMotion** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
@@ -1633,7 +1633,7 @@ For Windows 10:
-or-
-- Apply the Licensing/DisallowKMSClientOnlineAVSValidation MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is disabled (default) and 1 is enabled.
+- Apply the Licensing/DisallowKMSClientOnlineAVSValidation MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is disabled (default) and 1 is enabled.
-or-
@@ -1673,7 +1673,7 @@ You can control if your settings are synchronized:
-or-
-- Apply the Experience/AllowSyncMySettings MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed.
+- Apply the Experience/AllowSyncMySettings MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed.
-or-
@@ -1689,9 +1689,9 @@ To turn off Messaging cloud sync:
### 21. Teredo
-You can disable Teredo by using Group Policy or by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](http://technet.microsoft.com/library/cc722030.aspx).
+You can disable Teredo by using Group Policy or by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](https://technet.microsoft.com/library/cc722030.aspx).
->[!NOTE]
+>[!NOTE]
>If you disable Teredo, some XBOX gaming features and Windows Update Delivery Optimization will not work.
- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **TCPIP Settings** > **IPv6 Transition Technologies** > **Set Teredo State** and set it to **Disabled State**.
@@ -1745,15 +1745,15 @@ You can disconnect from the Microsoft Antimalware Protection Service.
-or-
-- For Windows 10 only, apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
+- For Windows 10 only, apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
-or-
- Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SpyNetReporting** to 0 (zero).
-
+
-and-
-
- From an elevated Windows PowerShell prompt, run **set-mppreference -Mapsreporting 0**
+
+ From an elevated Windows PowerShell prompt, run **set-mppreference -Mapsreporting 0**
You can stop sending file samples back to Microsoft.
@@ -1815,13 +1815,13 @@ If you're running Windows 10, version 1607 or later, you only need to enable the
- **User Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off all Windows spotlight features**
- > [!NOTE]
+ > [!NOTE]
> This must be done within 15 minutes after Windows 10 is installed. Alternatively, you can create an image with this setting.
-or-
- For Windows 10 only, apply the Experience/AllowWindowsSpotlight MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience), with a value of 0 (zero).
-
+
-or-
- Create a new REG\_DWORD registry setting named **DisableWindowsSpotlightFeatures** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of 1 (one).
@@ -1832,7 +1832,7 @@ If you're not running Windows 10, version 1607 or later, you can use the other o
- **Personalization** > **Lock screen** > **Background** > **Windows spotlight**, select a different background, and turn off **Get fun facts, tips, tricks and more on your lock screen**.
- > [!NOTE]
+ > [!NOTE]
> In Windows 10, version 1507 and Windows 10, version 1511, this setting was named **Show me tips, tricks, and more on the lock screen**.
- **Personalization** > **Start** > **Occasionally show suggestions in Start**.
@@ -1848,9 +1848,9 @@ If you're not running Windows 10, version 1607 or later, you can use the other o
- Set the **Turn off fun facts, tips, tricks, and more on lock screen** check box.
- > [!NOTE]
+ > [!NOTE]
> This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. Alternatively, you can create a new REG\_SZ registry setting nameed **LockScreenImage** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG\_DWORD registry setting named **LockScreenOverlaysDisabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of 1 (one).
-
+
- **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips**.
@@ -1868,9 +1868,9 @@ For more info, see [Windows Spotlight on the lock screen](/windows/configuration
### 26. Microsoft Store
-You can turn off the ability to launch apps from the Microsoft Store that were preinstalled or downloaded.
-This will also turn off automatic app updates, and the Microsoft Store will be disabled.
-In addition, new email accounts cannot be created by clicking **Settings** > **Accounts** > **Email & app accounts** > **Add an account**.
+You can turn off the ability to launch apps from the Microsoft Store that were preinstalled or downloaded.
+This will also turn off automatic app updates, and the Microsoft Store will be disabled.
+In addition, new email accounts cannot be created by clicking **Settings** > **Accounts** > **Email & app accounts** > **Add an account**.
On Windows Server 2016, this will block Microsoft Store calls from Universal Windows Apps.
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Microsoft Store**.
@@ -1923,7 +1923,7 @@ You can also set the **Download Mode** policy by creating a new REG\_DWORD regis
### 27.3 Delivery Optimization MDM policies
-The following Delivery Optimization MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
+The following Delivery Optimization MDM policies are available in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
| Policy | Description |
|---------------------------|-----------------------------------------------------------------------------------------------------|
@@ -1997,4 +1997,4 @@ You can turn off automatic updates by doing one of the following. This is not re
- **5**. Turn off automatic updates.
-To learn more, see [Device update management](http://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](http://technet.microsoft.com/library/cc720539.aspx).
+To learn more, see [Device update management](https://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](https://technet.microsoft.com/library/cc720539.aspx).
diff --git a/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md
index 601a236c61..b0ee83d6a3 100644
--- a/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md
+++ b/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md
@@ -22,9 +22,9 @@ In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-e
We used the following methodology to derive these network endpoints:
-1. Set up the latest version of Windows 10 on a test virtual machine using the default settings.
+1. Set up the latest version of Windows 10 on a test virtual machine using the default settings.
2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device).
-3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.
+3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.
4. Compile reports on traffic going to public IP addresses.
5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory.
@@ -113,7 +113,7 @@ We used the following methodology to derive these network endpoints:
| wildcard.twimg.com | TLSv1.2 | Used for the Twitter Live Tile. |
| www.bing.com | HTTP | Used for updates for Cortana, apps, and Live Tiles. |
| www.facebook.com | HTTPS | Used for the Facebook Live Tile. |
-| [www.microsoft.com](http://www.microsoft.com/) | HTTPS | Used for updates for Cortana, apps, and Live Tiles. |
+| [www.microsoft.com](https://www.microsoft.com/) | HTTPS | Used for updates for Cortana, apps, and Live Tiles. |
## Windows 10 Pro
@@ -202,7 +202,7 @@ We used the following methodology to derive these network endpoints:
| wildcard.twimg.com | TLSv1.2 | Used for the Twitter Live Tile. |
| www.bing.com | TLSv1.2 | Used for updates for Cortana, apps, and Live Tiles. |
| www.facebook.com | HTTPS | Used for the Facebook Live Tile. |
-| [www.microsoft.com](http://www.microsoft.com/) | HTTPS | Used for updates for Cortana, apps, and Live Tiles. |
+| [www.microsoft.com](https://www.microsoft.com/) | HTTPS | Used for updates for Cortana, apps, and Live Tiles. |
## Windows 10 Education
diff --git a/windows/privacy/windows-personal-data-services-configuration.md b/windows/privacy/windows-personal-data-services-configuration.md
index 9c969844b3..3743dc7b3b 100644
--- a/windows/privacy/windows-personal-data-services-configuration.md
+++ b/windows/privacy/windows-personal-data-services-configuration.md
@@ -397,4 +397,4 @@ These settings whether employees send “Do Not Track” header from the Microso
### Other resources
-* [Privacy at Microsoft](http://privacy.microsoft.com/)
+* [Privacy at Microsoft](https://privacy.microsoft.com/)
diff --git a/windows/security/identity-protection/TOC.md b/windows/security/identity-protection/TOC.md
index 91f27e52b9..23991e4fc0 100644
--- a/windows/security/identity-protection/TOC.md
+++ b/windows/security/identity-protection/TOC.md
@@ -70,115 +70,5 @@
### [How to use single sign-on (SSO) over VPN and Wi-Fi connections](vpn\how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md)
### [Windows 10 credential theft mitigation guide abstract](windows-credential-theft-mitigation-guide-abstract.md)
-## [Windows Firewall with Advanced Security](windows-firewall/windows-firewall-with-advanced-security.md)
-### [Isolating Microsoft Store Apps on Your Network](windows-firewall/isolating-apps-on-your-network.md)
-### [Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server 2012](windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md)
-### [Windows Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md)
-### [Windows Firewall with Advanced Security Design Guide](windows-firewall/windows-firewall-with-advanced-security-design-guide.md)
-#### [Understanding the Windows Firewall with Advanced Security Design Process](windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md)
-#### [Identifying Your Windows Firewall with Advanced Security Deployment Goals](windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
-##### [Protect Devices from Unwanted Network Traffic](windows-firewall/protect-devices-from-unwanted-network-traffic.md)
-##### [Restrict Access to Only Trusted Devices](windows-firewall/restrict-access-to-only-trusted-devices.md)
-##### [Require Encryption When Accessing Sensitive Network Resources](windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md)
-##### [Restrict Access to Only Specified Users or Computers](windows-firewall/restrict-access-to-only-specified-users-or-devices.md)
-#### [Mapping Your Deployment Goals to a Windows Firewall with Advanced Security Design](windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md)
-##### [Basic Firewall Policy Design](windows-firewall/basic-firewall-policy-design.md)
-##### [Domain Isolation Policy Design](windows-firewall/domain-isolation-policy-design.md)
-##### [Server Isolation Policy Design](windows-firewall/server-isolation-policy-design.md)
-##### [Certificate-based Isolation Policy Design](windows-firewall/certificate-based-isolation-policy-design.md)
-#### [Evaluating Windows Firewall with Advanced Security Design Examples](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md)
-##### [Firewall Policy Design Example](windows-firewall/firewall-policy-design-example.md)
-##### [Domain Isolation Policy Design Example](windows-firewall/domain-isolation-policy-design-example.md)
-##### [Server Isolation Policy Design Example](windows-firewall/server-isolation-policy-design-example.md)
-##### [Certificate-based Isolation Policy Design Example](windows-firewall/certificate-based-isolation-policy-design-example.md)
-#### [Designing a Windows Firewall with Advanced Security Strategy](windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md)
-##### [Gathering the Information You Need](windows-firewall/gathering-the-information-you-need.md)
-###### [Gathering Information about Your Current Network Infrastructure](windows-firewall/gathering-information-about-your-current-network-infrastructure.md)
-###### [Gathering Information about Your Active Directory Deployment](windows-firewall/gathering-information-about-your-active-directory-deployment.md)
-###### [Gathering Information about Your Computers](windows-firewall/gathering-information-about-your-devices.md)
-###### [Gathering Other Relevant Information](windows-firewall/gathering-other-relevant-information.md)
-##### [Determining the Trusted State of Your Computers](windows-firewall/determining-the-trusted-state-of-your-devices.md)
-#### [Planning Your Windows Firewall with Advanced Security Design](windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md)
-##### [Planning Settings for a Basic Firewall Policy](windows-firewall/planning-settings-for-a-basic-firewall-policy.md)
-##### [Planning Domain Isolation Zones](windows-firewall/planning-domain-isolation-zones.md)
-###### [Exemption List](windows-firewall/exemption-list.md)
-###### [Isolated Domain](windows-firewall/isolated-domain.md)
-###### [Boundary Zone](windows-firewall/boundary-zone.md)
-###### [Encryption Zone](windows-firewall/encryption-zone.md)
-##### [Planning Server Isolation Zones](windows-firewall/planning-server-isolation-zones.md)
-##### [Planning Certificate-based Authentication](windows-firewall/planning-certificate-based-authentication.md)
-###### [Documenting the Zones](windows-firewall/documenting-the-zones.md)
-###### [Planning Group Policy Deployment for Your Isolation Zones](windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md)
-####### [Planning Isolation Groups for the Zones](windows-firewall/planning-isolation-groups-for-the-zones.md)
-####### [Planning Network Access Groups](windows-firewall/planning-network-access-groups.md)
-####### [Planning the GPOs](windows-firewall/planning-the-gpos.md)
-######## [Firewall GPOs](windows-firewall/firewall-gpos.md)
-######### [GPO_DOMISO_Firewall](windows-firewall/gpo-domiso-firewall.md)
-######## [Isolated Domain GPOs](windows-firewall/isolated-domain-gpos.md)
-######### [GPO_DOMISO_IsolatedDomain_Clients](windows-firewall/gpo-domiso-isolateddomain-clients.md)
-######### [GPO_DOMISO_IsolatedDomain_Servers](windows-firewall/gpo-domiso-isolateddomain-servers.md)
-######## [Boundary Zone GPOs](windows-firewall/boundary-zone-gpos.md)
-######### [GPO_DOMISO_Boundary](windows-firewall/gpo-domiso-boundary.md)
-######## [Encryption Zone GPOs](windows-firewall/encryption-zone-gpos.md)
-######### [GPO_DOMISO_Encryption](windows-firewall/gpo-domiso-encryption.md)
-######## [Server Isolation GPOs](windows-firewall/server-isolation-gpos.md)
-####### [Planning GPO Deployment](windows-firewall/planning-gpo-deployment.md)
-#### [Appendix A: Sample GPO Template Files for Settings Used in this Guide](windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md)
-### [Windows Firewall with Advanced Security Deployment Guide](windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md)
-#### [Planning to Deploy Windows Firewall with Advanced Security](windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md)
-#### [Implementing Your Windows Firewall with Advanced Security Design Plan](windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md)
-#### [Checklist: Creating Group Policy Objects](windows-firewall/checklist-creating-group-policy-objects.md)
-#### [Checklist: Implementing a Basic Firewall Policy Design](windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md)
-#### [Checklist: Configuring Basic Firewall Settings](windows-firewall/checklist-configuring-basic-firewall-settings.md)
-#### [Checklist: Creating Inbound Firewall Rules](windows-firewall/checklist-creating-inbound-firewall-rules.md)
-#### [Checklist: Creating Outbound Firewall Rules](windows-firewall/checklist-creating-outbound-firewall-rules.md)
-#### [Checklist: Implementing a Domain Isolation Policy Design](windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md)
-##### [Checklist: Configuring Rules for the Isolated Domain](windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md)
-##### [Checklist: Configuring Rules for the Boundary Zone](windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md)
-##### [Checklist: Configuring Rules for the Encryption Zone](windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md)
-##### [Checklist: Configuring Rules for an Isolated Server Zone](windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md)
-#### [Checklist: Implementing a Standalone Server Isolation Policy Design](windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md)
-##### [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md)
-##### [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md)
-#### [Checklist: Implementing a Certificate-based Isolation Policy Design](windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md)
-#### [Procedures Used in This Guide](windows-firewall/procedures-used-in-this-guide.md)
-##### [Add Production Devices to the Membership Group for a Zone](windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md)
-##### [Add Test Devices to the Membership Group for a Zone](windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md)
-##### [Assign Security Group Filters to the GPO](windows-firewall/assign-security-group-filters-to-the-gpo.md)
-##### [Change Rules from Request to Require Mode](windows-firewall/change-rules-from-request-to-require-mode.md)
-##### [Configure Authentication Methods](windows-firewall/configure-authentication-methods.md)
-##### [Configure Data Protection (Quick Mode) Settings](windows-firewall/configure-data-protection-quick-mode-settings.md)
-##### [Configure Group Policy to Autoenroll and Deploy Certificates](windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md)
-##### [Configure Key Exchange (Main Mode) Settings](windows-firewall/configure-key-exchange-main-mode-settings.md)
-##### [Configure the Rules to Require Encryption](windows-firewall/configure-the-rules-to-require-encryption.md)
-##### [Configure the Windows Firewall Log](windows-firewall/configure-the-windows-firewall-log.md)
-##### [Configure the Workstation Authentication Certificate Template](windows-firewall/configure-the-workstation-authentication-certificate-template.md)
-##### [Configure Windows Firewall to Suppress Notifications When a Program Is Blocked](windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md)
-##### [Confirm That Certificates Are Deployed Correctly](windows-firewall/confirm-that-certificates-are-deployed-correctly.md)
-##### [Copy a GPO to Create a New GPO](windows-firewall/copy-a-gpo-to-create-a-new-gpo.md)
-##### [Create a Group Account in Active Directory](windows-firewall/create-a-group-account-in-active-directory.md)
-##### [Create a Group Policy Object](windows-firewall/create-a-group-policy-object.md)
-##### [Create an Authentication Exemption List Rule](windows-firewall/create-an-authentication-exemption-list-rule.md)
-##### [Create an Authentication Request Rule](windows-firewall/create-an-authentication-request-rule.md)
-##### [Create an Inbound ICMP Rule](windows-firewall/create-an-inbound-icmp-rule.md)
-##### [Create an Inbound Port Rule](windows-firewall/create-an-inbound-port-rule.md)
-##### [Create an Inbound Program or Service Rule](windows-firewall/create-an-inbound-program-or-service-rule.md)
-##### [Create an Outbound Port Rule](windows-firewall/create-an-outbound-port-rule.md)
-##### [Create an Outbound Program or Service Rule](windows-firewall/create-an-outbound-program-or-service-rule.md)
-##### [Create Inbound Rules to Support RPC](windows-firewall/create-inbound-rules-to-support-rpc.md)
-##### [Create WMI Filters for the GPO](windows-firewall/create-wmi-filters-for-the-gpo.md)
-##### [Enable Predefined Inbound Rules](windows-firewall/enable-predefined-inbound-rules.md)
-##### [Enable Predefined Outbound Rules](windows-firewall/enable-predefined-outbound-rules.md)
-##### [Exempt ICMP from Authentication](windows-firewall/exempt-icmp-from-authentication.md)
-##### [Link the GPO to the Domain](windows-firewall/link-the-gpo-to-the-domain.md)
-##### [Modify GPO Filters to Apply to a Different Zone or Version of Windows](windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)
-##### [Open the Group Policy Management Console to IP Security Policies](windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md)
-##### [Open the Group Policy Management Console to Windows Firewall](windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md)
-##### [Open the Group Policy Management Console to Windows Firewall with Advanced Security](windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md)
-##### [Open Windows Firewall with Advanced Security](windows-firewall/open-windows-firewall-with-advanced-security.md)
-##### [Restrict Server Access to Members of a Group Only](windows-firewall/restrict-server-access-to-members-of-a-group-only.md)
-##### [Turn on Windows Firewall and Configure Default Behavior](windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md)
-##### [Verify That Network Traffic Is Authenticated](windows-firewall/verify-that-network-traffic-is-authenticated.md)
-
## [Windows Hello for Business](hello-for-business/hello-identity-verification.md)
diff --git a/windows/security/identity-protection/access-control/access-control.md b/windows/security/identity-protection/access-control/access-control.md
index 321cfccf77..d08c52de33 100644
--- a/windows/security/identity-protection/access-control/access-control.md
+++ b/windows/security/identity-protection/access-control/access-control.md
@@ -93,16 +93,16 @@ The permissions attached to an object depend on the type of object. For example,
When you set permissions, you specify the level of access for groups and users. For example, you can let one user read the contents of a file, let another user make changes to the file, and prevent all other users from accessing the file. You can set similar permissions on printers so that certain users can configure the printer and other users can only print.
-When you need to change the permissions on a file, you can run Windows Explorer, right-click the file name, and click **Properties**. On the **Security** tab, you can change permissions on the file. For more information, see [Managing Permissions](http://technet.microsoft.com/library/cc770962.aspx).
+When you need to change the permissions on a file, you can run Windows Explorer, right-click the file name, and click **Properties**. On the **Security** tab, you can change permissions on the file. For more information, see [Managing Permissions](https://technet.microsoft.com/library/cc770962.aspx).
**Note**
-Another kind of permissions, called share permissions, is set on the Sharing tab of a folder's **Properties** page or by using the Shared Folder Wizard. For more information see [Share and NTFS Permissions on a File Server](http://technet.microsoft.com/library/cc754178.aspx).
+Another kind of permissions, called share permissions, is set on the Sharing tab of a folder's **Properties** page or by using the Shared Folder Wizard. For more information see [Share and NTFS Permissions on a File Server](https://technet.microsoft.com/library/cc754178.aspx).
### Ownership of objects
-An owner is assigned to an object when that object is created. By default, the owner is the creator of the object. No matter what permissions are set on an object, the owner of the object can always change the permissions. For more information, see [Manage Object Ownership](http://technet.microsoft.com/library/cc732983.aspx).
+An owner is assigned to an object when that object is created. By default, the owner is the creator of the object. No matter what permissions are set on an object, the owner of the object can always change the permissions. For more information, see [Manage Object Ownership](https://technet.microsoft.com/library/cc732983.aspx).
### Inheritance of permissions
diff --git a/windows/security/identity-protection/access-control/active-directory-accounts.md b/windows/security/identity-protection/access-control/active-directory-accounts.md
index 7ac2f1da1b..18260aeb64 100644
--- a/windows/security/identity-protection/access-control/active-directory-accounts.md
+++ b/windows/security/identity-protection/access-control/active-directory-accounts.md
@@ -351,7 +351,7 @@ Because it is impossible to predict the specific errors that will occur for any
**Important**
Rebooting a computer is the only reliable way to recover functionality as this will cause both the computer account and user accounts to log back in again. Logging in again will request new TGTs that are valid with the new KRBTGT, correcting any KRBTGT related operational issues on that computer.
-For information about how to help mitigate the risks associated with a potentially compromised KRBTGT account, see [KRBTGT Account Password Reset Scripts now available for customers](http://blogs.microsoft.com/cybertrust/2015/02/11/krbtgt-account-password-reset-scripts-now-available-for-customers/).
+For information about how to help mitigate the risks associated with a potentially compromised KRBTGT account, see [KRBTGT Account Password Reset Scripts now available for customers](https://blogs.microsoft.com/cybertrust/2015/02/11/krbtgt-account-password-reset-scripts-now-available-for-customers/).
### Read-only domain controllers and the KRBTGT account
@@ -497,11 +497,11 @@ After the default local accounts are installed, these accounts reside in the Use
You can use Active Directory Users and Computers to assign rights and permissions on a given local domain controller, and that domain controller only, to limit the ability of local users and groups to perform certain actions. A right authorizes a user to perform certain actions on a computer, such as backing up files and folders or shutting down a computer. In contrast, an access permission is a rule that is associated with an object, usually a file, folder, or printer, that regulates which users can have access to the object and in what manner.
-For more information about creating and managing local user accounts in Active Directory, see [Manage Local Users](http://technet.microsoft.com/library/cc731899.aspx).
+For more information about creating and managing local user accounts in Active Directory, see [Manage Local Users](https://technet.microsoft.com/library/cc731899.aspx).
You can also use Active Directory Users and Computers on a domain controller to target remote computers that are not domain controllers on the network.
-You can obtain recommendations from Microsoft for domain controller configurations that you can distribute by using the Security Compliance Manager (SCM) tool. For more information, see [Microsoft Security Compliance Manager](http://technet.microsoft.com/library/cc677002.aspx).
+You can obtain recommendations from Microsoft for domain controller configurations that you can distribute by using the Security Compliance Manager (SCM) tool. For more information, see [Microsoft Security Compliance Manager](https://technet.microsoft.com/library/cc677002.aspx).
Some of the default local user accounts are protected by a background process that periodically checks and applies a specific security descriptor, which is a data structure that contains security information that is associated with a protected object. This security descriptor is present on the AdminSDHolder object.
@@ -585,7 +585,7 @@ In this procedure, the workstations are dedicated to domain administrators. By s
2. Create computer accounts for the new workstations.
- > **Note** You might have to delegate permissions to join computers to the domain if the account that joins the workstations to the domain does not already have them. For more information, see [Delegation of Administration in Active Directory](http://social.technet.microsoft.com/wiki/contents/articles/20292.delegation-of-administration-in-active-directory.aspx).
+ > **Note** You might have to delegate permissions to join computers to the domain if the account that joins the workstations to the domain does not already have them. For more information, see [Delegation of Administration in Active Directory](https://social.technet.microsoft.com/wiki/contents/articles/20292.delegation-of-administration-in-active-directory.aspx).
diff --git a/windows/security/identity-protection/access-control/active-directory-security-groups.md b/windows/security/identity-protection/access-control/active-directory-security-groups.md
index 4d1ebc58cb..d0a9735761 100644
--- a/windows/security/identity-protection/access-control/active-directory-security-groups.md
+++ b/windows/security/identity-protection/access-control/active-directory-security-groups.md
@@ -312,14 +312,14 @@ The following tables provide descriptions of the default groups that are located
@@ -1270,7 +1270,7 @@ Members of the DnsUpdateProxy group are DNS clients. They are permitted to perfo
However, to protect against unsecured records or to permit members of the DnsUpdateProxy group to register records in zones that allow only secured dynamic updates, you must create a dedicated user account and configure DHCP servers to perform DNS dynamic updates by using the credentials of this account (user name, password, and domain). Multiple DHCP servers can use the credentials of one dedicated user account.
-For information, see [DNS Record Ownership and the DnsUpdateProxy Group](http://technet.microsoft.com/library/dd334715.aspx).
+For information, see [DNS Record Ownership and the DnsUpdateProxy Group](https://technet.microsoft.com/library/dd334715.aspx).
This security group has not changed since Windows Server 2008.
@@ -2180,7 +2180,7 @@ This group appears as a SID until the domain controller is made the primary doma
-For more information, see [How Domain and Forest Trusts Work: Domain and Forest Trusts](http://technet.microsoft.com/library/f5c70774-25cd-4481-8b7a-3d65c86e69b1).
+For more information, see [How Domain and Forest Trusts Work: Domain and Forest Trusts](https://technet.microsoft.com/library/f5c70774-25cd-4481-8b7a-3d65c86e69b1).
The Incoming Forest Trust Builders group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable).
@@ -3105,7 +3105,7 @@ Members of the Remote Management Users group can access WMI resources over manag
The Remote Management Users group is generally used to allow users to manage servers through the Server Manager console, whereas the [WinRMRemoteWMIUsers\_](#bkmk-winrmremotewmiusers-) group is allows remotely running Windows PowerShell commands.
-For more information, see [What's New in MI?](https://msdn.microsoft.com/library/jj819828(v=vs.85).aspx) and [About WMI](http://msdn.microsoft.com/library/aa384642.aspx).
+For more information, see [What's New in MI?](https://msdn.microsoft.com/library/jj819828(v=vs.85).aspx) and [About WMI](https://msdn.microsoft.com/library/aa384642.aspx).
This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions.
@@ -3171,7 +3171,7 @@ In Windows Server 2008 R2, FRS cannot be used for replicating DFS folders or c
However, Windows Server 2008 R2 servers cannot use FRS to replicate the contents of any replica set apart from the SYSVOL shared resource. The DFS Replication service is a replacement for FRS, and it can be used to replicate the contents of a SYSVOL shared resource, DFS folders, and other custom (non-SYSVOL) data. You should migrate all non-SYSVOL FRS replica sets to DFS Replication. For more information, see:
-- [File Replication Service (FRS) Is Deprecated in Windows Server 2008 R2 (Windows)](http://msdn.microsoft.com/library/windows/desktop/ff384840.aspx)
+- [File Replication Service (FRS) Is Deprecated in Windows Server 2008 R2 (Windows)](https://msdn.microsoft.com/library/windows/desktop/ff384840.aspx)
- [DFS Namespaces and DFS Replication Overview](https://technet.microsoft.com/library/jj127250(v=ws.11).aspx)
This security group has not changed since Windows Server 2008.
@@ -3237,7 +3237,7 @@ The group is authorized to make schema changes in Active Directory. By default,
The membership of this group can be modified by any of the service administrator groups in the root domain. This is considered a service administrator account because its members can modify the schema, which governs the structure and content of the entire directory.
-For more information, see [What Is the Active Directory Schema?: Active Directory](http://technet.microsoft.com/library/cc784826.aspx).
+For more information, see [What Is the Active Directory Schema?: Active Directory](https://technet.microsoft.com/library/cc784826.aspx).
The Schema Admins group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable).
@@ -3408,7 +3408,7 @@ The System Managed Accounts group applies to versions of the Windows Server oper
Members of the Terminal Server License Servers group can update user accounts in Active Directory with information about license issuance. This is used to track and report TS Per User CAL usage. A TS Per User CAL gives one user the right to access a Terminal Server from an unlimited number of client computers or devices. This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO).
-For more information about this security group, see [Terminal Services License Server Security Group Configuration](http://technet.microsoft.com/library/cc775331.aspx).
+For more information about this security group, see [Terminal Services License Server Security Group Configuration](https://technet.microsoft.com/library/cc775331.aspx).
The Terminal Server License Servers group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable).
diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md
index 2cc7a62ad3..b7b1c25886 100644
--- a/windows/security/identity-protection/access-control/local-accounts.md
+++ b/windows/security/identity-protection/access-control/local-accounts.md
@@ -82,7 +82,7 @@ The default Administrator account is initially installed differently for Windows
In summary, for Windows Server operating systems, the Administrator account is used to set up the local server only for tasks that require administrative rights. The default Administrator account is set up by using the default settings that are provided on installation. Initially, the Administrator account is not associated with a password. After installation, when you first set up Windows Server, your first task is to set up the Administrator account properties securely. This includes creating a strong password and securing the **Remote control** and **Remote Desktop Services Profile** settings. You can also disable the Administrator account when it is not required.
-In comparison, for the Windows client operating systems, the Administrator account has access to the local system only. The default Administrator account is initially disabled by default, and this account is not associated with a password. It is a best practice to leave the Administrator account disabled. The default Administrator account is considered only as a setup and disaster recovery account, and it can be used to join the computer to a domain. When administrator access is required, do not sign in as an administrator. You can sign in to your computer with your local (non-administrator) credentials and use **Run as administrator**.
+In comparison, for the Windows client operating systems, the Administrator account has access to the local system only. The default Administrator account is initially disabled by default, and this account is not associated with a password. It is a best practice to leave the Administrator account disabled. The default Administrator account is considered only as a setup and disaster recovery account, and it can be used to join the computer to a domain. When administrator access is required, do not sign in as an administrator. You can sign in to your computer with your local (non-administrator) credentials and use **Run as administrator**.
**Account group membership**
@@ -94,13 +94,13 @@ The Administrator account cannot be deleted or removed from the Administrators g
Because the Administrator account is known to exist on many versions of the Windows operating system, it is a best practice to disable the Administrator account when possible to make it more difficult for malicious users to gain access to the server or client computer.
-You can rename the Administrator account. However, a renamed Administrator account continues to use the same automatically assigned security identifier (SID), which can be discovered by malicious users. For more information about how to rename or disable a user account, see [Disable or activate a local user account](http://technet.microsoft.com/library/cc732112.aspx) and [Rename a local user account](http://technet.microsoft.com/library/cc725595.aspx).
+You can rename the Administrator account. However, a renamed Administrator account continues to use the same automatically assigned security identifier (SID), which can be discovered by malicious users. For more information about how to rename or disable a user account, see [Disable or activate a local user account](https://technet.microsoft.com/library/cc732112.aspx) and [Rename a local user account](https://technet.microsoft.com/library/cc725595.aspx).
As a security best practice, use your local (non-Administrator) account to sign in and then use **Run as administrator** to accomplish tasks that require a higher level of rights than a standard user account. Do not use the Administrator account to sign in to your computer unless it is entirely necessary. For more information, see [Run a program with administrative credentials](https://technet.microsoft.com/en-us/library/cc732200.aspx).
In comparison, on the Windows client operating system, a user with a local user account that has Administrator rights is considered the system administrator of the client computer. The first local user account that is created during installation is placed in the local Administrators group. However, when multiple users run as local administrators, the IT staff has no control over these users or their client computers.
-In this case, Group Policy can be used to enable secure settings that can control the use of the local Administrators group automatically on every server or client computer. For more information about Group Policy, see [Group Policy Overview](http://technet.microsoft.com/library/hh831791.aspx).
+In this case, Group Policy can be used to enable secure settings that can control the use of the local Administrators group automatically on every server or client computer. For more information about Group Policy, see [Group Policy Overview](https://technet.microsoft.com/library/hh831791.aspx).
**Note**
Blank passwords are not allowed in the versions designated in the **Applies To** list at the beginning of this topic.
@@ -159,7 +159,7 @@ To grant the account Administrators group file permissions does not implicitly g
## How to manage local user accounts
-The default local user accounts, and the local user accounts that you create, are located in the Users folder. The Users folder is located in the Local Users and Groups folder in the local Computer Management Microsoft Management Console (MMC), a collection of administrative tools that you can use to manage a single local or remote computer. For more information about creating and managing local user accounts, see [Manage Local Users](http://technet.microsoft.com/library/cc731899.aspx).
+The default local user accounts, and the local user accounts that you create, are located in the Users folder. The Users folder is located in the Local Users and Groups folder in the local Computer Management Microsoft Management Console (MMC), a collection of administrative tools that you can use to manage a single local or remote computer. For more information about creating and managing local user accounts, see [Manage Local Users](https://technet.microsoft.com/library/cc731899.aspx).
You can use Local Users and Groups to assign rights and permissions on the local server, and that server only, to limit the ability of local users and groups to perform certain actions. A right authorizes a user to perform certain actions on a server, such as backing up files and folders or shutting down a server. An access permission is a rule that is associated with an object, usually a file, folder, or printer. It regulates which users can have access to an object on the server and in what manner.
@@ -475,7 +475,7 @@ Passwords can be randomized by:
- Purchasing and implementing an enterprise tool to accomplish this task. These tools are commonly referred to as "privileged password management" tools.
-- Configuring, customizing and implementing a free tool to accomplish this task. A sample tool with source code is available at [Solution for management of built-in Administrator account’s password via GPO](http://code.msdn.microsoft.com/windowsdesktop/Solution-for-management-of-ae44e789).
+- Configuring, customizing and implementing a free tool to accomplish this task. A sample tool with source code is available at [Solution for management of built-in Administrator account’s password via GPO](https://code.msdn.microsoft.com/windowsdesktop/Solution-for-management-of-ae44e789).
**Note**
This tool is not supported by Microsoft. There are some important considerations to make before deploying this tool because this tool requires client-side extensions and schema extensions to support password generation and storage.
diff --git a/windows/security/identity-protection/access-control/microsoft-accounts.md b/windows/security/identity-protection/access-control/microsoft-accounts.md
index e2fb4669aa..f1071d55e7 100644
--- a/windows/security/identity-protection/access-control/microsoft-accounts.md
+++ b/windows/security/identity-protection/access-control/microsoft-accounts.md
@@ -52,7 +52,7 @@ Credential information is encrypted twice. The first encryption is based on the
Blank passwords are not allowed.
- For more information, see [Microsoft Account Security Overview](http://www.microsoft.com/account/security/default.aspx).
+ For more information, see [Microsoft Account Security Overview](https://www.microsoft.com/account/security/default.aspx).
- **Secondary proof of identity is required**.
@@ -118,13 +118,13 @@ The following Group Policy settings help control the use of Microsoft accounts i
This setting controls whether users can provide Microsoft accounts for authentication for applications or services.
-If this setting is enabled, all applications and services on the device are prevented from using Microsoft accounts for authentication.
-This applies both to existing users of a device and new users who may be added.
+If this setting is enabled, all applications and services on the device are prevented from using Microsoft accounts for authentication.
+This applies both to existing users of a device and new users who may be added.
-However, any application or service that has already authenticated a user will not be affected by enabling this setting until the authentication cache expires.
+However, any application or service that has already authenticated a user will not be affected by enabling this setting until the authentication cache expires.
It is recommended to enable this setting before any user signs in to a device to prevent cached tokens from being present.
-If this setting is disabled or not configured, applications and services can use Microsoft accounts for authentication.
+If this setting is disabled or not configured, applications and services can use Microsoft accounts for authentication.
By default, this setting is **Disabled**.
This setting does not affect whether users can sign in to devices by using Microsoft accounts, or the ability for users to provide Microsoft accounts via the browser for authentication with web-based applications.
@@ -135,7 +135,7 @@ Computer Configuration\Administrative Templates\Windows Components\Microsoft acc
#### Accounts: Block Microsoft accounts
-This setting prevents using the **Settings** app to add a Microsoft account for single sign-on (SSO) authentication for Microsoft services and some background services, or using a Microsoft account for single sign-on to other applications or services.
+This setting prevents using the **Settings** app to add a Microsoft account for single sign-on (SSO) authentication for Microsoft services and some background services, or using a Microsoft account for single sign-on to other applications or services.
There are two options if this setting is enabled:
diff --git a/windows/security/identity-protection/access-control/service-accounts.md b/windows/security/identity-protection/access-control/service-accounts.md
index ff297b1517..c210880baa 100644
--- a/windows/security/identity-protection/access-control/service-accounts.md
+++ b/windows/security/identity-protection/access-control/service-accounts.md
@@ -74,7 +74,7 @@ A 64-bit architecture is required to run the Windows PowerShell commands that ar
A managed service account is dependent on encryption types supported by Kerberos. When a client computer authenticates to a server by using Kerberos protocol, the domain controller creates a Kerberos service ticket that is protected with encryption that the domain controller and the server support. The domain controller uses the account’s **msDS-SupportedEncryptionTypes** attribute to determine what encryption the server supports, and if there is no attribute, it assumes that the client computer does not support stronger encryption types. The Advanced Encryption Standard (AES) should always be explicitly configured for managed service accounts. If computers that host the managed service account are configured to not support RC4, authentication will always fail.
**Note**
-Introduced in Windows Server 2008 R2, the Data Encryption Standard (DES) is disabled by default. For more information about supported encryption types, see [Changes in Kerberos Authentication](http://technet.microsoft.com/library/dd560670(WS.10).aspx).
+Introduced in Windows Server 2008 R2, the Data Encryption Standard (DES) is disabled by default. For more information about supported encryption types, see [Changes in Kerberos Authentication](https://technet.microsoft.com/library/dd560670(WS.10).aspx).
@@ -92,7 +92,7 @@ Virtual accounts were introduced in Windows Server 2008 R2 and Windows 7, and
Services that run as virtual accounts access network resources by using the credentials of the computer account in the format <domain\_name>\\<computer\_name>$.
-For information about how to configure and use virtual service accounts, see [Service Accounts Step-by-Step Guide](http://technet.microsoft.com/library/dd548356.aspx).
+For information about how to configure and use virtual service accounts, see [Service Accounts Step-by-Step Guide](https://technet.microsoft.com/library/dd548356.aspx).
### Software requirements
diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md
index 2147976e2f..37b2f2e983 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md
@@ -18,20 +18,20 @@ ms.date: 08/31/2017
Prefer video? See [Credentials Protected by Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=mD3geLJyC_8304300474)
in the **Deep Dive into Windows Defender Credential Guard** video series.
-
+
Passwords are still weak. We recommend that in addition to deploying Windows Defender Credential Guard, organizations move away from passwords to other authentication methods, such as physical smart cards, virtual smart cards, or Windows Hello for Business.
-
-Windows Defender Credential Guard uses hardware security, so some features such as Windows To Go, are not supported.
+
+Windows Defender Credential Guard uses hardware security, so some features such as Windows To Go, are not supported.
## Wi-fi and VPN Considerations
-When you enable Windows Defender Credential Guard, you can no longer use NTLM classic authentication for Single Sign-On. You will be forced to enter your credentials to use these protocols and cannot save the credentials for future use. If you are using WiFi and VPN endpoints that are based on MS-CHAPv2, they are subject to similar attacks as for NTLMv1. For WiFi and VPN connections, Microsoft recommends that organizations move from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS.
+When you enable Windows Defender Credential Guard, you can no longer use NTLM classic authentication for Single Sign-On. You will be forced to enter your credentials to use these protocols and cannot save the credentials for future use. If you are using WiFi and VPN endpoints that are based on MS-CHAPv2, they are subject to similar attacks as for NTLMv1. For WiFi and VPN connections, Microsoft recommends that organizations move from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS.
## Kerberos Considerations
When you enable Windows Defender Credential Guard, you can no longer use Kerberos unconstrained delegation or DES encryption. Unconstrained delegation could allow attackers to extract Kerberos keys from the isolated LSA process. Use constrained or resource-based Kerberos delegation instead.
## 3rd Party Security Support Providers Considerations
-Some 3rd party Security Support Providers (SSPs and APs) might not be compatible with Windows Defender Credential Guard because it does not allow third-party SSPs to ask for password hashes from LSA. However, SSPs and APs still get notified of the password when a user logs on and/or changes their password. Any use of undocumented APIs within custom SSPs and APs are not supported. We recommend that custom implementations of SSPs/APs are tested with Windows Defender Credential Guard. SSPs and APs that depend on any undocumented or unsupported behaviors fail. For example, using the KerbQuerySupplementalCredentialsMessage API is not supported. Replacing the NTLM or Kerberos SSPs with custom SSPs and APs. For more info, see [Restrictions around Registering and Installing a Security Package](http://msdn.microsoft.com/library/windows/desktop/dn865014.aspx) on MSDN.
+Some 3rd party Security Support Providers (SSPs and APs) might not be compatible with Windows Defender Credential Guard because it does not allow third-party SSPs to ask for password hashes from LSA. However, SSPs and APs still get notified of the password when a user logs on and/or changes their password. Any use of undocumented APIs within custom SSPs and APs are not supported. We recommend that custom implementations of SSPs/APs are tested with Windows Defender Credential Guard. SSPs and APs that depend on any undocumented or unsupported behaviors fail. For example, using the KerbQuerySupplementalCredentialsMessage API is not supported. Replacing the NTLM or Kerberos SSPs with custom SSPs and APs. For more info, see [Restrictions around Registering and Installing a Security Package](https://msdn.microsoft.com/library/windows/desktop/dn865014.aspx) on MSDN.
## Upgrade Considerations
As the depth and breadth of protections provided by Windows Defender Credential Guard are increased, subsequent releases of Windows 10 with Windows Defender Credential Guard running may impact scenarios that were working in the past. For example, Windows Defender Credential Guard may block the use of a particular type of credential or a particular component to prevent malware from taking advantage of vulnerabilities. Test scenarios required for operations in an organization before upgrading a device using Windows Defender Credential Guard.
@@ -44,19 +44,19 @@ Starting with Windows 10, version 1511, domain credentials that are stored with
- When credentials are backed up from a PC that has Windows Defender Credential Guard enabled, the Windows credentials cannot be restored. If you need to back up your credentials, you must do this before you enable Windows Defender Credential Guard. Otherwise, you cannot restore those credentials.
## Clearing TPM Considerations
-Virtualization-based Security (VBS) uses the TPM to protect its key. So when the TPM is cleared then the TPM protected key used to encrypt VBS secrets is lost.
+Virtualization-based Security (VBS) uses the TPM to protect its key. So when the TPM is cleared then the TPM protected key used to encrypt VBS secrets is lost.
->[!WARNING]
+>[!WARNING]
> Clearing the TPM results in loss of protected data for all features that use VBS to protect data.
> When a TPM is cleared ALL features, which use VBS to protect data can no longer decrypt their protected data.
As a result Credential Guard can no longer decrypt protected data. VBS creates a new TPM protected key for Credential Guard. Credential Guard uses the new key to protect new data. However, the previously protected data is lost forever.
->[!NOTE]
-> Credential Guard obtains the key during initialization. So the data loss will only impact persistent data and occur after the next system startup.
+>[!NOTE]
+> Credential Guard obtains the key during initialization. So the data loss will only impact persistent data and occur after the next system startup.
### Windows credentials saved to Credential Manager
-Since Credential Manager cannot decrypt saved Windows Credentials, they are deleted. Applications should prompt for credentials that were previously saved. If saved again, then Windows credentials are protected Credential Guard.
+Since Credential Manager cannot decrypt saved Windows Credentials, they are deleted. Applications should prompt for credentials that were previously saved. If saved again, then Windows credentials are protected Credential Guard.
### Domain-joined device’s automatically provisioned public key
Beginning with Windows 10 and Windows Server 2016, domain-devices automatically provision a bound public key, for more information about automatic public key provisioning, see [Domain-joined Device Public Key Authentication](https://docs.microsoft.com/windows-server/security/kerberos/domain-joined-device-public-key-authentication).
@@ -66,17 +66,17 @@ Since Credential Guard cannot decrypt the protected private key, Windows uses th
Also if any access control checks including authentication policies require devices to have either the KEY TRUST IDENTITY (S-1-18-4) or FRESH PUBLIC KEY IDENTITY (S-1-18-3) well-known SIDs, then those access checks fail. For more information about authentication policies, see [Authentication Policies and Authentication Policy Silos](https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/authentication-policies-and-authentication-policy-silos). For more information about well-known SIDs, see [[MS-DTYP] Section 2.4.2.4 Well-known SID Structures](https://msdn.microsoft.com/en-us/library/cc980032.aspx).
### Breaking DPAPI on domain-joined devices
-On domain-joined devices, DPAPI can recover user keys using a domain controller from the user's domain. If a domain-joined device has no connectivity to a domain controller, then recovery is not possible.
+On domain-joined devices, DPAPI can recover user keys using a domain controller from the user's domain. If a domain-joined device has no connectivity to a domain controller, then recovery is not possible.
->[!IMPORTANT]
+>[!IMPORTANT]
> Best practice when clearing a TPM on a domain-joined device is to be on a network with connectivity to domain controllers. This ensures DPAPI functions and the user does not experience strange behavior.
-Auto VPN configuration is protected with user DPAPI. User may not be able to use VPN to connect to domain controllers since the VPN configurations are lost.
+Auto VPN configuration is protected with user DPAPI. User may not be able to use VPN to connect to domain controllers since the VPN configurations are lost.
If you must clear the TPM on a domain-joined device without connectivity to domain controllers, then you should consider the following.
-Domain user sign-in on a domain-joined device after clearing a TPM for as long as there is no connectivity to a domain controller:
+Domain user sign-in on a domain-joined device after clearing a TPM for as long as there is no connectivity to a domain controller:
-|Credential Type | Windows 10 version | Behavior
+|Credential Type | Windows 10 version | Behavior
|---|---|---|
| Certificate (smart card or Windows Hello for Business) | All | All data protected with user DPAPI is unusable and user DPAPI does not work at all. |
| Password | Windows 10 v1709 or later | If the user signed-in with a certificate or password prior to clearing the TPM, then they can sign-in with password and user DPAPI is unaffected.
@@ -86,7 +86,7 @@ Domain user sign-in on a domain-joined device after clearing a TPM for as long a
Once the device has connectivity to the domain controllers, DPAPI recovers the user's key and data protected prior to clearing the TPM can be decrypted.
#### Impact of DPAPI failures on Windows Information Protection
-When data protected with user DPAPI is unusable, then the user loses access to all work data protected by Windows Information Protection. The impact includes: Outlook 2016 is unable to start and work protected documents cannot be opened. If DPAPI is working, then newly created work data is protected and can be accessed.
+When data protected with user DPAPI is unusable, then the user loses access to all work data protected by Windows Information Protection. The impact includes: Outlook 2016 is unable to start and work protected documents cannot be opened. If DPAPI is working, then newly created work data is protected and can be accessed.
**Workaround:** Users can resolve the problem by connecting their device to the domain and rebooting or using their Encrypting File System Data Recovery Agent certificate. For more information about Encrypting File System Data Recovery Agent certificate, see [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](https://docs.microsoft.com/en-us/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate).
diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md
index 40b59a9301..66069f5d73 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md
@@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
author: brianlic-msft
-ms.date: 05/18/2018
+ms.date: 09/04/2018
---
# Manage Windows Defender Credential Guard
@@ -19,7 +19,7 @@ ms.date: 05/18/2018
Prefer video? See [Windows Defender Credential Guard Deployment](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=sRcyvLJyC_3304300474) in the Deep Dive into Windows Defender Credential Guard video series.
## Enable Windows Defender Credential Guard
-Windows Defender Credential Guard can be enabled either by using [Group Policy](#enable-credential-guard-by-using-group-policy), the [registry](#enable-credential-guard-by-using-the-registry), or the Windows Defender Device Guard and Windows Defender Credential Guard [hardware readiness tool](#hardware-readiness-tool). Windows Defender Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine.
+Windows Defender Credential Guard can be enabled either by using [Group Policy](#enable-credential-guard-by-using-group-policy), the [registry](#enable-credential-guard-by-using-the-registry), or the Windows Defender Device Guard and Windows Defender Credential Guard [hardware readiness tool](#hardware-readiness-tool). Windows Defender Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine.
The same set of procedures used to enable Windows Defender Credential Guard on physical machines applies also to virtual machines.
@@ -33,10 +33,10 @@ You can use Group Policy to enable Windows Defender Credential Guard. This will
4. In the **Credential Guard Configuration** box, click **Enabled with UEFI lock**, and then click **OK**. If you want to be able to turn off Windows Defender Credential Guard remotely, choose **Enabled without lock**.
-
+
5. Close the Group Policy Management Console.
-To enforce processing of the group policy, you can run ```gpupdate /force```.
+To enforce processing of the group policy, you can run ```gpupdate /force```.
### Enable Windows Defender Credential Guard by using the registry
@@ -47,9 +47,9 @@ If you don't use Group Policy, you can enable Windows Defender Credential Guard
Starting with Windows 10, version 1607 and Windows Server 2016, enabling Windows features to use virtualization-based security is not necessary and this step can be skipped.
-If you are using Windows 10, version 1507 (RTM) or Windows 10, version 1511, Windows features have to be enabled to use virtualization-based security.
+If you are using Windows 10, version 1507 (RTM) or Windows 10, version 1511, Windows features have to be enabled to use virtualization-based security.
You can do this by using either the Control Panel or the Deployment Image Servicing and Management tool (DISM).
-> [!NOTE]
+> [!NOTE]
If you enable Windows Defender Credential Guard by using Group Policy, the steps to enable Windows features through Control Panel or DISM are not required. Group Policy will install Windows features for you.
@@ -58,7 +58,7 @@ If you enable Windows Defender Credential Guard by using Group Policy, the steps
1. Open the Programs and Features control panel.
2. Click **Turn Windows feature on or off**.
3. Go to **Hyper-V** -> **Hyper-V Platform**, and then select the **Hyper-V Hypervisor** check box.
-4. Select the **Isolated User Mode** check box at the top level of the feature selection.
+4. Select the **Isolated User Mode** check box at the top level of the feature selection.
5. Click **OK**.
**Add the virtualization-based security features to an offline image by using DISM**
@@ -73,7 +73,7 @@ If you enable Windows Defender Credential Guard by using Group Policy, the steps
dism /image: /Enable-Feature /FeatureName:IsolatedUserMode
```
-> [!NOTE]
+> [!NOTE]
> You can also add these features to an online image by using either DISM or Configuration Manager.
#### Enable virtualization-based security and Windows Defender Credential Guard
@@ -89,8 +89,8 @@ If you enable Windows Defender Credential Guard by using Group Policy, the steps
4. Close Registry Editor.
-> [!NOTE]
-> You can also enable Windows Defender Credential Guard by setting the registry entries in the [FirstLogonCommands](http://msdn.microsoft.com/library/windows/hardware/dn922797.aspx) unattend setting.
+> [!NOTE]
+> You can also enable Windows Defender Credential Guard by setting the registry entries in the [FirstLogonCommands](https://msdn.microsoft.com/library/windows/hardware/dn922797.aspx) unattend setting.
### Enable Windows Defender Credential Guard by using the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool
@@ -98,7 +98,7 @@ If you enable Windows Defender Credential Guard by using Group Policy, the steps
You can also enable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337).
```
-DG_Readiness_Tool_v3.2.ps1 -Enable -AutoReboot
+DG_Readiness_Tool_v3.5.ps1 -Enable -AutoReboot
```
### Review Windows Defender Credential Guard performance
@@ -112,20 +112,20 @@ You can view System Information to check that Windows Defender Credential Guard
3. Confirm that **Credential Guard** is shown next to **Virtualization-based security Services Configured**.
Here's an example:
-
+
You can also check that Windows Defender Credential Guard is running by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337).
```
-DG_Readiness_Tool_v3.2.ps1 -Ready
+DG_Readiness_Tool_v3.5.ps1 -Ready
```
> [!NOTE]
For client machines that are running Windows 10 1703, LsaIso.exe is running whenever virtualization-based security is enabled for other features.
-- We recommend enabling Windows Defender Credential Guard before a device is joined to a domain. If Windows Defender Credential Guard is enabled after domain join, the user and device secrets may already be compromised. In other words, enabling Credential Guard will not help to secure a device or identity that has already been compromised, which is why we recommend turning on Credential Guard as early as possible.
+- We recommend enabling Windows Defender Credential Guard before a device is joined to a domain. If Windows Defender Credential Guard is enabled after domain join, the user and device secrets may already be compromised. In other words, enabling Credential Guard will not help to secure a device or identity that has already been compromised, which is why we recommend turning on Credential Guard as early as possible.
- You should perform regular reviews of the PCs that have Windows Defender Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for:
- **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials.
@@ -137,7 +137,7 @@ For client machines that are running Windows 10 1703, LsaIso.exe is running when
- **Event ID 17** Error reading Windows Defender Credential Guard (LsaIso.exe) UEFI configuration: \[error code\]
You can also verify that TPM is being used for key protection by checking Event ID 51 in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0.
- **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x0.
-
+
## Disable Windows Defender Credential Guard
To disable Windows Defender Credential Guard, you can use the following set of procedures or [the Device Guard and Credential Guard hardware readiness tool](#turn-off-with-hardware-readiness-tool). If Credential Guard was enabled with UEFI Lock then you must use the following procedure as the settings are persisted in EFI (firmware) variables and it will require physical presence at the machine to press a function key to accept the change. If Credential Guard was enabled without UEFI Lock then you can turn it off by using Group Policy.
@@ -148,34 +148,34 @@ To disable Windows Defender Credential Guard, you can use the following set of p
- HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\EnableVirtualizationBasedSecurity
- HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\RequirePlatformSecurityFeatures
- > [!IMPORTANT]
+ > [!IMPORTANT]
> If you manually remove these registry settings, make sure to delete them all. If you don't remove them all, the device might go into BitLocker recovery.
3. Delete the Windows Defender Credential Guard EFI variables by using bcdedit. From an elevated command prompt, type the following commands:
``` syntax
mountvol X: /s
-
+
copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y
-
+
bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader
-
+
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi"
-
+
bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}
-
+
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO
-
+
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:
-
+
mountvol X: /d
-
+
```
2. Restart the PC.
3. Accept the prompt to disable Windows Defender Credential Guard.
4. Alternatively, you can disable the virtualization-based security features to turn off Windows Defender Credential Guard.
-> [!NOTE]
+> [!NOTE]
> The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Windows Defender Credential Guard and virtualization-based security, run the following bcdedit command after turning off all virtualization-based security Group Policy and registry settings: bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS
For more info on virtualization-based security and Windows Defender Device Guard, see [Windows Defender Device Guard deployment guide](/windows/device-security/device-guard/device-guard-deployment-guide).
@@ -186,7 +186,7 @@ For more info on virtualization-based security and Windows Defender Device Guard
You can also disable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337).
```
-DG_Readiness_Tool_v3.2.ps1 -Disable -AutoReboot
+DG_Readiness_Tool_v3.5.ps1 -Disable -AutoReboot
```
#### Disable Windows Defender Credential Guard for a virtual machine
diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md
index f63762b17a..2e605bc8fe 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md
@@ -1,6 +1,6 @@
---
title: Windows Defender Credential Guard Requirements (Windows 10)
-description: Windows Defender Credential Guard baseline hardware, firmware, and software requirements, and additional protections for improved security associated with available hardware and firmware options.
+description: Windows Defender Credential Guard baseline hardware, firmware, and software requirements, and additional protections for improved security associated with available hardware and firmware options.
ms.prod: w10
ms.mktglfcycl: explore
ms.sitesec: library
@@ -16,7 +16,7 @@ ms.date: 01/12/2018
- Windows 10
- Windows Server 2016
-Prefer video? See
+Prefer video? See
[Windows Defender Credential Guard Deployment](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=sRcyvLJyC_3304300474)
in the Deep Dive into Windows Defender Credential Guard video series.
@@ -36,14 +36,14 @@ The Virtualization-based security requires:
- CPU virtualization extensions plus extended page tables
- Windows hypervisor
-### Windows Defender Credential Guard deployment in virtual machines
+### Windows Defender Credential Guard deployment in virtual machines
Credential Guard can protect secrets in a Hyper-V virtual machine, just as it would on a physical machine. When Credential Guard is deployed on a VM, secrets are protected from attacks inside the VM. Credential Guard does not provide additional protection from privileged system attacks originating from the host.
#### Requirements for running Windows Defender Credential Guard in Hyper-V virtual machines
- The Hyper-V host must have an IOMMU, and run at least Windows Server 2016 or Windows 10 version 1607.
-- The Hyper-V virtual machine must be Generation 2, have an enabled virtual TPM, and be running at least Windows Server 2016 or Windows 10.
+- The Hyper-V virtual machine must be Generation 2, have an enabled virtual TPM, and be running at least Windows Server 2016 or Windows 10.
For information about other host platforms, see [Enabling Windows Server 2016 and Hyper-V virtualization based security features on other platforms](https://blogs.technet.microsoft.com/windowsserver/2016/09/29/enabling-windows-server-2016-and-hyper-v-virtualization-based-security-features-on-other-platforms/)
@@ -51,14 +51,14 @@ For information about Windows Defender Remote Credential Guard hardware and soft
## Application requirements
-When Windows Defender Credential Guard is enabled, specific authentication capabilities are blocked, so applications that require such capabilities will break. Applications should be tested prior to deployment to ensure compatiblity with the reduced functionality.
+When Windows Defender Credential Guard is enabled, specific authentication capabilities are blocked, so applications that require such capabilities will break. Applications should be tested prior to deployment to ensure compatiblity with the reduced functionality.
->[!WARNING]
+>[!WARNING]
> Enabling Windows Defender Credential Guard on domain controllers is not supported.
-> The domain controller hosts authentication services which integrate with processes isolated when Windows Defender Credential Guard is enabled, causing crashes.
+> The domain controller hosts authentication services which integrate with processes isolated when Windows Defender Credential Guard is enabled, causing crashes.
>[!NOTE]
-> Windows Defender Credential Guard does not provide protections for the Active Directory database or the Security Accounts Manager (SAM). The credentials protected by Kerberos and NTLM when Windows Defender Credential Guard is enabled are also in the Active Directory database (on domain controllers) and the SAM (for local accounts).
+> Windows Defender Credential Guard does not provide protections for the Active Directory database or the Security Accounts Manager (SAM). The credentials protected by Kerberos and NTLM when Windows Defender Credential Guard is enabled are also in the Active Directory database (on domain controllers) and the SAM (for local accounts).
Applications will break if they require:
- Kerberos DES encryption support
@@ -71,32 +71,32 @@ Applications will prompt and expose credentials to risk if they require:
- Credential delegation
- MS-CHAPv2
-Applications may cause performance issues when they attempt to hook the isolated Windows Defender Credential Guard process.
+Applications may cause performance issues when they attempt to hook the isolated Windows Defender Credential Guard process.
-Services or protocols that rely on Kerberos, such as file shares, remote desktop, or BranchCache, continue to work and are not affected by Windows Defender Credential Guard.
+Services or protocols that rely on Kerberos, such as file shares, remote desktop, or BranchCache, continue to work and are not affected by Windows Defender Credential Guard.
See this video: [Credentials Protected by Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474)
## Security considerations
-All computers that meet baseline protections for hardware, firmware, and software can use Windows Defender Credential Guard.
-Computers that meet additional qualifications can provide additional protections to further reduce the attack surface.
+All computers that meet baseline protections for hardware, firmware, and software can use Windows Defender Credential Guard.
+Computers that meet additional qualifications can provide additional protections to further reduce the attack surface.
The following tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017.
-> [!NOTE]
+> [!NOTE]
> Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new shipping computers.
> If you are an OEM, see [PC OEM requirements for Windows Defender Device Guard and Windows Defender Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx).
### Baseline protections
-|Baseline Protections | Description | Security benefits
+|Baseline Protections | Description | Security benefits
|---|---|---|
| Hardware: **64-bit CPU** | A 64-bit computer is required for the Windows hypervisor to provide VBS. |
| Hardware: **CPU virtualization extensions**, plus **extended page tables** | **Requirements**: These hardware features are required for VBS: One of the following virtualization extensions: • VT-x (Intel) or • AMD-V And: • Extended page tables, also called Second Level Address Translation (SLAT). | VBS provides isolation of secure kernel from normal operating system. Vulnerabilities and Day 0s in normal operating system cannot be exploited because of this isolation. |
| Hardware: **Trusted Platform Module (TPM)** | **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware. [TPM recommendations](https://technet.microsoft.com/itpro/windows/keep-secure/tpm-recommendations) | A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. |
-| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)| UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. |
-| Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).| UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. |
+| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)| UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. |
+| Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).| UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. |
| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise
Important: Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard. Only Windows Defender Device Guard is supported in this configuration.
|Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard. |
> [!IMPORTANT]
@@ -126,11 +126,11 @@ The following tables describe baseline protections, plus protections for improve
-### 2017 Additional security qualifications starting with Windows 10, version 1703
+### 2017 Additional security qualifications starting with Windows 10, version 1703
-The following table lists qualifications for Windows 10, version 1703, which are in addition to all preceding qualifications.
+The following table lists qualifications for Windows 10, version 1703, which are in addition to all preceding qualifications.
| Protections for Improved Security | Description | Security Benefits
|---|---|---|
| Firmware: **VBS enablement of NX protection for UEFI runtime services** | **Requirements**: • VBS will enable No-Execute (NX) protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be executable. • UEFI runtime service must meet these requirements: - Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table. - PE sections need to be page-aligned in memory (not required for in non-volatile storage). - The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS: - All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both - No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory must be either readable and executable or writeable and non-executable.
Notes: • This only applies to UEFI runtime service memory, and not UEFI boot service memory. • This protection is applied by VBS on OS page tables.
Please also note the following: • Do not use sections that are both writeable and executable • Do not attempt to directly modify executable system memory • Do not use dynamic code | • Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable) • Reduces the attack surface to VBS from system firmware. |
-| Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features. | • Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable) • Reduces the attack surface to VBS from system firmware. • Blocks additional security attacks against SMM. |
+| Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](https://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features. | • Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable) • Reduces the attack surface to VBS from system firmware. • Blocks additional security attacks against SMM. |
diff --git a/windows/security/identity-protection/credential-guard/credential-guard.md b/windows/security/identity-protection/credential-guard/credential-guard.md
index 39efca9686..d541979fb9 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard.md
@@ -35,9 +35,9 @@ By enabling Windows Defender Credential Guard, the following features and soluti
- [More on Processes and Features in Windows 10 Isolated User Mode with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/More-on-Processes-and-Features-in-Windows-10-Isolated-User-Mode-with-Dave-Probert)
- [Mitigating Credential Theft using the Windows 10 Isolated User Mode (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Credential-Theft-using-the-Windows-10-Isolated-User-Mode)
- [Protecting network passwords with Windows Defender Credential Guard](https://www.microsoft.com/itshowcase/Article/Content/831/Protecting-network-passwords-with-Windows-10-Credential-Guard)
-- [Enabling Strict KDC Validation in Windows Kerberos](http://www.microsoft.com/download/details.aspx?id=6382)
-- [What's New in Kerberos Authentication for Windows Server 2012](http://technet.microsoft.com/library/hh831747.aspx)
-- [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](http://technet.microsoft.com/library/dd378897.aspx)
+- [Enabling Strict KDC Validation in Windows Kerberos](https://www.microsoft.com/download/details.aspx?id=6382)
+- [What's New in Kerberos Authentication for Windows Server 2012](https://technet.microsoft.com/library/hh831747.aspx)
+- [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](https://technet.microsoft.com/library/dd378897.aspx)
- [Trusted Platform Module](/windows/device-security/tpm/trusted-platform-module-overview)
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md
index b09e2f8ec6..8a9bbb737d 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md
@@ -17,11 +17,11 @@ ms.date: 03/26/2018
- Windows 10
>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher.
-
-You're environment is federated and you are ready to configure device registration for your hybrid environment. Hybrid Windows Hello for Business deployment needs device registration and device write-back to enable proper device authentication.
-
+
+You're environment is federated and you are ready to configure device registration for your hybrid environment. Hybrid Windows Hello for Business deployment needs device registration and device write-back to enable proper device authentication.
+
> [!IMPORTANT]
-> If your environment is not federated, review the [New Installation baseline](hello-hybrid-cert-new-install.md) section of this deployment document to learn how to federate your environment for your Windows Hello for Business deployment.
+> If your environment is not federated, review the [New Installation baseline](hello-hybrid-cert-new-install.md) section of this deployment document to learn how to federate your environment for your Windows Hello for Business deployment.
Use this three phased approach for configuring device registration.
1. [Configure devices to register in Azure](#configure-azure-for-device-registration)
@@ -37,17 +37,17 @@ Use this three phased approach for configuring device registration.
> You can learn about this and more by reading [Introduction to Device Management in Azure Active Directory.](https://docs.microsoft.com/en-us/azure/active-directory/device-management-introduction)
## Configure Azure for Device Registration
-Begin configuring device registration to support Hybrid Windows Hello for Business by configuring device registration capabilities in Azure AD.
+Begin configuring device registration to support Hybrid Windows Hello for Business by configuring device registration capabilities in Azure AD.
-To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-setup/)
+To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-setup/)
## Configure Active Directory to support Azure device synchronization
-Azure Active Directory is now configured for device registration. Next, you need to configure the on-premises Active Directory to support synchronizing hybrid Azure AD joined devices. Begin with upgrading the Active Directory Schema
+Azure Active Directory is now configured for device registration. Next, you need to configure the on-premises Active Directory to support synchronizing hybrid Azure AD joined devices. Begin with upgrading the Active Directory Schema
-### Upgrading Active Directory to the Windows Server 2016 Schema
+### Upgrading Active Directory to the Windows Server 2016 Schema
-To use Windows Hello for Business with Hybrid Azure AD joined devices, you must first upgrade your Active Directory schema to Windows Server 2016.
+To use Windows Hello for Business with Hybrid Azure AD joined devices, you must first upgrade your Active Directory schema to Windows Server 2016.
> [!IMPORTANT]
> If you already have a Windows Server 2016 domain controller in your forest, you can skip **Upgrading Active Directory to the Windows Server 2016 Schema** (this section).
@@ -64,7 +64,7 @@ The command should return the name of the domain controller where you need to ad
#### Updating the Schema
-Windows Hello for Business uses asymmetric keys as user credentials (rather than passwords). During enrollment, the public key is registered in an attribute on the user object in Active Directory. The schema update adds this new attribute to Active Directory.
+Windows Hello for Business uses asymmetric keys as user credentials (rather than passwords). During enrollment, the public key is registered in an attribute on the user object in Active Directory. The schema update adds this new attribute to Active Directory.
Manually updating Active Directory uses the command-line utility **adprep.exe** located at **\:\support\adprep** on the Windows Server 2016 DVD or ISO. Before running adprep.exe, you must identify the domain controller hosting the schema master role.
@@ -86,7 +86,7 @@ Review the [AD FS Design guide](https://docs.microsoft.com/en-us/windows-server/
Once you have your AD FS design ready, review [Deploying a Federation Server farm](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/deploying-a-federation-server-farm) to configure AD FS in your environment.
> [!IMPORTANT]
-> During your AD FS deployment, skip the **Configure a federation server with Device Registration Service** and the **Configure Corporate DNS for the Federation Service and DRS** procedures.
+> During your AD FS deployment, skip the **Configure a federation server with Device Registration Service** and the **Configure Corporate DNS for the Federation Service and DRS** procedures.
The AD FS farm used with Windows Hello for Business must be Windows Server 2016 with minimum update of [KB4088889 (14393.2155)](https://support.microsoft.com/en-us/help/4088889). If your AD FS farm is not running the AD FS role with updates from Windows Server 2016, then read [Upgrading to AD FS in Windows Server 2016](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016)
@@ -95,87 +95,87 @@ Federation server proxies are computers that run AD FS software that have been c
Use the [Setting of a Federation Proxy](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/checklist--setting-up-a-federation-server-proxy) checklist to configure AD FS proxy servers in your environment.
### Deploy Azure AD Connect
-Next, you need to synchronizes the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](http://go.microsoft.com/fwlink/?LinkId=615771).
+Next, you need to synchronizes the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](https://go.microsoft.com/fwlink/?LinkId=615771).
-When you are ready to install, follow the **Configuring federation with AD FS** section of [Custom installation of Azure AD Connect](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-get-started-custom). Select the **Federation with AD FS** option on the **User sign-in** page. At the **AD FS Farm** page, select the use an existing option and click **Next**.
+When you are ready to install, follow the **Configuring federation with AD FS** section of [Custom installation of Azure AD Connect](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-get-started-custom). Select the **Federation with AD FS** option on the **User sign-in** page. At the **AD FS Farm** page, select the use an existing option and click **Next**.
-### Create AD objects for AD FS Device Authentication
-If your AD FS farm is not already configured for Device Authentication (you can see this in the AD FS Management console under Service -> Device Registration), use the following steps to create the correct AD DS objects and configuration.
+### Create AD objects for AD FS Device Authentication
+If your AD FS farm is not already configured for Device Authentication (you can see this in the AD FS Management console under Service -> Device Registration), use the following steps to create the correct AD DS objects and configuration.
> [!NOTE]
-> The below commands require Active Directory administration tools, so if your federation server is not also a domain controller, first install the tools using step 1 below. Otherwise you can skip step 1.
+> The below commands require Active Directory administration tools, so if your federation server is not also a domain controller, first install the tools using step 1 below. Otherwise you can skip step 1.
1. Run the **Add Roles & Features** wizard and select feature **Remote Server Administration Tools** -> **Role Administration Tools** -> **AD DS and AD LDS Tools** -> Choose both the **Active Directory module for Windows PowerShell** and the **AD DS Tools**.
-
-2. On your AD FS primary server, ensure you are logged in as AD DS user with Enterprise Admin (EA ) privileges and open an elevated Windows PowerShell prompt. Then, run the following commands:
-
- `Import-module activedirectory`
- `PS C:\> Initialize-ADDeviceRegistration -ServiceAccountName "" `
+
+2. On your AD FS primary server, ensure you are logged in as AD DS user with Enterprise Admin (EA ) privileges and open an elevated Windows PowerShell prompt. Then, run the following commands:
+
+ `Import-module activedirectory`
+ `PS C:\> Initialize-ADDeviceRegistration -ServiceAccountName "" `
3. On the pop-up window click **Yes**.
> [!NOTE]
> If your AD FS service is configured to use a GMSA account, enter the account name in the format "domain\accountname$"
-
+
-The above PSH creates the following objects:
+The above PSH creates the following objects:
-- RegisteredDevices container under the AD domain partition
-- Device Registration Service container and object under Configuration --> Services --> Device Registration Configuration
-- Device Registration Service DKM container and object under Configuration --> Services --> Device Registration Configuration
+- RegisteredDevices container under the AD domain partition
+- Device Registration Service container and object under Configuration --> Services --> Device Registration Configuration
+- Device Registration Service DKM container and object under Configuration --> Services --> Device Registration Configuration
-
+
4. Once this is done, you will see a successful completion message.
-
+
-### Create Service Connection Point (SCP) in Active Directory
-If you plan to use Windows 10 domain join (with automatic registration to Azure AD) as described here, execute the following commands to create a service connection point in AD DS
+### Create Service Connection Point (SCP) in Active Directory
+If you plan to use Windows 10 domain join (with automatic registration to Azure AD) as described here, execute the following commands to create a service connection point in AD DS
1. Open Windows PowerShell and execute the following:
-
- `PS C:>Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1" `
+
+ `PS C:>Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1" `
> [!NOTE]
> If necessary, copy the AdSyncPrep.psm1 file from your Azure AD Connect server. This file is located in Program Files\Microsoft Azure Active Directory Connect\AdPrep
-
+
-2. Provide your Azure AD global administrator credentials
+2. Provide your Azure AD global administrator credentials
`PS C:>$aadAdminCred = Get-Credential`
-
+
-3. Run the following PowerShell command
+3. Run the following PowerShell command
- `PS C:>Initialize-ADSyncDomainJoinedComputerSync -AdConnectorAccount [AD connector account name] -AzureADCredentials $aadAdminCred `
+ `PS C:>Initialize-ADSyncDomainJoinedComputerSync -AdConnectorAccount [AD connector account name] -AzureADCredentials $aadAdminCred `
Where the [AD connector account name] is the name of the account you configured in Azure AD Connect when adding your on-premises AD DS directory.
-
-The above commands enable Windows 10 clients to find the correct Azure AD domain to join by creating the serviceConnectionpoint object in AD DS.
-### Prepare AD for Device Write Back
+The above commands enable Windows 10 clients to find the correct Azure AD domain to join by creating the serviceConnectionpoint object in AD DS.
+
+### Prepare AD for Device Write Back
To ensure AD DS objects and containers are in the correct state for write back of devices from Azure AD, do the following.
-1. Open Windows PowerShell and execute the following:
+1. Open Windows PowerShell and execute the following:
- `PS C:>Initialize-ADSyncDeviceWriteBack -DomainName -AdConnectorAccount [AD connector account name] `
+ `PS C:>Initialize-ADSyncDeviceWriteBack -DomainName -AdConnectorAccount [AD connector account name] `
-Where the [AD connector account name] is the name of the account you configured in Azure AD Connect when adding your on-premises AD DS directory in domain\accountname format
+Where the [AD connector account name] is the name of the account you configured in Azure AD Connect when adding your on-premises AD DS directory in domain\accountname format
-The above command creates the following objects for device write back to AD DS, if they do not exist already, and allows access to the specified AD connector account name
+The above command creates the following objects for device write back to AD DS, if they do not exist already, and allows access to the specified AD connector account name
-- RegisteredDevices container in the AD domain partition
-- Device Registration Service container and object under Configuration --> Services --> Device Registration Configuration
+- RegisteredDevices container in the AD domain partition
+- Device Registration Service container and object under Configuration --> Services --> Device Registration Configuration
-### Enable Device Write Back in Azure AD Connect
-If you have not done so before, enable device write back in Azure AD Connect by running the wizard a second time and selecting **"Customize Synchronization Options"**, then checking the box for device write back and selecting the forest in which you have run the above cmdlets
+### Enable Device Write Back in Azure AD Connect
+If you have not done so before, enable device write back in Azure AD Connect by running the wizard a second time and selecting **"Customize Synchronization Options"**, then checking the box for device write back and selecting the forest in which you have run the above cmdlets
## Configure AD FS to use Azure registered devices
@@ -205,7 +205,7 @@ If you are already issuing an ImmutableID claim (e.g., alternate login ID) you n
* `http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID`
In the following sections, you find information about:
-
+
- The values each claim should have
- How a definition would look like in AD FS
@@ -220,12 +220,12 @@ The definition helps you to verify whether the values are present or if you need
@RuleName = "Issue account type for domain-joined computers"
c:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
- Value =~ "-515$",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
+ Value =~ "-515$",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
]
=> issue(
- Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
+ Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
Value = "DJ"
);
@@ -235,35 +235,35 @@ The definition helps you to verify whether the values are present or if you need
@RuleName = "Issue object GUID for domain-joined computers"
c1:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
- Value =~ "-515$",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
+ Value =~ "-515$",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
]
- &&
+ &&
c2:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
]
=> issue(
- store = "Active Directory",
- types = ("http://schemas.microsoft.com/identity/claims/onpremobjectguid"),
- query = ";objectguid;{0}",
+ store = "Active Directory",
+ types = ("http://schemas.microsoft.com/identity/claims/onpremobjectguid"),
+ query = ";objectguid;{0}",
param = c2.Value
);
-
+
#### Issue objectSID of the computer account on-premises
**`http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid`** - This claim must contain the **objectSid** value of the on-premises computer account. In AD FS, you can add an issuance transform rule that looks like this:
@RuleName = "Issue objectSID for domain-joined computers"
c1:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
- Value =~ "-515$",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
+ Value =~ "-515$",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
]
- &&
+ &&
c2:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
]
=> issue(claim = c2);
@@ -275,41 +275,41 @@ The definition helps you to verify whether the values are present or if you need
@RuleName = "Issue account type with the value User when its not a computer"
NOT EXISTS(
[
- Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
+ Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
Value == "DJ"
]
)
=> add(
- Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
+ Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
Value = "User"
);
-
+
@RuleName = "Capture UPN when AccountType is User and issue the IssuerID"
c1:[
Type == "http://schemas.xmlsoap.org/claims/UPN"
]
- &&
+ &&
c2:[
- Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
+ Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
Value == "User"
]
=> issue(
- Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
+ Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
Value = regexreplace(
- c1.Value,
- ".+@(?.+)",
+ c1.Value,
+ ".+@(?.+)",
"http://${domain}/adfs/services/trust/"
)
);
-
+
@RuleName = "Issue issuerID for domain-joined computers"
c:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
- Value =~ "-515$",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
+ Value =~ "-515$",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
]
=> issue(
- Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
+ Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
Value = "http:///adfs/services/trust/"
);
@@ -319,8 +319,8 @@ In the claim above,
- `$` is the AD FS service URL
- `` is a placeholder you need to replace with one of your verified domain names in Azure AD
-For more details about verified domain names, see [Add a custom domain name to Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-add-domain).
-To get a list of your verified company domains, you can use the [Get-MsolDomain](https://docs.microsoft.com/en-us/powershell/module/msonline/get-msoldomain?view=azureadps-1.0) cmdlet.
+For more details about verified domain names, see [Add a custom domain name to Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-add-domain).
+To get a list of your verified company domains, you can use the [Get-MsolDomain](https://docs.microsoft.com/en-us/powershell/module/msonline/get-msoldomain?view=azureadps-1.0) cmdlet.
#### Issue ImmutableID for computer when one for users exist (e.g. alternate login ID is set)
@@ -328,19 +328,19 @@ To get a list of your verified company domains, you can use the [Get-MsolDomain]
@RuleName = "Issue ImmutableID for computers"
c1:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
- Value =~ "-515$",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
+ Value =~ "-515$",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
- ]
- &&
+ ]
+ &&
c2:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
]
=> issue(
- store = "Active Directory",
- types = ("http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID"),
- query = ";objectguid;{0}",
+ store = "Active Directory",
+ types = ("http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID"),
+ query = ";objectguid;{0}",
param = c2.Value
);
@@ -351,45 +351,45 @@ The following script helps you with the creation of the issuance transform rules
$multipleVerifiedDomainNames = $false
$immutableIDAlreadyIssuedforUsers = $false
$oneOfVerifiedDomainNames = 'example.com' # Replace example.com with one of your verified domains
-
+
$rule1 = '@RuleName = "Issue account type for domain-joined computers"
c:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
- Value =~ "-515$",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
+ Value =~ "-515$",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
]
=> issue(
- Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
+ Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
Value = "DJ"
);'
$rule2 = '@RuleName = "Issue object GUID for domain-joined computers"
c1:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
- Value =~ "-515$",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
+ Value =~ "-515$",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
]
- &&
+ &&
c2:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
]
=> issue(
- store = "Active Directory",
- types = ("http://schemas.microsoft.com/identity/claims/onpremobjectguid"),
- query = ";objectguid;{0}",
+ store = "Active Directory",
+ types = ("http://schemas.microsoft.com/identity/claims/onpremobjectguid"),
+ query = ";objectguid;{0}",
param = c2.Value
);'
$rule3 = '@RuleName = "Issue objectSID for domain-joined computers"
c1:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
- Value =~ "-515$",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
+ Value =~ "-515$",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
]
- &&
+ &&
c2:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
]
=> issue(claim = c2);'
@@ -399,41 +399,41 @@ The following script helps you with the creation of the issuance transform rules
$rule4 = '@RuleName = "Issue account type with the value User when it is not a computer"
NOT EXISTS(
[
- Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
+ Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
Value == "DJ"
]
)
=> add(
- Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
+ Type = "http://schemas.microsoft.com/ws/2012/01/accounttype",
Value = "User"
);
-
+
@RuleName = "Capture UPN when AccountType is User and issue the IssuerID"
c1:[
Type == "http://schemas.xmlsoap.org/claims/UPN"
]
- &&
+ &&
c2:[
- Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
+ Type == "http://schemas.microsoft.com/ws/2012/01/accounttype",
Value == "User"
]
=> issue(
- Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
+ Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
Value = regexreplace(
- c1.Value,
- ".+@(?.+)",
+ c1.Value,
+ ".+@(?.+)",
"http://${domain}/adfs/services/trust/"
)
);
-
+
@RuleName = "Issue issuerID for domain-joined computers"
c:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
- Value =~ "-515$",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
+ Value =~ "-515$",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
]
=> issue(
- Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
+ Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid",
Value = "http://' + $oneOfVerifiedDomainNames + '/adfs/services/trust/"
);'
}
@@ -442,32 +442,32 @@ The following script helps you with the creation of the issuance transform rules
if ($immutableIDAlreadyIssuedforUsers -eq $true) {
$rule5 = '@RuleName = "Issue ImmutableID for computers"
c1:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
- Value =~ "-515$",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
+ Value =~ "-515$",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
- ]
- &&
+ ]
+ &&
c2:[
- Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
+ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"
]
=> issue(
- store = "Active Directory",
- types = ("http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID"),
- query = ";objectguid;{0}",
+ store = "Active Directory",
+ types = ("http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID"),
+ query = ";objectguid;{0}",
param = c2.Value
);'
}
- $existingRules = (Get-ADFSRelyingPartyTrust -Identifier urn:federation:MicrosoftOnline).IssuanceTransformRules
+ $existingRules = (Get-ADFSRelyingPartyTrust -Identifier urn:federation:MicrosoftOnline).IssuanceTransformRules
$updatedRules = $existingRules + $rule1 + $rule2 + $rule3 + $rule4 + $rule5
- $crSet = New-ADFSClaimRuleSet -ClaimRule $updatedRules
+ $crSet = New-ADFSClaimRuleSet -ClaimRule $updatedRules
- Set-AdfsRelyingPartyTrust -TargetIdentifier urn:federation:MicrosoftOnline -IssuanceTransformRules $crSet.ClaimRulesString
+ Set-AdfsRelyingPartyTrust -TargetIdentifier urn:federation:MicrosoftOnline -IssuanceTransformRules $crSet.ClaimRulesString
-#### Remarks
+#### Remarks
- This script appends the rules to the existing rules. Do not run the script twice because the set of rules would be added twice. Make sure that no corresponding rules exist for these claims (under the corresponding conditions) before running the script again.
@@ -475,28 +475,28 @@ The following script helps you with the creation of the issuance transform rules
c:[Type == "http://schemas.xmlsoap.org/claims/UPN"]
- => issue(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", Value = regexreplace(c.Value, ".+@(?.+)", "http://${domain}/adfs/services/trust/"));
+ => issue(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", Value = regexreplace(c.Value, ".+@(?.+)", "http://${domain}/adfs/services/trust/"));
- If you have already issued an **ImmutableID** claim for user accounts, set the value of **$immutableIDAlreadyIssuedforUsers** in the script to **$true**.
-#### Configure Device Authentication in AD FS
-Using an elevated PowerShell command window, configure AD FS policy by executing the following command
+#### Configure Device Authentication in AD FS
+Using an elevated PowerShell command window, configure AD FS policy by executing the following command
-`PS C:>Set-AdfsGlobalAuthenticationPolicy -DeviceAuthenticationEnabled $true -DeviceAuthenticationMethod All`
+`PS C:>Set-AdfsGlobalAuthenticationPolicy -DeviceAuthenticationEnabled $true -DeviceAuthenticationMethod All`
-#### Check your configuration
+#### Check your configuration
For your reference, below is a comprehensive list of the AD DS devices, containers and permissions required for device write-back and authentication to work
-- object of type ms-DS-DeviceContainer at CN=RegisteredDevices,DC=<domain>
- - read access to the AD FS service account
+- object of type ms-DS-DeviceContainer at CN=RegisteredDevices,DC=<domain>
+ - read access to the AD FS service account
- read/write access to the Azure AD Connect sync AD connector account
- Container CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain>
- Container Device Registration Service DKM under the above container
-
-
-- object of type serviceConnectionpoint at CN=<guid>, CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain>
- - read/write access to the specified AD connector account name on the new object
+
+
+- object of type serviceConnectionpoint at CN=<guid>, CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain>
+ - read/write access to the specified AD connector account name on the new object
- object of type msDS-DeviceRegistrationServiceContainer at CN=Device Registration Services,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain>
- object of type msDS-DeviceRegistrationService in the above container
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md
index 97684aec7b..bf7954d10e 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md
@@ -17,11 +17,11 @@ ms.date: 10/20/2017
- Windows 10
>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher.
-
-You are ready to configure directory synchronization for your hybrid environment. Hybrid Windows Hello for Business deployment needs both a cloud and an on-premises identity to authenticate and access resources in the cloud or on-premises.
+
+You are ready to configure directory synchronization for your hybrid environment. Hybrid Windows Hello for Business deployment needs both a cloud and an on-premises identity to authenticate and access resources in the cloud or on-premises.
## Deploy Azure AD Connect
-Next, you need to synchronizes the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](http://go.microsoft.com/fwlink/?LinkId=615771).
+Next, you need to synchronizes the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](https://go.microsoft.com/fwlink/?LinkId=615771).
diff --git a/windows/security/identity-protection/index.md b/windows/security/identity-protection/index.md
index 7208a54485..1e0b600031 100644
--- a/windows/security/identity-protection/index.md
+++ b/windows/security/identity-protection/index.md
@@ -25,5 +25,4 @@ Learn more about identity annd access management technologies in Windows 10 and
| [VPN technical guide](vpn/vpn-guide.md) | Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. |
| [Smart Cards](smart-cards/smart-card-windows-smart-card-technical-reference.md) | Provides a collection of references topics about smart cards, which are tamper-resistant portable storage devices that can enhance the security of tasks such as authenticating clients, signing code, securing e-mail, and signing in with a Windows domain account. |
| [Windows Hello for Business](hello-for-business/hello-identity-verification.md) | In Windows 10, Windows Hello replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. |
-| [Windows Firewall with Advanced Security](windows-firewall/windows-firewall-with-advanced-security.md) | Provides information about Windows Firewall with Advanced Security, which is an important part of a layered security model. By providing host-based, two-way network traffic filtering for a device, Windows Firewall with Advanced Security blocks unauthorized network traffic flowing into or out of the local device. |
| [Windows 10 Credential Theft Mitigation Guide Abstract](windows-credential-theft-mitigation-guide-abstract.md) | Learn more about credential theft mitigation in Windows 10. |
diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md
index e5ef6bfcf2..36ee129b4c 100644
--- a/windows/security/identity-protection/remote-credential-guard.md
+++ b/windows/security/identity-protection/remote-credential-guard.md
@@ -14,7 +14,7 @@ ms.date: 01/12/2018
- Windows 10
- Windows Server 2016
-Introduced in Windows 10, version 1607, Windows Defender Remote Credential Guard helps you protect your credentials over a Remote Desktop connection by redirecting Kerberos requests back to the device that's requesting the connection. It also provides single sign-on experiences for Remote Desktop sessions.
+Introduced in Windows 10, version 1607, Windows Defender Remote Credential Guard helps you protect your credentials over a Remote Desktop connection by redirecting Kerberos requests back to the device that's requesting the connection. It also provides single sign-on experiences for Remote Desktop sessions.
Administrator credentials are highly privileged and must be protected. By using Windows Defender Remote Credential Guard to connect during Remote Desktop sessions, if the target device is compromised, your credentials are not exposed because both credential and credential derivatives are never passed over the network to the target device.
@@ -25,13 +25,13 @@ Administrator credentials are highly privileged and must be protected. By using
## Comparing Windows Defender Remote Credential Guard with other Remote Desktop connection options
-The following diagram helps you to understand how a standard Remote Desktop session to a server without Windows Defender Remote Credential Guard works:
+The following diagram helps you to understand how a standard Remote Desktop session to a server without Windows Defender Remote Credential Guard works:
-The following diagram helps you to understand how Windows Defender Remote Credential Guard works, what it helps to protect against, and compares it with the [Restricted Admin mode](http://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) option:
+The following diagram helps you to understand how Windows Defender Remote Credential Guard works, what it helps to protect against, and compares it with the [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) option:
@@ -55,31 +55,31 @@ Use the following table to compare different Remote Desktop connection security
|**Network identity**|Remote Desktop session **connects to other resources as signed-in user**. | Remote Desktop session **connects to other resources as signed-in user**. |Remote Desktop session **connects to other resources as remote host’s identity**.|
|**Multi-hop**|From the remote desktop, **you can connect through Remote Desktop to another computer** | From the remote desktop, you **can connect through Remote Desktop to another computer**.|Not allowed for user as the session is running as a local host account|
|**Supported authentication** |Any negotiable protocol.| Kerberos only.|Any negotiable protocol|
-
+
-For further technical information, see [Remote Desktop Protocol](https://msdn.microsoft.com/library/aa383015(v=vs.85).aspx)
+For further technical information, see [Remote Desktop Protocol](https://msdn.microsoft.com/library/aa383015(v=vs.85).aspx)
and [How Kerberos works](https://technet.microsoft.com/en-us/library/cc961963.aspx(d=robot))
-
+
## Remote Desktop connections and helpdesk support scenarios
-
+
For helpdesk support scenarios in which personnel require administrative access to provide remote assistance to computer users via Remote Desktop sessions, Microsoft recommends that Windows Defender Remote Credential Guard should not be used in that context. This is because if an RDP session is initiated to a compromised client that an attacker already controls, the attacker could use that open channel to create sessions on the user's behalf (without compromising credentials) to access any of the user’s resources for a limited time (a few hours) after the session disconnects.
-Therefore, we recommend instead that you use the Restricted Admin mode option. For helpdesk support scenarios, RDP connections should only be initiated using the /RestrictedAdmin switch. This helps ensure that credentials and other user resources are not exposed to compromised remote hosts. For more information, see [Mitigating Pass-the-Hash and Other Credential Theft v2](http://download.microsoft.com/download/7/7/A/77ABC5BD-8320-41AF-863C-6ECFB10CB4B9/Mitigating-Pass-the-Hash-Attacks-and-Other-Credential-Theft-Version-2.pdf).
+Therefore, we recommend instead that you use the Restricted Admin mode option. For helpdesk support scenarios, RDP connections should only be initiated using the /RestrictedAdmin switch. This helps ensure that credentials and other user resources are not exposed to compromised remote hosts. For more information, see [Mitigating Pass-the-Hash and Other Credential Theft v2](https://download.microsoft.com/download/7/7/A/77ABC5BD-8320-41AF-863C-6ECFB10CB4B9/Mitigating-Pass-the-Hash-Attacks-and-Other-Credential-Theft-Version-2.pdf).
To further harden security, we also recommend that you implement Local Administrator Password Solution (LAPS), a Group Policy client-side extension (CSE) introduced in Windows 8.1 that automates local administrator password management. LAPS mitigates the risk of lateral escalation and other cyberattacks facilitated when customers use the same administrative local account and password combination on all their computers. You can download and install LAPS [here](https://www.microsoft.com/en-us/download/details.aspx?id=46899).
-For further information on LAPS, see [Microsoft Security Advisory 3062591](https://technet.microsoft.com/en-us/library/security/3062591.aspx).
+For further information on LAPS, see [Microsoft Security Advisory 3062591](https://technet.microsoft.com/en-us/library/security/3062591.aspx).
## Remote Credential Guard requirements
-To use Windows Defender Remote Credential Guard, the Remote Desktop client and remote host must meet the following requirements:
+To use Windows Defender Remote Credential Guard, the Remote Desktop client and remote host must meet the following requirements:
The Remote Desktop client device:
@@ -111,7 +111,7 @@ You must enable Restricted Admin or Windows Defender Remote Credential Guard on
1. Open Registry Editor on the remote host.
2. Enable Restricted Admin and Windows Defender Remote Credential Guard:
- Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa.
- - Add a new DWORD value named **DisableRestrictedAdmin**.
+ - Add a new DWORD value named **DisableRestrictedAdmin**.
- To turn on Restricted Admin and Windows Defender Remote Credential Guard, set the value of this registry setting to 0 to turn on Windows Defender Remote Credential Guard.
3. Close Registry Editor.
@@ -134,14 +134,14 @@ Beginning with Windows 10 version 1703, you can enable Windows Defender Remote C
3. Under **Use the following restricted mode**:
- - If you want to require either [Restricted Admin mode](http://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) or Windows Defender Remote Credential Guard, choose **Prefer Windows Defender Remote Credential Guard**. In this configuration, Windows Defender Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Windows Defender Remote Credential Guard cannot be used.
+ - If you want to require either [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) or Windows Defender Remote Credential Guard, choose **Prefer Windows Defender Remote Credential Guard**. In this configuration, Windows Defender Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Windows Defender Remote Credential Guard cannot be used.
> **Note:** Neither Windows Defender Remote Credential Guard nor Restricted Admin mode will send credentials in clear text to the Remote Desktop server.
-
+
- If you want to require Windows Defender Remote Credential Guard, choose **Require Windows Defender Remote Credential Guard**. With this setting, a Remote Desktop connection will succeed only if the remote computer meets the [requirements](#reqs) listed earlier in this topic.
-
+
- If you want to require Restricted Admin mode, choose **Require Restricted Admin**. For information about Restricted Admin mode, see the table in [Comparing Windows Defender Remote Credential Guard with other Remote Desktop connection options](#comparing-remote-credential-guard-with-other-remote-desktop-connection-options), earlier in this topic.
-
+
4. Click **OK**.
5. Close the Group Policy Management Console.
@@ -149,7 +149,7 @@ Beginning with Windows 10 version 1703, you can enable Windows Defender Remote C
6. From a command prompt, run **gpupdate.exe /force** to ensure that the Group Policy object is applied.
-### Use Windows Defender Remote Credential Guard with a parameter to Remote Desktop Connection
+### Use Windows Defender Remote Credential Guard with a parameter to Remote Desktop Connection
If you don't use Group Policy in your organization, or if not all your remote hosts support Remote Credential Guard, you can add the remoteGuard parameter when you start Remote Desktop Connection to turn on Windows Defender Remote Credential Guard for that connection.
@@ -162,7 +162,7 @@ mstsc.exe /remoteGuard
- Windows Defender Remote Credential Guard does not support compound authentication. For example, if you’re trying to access a file server from a remote host that requires a device claim, access will be denied.
-- Windows Defender Remote Credential Guard can be used only when connecting to a device that is joined to a Windows Server Active Directory domain, including AD domain-joined servers that run as Azure virtual machines (VMs). Windows Defender Remote Credential Guard cannot be used when connecting to remote devices joined to Azure Active Directory.
+- Windows Defender Remote Credential Guard can be used only when connecting to a device that is joined to a Windows Server Active Directory domain, including AD domain-joined servers that run as Azure virtual machines (VMs). Windows Defender Remote Credential Guard cannot be used when connecting to remote devices joined to Azure Active Directory.
- Remote Desktop Credential Guard only works with the RDP protocol.
diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md
index 87d7ffeeff..cc4e495d4f 100644
--- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md
+++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md
@@ -49,7 +49,7 @@ To delete a container, type **certutil -delkey -csp "Microsoft Base Smart Card C
## Debugging and tracing using WPP
-Windows software trace preprocessor (WPP) simplifies tracing the operation of the trace provider, and it provides a mechanism for the trace provider to log real-time binary messages. Logged messages can subsequently be converted to a human-readable trace of the operation of the trace provider. For more information about WPP, see [Diagnostics with WPP - The NDIS blog](http://blogs.msdn.com/b/ndis/archive/2011/04/06/diagnostics-with-wpp.aspx).
+Windows software trace preprocessor (WPP) simplifies tracing the operation of the trace provider, and it provides a mechanism for the trace provider to log real-time binary messages. Logged messages can subsequently be converted to a human-readable trace of the operation of the trace provider. For more information about WPP, see [Diagnostics with WPP - The NDIS blog](https://blogs.msdn.com/b/ndis/archive/2011/04/06/diagnostics-with-wpp.aspx).
### Enable the trace
diff --git a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md
index c0e5e23158..0854da77c6 100644
--- a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md
+++ b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md
@@ -187,7 +187,7 @@ The registry keys are found in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Wind
| Registry key | Group Policy setting | Registry setting |
| - | - | - |
| FilterAdministratorToken | [User Account Control: Admin Approval Mode for the built-in Administrator account](#user-account-control-admin-approval-mode-for-the-built-in-administrator-account) | 0 (Default) = Disabled 1 = Enabled |
-| EnableUIADesktopToggle | [User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop](#user-account-control-allow-uiaccess-applications-to prompt-for-elevation-without-using-the-secure-desktop) | 0 (Default) = Disabled 1 = Enabled |
+| EnableUIADesktopToggle | [User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop](#user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop) | 0 (Default) = Disabled 1 = Enabled |
| ConsentPromptBehaviorAdmin | [User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode](#user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode) | 0 = Elevate without prompting 1 = Prompt for credentials on the secure desktop 2 = Prompt for consent on the secure desktop 3 = Prompt for credentials 4 = Prompt for consent 5 (Default) = Prompt for consent for non-Windows binaries |
| ConsentPromptBehaviorUser | [User Account Control: Behavior of the elevation prompt for standard users](#user-account-control-behavior-of-the-elevation-prompt-for-standard-users) | 0 = Automatically deny elevation requests 1 = Prompt for credentials on the secure desktop 3 (Default) = Prompt for credentials |
| EnableInstallerDetection | [User Account Control: Detect application installations and prompt for elevation](#user-account-control-detect-application-installations-and-prompt-for-elevation) | 1 = Enabled (default for home) 0 = Disabled (default for enterprise) |
diff --git a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md
index a5a77954c9..9ad00797a5 100644
--- a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md
+++ b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md
@@ -15,7 +15,7 @@ ms.date: 04/19/2017
**Applies to**
- Windows 10
-This topic provides a summary of the Windows 10 credential theft mitigation guide, which can be downloaded from the [Microsoft Download Center](http://download.microsoft.com/download/C/1/4/C14579CA-E564-4743-8B51-61C0882662AC/Windows 10 credential theft mitigation guide.docx).
+This topic provides a summary of the Windows 10 credential theft mitigation guide, which can be downloaded from the [Microsoft Download Center](https://download.microsoft.com/download/C/1/4/C14579CA-E564-4743-8B51-61C0882662AC/Windows%2010%20credential%20theft%20mitigation%20guide.docx).
This guide explains how credential theft attacks occur and the strategies and countermeasures you can implement to mitigate them, following these security stages:
- Identify high-value assets
@@ -28,7 +28,7 @@ This guide explains how credential theft attacks occur and the strategies and co
## Attacks that steal credentials
-Learn about the different types of attacks that are used to steal credentials, and the factors that can place your organization at risk.
+Learn about the different types of attacks that are used to steal credentials, and the factors that can place your organization at risk.
The types of attacks that are covered include:
- Pass the hash
@@ -39,7 +39,7 @@ The types of attacks that are covered include:
## Credential protection strategies
-This part of the guide helps you consider the mindset of the attacker, with prescriptive guidance about how to prioritize high-value accounts and computers.
+This part of the guide helps you consider the mindset of the attacker, with prescriptive guidance about how to prioritize high-value accounts and computers.
You'll learn how to architect a defense against credential theft:
- Establish a containment model for account privileges
@@ -63,6 +63,6 @@ This sections covers how to detect the use of stolen credentials and how to coll
## Responding to suspicious activity
-Learn Microsoft's recommendations for responding to incidents, including how to recover control of compromised accounts, how to investigate attacks, and how to recover from a breach.
+Learn Microsoft's recommendations for responding to incidents, including how to recover control of compromised accounts, how to investigate attacks, and how to recover from a breach.
diff --git a/windows/security/index.yml b/windows/security/index.yml
index 019ee50e72..ca0486b130 100644
--- a/windows/security/index.yml
+++ b/windows/security/index.yml
@@ -22,7 +22,7 @@ metadata:
manager: brianlic
- ms.date: 07/12/2018
+ ms.date: 08/01/2018
ms.topic: article
@@ -78,17 +78,3 @@ sections:
title: Information protection
-- title: Windows Defender Advanced Threat Protection
- items:
- - type: markdown
- text: "
- Prevent, detect, investigate, and respond to advanced threats. The following capabilities are available across multiple products that make up the Windows Defender ATP platform.
-
-
Attack surface reduction
Next generation protection
Endpoint detection and response
Auto investigation and remediation
Security posture
-
[Hardware based isolation](https://docs.microsoft.com/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows)
[Realtime and historical threat hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)
[API and SIEM integration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection)
[Advanced detonation and analysis service](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection#deep-analysis)
-
[Automated investigation and remediation](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection)
[Operating system baseline compliance](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)
[Reporting and trends](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection)
-
-
"
\ No newline at end of file
diff --git a/windows/security/information-protection/TOC.md b/windows/security/information-protection/TOC.md
index b9c98da745..4afb579db3 100644
--- a/windows/security/information-protection/TOC.md
+++ b/windows/security/information-protection/TOC.md
@@ -22,14 +22,13 @@
### [BitLocker Group Policy settings](bitlocker\bitlocker-group-policy-settings.md)
### [BCD settings and BitLocker](bitlocker\bcd-settings-and-bitlocker.md)
### [BitLocker Recovery Guide](bitlocker\bitlocker-recovery-guide-plan.md)
-### [Protect BitLocker from pre-boot attacks](bitlocker\protect-bitlocker-from-pre-boot-attacks.md)
-#### [Types of attacks for volume encryption keys](bitlocker\types-of-attacks-for-volume-encryption-keys.md)
-#### [BitLocker Countermeasures](bitlocker\bitlocker-countermeasures.md)
-#### [Choose the Right BitLocker Countermeasure](bitlocker\choose-the-right-bitlocker-countermeasure.md)
+### [BitLocker Countermeasures](bitlocker\bitlocker-countermeasures.md)
### [Protecting cluster shared volumes and storage area networks with BitLocker](bitlocker\protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md)
## [Encrypted Hard Drive](encrypted-hard-drive.md)
+## [Kernel DMA Protection for Thunderbolt™ 3](kernel-dma-protection-for-thunderbolt.md)
+
## [Protect your enterprise data using Windows Information Protection (WIP)](windows-information-protection\protect-enterprise-data-using-wip.md)
### [Create a Windows Information Protection (WIP) policy using Microsoft Intune](windows-information-protection\overview-create-wip-policy.md)
#### [Create a Windows Information Protection (WIP) policy using the classic console for Microsoft Intune](windows-information-protection\create-wip-policy-using-intune.md)
diff --git a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md
index 529ff6e574..cf809e8fc8 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md
@@ -23,7 +23,7 @@ BitLocker provides full volume encryption (FVE) for operating system volumes, as
In the event that the drive was prepared as a single contiguous space, BitLocker requires a new volume to hold the boot files. BdeHdCfg.exe can create these volumes.
-> **Note:** For more info about using this tool, see [Bdehdcfg](http://technet.microsoft.com/library/ee732026.aspx) in the Command-Line Reference.
+> **Note:** For more info about using this tool, see [Bdehdcfg](https://technet.microsoft.com/library/ee732026.aspx) in the Command-Line Reference.
BitLocker encryption can be done using the following methods:
@@ -122,7 +122,7 @@ Encryption status displays in the notification area or within the BitLocker cont
There is a new option for storing the BitLocker recovery key using the OneDrive. This option requires that computers are not members of a domain and that the user is using a Microsoft Account. Local accounts do not give the option to utilize OneDrive. Using the OneDrive option is the default, recommended recovery key storage method for computers that are not joined to a domain.
-Users can verify the recovery key was saved properly by checking their OneDrive for the BitLocker folder which is created automatically during the save process. The folder will contain two files, a readme.txt and the recovery key. For users storing more than one recovery password on their OneDrive,
+Users can verify the recovery key was saved properly by checking their OneDrive for the BitLocker folder which is created automatically during the save process. The folder will contain two files, a readme.txt and the recovery key. For users storing more than one recovery password on their OneDrive,
they can identify the required recovery key by looking at the file name. The recovery key ID is appended to the end of the file name.
### Using BitLocker within Windows Explorer
@@ -179,7 +179,7 @@ Table 1: Cross compatibility for Windows 10, Windows 8.1, Windows 8, and Window
## Encrypting volumes using the manage-bde command line interface
-Manage-bde is a command-line utility that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the options, see [Manage-bde](http://technet.microsoft.com/library/ff829849.aspx).
+Manage-bde is a command-line utility that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the options, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx).
Manage-bde offers a multitude of wider options for configuring BitLocker. This means that using the command syntax may require care and possibly later customization by the user. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected.
Command line users need to determine the appropriate syntax for a given situation. The following section covers general encryption for operating system volumes and data volumes.
diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md
index e692472aa5..91d9c277db 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md
@@ -7,137 +7,185 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
-ms.date: 10/27/2017
+ms.date: 09/06/2018
---
+
# BitLocker Countermeasures
**Applies to**
- Windows 10
-Windows uses technologies including TPM, Secure Boot, Trusted Boot, and Early Launch Antimalware (ELAM) to protect against attacks on the BitLocker encryption key.
-BitLocker is part of a strategic approach to securing mobile data through encryption technology. Data on a lost or stolen computer is vulnerable to unauthorized access, either by running a software attack tool against it or by transferring the computer’s hard disk to a different computer. Today, BitLocker helps mitigate unauthorized data access on lost or stolen computers before the operating system is started by:
+Windows uses technologies including Trusted Platform Module (TPM), Secure Boot, and Measured Boot to help protect BitLocker encryption keys against attacks.
+BitLocker is part of a strategic approach to securing data against offline attacks through encryption technology.
+Data on a lost or stolen computer is vulnerable.
+For example, there could be unauthorized access, either by running a software attack tool against it or by transferring the computer’s hard disk to a different computer.
-- **Encrypting the hard drives on your computer.** For example, you can turn on BitLocker for your operating system drive, a fixed data drive, or a removable data drive (such as a USB flash drive). Turning on BitLocker for your operating system drive encrypts all system files on the operating system drive, including the swap files and hibernation files.
-- **Ensuring the integrity of early boot components and boot configuration data.** On devices that have a TPM version 1.2 or higher, BitLocker uses the enhanced security capabilities of the TPM to help ensure that your data is accessible only if the computer’s boot components appear unaltered and the encrypted disk is located in the original computer.
+BitLocker helps mitigate unauthorized data access on lost or stolen computers before the authorized operating system is started by:
-The sections that follow provide more detailed information about the different technologies that Windows uses to protect against attacks on the BitLocker encryption key in four different boot phases: before startup, during pre-boot, during startup, and finally after startup.
+- **Encrypting volumes on your computer.** For example, you can turn on BitLocker for your operating system volume, or a volume on a fixed or removable data drive (such as a USB flash drive, SD card, and so on). Turning on BitLocker for your operating system volume encrypts all system files on the volume, including the paging files and hibernation files. The only exception is for the System partition, which includes the Windows Boot Manager and minimal boot collateral required for decryption of the operating system volume after the key is unsealed.
+- **Ensuring the integrity of early boot components and boot configuration data.** On devices that have a TPM version 1.2 or higher, BitLocker uses the enhanced security capabilities of the TPM to make data accessible only if the computer’s BIOS firmware code and configuration, original boot sequence, boot components, and BCD configuration all appear unaltered and the encrypted disk is located in the original computer. On systems that leverage TPM PCR[7], BCD setting changes deemed safe are permitted to improve usability.
+
+The next sections provide more details about how Windows protects against various attacks on the BitLocker encryption keys in Windows 10, Windows 8.1, and Windows 8.
-### Protection before startup
+For more information about how to enable the best overall security configuration for devices beginning with Windows 10 version 1803, see [Standards for a highly secure Windows 10 device](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-highly-secure).
-Before Windows starts, you must rely on security features implemented as part of the device hardware, including TPM and Secure Boot. Fortunately, many modern computers feature TPM.
+## Protection before startup
-#### Trusted Platform Module
+Before Windows starts, you must rely on security features implemented as part of the device hardware and firmware, including TPM and Secure Boot. Fortunately, many modern computers feature a TPM and Secure Boot.
-Software alone isn’t sufficient to protect a system. After an attacker has compromised software, the software might be unable to detect the compromise. Therefore, a single successful software compromise results in an untrusted system that might never be detected. Hardware, however, is much more difficult to modify.
+### Trusted Platform Module
-A TPM is a microchip designed to provide basic security-related functions, primarily involving encryption keys. The TPM is usually installed on the motherboard of a computer and communicates with the rest of the system through a hardware bus. Physically, TPMs are designed to be tamper-proof. If an attacker tries to physically retrieve data directly from the chip, they’ll probably destroy the chip in the process.
-By binding the BitLocker encryption key with the TPM and properly configuring the device, it’s nearly impossible for an attacker to gain access to the BitLocker-encrypted data without obtaining an authorized user’s credentials. Therefore, computers with a TPM can provide a high level of protection against attacks that attempt to directly retrieve the BitLocker encryption key.
-For more info about TPM, see [Trusted Platform Module](/windows/device-security/tpm/trusted-platform-module-overview).
+A TPM is a microchip designed to provide basic security-related functions, primarily involving encryption keys.
+On some platforms, TPM can alternatively be implemented as a part of secure firmware.
+BitLocker binds encryption keys with the TPM to ensure that a computer has not been tampered with while the system was offline.
+For more info about TPM, see [Trusted Platform Module](https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-overview).
-#### UEFI and Secure Boot
+### UEFI and Secure Boot
-No operating system can protect a device when the operating system is offline. For that reason, Microsoft worked closely with hardware vendors to require firmware-level protection against boot and rootkits that might compromise an encryption solution’s encryption keys.
+Unified Extensible Firmware Interface (UEFI) is a programmable boot environment that initializes devices and starts the operating system’s bootloader.
-The UEFI is a programmable boot environment introduced as a replacement for BIOS, which has for the most part remained unchanged for the past 30 years. Like BIOS, PCs start UEFI before any other software; it initializes devices, and UEFI then starts the operating system’s bootloader. As part of its introduction into the pre–operating system environment, UEFI serves a number of purposes, but one of the key benefits is to protect newer devices against a sophisticated type of malware called a bootkit through the use of its Secure Boot feature.
+The UEFI specification defines a firmware execution authentication process called [Secure Boot](https://docs.microsoft.com/windows/security/information-protection/secure-the-windows-10-boot-process).
+Secure Boot blocks untrusted firmware and bootloaders (signed or unsigned) from being able to start on the system.
-Recent implementations of UEFI (starting with version 2.3.1) can verify the digital signatures of the device’s firmware before running it. Because only the PC’s hardware manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI can prevent firmware-based bootkits. Thus, UEFI is the first link in the chain of trust.
+By default, BitLocker provides integrity protection for Secure Boot by utilizing the TPM PCR[7] measurement.
+An unauthorized EFI firmware, EFI boot application, or bootloader cannot run and acquire the BitLocker key.
-Secure Boot is the foundation of platform and firmware security and was created to enhance security in the pre-boot environment regardless of device architecture. Using signatures to validate the integrity of firmware images before they are allowed to execute, Secure Boot helps reduce the risk of bootloader attacks. The purpose of Secure Boot is to block untrusted firmware and bootloaders (signed or unsigned) from being able to start on the system.
-With the legacy BIOS boot process, the pre–operating system environment is vulnerable to attacks by redirecting bootloader handoff to possible malicious loaders. These loaders could remain undetected to operating system and antimalware software. The diagram in Figure 1 contrasts the BIOS and UEFI startup processes.
+### BitLocker and reset attacks
-
+To defend against malicious reset attacks, BitLocker leverages the TCG Reset Attack Mitigation, also known as MOR bit (Memory Overwrite Request), before extracting keys into memory.
-**Figure 1.** The BIOS and UEFI startup processes
+>[!NOTE]
+>This does not protect against physical attacks where an attacker opens the case and attacks the hardware.
-With Secure Boot enabled, UEFI, in coordination with the TPM, can examine the bootloader and determine whether it’s trustworthy. To determine whether the bootloader is trustworthy, UEFI examines the bootloader’s digital signature.
-Using the digital signature, UEFI verifies that the bootloader was signed using a trusted certificate.
+## Security policies
-If the bootloader passes these two tests, UEFI knows that the bootloader isn’t a bootkit and starts it. At this point, Trusted Boot takes over, and the Windows bootloader, using the same cryptographic technologies that UEFI used to verify the bootloader, then verifies that the Windows system files haven’t been changed.
+The next sections cover pre-boot authentication and DMA policies that can provide additional protection for BitLocker.
-Starting with Windows 8, certified devices must meet several requirements related to UEFI-based Secure Boot:
+### Pre-boot authentication
-- They must have Secure Boot enabled by default.
-- They must trust Microsoft’s certificate (and thus any bootloader Microsoft has signed).
-- They must allow the user to configure Secure Boot to trust other signed bootloaders.
-- Except for Windows RT devices, they must allow the user to completely disable Secure Boot.
+Pre-boot authentication with BitLocker is a policy setting that requires the use of either user input, such as a PIN, a startup key, or both to authenticate prior to making the contents of the system drive accessible.
+The Group Policy setting is [Require additional authentication at startup](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#a-href-idbkmk-unlockpol1arequire-additional-authentication-at-startup) and the corresponding setting in the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) is SystemDrivesRequireStartupAuthentication.
-These requirements help protect you from rootkits while allowing you to run any operating system you want. You have three options for running non-Microsoft operating systems:
+BitLocker accesses and stores the encryption keys in memory only after pre-boot authentication is completed.
+If Windows can’t access the encryption keys, the device can’t read or edit the files on the system drive. The only option for bypassing pre-boot authentication is entering the recovery key.
-- **Use an operating system with a certified bootloader.** Microsoft can analyze and sign non-Microsoft bootloaders so that they can be trusted. The Linux community is using this process to enable Linux to take advantage of
-Secure Boot on Windows-certified devices.
-
-- **Configure UEFI to trust your custom bootloader.** Your device can trust a signed, non-certified bootloader that you specify in the UEFI database, allowing you to run any operating system, including homemade operating systems.
-- **Turn off Secure Boot.** You can turn off Secure Boot. This does not help protect you from bootkits, however.
-
-To prevent malware from abusing these options, the user has to manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software cannot change the Secure Boot settings.
-Any device that doesn’t require Secure Boot or a similar bootloader-verification technology, regardless of the architecture or operating system, is vulnerable to bootkits, which can be used to compromise the encryption solution.
-UEFI is secure by design, but it’s critical to protect the Secure Boot configuration by using password protection. In addition, although several well-publicized attacks against UEFI have occurred, they were exploiting faulty UEFI implementations. Those attacks are ineffective when UEFI is implemented properly.
-
-For more information about Secure Boot, refer to [Securing the Windows 8.1 Boot Process](http://technet.microsoft.com/windows/dn168167.aspx).
-
-### Protection during pre-boot: Pre-boot authentication
-
-Pre-boot authentication with BitLocker is a process that requires the use of either a Trusted Platform Module (TPM), user input, such as a PIN, or both, depending on hardware and operating system configuration, to authenticate prior to making the contents of the system drive accessible. In the case of BitLocker, BitLocker encrypts the entire drive, including all system files. BitLocker accesses and stores the encryption key in memory only after a pre-boot authentication is completed using one or more of the following options: Trusted Platform Module (TPM), user provides a specific PIN, USB startup key.
-
-If Windows can’t access the encryption key, the device can’t read or edit the files on the system drive. Even if an attacker takes the disk out of the PC or steals the entire PC, they won’t be able to read or edit the files without the encryption key. The only option for bypassing pre-boot authentication is entering the highly complex, 48-digit recovery key.
-
-The BitLocker pre-boot authentication capability is not specifically designed to prevent the operating system from starting: That’s merely a side effect of how BitLocker protects data confidentiality and system integrity. Pre-boot authentication is designed to prevent the encryption key from being loaded to system memory on devices that are vulnerable to certain types of cold boot attacks. Many modern devices prevent an attacker from easily removing the memory, and Microsoft expects those devices to become even more common in the future.
+Pre-boot authentication is designed to prevent the encryption keys from being loaded to system memory without the trusted user supplying another authentication factor such as a PIN or startup key.
+This helps mitigate DMA and memory remanence attacks.
On computers with a compatible TPM, operating system drives that are BitLocker-protected can be unlocked in four ways:
-- **TPM-only.** Using TPM-only validation does not require any interaction with the user to decrypt and provide access to the drive. If the TPM validation succeeds, the user logon experience is the same as a standard logon. If the TPM is missing or changed or if the TPM detects changes to critical operating system startup files, BitLocker enters its recovery mode, and the user must enter a recovery password to regain access to the data.
-- **TPM with startup key.** In addition to the protection that the TPM provides, part of the encryption key is stored on a USB flash drive, referred to as a startup key. Data on the encrypted volume cannot be accessed without the startup key.
-- **TPM with PIN.** In addition to the protection that the TPM provides, BitLocker requires that the user enter a PIN. Data on the encrypted volume cannot be accessed without entering the PIN.
-- **TPM with startup key and PIN.** In addition to the core component protection that the TPM provides, part of the encryption key is stored on a USB flash drive, and a PIN is required to authenticate the user to the TPM. This configuration provides multifactor authentication so that if the USB key is lost or stolen, it cannot be used for access to the drive, because the correct PIN is also required.
+- **TPM-only.** Using TPM-only validation does not require any interaction with the user to unlock and provide access to the drive. If the TPM validation succeeds, the user sign in experience is the same as a standard logon. If the TPM is missing or changed or if BitLocker detects changes to the BIOS or UEFI code or configuration, critical operating system startup files, or the boot configuration, BitLocker enters recovery mode, and the user must enter a recovery password to regain access to the data. This option is more convenient for sign-in but less secure than the other options, which require an additional authentication factor.
+- **TPM with startup key.** In addition to the protection that the TPM-only provides, part of the encryption key is stored on a USB flash drive, referred to as a startup key. Data on the encrypted volume cannot be accessed without the startup key.
+- **TPM with PIN.** In addition to the protection that the TPM provides, BitLocker requires that the user enter a PIN. Data on the encrypted volume cannot be accessed without entering the PIN. TPMs also have [anti-hammering protection](https://docs.microsoft.com/windows/security/hardware-protection/tpm/tpm-fundamentals#anti-hammering) that is designed to prevent brute force attacks that attempt to determine the PIN.
+- **TPM with startup key and PIN.** In addition to the core component protection that the TPM-only provides, part of the encryption key is stored on a USB flash drive, and a PIN is required to authenticate the user to the TPM. This configuration provides multifactor authentication so that if the USB key is lost or stolen, it cannot be used for access to the drive, because the correct PIN is also required.
-For many years, Microsoft has recommended using pre-boot authentication to protect against DMA and memory remanence attacks. Today, Microsoft only recommends using pre-boot authentication on PCs where the mitigations described in this document cannot be implemented. These mitigations may be inherent to the device or may come by way of configurations that IT can provision to devices and Windows itself.
+In the following Group Policy example, TPM + PIN is required to unlock an operating system drive:
-Although effective, pre-boot authentication is inconvenient to users. In addition, if a user forgets their PIN or loses their startup key, they’re denied access to their data until they can contact their organization’s support team to obtain a recovery key. Today, most new PCs running Windows 10, Windows 8.1, or Windows 8 provide sufficient protection against DMA attacks without requiring pre-boot authentication. For example, most modern PCs include USB port options (which are not vulnerable to DMA attacks) but do not include FireWire or Thunderbolt ports (which are vulnerable to DMA attacks).
+
-BitLocker-encrypted devices with DMA ports enabled, including FireWire or Thunderbolt ports, should be configured with pre-boot authentication if they are running Windows 10, Windows 7, Windows 8, or Windows 8.1 and disabling the ports using policy or firmware configuration is not an option. Many customers find that the DMA ports on their devices are never used, and they choose to eliminate the possibility of an attack by disabling the DMA ports themselves, either at the hardware level or through Group Policy.
-Many new mobile devices have the system memory soldered to the motherboard, which helps prevent the cold boot–style attack, where the system memory is frozen, removed, and then placed into another device. Those devices, and most PCs, can still be vulnerable when booting to a malicious operating system, however.
+Pre-boot authentication with a PIN can mitigate an attack vector for devices that use a bootable eDrive because an exposed eDrive bus can allow an attacker to capture the BitLocker encryption key during startup.
+Pre-boot authentication with a PIN can also mitigate DMA port attacks during the window of time between when BitLocker unlocks the drive and Windows boots to the point that Windows can set any port-related policies that have been configured.
-You can mitigate the risk of booting to a malicious operating system:
+On the other hand, Pre-boot authentication prompts can be inconvenient to users.
+In addition, users who forget their PIN or lose their startup key are denied access to their data until they can contact their organization’s support team to obtain a recovery key.
+Pre-boot authentication can also make it more difficult to update unattended desktops and remotely administered servers because a PIN needs to be entered when a computer reboots or resumes from hibernation.
-- **Windows 10 (without Secure Boot), Windows 8.1 (without Secure Boot), Windows 8 (without UEFI-based Secure Boot), or Windows 7 (with or without a TPM).** Disable booting from external media, and require a firmware password to prevent the attacker from changing that option.
-- **Windows 10, Windows 8.1, or Windows 8 (certified or with Secure Boot).** Password protect the firmware, and do not disable Secure Boot.
+To address these issues, you can deploy [BitLocker Network Unlock](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock).
+Network Unlock allows systems within the physical enterprise security perimeter that meet the hardware requirements and have BitLocker enabled with TPM+PIN to boot into Windows without user intervention.
+It requires direct ethernet connectivity to an enterprise Windows Deployment Services (WDS) server.
-### Protection During Startup
+### Protecting Thunderbolt and other DMA ports
-During the startup process, Windows 10 uses Trusted Boot and Early Launch Antimalware (ELAM) to examine the integrity of every component. The sections that follow describe these technologies in more detail.
+There are a few different options to protect DMA ports, such as Thunderbolt™3.
+Beginning with Windows 10 version 1803, new Intel-based devices have kernel protection against DMA attacks via Thunderbolt™ 3 ports enabled by default.
+This kernel DMA protection is available only for new systems beginning with Windows 10 version 1803, as it requires changes in the system firmware and/or BIOS.
-**Trusted Boot**
+You can use the System Information desktop app (MSINFO32) to check if a device has kernel DMA protection enabled:
-Trusted Boot takes over where UEFI-based Secure Boot leaves off—during the operating system initialization phase. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and ELAM driver. If a file has been modified or is not properly signed with a Microsoft signature, Windows detects the problem and refuses to load the corrupted component. Often, Windows can automatically repair the corrupted component, restoring the integrity of Windows and allowing the PC to start normally.
+
-Windows 10 uses Trusted Boot on any hardware platform: It requires neither UEFI nor a TPM. However, without Secure Boot, it’s possible for malware to compromise the startup process prior to Windows starting, at which point Trusted Boot protections could be bypassed or potentially disabled.
+If kernel DMA protection *not* enabled, follow these steps to protect Thunderbolt™ 3 enabled ports:
-**Early Launch Antimalware**
+1. Require a password for BIOS changes
+2. Intel Thunderbolt Security must be set to User Authorization in BIOS settings
+3. Additional DMA security may be added by deploying policy (beginning with Windows 10 version 1607):
-Because UEFI-based Secure Boot has protected the bootloader and Trusted Boot has protected the Windows kernel or other Windows startup components, the next opportunity for malware to start is by infecting a non-Microsoft boot-related driver. Traditional antimalware apps don’t start until after the boot-related drivers have been loaded, giving a rootkit disguised as a driver the opportunity to work.
+ - MDM: [DataProtection/AllowDirectMemoryAccess](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-dataprotection#dataprotection-allowdirectmemoryaccess) policy
+ - Group Policy: [Disable new DMA devices when this computer is locked](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#disable-new-dma-devices-when-this-computer-is-locked) (This setting is not configured by default.)
-Early Launch Antimalware (ELAM) is designed to enable the antimalware solution to start before all non-Microsoft drivers and apps. ELAM checks the integrity of non-Microsoft drivers to determine whether the drivers are trustworthy. Because Windows needs to start as fast as possible, ELAM cannot be a complicated process of checking the driver files against known malware signatures. Instead, ELAM has the simple task of examining every boot driver and determining whether it is on the list of trusted drivers. If malware modifies a boot-related driver, ELAM will detect the change, and Windows will prevent the driver from starting, thus blocking driver-based rootkits. ELAM also allows the registered antimalware provider to scan drivers that are loaded after the boot process is complete.
+For Thunderbolt v1 and v2 (DisplayPort Connector), refer to the “Thunderbolt Mitigation” section in [KB 2516445](https://support.microsoft.com/help/2516445/blocking-the-sbp-2-driver-and-thunderbolt-controllers-to-reduce-1394-d).
+For SBP-2 and 1394 (a.k.a. Firewire), refer to the “SBP-2 Mitigation” section in [KB 2516445](https://support.microsoft.com/help/2516445/blocking-the-sbp-2-driver-and-thunderbolt-controllers-to-reduce-1394-d).
+
+## Attack countermeasures
-Windows Defender in Windows 10 supports ELAM, as do Microsoft System Center 2012 Endpoint Protection and non-Microsoft antimalware apps.
+This section covers countermeasures for specific types attacks.
-To do this, ELAM loads an antimalware driver before drivers that are flagged as boot-start can be executed. This approach provides the ability for an antimalware driver to register as a trusted boot-critical driver. It is launched during the Trusted Boot process, and with that, Windows ensures that it is loaded before any other non-Microsoft software.
+### Bootkits and rootkits
-With this solution in place, boot drivers are initialized based on the classification that the ELAM driver returns according to an initialization policy. IT pros have the ability to change this policy through Group Policy.
-ELAM classifies drivers as follows:
+A physically-present attacker might attempt to install a bootkit or rootkit-like piece of software into the boot chain in an attempt to steal the BitLocker keys.
+The TPM should observe this installation via PCR measurements, and the BitLocker key will not be released.
+This is the default configuration.
-- **Good.** The driver has been signed and has not been tampered with.
-- **Bad.** The driver has been identified as malware. It is recommended that you not allow known bad drivers to be initialized.
-- **Bad but required for boot.** The driver has been identified as malware, but the computer cannot successfully boot without loading this driver.
-- **Unknown.** This driver has not been attested to by your malware-detection application or classified by the ELAM boot-start driver.
+A BIOS password is recommended for defense-in-depth in case a BIOS exposes settings that may weaken the BitLocker security promise.
+Intel Boot Guard and AMD Hardware Verified Boot support stronger implementations of Secure Boot that provide additional resilience against malware and physical attacks.
+Intel Boot Guard and AMD Hardware Verified Boot are part of platform boot verification [standards for a highly secure Windows 10 device](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-highly-secure).
-While the features listed above protect the Windows boot process from malware threats that could compromise BitLocker security, it is important to note that DMA ports may be enabled during the window of time between when BitLocker unlocks the drive and Windows boots to the point that Windows can set any port related policies that have been configured. This period of time where the encryption key could be exposed to a DMA attack could be less than a minute on recent devices or longer depending on system performance. The use of pre-boot authentication with a PIN can be used to successfully mitigate against an attack.
+### Brute force attacks against a PIN
+Require TPM + PIN for anti-hammering protection.
-### Protection After Startup: eliminate DMA availability
+### DMA attacks
-Windows Modern Standby–certified devices do not have DMA ports, eliminating the risk of DMA attacks. On other devices, you can disable FireWire, Thunderbolt, or other ports that support DMA.
+See [Protecting Thunderbolt and other DMA ports](#protecting-thunderbolt-and-other-dma-ports) earlier in this topic.
-## See also
-- [Types of Attacks for Volume Encryption Keys](types-of-attacks-for-volume-encryption-keys.md)
-- [Choose the right BitLocker countermeasure](choose-the-right-bitlocker-countermeasure.md)
-- [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md)
-- [BitLocker overview](bitlocker-overview.md)
+### Paging file, crash dump, and Hyberfil.sys attacks
+These files are secured on an encrypted volume by default when BitLocker is enabled on OS drives.
+It also blocks automatic or manual attempts to move the paging file.
+
+### Memory remanence
+
+Enable Secure Boot and require a password to change BIOS settings.
+For customers requiring protection against these advanced attacks, configure a TPM+PIN protector, disable Standby power management, and shut down or hibernate the device before it leaves the control of an authorized user.
+
+## Attacker countermeasures
+
+The following sections cover mitigations for different types of attackers.
+
+### Attacker without much skill or with limited physical access
+
+Physical access may be limited by a form factor that does not expose buses and memory.
+For example, there are no external DMA-capable ports, no exposed screws to open the chassis, and memory is soldered to the mainboard.
+This attacker of opportunity does not use destructive methods or sophisticated forensics hardware/software.
+
+Mitigation:
+- Pre-boot authentication set to TPM only (the default)
+
+### Attacker with skill and lengthy physical access
+
+Targeted attack with plenty of time; this attacker will open the case, will solder, and will use sophisticated hardware or software.
+
+Mitigation:
+- Pre-boot authentication set to TPM with a PIN protector (with a sophisticated alphanumeric PIN to help the TPM anti-hammering mitigation).
+
+ -And-
+
+- Disable Standby power management and shut down or hibernate the device before it leaves the control of an authorized user. This can be set using Group Policy:
+
+ - Computer Configuration|Policies|Administrative Templates|Windows Components|File Explorer|Show hibernate in the power options menu
+ - Computer Configuration|Policies|Administrative Templates|System|Power Management|Sleep Settings|Allow standby states (S1-S3) when sleeping (plugged in)
+ - Computer Configuration|Policies|Administrative Templates|System|Power Management|Sleep Settings|Allow standby states (S1-S3) when sleeping (on battery)
+
+These settings are **Not configured** by default.
+
+For some systems, bypassing TPM-only may require opening the case, and may require soldering, but could possibly be done for a reasonable cost. Bypassing a TPM with a PIN protector would cost much more, and require brute forcing the PIN. With a sophisticated enhanced PIN, it could be nearly impossible. The Group Policy setting for [enhanced PIN](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#a-href-idbkmk-unlockpol2aallow-enhanced-pins-for-startup) is:
+
+Computer Configuration|Administrative Templates|Windows Components|BitLocker Drive Encryption|Operating System Drives|Allow enhanced PINs for startup
+
+This setting is **Not configured** by default.
+
+For secure administrative workstations, Microsoft recommends TPM with PIN protector and disable Standby power management and shut down or hibernate the device.
+
+## See also
+
+- [Blocking the SBP-2 driver and Thunderbolt controllers to reduce 1394 DMA and Thunderbolt DMA threats to BitLocker](https://support.microsoft.com/help/2516445/blocking-the-sbp-2-driver-and-thunderbolt-controllers-to-reduce-1394-d)
+- [BitLocker Group Policy settings](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings)
+- [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp)
\ No newline at end of file
diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md
index ad44659819..64800a4fe1 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md
@@ -24,8 +24,8 @@ To control what drive encryption tasks the user can perform from the Windows Con
BitLocker Group Policy settings can be accessed using the Local Group Policy Editor and the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**.
Most of the BitLocker Group Policy settings are applied when BitLocker is initially turned on for a drive. If a computer is not compliant with existing Group Policy settings, BitLocker may not be turned on or modified until the computer is in a compliant state. When a drive is out of compliance with Group Policy settings (for example, if a Group Policy setting was changed after the initial BitLocker deployment in your organization, and then the setting was applied to previously encrypted drives), no change can be made to the BitLocker configuration of that drive except a change that will bring it into compliance.
-If multiple changes are necessary to bring the drive into compliance, you must suspend BitLocker protection, make the necessary changes, and then resume protection. This situation could occur, for example, if a removable drive was initially configured to be unlocked with a password and then Group
-Policy settings are changed to disallow passwords and require smart cards. In this situation, you need to suspend BitLocker protection by using the [Manage-bde](http://technet.microsoft.com/library/ff829849.aspx) command-line tool, delete the password unlock method, and add the smart card method. After this is complete, BitLocker is compliant with the Group Policy setting and BitLocker protection on the drive can be resumed.
+If multiple changes are necessary to bring the drive into compliance, you must suspend BitLocker protection, make the necessary changes, and then resume protection. This situation could occur, for example, if a removable drive was initially configured to be unlocked with a password and then Group
+Policy settings are changed to disallow passwords and require smart cards. In this situation, you need to suspend BitLocker protection by using the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line tool, delete the password unlock method, and add the smart card method. After this is complete, BitLocker is compliant with the Group Policy setting and BitLocker protection on the drive can be resumed.
## BitLocker Group Policy settings
@@ -91,7 +91,7 @@ The following policies are used to support customized deployment scenarios in yo
### Allow devices with Secure Boot and protected DMA ports to opt out of preboot PIN
This policy setting allows users on devices that are compliant with Modern Standby or the Microsoft Hardware Security Test Interface (HSTI) to not have a PIN for preboot authentication.
-
+
@@ -116,7 +116,7 @@ This policy setting allows users on devices that are compliant with Modern Stand
Conflicts
-
This setting overrides the Require startup PIN with TPM option of the [Require additional authentication at startup](#bkmk-unlockpol1) policy on compliant hardware.
+
This setting overrides the Require startup PIN with TPM option of the [Require additional authentication at startup](#bkmk-unlockpol1) policy on compliant hardware.
@@ -133,15 +133,15 @@ This policy setting allows users on devices that are compliant with Modern Stand
**Reference**
-The preboot authentication option Require startup PIN with TPM of the [Require additional authentication at startup](#bkmk-unlockpol1) policy is often enabled to help ensure security for older devices that do not support Modern Standby.
-But visually impaired users have no audible way to know when to enter a PIN.
-This setting enables an exception to the PIN-required policy on secure hardware.
+The preboot authentication option Require startup PIN with TPM of the [Require additional authentication at startup](#bkmk-unlockpol1) policy is often enabled to help ensure security for older devices that do not support Modern Standby.
+But visually impaired users have no audible way to know when to enter a PIN.
+This setting enables an exception to the PIN-required policy on secure hardware.
### Allow network unlock at startup
-This policy controls a portion of the behavior of the Network Unlock feature in BitLocker. This policy is required to enable BitLocker Network Unlock on a network because it allows clients running BitLocker to create the necessary network key protector during encryption.
+This policy controls a portion of the behavior of the Network Unlock feature in BitLocker. This policy is required to enable BitLocker Network Unlock on a network because it allows clients running BitLocker to create the necessary network key protector during encryption.
This policy is used in addition to the BitLocker Drive Encryption Network Unlock Certificate security policy (located in the **Public Key Policies** folder of Local Computer Policy) to allow systems that are connected to a trusted network to properly utilize the Network Unlock feature.
-
+
@@ -355,27 +355,27 @@ This policy setting is used to set a minimum PIN length when you use an unlock m
**Reference**
-This policy setting is applied when you turn on BitLocker.
+This policy setting is applied when you turn on BitLocker.
The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits.
-Originally, BitLocker allowed from 4 to 20 characters for a PIN.
-Windows Hello has its own PIN for logon, which can be 4 to 127 characters.
-Both BitLocker and Windows Hello use the TPM to prevent PIN brute-force attacks.
+Originally, BitLocker allowed from 4 to 20 characters for a PIN.
+Windows Hello has its own PIN for logon, which can be 4 to 127 characters.
+Both BitLocker and Windows Hello use the TPM to prevent PIN brute-force attacks.
-The TPM can be configured to use Dictionary Attack Prevention parameters ([lockout threshold and lockout duration](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings)) to control how many failed authorizations attempts are allowed before the TPM is locked out, and how much time must elapse before another attempt can be made.
+The TPM can be configured to use Dictionary Attack Prevention parameters ([lockout threshold and lockout duration](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings)) to control how many failed authorizations attempts are allowed before the TPM is locked out, and how much time must elapse before another attempt can be made.
-The Dictionary Attack Prevention Parameters provide a way to balance security needs with usability.
-For example, when BitLocker is used with a TPM + PIN configuration, the number of PIN guesses is limited over time.
-A TPM 2.0 in this example could be configured to allow only 32 PIN guesses immediately, and then only one more guess every two hours.
-This totals a maximum of about 4415 guesses per year.
-If the PIN is 4 digits, all 9999 possible PIN combinations could be attempted in a little over two years.
+The Dictionary Attack Prevention Parameters provide a way to balance security needs with usability.
+For example, when BitLocker is used with a TPM + PIN configuration, the number of PIN guesses is limited over time.
+A TPM 2.0 in this example could be configured to allow only 32 PIN guesses immediately, and then only one more guess every two hours.
+This totals a maximum of about 4415 guesses per year.
+If the PIN is 4 digits, all 9999 possible PIN combinations could be attempted in a little over two years.
-Increasing the PIN length requires a greater number of guesses for an attacker.
+Increasing the PIN length requires a greater number of guesses for an attacker.
In that case, the lockout duration between each guess can be shortened to allow legitimate users to retry a failed attempt sooner, while maintaining a similar level of protection.
-Beginning with Windows 10, version 1703, the minimum length for the BitLocker PIN was increased to 6 characters to better align with other Windows features that leverage TPM 2.0, including Windows Hello.
-To help organizations with the transition, beginning with Windows 10, version 1709 and Windows 10, version 1703 with the October 2017 [cumulative update](https://support.microsoft.com/help/4018124) installed, the BitLocker PIN length is 6 characters by default, but it can be reduced to 4 characters.
-If the minimum PIN length is reduced from the default of six characters, then the TPM 2.0 lockout period will be extended.
+Beginning with Windows 10, version 1703, the minimum length for the BitLocker PIN was increased to 6 characters to better align with other Windows features that leverage TPM 2.0, including Windows Hello.
+To help organizations with the transition, beginning with Windows 10, version 1709 and Windows 10, version 1703 with the October 2017 [cumulative update](https://support.microsoft.com/help/4018124) installed, the BitLocker PIN length is 6 characters by default, but it can be reduced to 4 characters.
+If the minimum PIN length is reduced from the default of six characters, then the TPM 2.0 lockout period will be extended.
### Disable new DMA devices when this computer is locked
@@ -778,7 +778,7 @@ This policy setting is used to require, allow, or deny the use of passwords with
**Reference**
-If you choose to allow the use of a password, you can require a password to be used, enforce complexity requirements, and configure a minimum length. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at
+If you choose to allow the use of a password, you can require a password to be used, enforce complexity requirements, and configure a minimum length. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at
**Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** must also be enabled.
>**Note:** These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive.
@@ -793,7 +793,7 @@ When set to **Do not allow complexity**, no password complexity validation will
>**Note:** Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled.
-For information about this setting, see [System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing](http://technet.microsoft.com/library/jj852211.aspx).
+For information about this setting, see [System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing](https://technet.microsoft.com/library/jj852211.aspx).
### Validate smart card certificate usage rule compliance
@@ -1058,7 +1058,7 @@ This policy setting is used to prevent users from turning BitLocker on or off on
This policy setting is applied when you turn on BitLocker.
-For information about suspending BitLocker protection, see [BitLocker Basic Deployment](http://technet.microsoft.com/library/dn383581.aspx).
+For information about suspending BitLocker protection, see [BitLocker Basic Deployment](https://technet.microsoft.com/library/dn383581.aspx).
The options for choosing property settings that control how users can configure BitLocker are:
@@ -1108,11 +1108,11 @@ This policy setting is used to control the encryption method and cipher strength
**Reference**
-The values of this policy determine the strength of the cipher that BitLocker uses for encryption.
+The values of this policy determine the strength of the cipher that BitLocker uses for encryption.
Enterprises may want to control the encryption level for increased security (AES-256 is stronger than AES-128).
-If you enable this setting, you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually.
-For fixed and operating system drives, we recommend that you use the XTS-AES algorithm.
+If you enable this setting, you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually.
+For fixed and operating system drives, we recommend that you use the XTS-AES algorithm.
For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10, version 1511 or later.
Changing the encryption method has no effect if the drive is already encrypted or if encryption is in progress. In these cases, this policy setting is ignored.
@@ -1486,7 +1486,7 @@ For more information about adding data recovery agents, see [BitLocker basic dep
In **Configure user storage of BitLocker recovery information**, select whether users are allowed, required, or not allowed to generate a 48-digit recovery password.
-Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for
+Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for
the drive are determined by the policy setting.
In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS) for operating system drives. If you select **Store recovery password and key packages**, the BitLocker recovery password and the key package are stored in AD DS. Storing the key package supports recovering data from a drive that is physically corrupted. If you select **Store recovery password only**, only the recovery password is stored in AD DS.
@@ -1706,10 +1706,10 @@ In **Configure user storage of BitLocker recovery information**, select whether
Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you cannot specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for the drive are determined by the policy setting.
-In **Save BitLocker recovery information to Active Directory Doman Services**, choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select **Backup recovery password and key package**, the BitLocker recovery password and the key package are stored in AD DS.
+In **Save BitLocker recovery information to Active Directory Doman Services**, choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select **Backup recovery password and key package**, the BitLocker recovery password and the key package are stored in AD DS.
Storing the key package supports recovering data from a drive that has been physically corrupted. To recover this data, you can use the **Repair-bde** command-line tool. If you select **Backup recovery password only**, only the recovery password is stored in AD DS.
-For more information about the BitLocker repair tool, see [Repair-bde](http://technet.microsoft.com/library/ff829851.aspx).
+For more information about the BitLocker repair tool, see [Repair-bde](https://technet.microsoft.com/library/ff829851.aspx).
Select the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.
@@ -2445,7 +2445,7 @@ You can save the optional recovery key to a USB drive. Because recovery password
You can edit the FIPS setting by using the Security Policy Editor (Secpol.msc) or by editing the Windows registry. You must be an administrator to perform these procedures.
-For more information about setting this policy, see [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](http://technet.microsoft.com/library/jj852197.aspx).
+For more information about setting this policy, see [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](https://technet.microsoft.com/library/jj852197.aspx).
## Power management Group Policy settings: Sleep and Hibernate
@@ -2466,10 +2466,10 @@ Changing from the default platform validation profile affects the security and m
**About PCR 7**
-PCR 7 measures the state of Secure Boot. With PCR 7, BitLocker can leverage Secure Boot for integrity validation. Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. PCR 7 measurements indicate whether Secure Boot is on and which keys are trusted on the platform. If Secure Boot is on and the firmware measures PCR 7 correctly per the UEFI specification, BitLocker can bind to this information rather than to PCRs 0, 2, and 4 which have the measurements of the exact firmware and Bootmgr images loaded. This
+PCR 7 measures the state of Secure Boot. With PCR 7, BitLocker can leverage Secure Boot for integrity validation. Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. PCR 7 measurements indicate whether Secure Boot is on and which keys are trusted on the platform. If Secure Boot is on and the firmware measures PCR 7 correctly per the UEFI specification, BitLocker can bind to this information rather than to PCRs 0, 2, and 4 which have the measurements of the exact firmware and Bootmgr images loaded. This
reduces the likelihood of BitLocker starting in recovery mode as a result of firmware and image updates, and it provides you with greater flexibility to manage the preboot configuration.
-PCR 7 measurements must follow the guidance that is described in [Appendix A Trusted Execution Environment EFI Protocol](http://msdn.microsoft.com/library/windows/hardware/jj923068.aspx).
+PCR 7 measurements must follow the guidance that is described in [Appendix A Trusted Execution Environment EFI Protocol](https://msdn.microsoft.com/library/windows/hardware/jj923068.aspx).
PCR 7 measurements are a mandatory logo requirement for systems that support Modern Standby (also known as Always On, Always Connected PCs), such as the Microsoft Surface RT. On such systems, if the TPM with PCR 7 measurement and Secure Boot are correctly configured, BitLocker binds to PCR 7 and PCR 11 by default.
diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md
index effba5e206..68b1e25d31 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md
@@ -36,7 +36,7 @@ BitLocker recovery is the process by which you can restore access to a BitLocker
The following list provides examples of specific events that will cause BitLocker to enter recovery mode when attempting to start the operating system drive:
-- On PCs that use BitLocker, or on devices such as tablets or phones that use Device Encryption only, when an attack is detected, the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality Administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor, or use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](http://technet.microsoft.com/library/aa998357.aspx) (also configurable through [Windows Intune](http://technet.microsoft.com/library/jj733621.aspx)), to limit the number of failed password attempts before the device goes into Device Lockout.
+- On PCs that use BitLocker, or on devices such as tablets or phones that use Device Encryption only, when an attack is detected, the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality Administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor, or use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](https://technet.microsoft.com/library/aa998357.aspx) (also configurable through [Windows Intune](https://technet.microsoft.com/library/jj733621.aspx)), to limit the number of failed password attempts before the device goes into Device Lockout.
- On devices with TPM 1.2, changing the BIOS or firmware boot device order causes BitLocker recovery. However, devices with TPM 2.0 do not start BitLocker recovery in this case. TPM 2.0 does not consider a firmware change of boot device order as a security threat because the OS Boot Loader is not compromised.
- Having the CD or DVD drive before the hard drive in the BIOS boot order and then inserting or removing a CD or DVD.
- Failing to boot from a network drive before booting from the hard drive.
@@ -93,7 +93,7 @@ Before you create a thorough BitLocker recovery process, we recommend that you t
2. At the command prompt, type the following command and then press ENTER:
`manage-bde -forcerecovery `
-
+
**To force recovery for a remote computer**
1. On the Start screen, type **cmd.exe**, and then click **Run as administrator**.
@@ -106,8 +106,8 @@ Before you create a thorough BitLocker recovery process, we recommend that you t
When planning the BitLocker recovery process, first consult your organization's current best practices for recovering sensitive information. For example: How does your enterprise handle lost Windows passwords? How does your organization perform smart card PIN resets? You can use these best practices and related resources (people and tools) to help formulate a BitLocker recovery model.
-Organizations that rely on BitLocker Drive Encryption and BitLocker To Go to protect data on a large number of computers and removable drives running the Windows 10, Windows 8, or Windows 7 operating systems and Windows to Go should consider using the Microsoft BitLocker Administration and Monitoring (MBAM) Tool version 2.0, which is included in the Microsoft Desktop Optimization Pack (MDOP) for Microsoft Software Assurance. MBAM makes BitLocker implementations easier to deploy and manage and allows administrators to provision and monitor encryption for operating system and fixed drives. MBAM prompts the user before encrypting fixed drives. MBAM also manages recovery keys for fixed and removable drives, making recovery easier to manage. MBAM can be used as part of a Microsoft System Center deployment or as a stand-alone solution. For more info, see [Microsoft BitLocker
-Administration and Monitoring](http://technet.microsoft.com/windows/hh826072.aspx).
+Organizations that rely on BitLocker Drive Encryption and BitLocker To Go to protect data on a large number of computers and removable drives running the Windows 10, Windows 8, or Windows 7 operating systems and Windows to Go should consider using the Microsoft BitLocker Administration and Monitoring (MBAM) Tool version 2.0, which is included in the Microsoft Desktop Optimization Pack (MDOP) for Microsoft Software Assurance. MBAM makes BitLocker implementations easier to deploy and manage and allows administrators to provision and monitor encryption for operating system and fixed drives. MBAM prompts the user before encrypting fixed drives. MBAM also manages recovery keys for fixed and removable drives, making recovery easier to manage. MBAM can be used as part of a Microsoft System Center deployment or as a stand-alone solution. For more info, see [Microsoft BitLocker
+Administration and Monitoring](https://technet.microsoft.com/windows/hh826072.aspx).
After a BitLocker recovery has been initiated, users can use a recovery password to unlock access to encrypted data. You must consider both self-recovery and recovery password retrieval methods for your organization.
@@ -133,7 +133,7 @@ If the user does not have a recovery password in a printout or on a USB flash dr
- **Choose how BitLocker-protected operating system drives can be recovered**
- **Choose how BitLocker-protected fixed drives can be recovered**
- **Choose how BitLocker-protected removable drives can be recovered**
-In each of these policies, select **Save BitLocker recovery information to Active Directory Domain Services** and then choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS). Select the **Do not enable BitLocker until recovery information is stored in AD
+In each of these policies, select **Save BitLocker recovery information to Active Directory Domain Services** and then choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS). Select the **Do not enable BitLocker until recovery information is stored in AD
DS** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information for the drive to AD DS succeeds.
>**Note:** If the PCs are part of a workgroup, users should be advised to save their BitLocker recovery password with their Microsoft Account online. Having an online copy of your BitLocker recovery password is recommended to help ensure that you do not lose access to your data in the event that recovery is required.
@@ -180,7 +180,7 @@ Because the recovery password is 48 digits long the user may need to record the
### Post-recovery analysis
-When a volume is unlocked using a recovery password, an event is written to the event log and the platform validation measurements are reset in the TPM to match the current configuration. Unlocking the volume means that the encryption key has been released and is ready for on-the-fly encryption
+When a volume is unlocked using a recovery password, an event is written to the event log and the platform validation measurements are reset in the TPM to match the current configuration. Unlocking the volume means that the encryption key has been released and is ready for on-the-fly encryption
when data is written to the volume, and on-the-fly decryption when data is read from the volume. After the volume is unlocked, BitLocker behaves the same way, regardless of how the access was granted.
If you notice that a computer is having repeated recovery password unlocks, you might want to have an administrator can perform post-recovery analysis to determine the root cause of the recovery and refresh BitLocker platform validation so that the user no longer needs to enter a recovery password each time that the computer starts up. See:
@@ -223,7 +223,7 @@ If a user has forgotten the PIN, you must reset the PIN while you are logged on
**To prevent continued recovery due to an unknown PIN**
1. Unlock the computer using the recovery password.
-2. Reset the PIN:
+2. Reset the PIN:
1. Right-click the drive and then click **Change PIN**
2. In the BitLocker Drive Encryption dialog, click **Reset a forgotten PIN**. If you are not logged in with an administrator account you must provide administrative credentials at this time.
3. In the PIN reset dialog, provide and confirm the new PIN to use and then click **Finish**.
@@ -314,7 +314,7 @@ You can use the following sample script to create a VBScript file to reset the r
strDriveLetter = "c:"
' Target computer name
' Use "." to connect to the local computer
-strComputerName = "."
+strComputerName = "."
' --------------------------------------------------------------------------------
' Connect to the BitLocker WMI provider class
' --------------------------------------------------------------------------------
@@ -322,8 +322,8 @@ strConnectionStr = "winmgmts:" _
& "{impersonationLevel=impersonate,authenticationLevel=pktPrivacy}!\\" _
& strComputerName _
& "\root\cimv2\Security\MicrosoftVolumeEncryption"
-
-
+
+
On Error Resume Next 'handle permission errors
Set objWMIService = GetObject(strConnectionStr)
If Err.Number <> 0 Then
@@ -353,7 +353,7 @@ If nRC <> 0 Then
WScript.Echo "FAILURE: ProtectKeyWithNumericalPassword failed with return code 0x" & Hex(nRC)
WScript.Quit -1
End If
-' Removes the other, "stale", recovery passwords
+' Removes the other, "stale", recovery passwords
' ----------------------------------------------------------------------------------
nKeyProtectorTypeIn = 3 ' type associated with "Numerical Password" protector
nRC = objVolume.GetKeyProtectors(nKeyProtectorTypeIn, aKeyProtectorIDs)
@@ -361,7 +361,7 @@ If nRC <> 0 Then
WScript.Echo "FAILURE: GetKeyProtectors failed with return code 0x" & Hex(nRC)
WScript.Quit -1
End If
-' Delete those key protectors other than the one we just added.
+' Delete those key protectors other than the one we just added.
For Each sKeyProtectorID In aKeyProtectorIDs
If sKeyProtectorID <> sNewKeyProtectorID Then
nRC = objVolume.DeleteKeyProtector(sKeyProtectorID)
@@ -405,7 +405,7 @@ You can use the following sample script to create a VBScript file to retrieve th
Sub ShowUsage
Wscript.Echo "USAGE: GetBitLockerKeyPackageADDS [Path To Save Key Package] [Optional Computer Name]"
Wscript.Echo "If no computer name is specified, the local computer is assumed."
- Wscript.Echo
+ Wscript.Echo
Wscript.Echo "Example: GetBitLockerKeyPackageADDS E:\bitlocker-ad-key-package mycomputer"
WScript.Quit
End Sub
@@ -417,17 +417,17 @@ Select Case args.Count
Case 1
If args(0) = "/?" Or args(0) = "-?" Then
ShowUsage
- Else
+ Else
strFilePath = args(0)
- ' Get the name of the local computer
+ ' Get the name of the local computer
Set objNetwork = CreateObject("WScript.Network")
- strComputerName = objNetwork.ComputerName
- End If
-
+ strComputerName = objNetwork.ComputerName
+ End If
+
Case 2
If args(0) = "/?" Or args(0) = "-?" Then
ShowUsage
- Else
+ Else
strFilePath = args(0)
strComputerName = args(1)
End If
@@ -437,40 +437,40 @@ End Select
' --------------------------------------------------------------------------------
' Get path to Active Directory computer object associated with the computer name
' --------------------------------------------------------------------------------
-Function GetStrPathToComputer(strComputerName)
+Function GetStrPathToComputer(strComputerName)
' Uses the global catalog to find the computer in the forest
' Search also includes deleted computers in the tombstone
Set objRootLDAP = GetObject("LDAP://rootDSE")
- namingContext = objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com
+ namingContext = objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com
strBase = ""
-
- Set objConnection = CreateObject("ADODB.Connection")
- Set objCommand = CreateObject("ADODB.Command")
- objConnection.Provider = "ADsDSOOBject"
- objConnection.Open "Active Directory Provider"
- Set objCommand.ActiveConnection = objConnection
+
+ Set objConnection = CreateObject("ADODB.Connection")
+ Set objCommand = CreateObject("ADODB.Command")
+ objConnection.Provider = "ADsDSOOBject"
+ objConnection.Open "Active Directory Provider"
+ Set objCommand.ActiveConnection = objConnection
strFilter = "(&(objectCategory=Computer)(cn=" & strComputerName & "))"
- strQuery = strBase & ";" & strFilter & ";distinguishedName;subtree"
- objCommand.CommandText = strQuery
- objCommand.Properties("Page Size") = 100
+ strQuery = strBase & ";" & strFilter & ";distinguishedName;subtree"
+ objCommand.CommandText = strQuery
+ objCommand.Properties("Page Size") = 100
objCommand.Properties("Timeout") = 100
- objCommand.Properties("Cache Results") = False
- ' Enumerate all objects found.
- Set objRecordSet = objCommand.Execute
+ objCommand.Properties("Cache Results") = False
+ ' Enumerate all objects found.
+ Set objRecordSet = objCommand.Execute
If objRecordSet.EOF Then
WScript.echo "The computer name '" & strComputerName & "' cannot be found."
WScript.Quit 1
End If
' Found object matching name
- Do Until objRecordSet.EOF
+ Do Until objRecordSet.EOF
dnFound = objRecordSet.Fields("distinguishedName")
GetStrPathToComputer = "LDAP://" & dnFound
- objRecordSet.MoveNext
- Loop
- ' Clean up.
- Set objConnection = Nothing
- Set objCommand = Nothing
- Set objRecordSet = Nothing
+ objRecordSet.MoveNext
+ Loop
+ ' Clean up.
+ Set objConnection = Nothing
+ Set objCommand = Nothing
+ Set objRecordSet = Nothing
End Function
' --------------------------------------------------------------------------------
' Securely access the Active Directory computer object using Kerberos
@@ -495,8 +495,8 @@ For Each objFveInfo in objFveInfos
strName = objFveInfo.Get("name")
strRecoveryPassword = objFveInfo.Get("msFVE-RecoveryPassword")
strKeyPackage = objFveInfo.Get("msFVE-KeyPackage")
- WScript.echo
- WScript.echo "Recovery Object Name: " + strName
+ WScript.echo
+ WScript.echo "Recovery Object Name: " + strName
WScript.echo "Recovery Password: " + strRecoveryPassword
' Validate file path
Set fso = CreateObject("Scripting.FileSystemObject")
@@ -506,23 +506,23 @@ WScript.Quit -1
End If
' Save binary data to the file
SaveBinaryDataText strFilePathCurrent, strKeyPackage
-
+
WScript.echo "Related key package successfully saved to " + strFilePathCurrent
' Update next file path using base name
nCount = nCount + 1
strFilePathCurrent = strFilePath & nCount
Next
'----------------------------------------------------------------------------------------
-' Utility functions to save binary data
+' Utility functions to save binary data
'----------------------------------------------------------------------------------------
Function SaveBinaryDataText(FileName, ByteArray)
'Create FileSystemObject object
Dim FS: Set FS = CreateObject("Scripting.FileSystemObject")
-
+
'Create text stream object
Dim TextStream
Set TextStream = FS.CreateTextFile(FileName)
-
+
'Convert binary data To text And write them To the file
TextStream.Write BinaryToString(ByteArray)
End Function
@@ -551,7 +551,7 @@ The following sample script exports a new key package from an unlocked, encrypte
' --------------------------------------------------------------------------------
Sub ShowUsage
Wscript.Echo "USAGE: GetBitLockerKeyPackage [VolumeLetter/DriveLetter:] [Path To Save Key Package]"
- Wscript.Echo
+ Wscript.Echo
Wscript.Echo "Example: GetBitLockerKeyPackage C: E:\bitlocker-backup-key-package"
WScript.Quit
End Sub
@@ -563,7 +563,7 @@ Select Case args.Count
Case 2
If args(0) = "/?" Or args(0) = "-?" Then
ShowUsage
- Else
+ Else
strDriveLetter = args(0)
strFilePath = args(1)
End If
@@ -575,10 +575,10 @@ End Select
' --------------------------------------------------------------------------------
' Target computer name
' Use "." to connect to the local computer
-strComputerName = "."
+strComputerName = "."
' Default key protector ID to use. Specify "" to let the script choose.
strDefaultKeyProtectorID = ""
-' strDefaultKeyProtectorID = "{001298E0-870E-4BA0-A2FF-FC74758D5720}" ' sample
+' strDefaultKeyProtectorID = "{001298E0-870E-4BA0-A2FF-FC74758D5720}" ' sample
' --------------------------------------------------------------------------------
' Connect to the BitLocker WMI provider class
' --------------------------------------------------------------------------------
@@ -586,8 +586,8 @@ strConnectionStr = "winmgmts:" _
& "{impersonationLevel=impersonate,authenticationLevel=pktPrivacy}!\\" _
& strComputerName _
& "\root\cimv2\Security\MicrosoftVolumeEncryption"
-
-
+
+
On Error Resume Next 'handle permission errors
Set objWMIService = GetObject(strConnectionStr)
If Err.Number <> 0 Then
@@ -634,8 +634,8 @@ End If
' No numerical passwords exist, save the first external key
If strDefaultKeyProtectorID = "" and UBound(aExternalKeyProtectorIDs) <> -1 Then
strDefaultKeyProtectorID = aExternalKeyProtectorIDs(0)
-End If
-' Fail case: no recovery key protectors exist.
+End If
+' Fail case: no recovery key protectors exist.
If strDefaultKeyProtectorID = "" Then
WScript.Echo "FAILURE: Cannot create backup key package because no recovery passwords or recovery keys exist. Check that BitLocker protection is on for this drive."
WScript.Echo "For help adding recovery passwords or recovery keys, type ""manage-bde -protectors -add -?""."
@@ -655,7 +655,7 @@ WScript.Quit -1
End If
' what's a string that can be used to describe it?
strDefaultKeyProtectorType = ""
-Select Case nDefaultKeyProtectorType
+Select Case nDefaultKeyProtectorType
Case nNumericalKeyProtectorType
strDefaultKeyProtectorType = "recovery password"
Case nExternalKeyProtectorType
@@ -701,16 +701,16 @@ WScript.Echo "The saved key file is named " & strDefaultKeyProtectorID & ".BEK"
WScript.Echo "For help re-saving this external key file, type ""manage-bde -protectors -get -?"""
End If
'----------------------------------------------------------------------------------------
-' Utility functions to save binary data
+' Utility functions to save binary data
'----------------------------------------------------------------------------------------
Function SaveBinaryDataText(FileName, ByteArray)
'Create FileSystemObject object
Dim FS: Set FS = CreateObject("Scripting.FileSystemObject")
-
+
'Create text stream object
Dim TextStream
Set TextStream = FS.CreateTextFile(FileName)
-
+
'Convert binary data To text And write them To the file
TextStream.Write BinaryToString(ByteArray)
End Function
diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md
index 08c6e11a72..d3ec59e360 100644
--- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md
+++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md
@@ -106,7 +106,7 @@ The following limitations exist for Repair-bde:
- The Repair-bde command-line tool cannot repair a drive that failed during the encryption or decryption process.
- The Repair-bde command-line tool assumes that if the drive has any encryption, then the drive has been fully encrypted.
-For more information about using repair-bde, see [Repair-bde](http://technet.microsoft.com/library/ff829851.aspx).
+For more information about using repair-bde, see [Repair-bde](https://technet.microsoft.com/library/ff829851.aspx).
## BitLocker cmdlets for Windows PowerShell
@@ -283,7 +283,7 @@ Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath -SkipHardwareTes
### Using the BitLocker Windows PowerShell cmdlets with data volumes
-Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a
+Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a
SecureString value to store the user defined password.
``` syntax
diff --git a/windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure.md b/windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure.md
deleted file mode 100644
index c1b351b15e..0000000000
--- a/windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure.md
+++ /dev/null
@@ -1,138 +0,0 @@
----
-title: Choose the right BitLocker countermeasure (Windows 10)
-description: This section outlines the best countermeasures you can use to protect your organization from bootkits and rootkits, brute force sign-in, Direct Memory Access (DMA) attacks, Hyberfil.sys attacks, and memory remanence attacks.
-ms.assetid: b0b09508-7885-4030-8c61-d91458afdb14
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: security
-author: brianlic-msft
-ms.date: 10/27/2017
----
-
-# Choose the right BitLocker countermeasure
-
-**Applies to**
-- Windows 10
-
-This section outlines the best countermeasures you can use to protect your organization from bootkits and rootkits, brute force sign-in, Direct Memory Access (DMA) attacks, Hyberfil.sys attacks, and memory remanence attacks.
-You can use BitLocker to protect your Windows 10 PCs. Whichever operating system you’re using, Microsoft and Windows-certified devices provide countermeasures to address attacks and improve your data security. In most cases, this protection can be implemented without the need for pre-boot authentication.
-
-Tables 1 and 2 summarize the recommended mitigations for different types of attacks against PCs running recent versions of Windows. The orange blocks indicate that the system requires additional configuration from the default settings.
-
-
-
-
-
-
-
-
-
-
-
Windows 8.1 without TPM
-
-
Windows 8.1 Certified (with TPM)
-
-
-
-
Bootkits and Rootkits
-
Without TPM, boot integrity checking is not available
-
Secure by default when UEFI-based Secure Boot is enabled and a firmware password is required to change settings
-
-
-
-
Brute Force Sign-in
-
Secure by default, and can be improved with account lockout Group Policy
-
Secure by default, and can be improved with account lockout and device lockout Group Policy settings
-
-
-
-
DMA Attacks
-
If policy is deployed, secure by default for all lost or stolen devices because new DMA devices are granted access only when an authorized user is signed in
-
If policy is deployed, secure by default for all lost or stolen devices because new DMA devices are granted access only when an authorized user is signed in
-
-
-
-
Hyberfil.sys Attacks
-
Secure by default; hyberfil.sys secured on encrypted volume
-
Secure by default; hyberfil.sys secured on encrypted volume
-
-
-
-
Memory Remanence Attacks
-
Password protect the firmware and disable booting from external media. If an attack is viable, consider pre-boot authentication
-
Password protect the firmware and ensure Secure Boot is enabled. If an attack is viable, consider pre-boot authentication
-
-
-
-**Table 1.** How to choose the best countermeasures for Windows 8.1
-
-
-
-
-
-
-
-
-
-
-
Windows 10 without TPM
-
-
Windows 10 Certified (with TPM)
-
-
-
-
Bootkits and Rootkits
-
Without TPM, boot integrity checking is not available
-
Secure by default when UEFI-based Secure Boot is enabled and a firmware password is required to change settings
-
-
-
-
Brute Force Sign-in
-
Secure by default, and can be improved with account lockout Group Policy
-
Secure by default, and can be improved with account lockout and device lockout Group Policy settings
-
-
-
-
DMA Attacks
-
If policy is deployed, secure by default for all lost or stolen devices because new DMA devices are granted access only when an authorized user is signed in
-
Secure by default; certified devices do not expose vulnerable DMA busses. Can be additionally secured by deploying policy to restrict DMA devices:
Secure by default; hyberfil.sys secured on encrypted volume
-
Secure by default; hyberfil.sys secured on encrypted volume
-
-
-
-
Memory Remanence Attacks
-
Password protect the firmware and disable booting from external media. If an attack is viable, consider pre-boot authentication
-
Password protect the firmware and ensure Secure Boot is enabled. The most effective mitigation, which we advise for high-security devices, is to configure a TPM+PIN protector, disable Standby power management, and shut down or hibernate the device before it leaves the control of an authorized user.
-
-
-
-**Table 2.** How to choose the best countermeasures for Windows 10
-
-The latest Modern Standby devices, primarily tablets, are designed to be secure by default against all attacks that might compromise the BitLocker encryption key. Other Windows devices can be secure by default too. DMA port–based attacks, which represent the attack vector of choice, are not possible on Modern Standby devices because these port types are prohibited. The inclusion of DMA ports on even non-Modern Standby devices is extremely rare on recent devices, particularly on mobile ones. This could change if Thunderbolt is broadly adopted, so IT should consider this when purchasing new devices. In any case, DMA ports can be disabled entirely, which is an increasingly popular option because the use of DMA ports is infrequent in the non-developer space. To prevent DMA port usage unless an authorized user is signed in, you can set the DataProtection/AllowDirectMemoryAccess policy by using Mobile Device Management (MDM) or the Group Policy setting **Disable new DMA devices when this computer is locked** (beginning with Windows 10, version 1703). This setting is **Not configured** by default. The path to the Group Policy setting is:
-
-**Computer Configuration|Administrative Templates|Windows Components|BitLocker Drive Encryption**
-
-Memory remanence attacks can be mitigated with proper configuration; in cases where the system memory is fixed and non-removable, they are not possible using published techniques. Even in cases where system memory can be removed and loaded into another device, attackers will find the attack vector extremely unreliable, as has been shown in the DRDC Valcartier group’s analysis (see [An In-depth Analysis of the Cold Boot Attack](http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA545078)).
-
-Windows 7 PCs share the same security risks as newer devices but are far more vulnerable to DMA and memory remanence attacks, because Windows 7 devices are more likely to include DMA ports, lack support for UEFI-based Secure Boot, and rarely have fixed memory. To eliminate the need for pre-boot authentication on Windows 7 devices, disable the ability to boot to external media, password-protect the BIOS configuration, and disable the DMA ports. If you believe that your devices may be a target of a memory remanence attack, where the system memory may be removed and put into another computer to gain access to its contents, consider testing your devices to determine whether they are susceptible to this type of attack.
-
-In the end, many customers will find that pre-boot authentication improves security only for a shrinking subset of devices within their organization. Microsoft recommends a careful examination of the attack vectors and mitigations
-outlined in this document along with an evaluation of your devices before choosing to implement pre-boot authentication, which may not enhance the security of your devices and instead will only compromise the user experience and add to support costs.
-
-## See also
-- [Types of attacks for volume encryption keys](types-of-attacks-for-volume-encryption-keys.md)
-- [BitLocker Countermeasures](bitlocker-countermeasures.md)
-- [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md)
-- [BitLocker overview](bitlocker-overview.md)
-
-
diff --git a/windows/security/information-protection/bitlocker/images/kernel-dma-protection.png b/windows/security/information-protection/bitlocker/images/kernel-dma-protection.png
new file mode 100644
index 0000000000..297809afdc
Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/kernel-dma-protection.png differ
diff --git a/windows/security/information-protection/bitlocker/images/pre-boot-authentication-group-policy.png b/windows/security/information-protection/bitlocker/images/pre-boot-authentication-group-policy.png
new file mode 100644
index 0000000000..94d0720c76
Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/pre-boot-authentication-group-policy.png differ
diff --git a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md
index eed67e922b..efa0edfef4 100644
--- a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md
+++ b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md
@@ -59,22 +59,22 @@ On computers that do not have a TPM version 1.2 or higher, you can still use Bi
| Key protector | Description |
| - | - |
-| TPM | A hardware device used to help establish a secure root-of-trust. BitLocker only supports TPM version 1.2 or higher.|
-| PIN | A user-entered numeric key protector that can only be used in addition to the TPM.|
-| Enhanced PIN | A user-entered alphanumeric key protector that can only be used in addition to the TPM.|
-| Startup key | An encryption key that can be stored on most removable media. This key protector can be used alone on non-TPM computers, or in conjunction with a TPM for added security.|
-| Recovery password | A 48-digit number used to unlock a volume when it is in recovery mode. Numbers can often be typed on a regular keyboard, if the numbers on the normal keyboard are not responding you can always use the function keys (F1-F10) to input the numbers.|
-| Recovery key| An encryption key stored on removable media that can be used for recovering data encrypted on a BitLocker volume.|
+| TPM | A hardware device used to help establish a secure root-of-trust. BitLocker only supports TPM version 1.2 or higher.|
+| PIN | A user-entered numeric key protector that can only be used in addition to the TPM.|
+| Enhanced PIN | A user-entered alphanumeric key protector that can only be used in addition to the TPM.|
+| Startup key | An encryption key that can be stored on most removable media. This key protector can be used alone on non-TPM computers, or in conjunction with a TPM for added security.|
+| Recovery password | A 48-digit number used to unlock a volume when it is in recovery mode. Numbers can often be typed on a regular keyboard, if the numbers on the normal keyboard are not responding you can always use the function keys (F1-F10) to input the numbers.|
+| Recovery key| An encryption key stored on removable media that can be used for recovering data encrypted on a BitLocker volume.|
### BitLocker authentication methods
| Authentication method | Requires user interaction | Description |
| - | - | - |
-| TPM only| No| TPM validates early boot components.|
-| TPM + PIN | Yes| TPM validates early boot components. The user must enter the correct PIN before the start-up process can continue, and before the drive can be unlocked. The TPM will enter lockout if the incorrect PIN is entered repeatedly to protect the PIN from brute force attacks. The number of repeated attempts that will trigger a lockout is variable.|
+| TPM only| No| TPM validates early boot components.|
+| TPM + PIN | Yes| TPM validates early boot components. The user must enter the correct PIN before the start-up process can continue, and before the drive can be unlocked. The TPM will enter lockout if the incorrect PIN is entered repeatedly to protect the PIN from brute force attacks. The number of repeated attempts that will trigger a lockout is variable.|
| TPM + Network key | No | The TPM successfully validates early boot components, and a valid encrypted network key has been provided from the WDS server. This authentication method provides automatic unlock of operating system volumes at system reboot while still maintaining multifactor authentication. |
-| TPM + startup key| Yes| The TPM successfully validates early boot components, and a USB flash drive containing the startup key has been inserted.|
-| Startup key only | Yes| The user is prompted to insert the USB flash drive that holds the recovery key and/or startup key and reboot the computer.|
+| TPM + startup key| Yes| The TPM successfully validates early boot components, and a USB flash drive containing the startup key has been inserted.|
+| Startup key only | Yes| The user is prompted to insert the USB flash drive that holds the recovery key and/or startup key and reboot the computer.|
**Will you support computers without TPM version 1.2 or higher?**
@@ -161,7 +161,7 @@ BitLocker integrates with Active Directory Domain Services (AD DS) to provide ce
Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Turn on BitLocker backup to Active Directory Domain Services
-By default, only Domain Admins have access to BitLocker recovery information, but [access can be delegated to others](https://blogs.technet.microsoft.com/craigf/2011/01/26/delegating-access-in-ad-to-bitlocker-recovery-information/).
+By default, only Domain Admins have access to BitLocker recovery information, but [access can be delegated to others](https://blogs.technet.microsoft.com/craigf/2011/01/26/delegating-access-in-ad-to-bitlocker-recovery-information/).
The following recovery data is saved for each computer object:
@@ -179,7 +179,7 @@ Functionality introduced in Windows Server 2012 R2 and Windows 8.1, allows BitLo
>**Note:** The United States Federal Information Processing Standard (FIPS) defines security and interoperability requirements for computer systems that are used by the U.S. federal government. The FIPS 140 standard defines approved cryptographic algorithms. The FIPS 140 standard also sets forth requirements for key generation and for key management. The National Institute of Standards and Technology (NIST) uses the Cryptographic Module Validation Program (CMVP) to determine whether a particular implementation of a cryptographic algorithm is compliant with the FIPS 140 standard. An implementation of a cryptographic algorithm is considered FIPS 140-compliant only if it has been submitted for and has passed NIST validation. An algorithm that has not been submitted cannot be considered FIPS-compliant even if the implementation produces identical data as a validated implementation of the same algorithm.
-Prior to these supported versions of Windows, when Windows was in FIPS mode, BitLocker prevented the creation or use of recovery passwords and instead forced the user to use recovery keys. For more information about these issues, see the support article [kb947249](http://support.microsoft.com/kb/947249).
+Prior to these supported versions of Windows, when Windows was in FIPS mode, BitLocker prevented the creation or use of recovery passwords and instead forced the user to use recovery keys. For more information about these issues, see the support article [kb947249](https://support.microsoft.com/kb/947249).
But on computers running these supported systems with BitLocker enabled:
diff --git a/windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks.md b/windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks.md
deleted file mode 100644
index d67cd69a82..0000000000
--- a/windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-title: Protect BitLocker from pre-boot attacks (Windows 10)
-description: This detailed guide will help you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device’s configuration.
-ms.assetid: 24d19988-fc79-4c45-b392-b39cba4ec86b
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: security
-author: brianlic-msft
-ms.date: 04/19/2017
----
-# Protect BitLocker from pre-boot attacks
-
-
-**Applies to**
-- Windows 10
-
-This detailed guide will help you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device’s configuration.
-
-BitLocker uses encryption to protect the data on your drive, but BitLocker security is only effective when the encryption key is protected. Many users have relied on pre-boot authentication to protect the operating system’s integrity, disk encryption solution (for example, encryption keys), and the PC’s data from offline attacks. With pre-boot authentication, users must provide some form of credential before unlocking encrypted volumes and starting
-Windows. Typically, they authenticate themselves using a PIN or a USB flash drive as a key.
-
-Full-volume encryption using BitLocker Drive Encryption is vital for protecting data and system integrity on devices running the Windows 10, Windows 8.1, Windows 8, or Windows 7 operating system. It is equally important to protect the BitLocker encryption key. On Windows 7 devices, sufficiently protecting that key often required pre-boot authentication, which many users find inconvenient and complicates device management.
-
-Pre-boot authentication provides excellent startup security, but it inconveniences users and increases IT management costs. Every time the PC is unattended, the device must be set to hibernate (in other words, shut down and powered off); when the computer restarts, users must authenticate before the encrypted volumes are unlocked. This requirement increases restart times and prevents users from accessing remote PCs until they can physically access the computer to authenticate, making pre-boot authentication unacceptable in the modern IT world, where users expect their devices to turn on instantly and IT requires PCs to be constantly connected to the network.
-
-If users lose their USB key or forget their PIN, they can’t access their PC without a recovery key. With a properly configured infrastructure, the organization’s support will be able to provide the recovery key, but doing so increases support costs, and users might lose hours of productive work time.
-
-Starting with Windows 8, Secure Boot and Windows Trusted Boot startup process ensures operating system integrity, allowing Windows to start automatically while minimizing the risk of malicious startup tools and rootkits. In addition, many modern devices are fundamentally physically resistant to sophisticated attacks against the computer’s memory, and now Windows authenticates the user before making devices that may represent a threat to the device and encryption keys available for use.
-
-## In this topic
-
-The sections that follow help you understand which PCs still need pre-boot authentication and which can meet your security requirements without the inconvenience of it.
-
-- [Types of attacks for volume encryption keys](types-of-attacks-for-volume-encryption-keys.md)
-- [BitLocker countermeasures](bitlocker-countermeasures.md)
-- [Choose the right BitLocker countermeasure](choose-the-right-bitlocker-countermeasure.md)
-
-## See also
-
-- [BitLocker overview](bitlocker-overview.md)
-
-
diff --git a/windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys.md b/windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys.md
deleted file mode 100644
index d96b30a8c5..0000000000
--- a/windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys.md
+++ /dev/null
@@ -1,129 +0,0 @@
----
-title: Types of attacks for volume encryption keys (Windows 10)
-description: There are many ways Windows helps protect your organization from attacks, including Unified Extensible Firmware Interface (UEFI) secure boot, Trusted Platform Module (TPM), Group Policy, complex passwords, and account lockouts.
-ms.assetid: 405060a9-2009-44fc-9f84-66edad32c6bc
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: security
-author: brianlic-msft
-ms.date: 10/27/2017
----
-
-# Types of attacks for volume encryption keys
-
-**Applies to**
-- Windows 10
-
-There are many ways Windows helps protect your organization from attacks, including Unified Extensible Firmware Interface (UEFI) Secure Boot, Trusted Platform Module (TPM), Group Policy, complex passwords, and account lockouts.
-
-The next few sections describe each type of attack that could be used to compromise a volume encryption key, whether for BitLocker or a non-Microsoft encryption solution. After an attacker has compromised a volume encryption key, the attacker can read data from your system drive or even install malware while Windows is offline. Each section begins with a graphical overview of the attack’s strengths and weaknesses as well as suggested mitigations.
-
-### Bootkit and rootkit attacks
-
-Rootkits are a sophisticated and dangerous type of malware that runs in kernel mode, using the same privileges as the operating system. Because rootkits have the same or possibly even more rights than the operating system, they can completely hide themselves from Windows and even an antimalware solution. Often, rootkits are part of an entire suite of malware that can bypass local logins, record passwords, transfer private files, and capture cryptography keys.
-
-Different types of bootkits and rootkits load at different software levels:
-
-- **Kernel level.** Rootkits running at the kernel level have the highest privilege in the operating system. They may be able to inject malicious code or replace portions of the core operating system, including both the kernel and device drivers.
-- **Application level.** These rootkits are aimed to replace application binaries with malicious code, such as a Trojan, and can even modify the behavior of existing applications.
-- **Library level.** The purpose of library-level rootkits is to hook, patch, or replace system calls with malicious code that can hide the malware’s presence.
-- **Hypervisor level.** Hypervisor rootkits target the boot sequence. Their primary purpose is to modify the boot sequence to load themselves as a hypervisor.
-- **Firmware level.** These rootkits overwrite the PC’s BIOS firmware, giving the malware low-level access and potentially the ability to install or hide malware, even if it’s cleaned or removed from the hard disk.
-
-Regardless of the operating system or encryption method, rootkits have access to confidential data once installed. Application-level rootkits can read any files the user can access, bypassing volume-level encryption. Kernel-, library-, hypervisor-, and firmware-level rootkits have direct access to system files on encrypted volumes and can also retrieve an encryption key from memory.
-
-Windows offers substantial protection from bootkits and rootkits, but it is possible to bypass operating system security when an attacker has physical access to the device and can install the malware to the device while Windows is offline. For example, an attacker might boot a PC from a USB flash drive containing malware that starts before Windows. The malware can replace system files or the PC’s firmware or simply start Windows under its control.
-
-To sufficiently protect a PC from boot and rootkits, devices must use pre-boot authentication or Secure Boot, or the encryption solution must use the device’s Trusted Platform Module (TPM) as a means of monitoring the integrity of the end-to-end boot process. Pre-boot authentication is available for any device, regardless of the hardware, but because it is inconvenient to users, it should be used only to mitigate threats that are applicable to the device. On devices with Secure Boot enabled, you do not need to use pre-boot authentication to protect against boot and rootkit attacks.
-
-Although password protection of the UEFI configuration is important for protecting a device’s configuration and preventing an attacker from disabling Secure Boot, use of a TPM and its Platform Configuration Register (PCR) measurements (PCR7) to ensure that the system’s bootloader (whether a Windows or non-Microsoft encryption solution) is tamper free and the first code to start on the device is critical. An encryption solution that doesn’t use a device’s TPM to protect its components from tampering may be unable to protect itself from bootkit-level infections that could log a user’s password or acquire encryption keys.
-
-For this reason, when BitLocker is configured on devices that include a TPM, the TPM and its PCRs are always used to secure and confirm the integrity of the pre–operating system environment before making encrypted volumes accessible.
-
-Any change to the UEFI configuration invalidates the PCR7 and requires the user to enter the BitLocker recovery key. Because of this feature, it’s not critical to password-protect your UEFI configuration. But UEFI password protection is a best practice and is still required for systems not using a TPM (such as non-Microsoft alternatives).
-
-### Brute-force Sign-in Attacks
-
-Attackers can find any password if you allow them to guess enough times. The process of trying millions of different passwords until you find the right one is known as a *brute-force sign-in attack*. In theory, an attacker could obtain any password by using this method.
-
-Three opportunities for brute-force attacks exist:
-
-- **Against the pre-boot authenticator.** An attacker could attack the device directly by attempting to guess the user’s BitLocker PIN or an equivalent authenticator. The TPM mitigates this approach by invoking an anti-hammering lockout capability that requires the user to wait until the lockout period ends or enter the BitLocker recovery key.
-- **Against the recovery key.** An attacker could attempt to guess the 48-digit BitLocker recovery key. Even without a lockout period, the key is long enough to make brute-force attacks impractical. Specifically, the BitLocker recovery key has 128 bits of entropy; thus, the average brute-force attack would succeed after 18,446,744,073,709,551,616 guesses. If an attacker could guess 1 million passwords per second, the average brute-force attack would require more than 580,000 years to be successful.
-- **Against the operating system sign-in authenticator.** An attacker can attempt to guess a valid user name and password. Windows implements a delay between password guesses, slowing down brute-force attacks. In addition, all recent versions of Windows allow administrators to require complex passwords and password lockouts. Similarly, administrators can use Microsoft Exchange ActiveSync policy or Group Policy to configure Windows 8.1 and Windows 8 to automatically restart and require the user to enter the BitLocker 48-digit recovery key after a specified number of invalid password attempts. When these settings are enabled and users follow best practices for complex passwords, brute-force attacks against the operating system sign-in are impractical.
-
-In general, brute-force sign-in attacks are not practical against Windows when administrators enforce complex passwords and account lockouts.
-
-### Direct Memory Access Attacks
-
-Direct memory access (DMA) allows certain types of hardware devices to communicate directly with a device’s system memory. For example, if you use Thunderbolt to connect another device to your computer, the second device automatically has Read and Write access to the target computer’s memory.
-
-Unfortunately, DMA ports don’t use authentication and access control to protect the contents of the computer’s memory. Whereas Windows can often prevent system components and apps from reading and writing to protected parts of memory, a device can use DMA to read any location in memory, including the location of any encryption keys.
-
-DMA attacks are relatively easy to execute and require little technical skills. Anyone can download a tool from the Internet, such as those made by [Passware](http://www.lostpassword.com/), [ElcomSoft](http://elcomsoft.com/), and
-others, and then use a DMA attack to read confidential data from a PC’s memory. Because encryption solutions store their encryption keys in memory, they can be accessed by a DMA attack.
-
-Not all port types are vulnerable to DMA attacks. USB in particular does not allow DMA, but devices that have any of the following port types are vulnerable:
-
-- FireWire
-- Thunderbolt
-- ExpressCard
-- PCMCIA
-- PCI
-- PCI-X
-- PCI Express
-
-To perform a DMA attack, attackers typically connect a second PC that is running a memory-scanning tool (for example, Passware, ElcomSoft) to the FireWire or Thunderbolt port of the target computer. When connected, the software
-scans the system memory of the target and locates the encryption key. Once acquired, the key can be used to decrypt the drive and read or modify its contents.
-
-A much more efficient form of this attack exists in theory: An attacker crafts a custom FireWire or Thunderbolt device that has the DMA attack logic programmed on it. Now, the attacker simply needs to physically connect the device. If the attacker does not have physical access, they could disguise it as a free USB flash drive and distribute it to employees of a target organization. When connected, the attacking device could use a DMA attack to scan the PC’s memory for the encryption key. It could then transmit the key (or any data in the PC’s memory) using the PC’s Internet connection or its own wireless connection. This type of attack would require an extremely high level of sophistication, because it requires that the attacker create a custom device (devices of these types are not readily available in the marketplace at this time).
-
-Today, one of the most common uses for DMA ports on Windows devices is for developer debugging, a task that some developers need to perform and one that few consumers will ever perform. Because USB; DisplayPort; and other, more secure port types satisfy consumers, most new mobile PCs do not include DMA ports. Microsoft’s view is that because of the inherent security risks of DMA ports, they do not belong on mobile devices, and Microsoft has prohibited their inclusion on any Modern Standby-certified devices. Modern Standby devices offer mobile phone–like power management and instant-on capabilities; at the time of writing, they are primarily found in Windows tablets.
-
-DMA-based expansion slots are another avenue of attack, but these slots generally appear only on desktop PCs that are designed for expansion. Organizations can use physical security to prevent outside attacks against their desktop PCs. In addition, a DMA attack on the expansion slot would require a custom device; as a result, an attacker would most likely insert an interface with a traditional DMA port (for example, FireWire) into the slot to attack the PC.
-
-To mitigate a port-based DMA attack an administrator can configure policy settings to disable FireWire and other device types that have DMA. Also, many PCs allow those devices to be disabled by using firmware settings. Although the need for pre-boot authentication can be eliminated at the device level or through Windows configuration, the BitLocker pre-boot authentication feature is still available when needed. When used, it successfully mitigates all types of DMA port and expansion slot attacks on any type of device.
-
-### Hiberfil.sys Attacks
-
-The hiberfil.sys file is the Windows hibernation file. It contains a snapshot of system memory that is generated when a device goes into hibernation and includes the encryption key for BitLocker and other encryption technologies. Attackers have claimed that they have successfully extracted encryption keys from the hiberfil.sys file.
-
-Like the DMA port attack discussed in the previous section, tools are available that can scan the hiberfile.sys file and locate the encryption key, including a tool made by [Passware](http://www.lostpassword.com/). Microsoft does not consider Windows to be vulnerable to this type of attack, because Windows stores the hiberfil.sys file within the encrypted system volume. As a result, the file would be accessible only if the attacker had both physical and sign-in access to the PC. When an attacker has sign-in access to the PC, there are few reasons for the attacker to decrypt the drive, because they would already have full access to the data within it.
-
-In practice, the only reason an attack on hiberfil.sys would grant an attacker additional access is if an administrator had changed the default Windows configuration and stored the hiberfil.sys file on an unencrypted drive. By default, Windows 10 is designed to be secure against this type of attack.
-
-### Memory Remanence Attacks
-
-A memory remanence attack is a side-channel attack that reads the encryption key from memory after restarting a PC. Although a PC’s memory is often considered to be cleared when the PC is restarted, memory chips don’t immediately lose their memory when you disconnect power. Therefore, an attacker who has physical access to the PC’s memory might be able to read data directly from the memory—including the encryption key.
-
-When performing this type of cold boot attack, the attacker accesses the PC’s physical memory and recovers the encryption key within a few seconds or minutes of disconnecting power. This type of attack was demonstrated by researchers at [Princeton University](http://www.youtube.com/watch?v=JDaicPIgn9U). With the encryption key, the attacker would be able to decrypt the drive and access its files.
-
-To acquire the keys, attackers follow this process:
-
-1. Freeze the PC’s memory. For example, an attacker can freeze the memory to −50°C by spraying it with aerosol air duster spray.
-2. Restart the PC.
-3. Instead of restarting Windows, boot to another operating system. Typically, this is done by connecting a bootable flash drive or loading a bootable DVD.
-4. The bootable media loads the memory remanence attack tools, which the attacker uses to scan the system memory and locate the encryption keys.
-5. The attacker uses the encryption keys to access the drive’s data.
-
-If the attacker is unable to boot the device to another operating system (for example, if bootable flash drives have been disabled or Secure Boot is enabled), the attacker can attempt to physically remove the frozen memory from the device and attach it to a different, possibly identical device. Fortunately, this process has proven extremely unreliable, as evidenced by the Defence Research and Development Canada (DRDC) Valcartier group’s analysis (see [An In-depth Analysis of the Cold Boot Attack](http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA545078)). On an increasing portion of modern devices, this type of attack is not even possible, because memory is soldered directly to the motherboard.
-
-Although Princeton’s research proved that this type of attack was possible on devices that have removable memory, device hardware has changed since the research was published in 2008:
-
-- Secure Boot prevents the malicious tools that the Princeton attack depends on from running on the target device.
-- Windows systems with BIOS or UEFI can be locked down with a password, and booting to a USB drive can be prevented.
-- If booting to USB is required on the device, it can be limited to starting trusted operating systems by using Secure Boot.
-- The discharge rates of memory are highly variable among devices, and many devices have memory that is completely immune to memory remanence attacks.
-- Increased density of memory diminishes their remanence properties and reduces the likelihood that the attack can be successfully executed, even when memory is physically removed and placed in an identical system where the system’s configuration may enable booting to the malicious tools.
-
-Because of these factors, this type of attack is rarely possible on modern devices. Even in cases where the risk factors exist on legacy devices, attackers will find the attack unreliable. For detailed info about the practical uses for forensic memory acquisition and the factors that make a computer vulnerable or resistant to memory remanence attacks, read [An In-depth Analysis of the Cold Boot Attack](http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA545078).
-
-The BitLocker pre-boot authentication feature can successfully mitigate memory remanence attacks on most devices, but you can also mitigate such attacks by protecting the system UEFI or BIOS and prevent the PC from booting from external media (such as a USB flash drive or DVD). The latter option is often a better choice, because it provides sufficient protection without inconveniencing users with pre-boot authentication.
-
-## See also
-
-- [BitLocker countermeasures](bitlocker-countermeasures.md)
-- [Choose the right BitLocker countermeasure](choose-the-right-bitlocker-countermeasure.md)
-- [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md)
-- [BitLocker overview](bitlocker-overview.md)
diff --git a/windows/security/information-protection/encrypted-hard-drive.md b/windows/security/information-protection/encrypted-hard-drive.md
index 323e089979..68675bb3d6 100644
--- a/windows/security/information-protection/encrypted-hard-drive.md
+++ b/windows/security/information-protection/encrypted-hard-drive.md
@@ -39,7 +39,7 @@ Encrypted Hard Drives are supported natively in the operating system through the
>**Warning:** Self-Encrypting Hard Drives and Encrypted Hard Drives for Windows are not the same type of device. Encrypted Hard Drives for Windows require compliance for specific TCG protocols as well as IEEE 1667 compliance; Self-Encrypting Hard Drives do not have these requirements. It is important to confirm the device type is an Encrypted Hard Drive for Windows when planning for deployment.
-If you are a storage device vendor who is looking for more info on how to implement Encrypted Hard Drive, see the [Encrypted Hard Drive Device Guide](http://msdn.microsoft.com/library/windows/hardware/dn653989.aspx).
+If you are a storage device vendor who is looking for more info on how to implement Encrypted Hard Drive, see the [Encrypted Hard Drive Device Guide](https://msdn.microsoft.com/library/windows/hardware/dn653989.aspx).
## System Requirements
@@ -70,7 +70,7 @@ Configuration of Encrypted Hard Drives as startup drives is done using the same
- **Deploy from media**: Configuration of Encrypted Hard Drives happens automatically through the installation process.
- **Deploy from network**: This deployment method involves booting a Windows PE environment and using imaging tools to apply a Windows image from a network share. Using this method, the Enhanced Storage optional component needs to be included in the Windows PE image. You can enable this component using Server Manager, Windows PowerShell, or the DISM command line tool. If this component is not present, configuration of Encrypted Hard Drives will not work.
-- **Deploy from server**: This deployment method involves PXE booting a client with Encrypted Hard Drives present. Configuration of Encrypted Hard Drives happens automatically in this environment when the Enhanced Storage component is added to the PXE boot image. During deployment, the [TCGSecurityActivationDisabled](http://msdn.microsoft.com/library/windows/hardware/dn923247.aspx) setting in unattend.xml controls the encryption behavior of Encrypted Hard Drives.
+- **Deploy from server**: This deployment method involves PXE booting a client with Encrypted Hard Drives present. Configuration of Encrypted Hard Drives happens automatically in this environment when the Enhanced Storage component is added to the PXE boot image. During deployment, the [TCGSecurityActivationDisabled](https://msdn.microsoft.com/library/windows/hardware/dn923247.aspx) setting in unattend.xml controls the encryption behavior of Encrypted Hard Drives.
- **Disk Duplication**: This deployment method involves use of a previously configured device and disk duplication tools to apply a Windows image to an Encrypted Hard Drive. Disks must be partitioned using at least Windows 8 or Windows Server 2012 for this configuration to work. Images made using disk duplicators will not work.
### Encrypted Hard Drive Architecture
@@ -81,7 +81,7 @@ The Data Encryption Key is the key used to encrypt all of the data on the drive.
The Authentication Key is the key used to unlock data on the drive. A hash of the key is stored on drive and requires confirmation to decrypt the DEK.
-When a computer with an Encrypted Hard Drive is in a powered off state, the drive locks automatically. As a computer powers on, the device remains in a locked state and is only unlocked after the Authentication Key decrypts the Data Encryption Key. Once the Authentication Key decrypts the Data
+When a computer with an Encrypted Hard Drive is in a powered off state, the drive locks automatically. As a computer powers on, the device remains in a locked state and is only unlocked after the Authentication Key decrypts the Data Encryption Key. Once the Authentication Key decrypts the Data
Encryption Key, read-write operations can take place on the device.
When writing data to the drive, it passes through an encryption engine before the write operation completes. Likewise, reading data from the drive requires the encryption engine to decrypt the data before passing that data back to the user. In the event that the DEK needs to be changed or erased, the data on the drive does not need to be re-encrypted. A new Authentication Key needs to be created and it will re-encrypt the DEK. Once completed, the DEK can now be unlocked using the new AK and read-writes to the volume can continue.
diff --git a/windows/security/information-protection/images/device-details-tab.png b/windows/security/information-protection/images/device-details-tab.png
new file mode 100644
index 0000000000..4dfe33e156
Binary files /dev/null and b/windows/security/information-protection/images/device-details-tab.png differ
diff --git a/windows/security/information-protection/images/kernel-dma-protection-user-experience.png b/windows/security/information-protection/images/kernel-dma-protection-user-experience.png
new file mode 100644
index 0000000000..8949c51627
Binary files /dev/null and b/windows/security/information-protection/images/kernel-dma-protection-user-experience.png differ
diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md
new file mode 100644
index 0000000000..fc494015d5
--- /dev/null
+++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md
@@ -0,0 +1,109 @@
+---
+title: Kernel DMA Protection for Thunderbolt™ 3 (Windows 10)
+description: Kernel DMA Protection protects PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports.
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+author: aadake
+ms.date: 09/06/2018
+---
+
+# Kernel DMA Protection for Thunderbolt™ 3
+
+**Applies to**
+- Windows 10
+
+In Windows 10 version 1803, Microsoft introduced a new feature called Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports.
+Drive-by DMA attacks can lead to disclosure of sensitive information residing on a PC, or even injection of malware that allows attackers to bypass the lock screen or control PCs remotely.
+
+This feature does not protect against DMA attacks via 1394/FireWire, PCMCIA, CardBus, ExpressCard, and so on.
+
+## Background
+
+PCI devices are DMA-capable, which allows them to read and write to system memory at will, without having to engage the system processor in these operations.
+The DMA capability is what makes PCI devices the highest performing devices available today.
+These devices have historically existed only inside the PC chassis, either connected as a card or soldered on the motherboard.
+Access to these devices required the user to turn off power to the system and disassemble the chassis.
+Today, this is no longer the case with Thunderbolt™.
+
+Thunderbolt™ technology has provided modern PCs with extensibility that was not available before for PCs.
+It allows users to attach new classes of external peripherals, such as graphics cards or other PCI devices, to their PCs with a hot plug experience identical to USB.
+Having PCI hot plug ports externally and easily accessible makes PCs susceptible to drive-by DMA attacks.
+
+Drive-by DMA attacks are attacks that occur while the owner of the system is not present and usually take less than 10 minutes, with simple to moderate attacking tools (affordable, off-the-shelf hardware and software) that do not require the disassembly of the PC.
+A simple example would be a PC owner leaves the PC for a quick coffee break, and within the break, and attacker steps in, plugs in a USB-like device and walks away with all the secrets on the machine, or injects a malware that allows them to have full control over the PC remotely.
+
+## How Windows protects against DMA drive-by attacks
+
+Windows leverages the system Input/Output Memory Management Unit (IOMMU) to block external devices from starting and performing DMA unless the drivers for these devices support memory isolation (such as DMA-remapping).
+Devices with compatible drivers will be automatically enumerated, started and allowed to perform DMA to their assigned memory regions.
+Devices with incompatible drivers will be blocked from starting and performing DMA until an authorized user signs into the system or unlocks the screen.
+
+## User experience
+
+
+
+A device that is incompatible with DMA-remapping will be blocked from starting if the device was plugged in before an authorized user logs in, or while the screen is locked.
+Once the system is unlocked, the device driver will be started by the OS, and the device will continue to function normally until the system is rebooted, or the device is unplugged.
+The devices will continue to function normally if the user locks the screen or logs out of the system.
+
+## System compatibility
+
+Kernel DMA Protection requires new UEFI firmware support.
+This support is anticipated only on newly-introduced, Intel-based systems shipping with Windows 10 version 1803 (not all systems). Virtualization-based Security (VBS) is not required.
+
+To see if a system supports Kernel DMA Protection, check the System Information desktop app (MSINFO32).
+Systems released prior to Windows 10 version 1803 do not support Kernel DMA Protection, but they can leverage other DMA attack mitigations as described in [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md).
+
+>[!NOTE]
+>Kernel DMA Protection is not compatible with other BitLocker DMA attacks countermeasures. It is recommended to disable the BitLocker DMA attacks countermeasures if the system supports Kernel DMA Protection. Kernel DMA Protection provides higher security bar for the system over the BitLocker DMA attack countermeasures, while maintaining usability of external peripherals.
+
+## Enabling Kernel DMA protection
+
+Systems running Windows 10 version 1803 that do support Kernel DMA Protection do have this security feature enabled automatically by the OS with no user or IT admin configuration required.
+
+**To check if a device supports kernel DMA protection**
+
+1. Launch MSINFO32.exe in a command prompt, or in the Windows search bar.
+2. Check the value of **Kernel DMA Protection**.
+ 
+3. If the current state of **Kernel DMA Protection** is OFF and **Virtualization Technology in Firmware** is NO:
+ - Reboot into BIOS settings
+ - Turn on Intel Virtualization Technology.
+ - Turn on Intel Virtualization Technology for I/O (VT-d). In Windows 10 version 1803, only Intel VT-d is supported. Other platforms can use DMA attack mitigations described in BitLocker Countermeasures.
+ - Reboot system into Windows 10.
+4. If the state of **Kernel DMA Protection** remains Off, then the system does not support this feature.
+
+## Frequently asked questions
+
+### Do in-market systems support Kernel DMA protection for Thunderbolt™ 3?
+In market systems, released with Windows 10 version 1709 or earlier, will not support Kernel DMA protection for Thunderbolt™ 3 after upgrading to Windows 10 version 1803, as this feature requires the BIOS/platform firmware changes and guarantees.
+
+### Does Kernel DMA Protection prevent drive-by DMA attacks during Boot?
+No, Kernel DMA Protection only protects against drive-by DMA attacks after the OS is loaded. It is the responsibility of the system firmware/BIOS to protect against attacks via the Thunderbolt™ 3 ports during boot.
+
+### How can I check if a certain driver supports DMA-remapping?
+DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the following Property GUID (highlighted in red in the image below) in the Details tab of a device in Device Manager. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping.
+Please check the driver instance for the device you are testing. Some drivers may have varying values depending on the location of the device (internal vs. external).
+
+
+
+### What should I do if the drivers for my Thunderbolt™ 3 peripherals do not support DMA-remapping?
+If the peripherals do have class drivers provided by Windows 10, please use these drivers on your systems. If there are no class drivers provided by Windows for your peripherals, please contact your peripheral vendor/driver vendor to update the driver to support this functionality. Details for driver compatibility requirements can be found here (add link to OEM documentation).
+
+### Do Microsoft drivers support DMA-remapping?
+In Windows 10 1803 and beyond, the Microsoft inbox drivers for USB XHCI (3.x) Controllers, Storage AHCI/SATA Controllers and Storage NVMe Controllers support DMA-remapping.
+
+### Do drivers for non-PCI devices need to be compatible with DMA-remapping?
+No. Devices for non-PCI peripherals, such as USB devices, do not perform DMA, thus no need for the driver to be compatible with DMA-remapping.
+
+### How can an enterprise enable the “External device enumeration” policy?
+The “External device enumeration” policy controls whether to enumerate external devices that are not compatible with DMA-remapping. Devices that are compatible with DMA-remapping are always enumerated. The policy can be enabled via Group Policy or Mobile Device Management (MDM):
+- Group Policy: Administrative Templates\System\Kernel DMA Protection\Enumeration policy for external devices incompatible with Kernel DMA Protection
+- MDM: [DmaGuard policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-dmaguard#dmaguard-policies)
+
+## Related topics
+
+- [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md)
+- [DmaGuard MDM policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-dmaguard#dmaguard-policies)
diff --git a/windows/security/information-protection/secure-the-windows-10-boot-process.md b/windows/security/information-protection/secure-the-windows-10-boot-process.md
index b939898180..99a3d2d62b 100644
--- a/windows/security/information-protection/secure-the-windows-10-boot-process.md
+++ b/windows/security/information-protection/secure-the-windows-10-boot-process.md
@@ -1,5 +1,5 @@
---
-title: Secure the Windows 10 boot process
+title: Secure the Windows 10 boot process
description: This article describes how Windows 10 security features helps protect your PC from malware, including rootkits and other applications
keywords: trusted boot, windows 10 boot proces
ms.prod: w10
@@ -13,7 +13,7 @@ ms.date: 10/13/2017
# Secure the Windows 10 boot process
-**Applies to:**
+**Applies to:**
- Windows 10
- Windows 8.1
@@ -48,9 +48,9 @@ Windows 10 supports four features to help prevent rootkits and bootkits from lo
Figure 1 shows the Windows 10 startup process.
-
+
.png)
-
+
**Figure 1. Secure Boot, Trusted Boot, and Measured Boot block malware at every stage**
Secure Boot and Measured Boot are only possible on PCs with UEFI 2.3.1 and a TPM chip. Fortunately, all Windows 10 PCs that meet Windows Hardware Compatibility Program requirements have these components, and many PCs designed for earlier versions of Windows have them as well.
@@ -78,7 +78,7 @@ These requirements help protect you from rootkits while allowing you to run any
- **Configure UEFI to trust your custom bootloader.** All Certified For Windows 10 PCs allow you to trust a non-certified bootloader by adding a signature to the UEFI database, allowing you to run any operating system, including homemade operating systems.
- **Turn off Secure Boot.** All Certified For Windows 10 PCs allow you to turn off Secure Boot so that you can run any software. This does not help protect you from bootkits, however.
-To prevent malware from abusing these options, the user must manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software cannot change the Secure Boot settings. For more information about Secure Boot, read the blog, [Protecting the pre-OS environment with UEFI](http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx).
+To prevent malware from abusing these options, the user must manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software cannot change the Secure Boot settings. For more information about Secure Boot, read the blog, [Protecting the pre-OS environment with UEFI](https://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx).
Like most mobile devices, ARM-based Certified For Windows RT devices, such as the Microsoft Surface RT device, are designed to run only Windows 8.1. Therefore, Secure Boot cannot be turned off, and you cannot load a different operating system. Fortunately, there is a large market of ARM devices designed to run other operating systems.
@@ -108,14 +108,14 @@ Depending on the implementation and configuration, the server can now determine
Figure 2 illustrates the Measured Boot and remote attestation process.
-
+
.png)
**Figure 2. Measured Boot proves the PC’s health to a remote server**
-Windows 10 includes the application programming interfaces to support Measured Boot, but you’ll need non-Microsoft tools to implement a remote attestation client and trusted attestation server to take advantage of it. For an example of such a tool, download the [TPM Platform Crypto-Provider Toolkit](http://research.microsoft.com/en-us/downloads/74c45746-24ad-4cb7-ba4b-0c6df2f92d5d/) from Microsoft Research or Microsoft Enterprise Security MVP Dan Griffin’s [Measured Boot Tool](http://mbt.codeplex.com/).
+Windows 10 includes the application programming interfaces to support Measured Boot, but you’ll need non-Microsoft tools to implement a remote attestation client and trusted attestation server to take advantage of it. For an example of such a tool, download the [TPM Platform Crypto-Provider Toolkit](https://research.microsoft.com/en-us/downloads/74c45746-24ad-4cb7-ba4b-0c6df2f92d5d/) from Microsoft Research or Microsoft Enterprise Security MVP Dan Griffin’s [Measured Boot Tool](http://mbt.codeplex.com/).
Measured Boot uses the power of UEFI, TPM, and Windows 10 to give you a way to confidently assess the trustworthiness of a client PC across the network.
diff --git a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md
index 62a7797e04..44e66ef033 100644
--- a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md
+++ b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md
@@ -18,7 +18,7 @@ The Windows 10 operating system improves most existing security features in the
**See also:**
- - [Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications)
+ - [Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications)
- [TPM Fundamentals](tpm-fundamentals.md)
@@ -66,17 +66,17 @@ In Windows, the Virtual Smart Card feature allows the TPM to mimic a permanently
For TPM-based virtual smart cards, the TPM protects the use and storage of the certificate private key so that it cannot be copied when it is in use or stored and used elsewhere. Using a component that is part of the system rather than a separate physical smart card can reduce total cost of ownership because it eliminates “lost card” and “card left at home” scenarios while still delivering the benefits of smart card–based multifactor authentication. For users, virtual smart cards are simple to use, requiring only a PIN to unlock. Virtual smart cards support the same scenarios that physical smart cards support, including signing in to Windows or authenticating for resource access.
-## Windows Hello for Business
+## Windows Hello for Business
Windows Hello for Business provides authentication methods intended to replace passwords, which can be difficult to remember and easily compromised. In addition, user name - password solutions for authentication often reuse the same user name – password combinations on multiple devices and services; if those credentials are compromised, they are compromised in many places. Windows Hello for Business provisions devices one by one and combines the information provisioned on each device (i.e., the cryptographic key) with additional information to authenticate users. On a system that has a TPM, the TPM can protect the key. If a system does not have a TPM, software-based techniques protect the key. The additional information the user supplies can be a PIN value or, if the system has the necessary hardware, biometric information, such as fingerprint or facial recognition. To protect privacy, the biometric information is used only on the provisioned device to access the provisioned key: it is not shared across devices.
-The adoption of new authentication technology requires that identity providers and organizations deploy and use that technology. Windows Hello for Business lets users authenticate with their existing Microsoft account, an Active Directory account, a Microsoft Azure Active Directory account, or even non-Microsoft Identity Provider Services or Relying Party Services that support [Fast ID Online V2.0 authentication](http://go.microsoft.com/fwlink/p/?LinkId=533889).
+The adoption of new authentication technology requires that identity providers and organizations deploy and use that technology. Windows Hello for Business lets users authenticate with their existing Microsoft account, an Active Directory account, a Microsoft Azure Active Directory account, or even non-Microsoft Identity Provider Services or Relying Party Services that support [Fast ID Online V2.0 authentication](https://go.microsoft.com/fwlink/p/?LinkId=533889).
Identity providers have flexibility in how they provision credentials on client devices. For example, an organization might provision only those devices that have a TPM so that the organization knows that a TPM protects the credentials. The ability to distinguish a TPM from malware acting like a TPM requires the following TPM capabilities (see Figure 1):
• **Endorsement key**. The TPM manufacturer can create a special key in the TPM called an *endorsement key*. An endorsement key certificate, signed by the manufacturer, says that the endorsement key is present in a TPM that that manufacturer made. Solutions can use the certificate with the TPM containing the endorsement key to confirm a scenario really involves a TPM from a specific TPM manufacturer (instead of malware acting like a TPM.
-• **Attestation identity key**. To protect privacy, most TPM scenarios do not directly use an actual endorsement key. Instead, they use attestation identity keys, and an identity certificate authority (CA) uses the endorsement key and its certificate to prove that one or more attestation identity keys actually exist in a real TPM. The identity CA issues attestation identity key certificates. More than one identity CA will generally see the same endorsement key certificate that can uniquely identify the TPM, but any number of attestation identity key certificates can be created to limit the information shared in other scenarios.
+• **Attestation identity key**. To protect privacy, most TPM scenarios do not directly use an actual endorsement key. Instead, they use attestation identity keys, and an identity certificate authority (CA) uses the endorsement key and its certificate to prove that one or more attestation identity keys actually exist in a real TPM. The identity CA issues attestation identity key certificates. More than one identity CA will generally see the same endorsement key certificate that can uniquely identify the TPM, but any number of attestation identity key certificates can be created to limit the information shared in other scenarios.
@@ -100,7 +100,7 @@ Newer hardware and Windows 10 work better together to disable direct memory acce
## Device Encryption
-Device Encryption is the consumer version of BitLocker, and it uses the same underlying technology. How it works is if a customer logs on with a Microsoft account and the system meets Modern Standby hardware requirements, BitLocker Drive Encryption is enabled automatically in Windows 10. The recovery key is backed up in the Microsoft cloud and is accessible to the consumer through his or her Microsoft account. The Modern Standby hardware requirements inform Windows 10 that the hardware is appropriate for deploying Device Encryption and allows use of the “TPM-only” configuration for a simple consumer experience. In addition, Modern Standby hardware is designed to reduce the likelihood that measurement values change and prompt the customer for the recovery key.
+Device Encryption is the consumer version of BitLocker, and it uses the same underlying technology. How it works is if a customer logs on with a Microsoft account and the system meets Modern Standby hardware requirements, BitLocker Drive Encryption is enabled automatically in Windows 10. The recovery key is backed up in the Microsoft cloud and is accessible to the consumer through his or her Microsoft account. The Modern Standby hardware requirements inform Windows 10 that the hardware is appropriate for deploying Device Encryption and allows use of the “TPM-only” configuration for a simple consumer experience. In addition, Modern Standby hardware is designed to reduce the likelihood that measurement values change and prompt the customer for the recovery key.
For software measurements, Device Encryption relies on measurements of the authority providing software components (based on code signing from manufacturers such as OEMs or Microsoft) instead of the precise hashes of the software components themselves. This permits servicing of components without changing the resulting measurement values. For configuration measurements, the values used are based on the boot security policy instead of the numerous other configuration settings recorded during startup. These values also change less frequently. The result is that Device Encryption is enabled on appropriate hardware in a user-friendly way while also protecting data.
@@ -118,7 +118,7 @@ The TPM provides the following way for scenarios to use the measurements recorde
• **Remote Attestation**. Using an attestation identity key, the TPM can generate and cryptographically sign a statement (or*quote*) of the current measurements in the TPM. Windows 10 can create unique attestation identity keys for various scenarios to prevent separate evaluators from collaborating to track the same device. Additional information in the quote is cryptographically scrambled to limit information sharing and better protect privacy. By sending the quote to a remote entity, a device can attest which software and configuration settings were used to boot the device and initialize the operating system. An attestation identity key certificate can provide further assurance that the quote is coming from a real TPM. Remote attestation is the process of recording measurements in the TPM, generating a quote, and sending the quote information to another system that evaluates the measurements to establish trust in a device. Figure 2 illustrates this process.
-When new security features are added to Windows, Measured Boot adds security-relevant configuration information to the measurements recorded in the TPM. Measured Boot enables remote attestation scenarios that reflect the system firmware and the Windows initialization state.
+When new security features are added to Windows, Measured Boot adds security-relevant configuration information to the measurements recorded in the TPM. Measured Boot enables remote attestation scenarios that reflect the system firmware and the Windows initialization state.
@@ -143,10 +143,10 @@ The resulting solution provides defense in depth, because even if malware runs i
The TPM adds hardware-based security benefits to Windows 10. When installed on hardware that includes a TPM, Window 10 delivers remarkably improved security benefits. The following table summarizes the key benefits of the TPM’s major features.
-
+
|Feature | Benefits when used on a system with a TPM|
|---|---|
-| Platform Crypto Provider | • If the machine is compromised, the private key associated with the certificate cannot be copied off the device. • The TPM’s dictionary attack mechanism protects PIN values to use a certificate.
+| Platform Crypto Provider | • If the machine is compromised, the private key associated with the certificate cannot be copied off the device. • The TPM’s dictionary attack mechanism protects PIN values to use a certificate.
| Virtual Smart Card | • Achieve security similar to that of physical smart cards without deploying physical smart cards or card readers.|
| Windows Hello for Business | • Credentials provisioned on a device cannot be copied elsewhere. • Confirm a device’s TPM before credentials are provisioned. |
| BitLocker Drive Encryption | • Multiple options are available for enterprises to protect data at rest while balancing security requirements with different device hardware.
diff --git a/windows/security/information-protection/tpm/manage-tpm-lockout.md b/windows/security/information-protection/tpm/manage-tpm-lockout.md
index b12ca2ea4c..db918c0ba6 100644
--- a/windows/security/information-protection/tpm/manage-tpm-lockout.md
+++ b/windows/security/information-protection/tpm/manage-tpm-lockout.md
@@ -79,7 +79,7 @@ For information about mitigating dictionary attacks that use the lockout setting
## Use the TPM cmdlets
-You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx).
+You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](https://technet.microsoft.com/library/jj603116.aspx).
## Related topics
diff --git a/windows/security/information-protection/tpm/tpm-fundamentals.md b/windows/security/information-protection/tpm/tpm-fundamentals.md
index 5b7969364b..23eb4f8be3 100644
--- a/windows/security/information-protection/tpm/tpm-fundamentals.md
+++ b/windows/security/information-protection/tpm/tpm-fundamentals.md
@@ -64,11 +64,11 @@ Virtual Smart Card must be issued to the user for each computer. A computer that
## TPM-based certificate storage
-The TPM can be used to protect certificates and RSA keys. The TPM key storage provider (KSP) provides easy, convenient use of the TPM as a way of strongly protecting private keys. The TPM KSP can be used to generate keys when an organization enrolls for certificates, and the KSP is managed by templates in the UI. The TPM can also be used to protect certificates that are imported from an outside source. TPM-based certificates can be used exactly as standard certificates with the added functionality that the certificate can never leave the TPM from which the keys were generated. The TPM can now be used for crypto-operations through Cryptography API: Next Generation (CNG). For more info, see [Cryptography API: Next Generation](http://msdn.microsoft.com/library/windows/desktop/aa376210.aspx).
+The TPM can be used to protect certificates and RSA keys. The TPM key storage provider (KSP) provides easy, convenient use of the TPM as a way of strongly protecting private keys. The TPM KSP can be used to generate keys when an organization enrolls for certificates, and the KSP is managed by templates in the UI. The TPM can also be used to protect certificates that are imported from an outside source. TPM-based certificates can be used exactly as standard certificates with the added functionality that the certificate can never leave the TPM from which the keys were generated. The TPM can now be used for crypto-operations through Cryptography API: Next Generation (CNG). For more info, see [Cryptography API: Next Generation](https://msdn.microsoft.com/library/windows/desktop/aa376210.aspx).
## TPM Cmdlets
-You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx).
+You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](https://docs.microsoft.com/en-us/powershell/module/trustedplatformmodule/).
## Physical presence interface
@@ -112,24 +112,24 @@ TPM 2.0 allows some keys to be created without an authorization value associate
### Rationale behind the defaults
-Originally, BitLocker allowed from 4 to 20 characters for a PIN.
-Windows Hello has its own PIN for logon, which can be 4 to 127 characters.
-Both BitLocker and Windows Hello use the TPM to prevent PIN brute-force attacks.
+Originally, BitLocker allowed from 4 to 20 characters for a PIN.
+Windows Hello has its own PIN for logon, which can be 4 to 127 characters.
+Both BitLocker and Windows Hello use the TPM to prevent PIN brute-force attacks.
-The TPM can be configured to use Dictionary Attack Prevention parameters ([lockout threshold and lockout duration](trusted-platform-module-services-group-policy-settings.md)) to control how many failed authorizations attempts are allowed before the TPM is locked out, and how much time must elapse before another attempt can be made.
+The TPM can be configured to use Dictionary Attack Prevention parameters ([lockout threshold and lockout duration](trusted-platform-module-services-group-policy-settings.md)) to control how many failed authorizations attempts are allowed before the TPM is locked out, and how much time must elapse before another attempt can be made.
-The Dictionary Attack Prevention Parameters provide a way to balance security needs with usability.
-For example, when BitLocker is used with a TPM + PIN configuration, the number of PIN guesses is limited over time.
-A TPM 2.0 in this example could be configured to allow only 32 PIN guesses immediately, and then only one more guess every two hours.
-This totals a maximum of about 4415 guesses per year.
-If the PIN is 4 digits, all 9999 possible PIN combinations could be attempted in a little over two years.
+The Dictionary Attack Prevention Parameters provide a way to balance security needs with usability.
+For example, when BitLocker is used with a TPM + PIN configuration, the number of PIN guesses is limited over time.
+A TPM 2.0 in this example could be configured to allow only 32 PIN guesses immediately, and then only one more guess every two hours.
+This totals a maximum of about 4415 guesses per year.
+If the PIN is 4 digits, all 9999 possible PIN combinations could be attempted in a little over two years.
-Increasing the PIN length requires a greater number of guesses for an attacker.
+Increasing the PIN length requires a greater number of guesses for an attacker.
In that case, the lockout duration between each guess can be shortened to allow legitimate users to retry a failed attempt sooner, while maintaining a similar level of protection.
-Beginning with Windows 10, version 1703, the minimum length for the BitLocker PIN was increased to 6 characters to better align with other Windows features that leverage TPM 2.0, including Windows Hello.
-To help organizations with the transition, beginning with Windows 10, version 1709 and Windows 10, version 1703 with the October 2017 [cumulative update](https://support.microsoft.com/help/4018124) installed, the BitLocker PIN length is 6 characters by default, but it can be reduced to 4 characters.
-If the minimum PIN length is reduced from the default of six characters, then the TPM 2.0 lockout period will be extended.
+Beginning with Windows 10, version 1703, the minimum length for the BitLocker PIN was increased to 6 characters to better align with other Windows features that leverage TPM 2.0, including Windows Hello.
+To help organizations with the transition, beginning with Windows 10, version 1709 and Windows 10, version 1703 with the October 2017 [cumulative update](https://support.microsoft.com/help/4018124) installed, the BitLocker PIN length is 6 characters by default, but it can be reduced to 4 characters.
+If the minimum PIN length is reduced from the default of six characters, then the TPM 2.0 lockout period will be extended.
### TPM-based smart cards
@@ -144,6 +144,6 @@ The Windows TPM-based smart card, which is a virtual smart card, can be configur
## Related topics
- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics)
-- [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx)
+- [TPM Cmdlets in Windows PowerShell](https://docs.microsoft.com/en-us/powershell/module/trustedplatformmodule/)
- [TPM WMI providers](https://msdn.microsoft.com/library/aa376476.aspx)
-- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://technet.microsoft.com/itpro/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations)
\ No newline at end of file
+- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://technet.microsoft.com/itpro/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations)
diff --git a/windows/security/information-protection/tpm/tpm-recommendations.md b/windows/security/information-protection/tpm/tpm-recommendations.md
index d2d690c0e6..00b392f1c2 100644
--- a/windows/security/information-protection/tpm/tpm-recommendations.md
+++ b/windows/security/information-protection/tpm/tpm-recommendations.md
@@ -51,7 +51,7 @@ TPM 2.0 products and systems have important security advantages over TPM 1.2, in
- For the list of algorithms that Windows supports in the platform cryptographic storage provider, see [CNG Cryptographic Algorithm Providers](https://msdn.microsoft.com/library/windows/desktop/bb931354(v=vs.85).aspx).
- - TPM 2.0 achieved ISO standardization ([ISO/IEC 11889:2015](http://blogs.microsoft.com/cybertrust/2015/06/29/governments-recognize-the-importance-of-tpm-2-0-through-iso-adoption/)).
+ - TPM 2.0 achieved ISO standardization ([ISO/IEC 11889:2015](https://blogs.microsoft.com/cybertrust/2015/06/29/governments-recognize-the-importance-of-tpm-2-0-through-iso-adoption/)).
- Use of TPM 2.0 may help eliminate the need for OEMs to make exception to standard configurations for certain countries and regions.
@@ -101,10 +101,10 @@ The following table defines which Windows features require TPM support.
|-------------------------|--------------|--------------------|--------------------|----------|
| Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot |
| BitLocker | Yes | Yes | Yes | TPM 1.2 or 2.0 is required |
-| Device Encryption | Yes | N/A | Yes | Device Encryption requires Modern Standby/Connected Standby certification, which requires TPM 2.0. |
+| Device Encryption | Yes | N/A | Yes | Device Encryption requires Modern Standby/Connected Standby certification, which requires TPM 2.0. |
| Windows Defender Application Control (Device Guard) | No | Yes | Yes | |
-| Windows Defender Exploit Guard | Yes | Yes | Yes | |
-| Windows Defender System Guard | Yes | Yes | Yes | |
+| Windows Defender Exploit Guard | Yes | Yes | Yes | |
+| Windows Defender System Guard | Yes | Yes | Yes | |
| Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. |
| Device Health Attestation| Yes | Yes | Yes | |
| Windows Hello/Windows Hello for Business| No | Yes | Yes | Azure AD join supports both versions of TPM, but requires TPM with keyed-hash message authentication code (HMAC) and Endorsement Key (EK) certificate for key attestation support. |
@@ -112,7 +112,7 @@ The following table defines which Windows features require TPM support.
| TPM Platform Crypto Provider Key Storage Provider| Yes | Yes| Yes | |
| Virtual Smart Card | Yes | Yes | Yes | |
| Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM. |
-
+
## OEM Status on TPM 2.0 system availability and certified parts
Government customers and enterprise customers in regulated industries may have acquisition standards that require use of common certified TPM parts. As a result, OEMs, who provide the devices, may be required to use only certified TPM components on their commercial class systems. For more information, contact your OEM or hardware vendor.
diff --git a/windows/security/information-protection/tpm/trusted-platform-module-overview.md b/windows/security/information-protection/tpm/trusted-platform-module-overview.md
index 6c4d5fad54..94c5d6fbce 100644
--- a/windows/security/information-protection/tpm/trusted-platform-module-overview.md
+++ b/windows/security/information-protection/tpm/trusted-platform-module-overview.md
@@ -81,5 +81,5 @@ Some things that you can check on the device are:
## Related topics
- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics)
-- [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx)
+- [TPM Cmdlets in Windows PowerShell](https://technet.microsoft.com/library/jj603116.aspx)
- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://technet.microsoft.com/itpro/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations)
diff --git a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md
index cc99d381bd..e91d6c96e7 100644
--- a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md
+++ b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md
@@ -32,7 +32,7 @@ Apps can be enlightened or unenlightened:
- Windows **Save As** experiences only allow you to save your files as enterprise.
-- **WIP-work only apps** are unenlightened line-of-business apps that have been tested and deemed safe for use in an enterprise with WIP and Mobile App Management (MAM) solutions.
+- **WIP-work only apps** are unenlightened line-of-business apps that have been tested and deemed safe for use in an enterprise with WIP and Mobile App Management (MAM) solutions.
## List of enlightened Microsoft apps
Microsoft has made a concerted effort to enlighten several of our more popular apps, including the following:
@@ -82,7 +82,7 @@ You can add any or all of the enlightened Microsoft apps to your allowed apps li
|PowerPoint Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` **Product Name:** Microsoft.Office.PowerPoint **App Type:** Universal app |
|OneNote |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` **Product Name:** Microsoft.Office.OneNote **App Type:** Universal app |
|Outlook Mail and Calendar |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` **Product Name:** microsoft.windowscommunicationsapps **App Type:** Universal app |
-|Office 365 ProPlus|Office 365 ProPlus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](http://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for WIP. We don't recommend setting up Office by using individual paths or publisher rules.|
+|Office 365 ProPlus|Office 365 ProPlus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](https://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for WIP. We don't recommend setting up Office by using individual paths or publisher rules.|
|Microsoft Photos |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` **Product Name:** Microsoft.Windows.Photos **App Type:** Universal app |
|Groove Music |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` **Product Name:** Microsoft.ZuneMusic **App Type:** Universal app |
|Microsoft Movies & TV |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` **Product Name:** Microsoft.ZuneVideo **App Type:** Universal app |
diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md
index efc971485b..2d5f0c92fd 100644
--- a/windows/security/threat-protection/TOC.md
+++ b/windows/security/threat-protection/TOC.md
@@ -1,42 +1,24 @@
# [Threat protection](index.md)
-
-
-
-
-
## [Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md)
-### [Windows Defender Security Center](windows-defender-atp/windows-defender-security-center-atp.md)
-####Get started
-##### [Minimum requirements](windows-defender-atp\minimum-requirements-windows-defender-advanced-threat-protection.md)
-##### [Validate licensing and complete setup](windows-defender-atp\licensing-windows-defender-advanced-threat-protection.md)
-##### [Troubleshoot subscription and portal access issues](windows-defender-atp\troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md)
-##### [Preview features](windows-defender-atp\preview-windows-defender-advanced-threat-protection.md)
-##### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md)
-##### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md)
-#### [Onboard machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md)
-##### [Onboard previous versions of Windows](windows-defender-atp\onboard-downlevel-windows-defender-advanced-threat-protection.md)
-##### [Onboard Windows 10 machines](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md)
-###### [Onboard machines using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
-###### [Onboard machines using System Center Configuration Manager](windows-defender-atp\configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
-###### [Onboard machines using Mobile Device Management tools](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
-####### [Onboard machines using Microsoft Intune](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune)
-###### [Onboard machines using a local script](windows-defender-atp\configure-endpoints-script-windows-defender-advanced-threat-protection.md)
-###### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp\configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
-##### [Onboard servers](windows-defender-atp\configure-server-endpoints-windows-defender-advanced-threat-protection.md)
-##### [Onboard non-Windows machines](windows-defender-atp\configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
-##### [Run a detection test on a newly onboarded machine](windows-defender-atp\run-detection-test-windows-defender-advanced-threat-protection.md)
-##### [Run simulated attacks on machines](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md)
-##### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md)
-##### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
-#### [Understand the portal ](windows-defender-atp\use-windows-defender-advanced-threat-protection.md)
-##### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md)
-##### [View the Security operations dashboard](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md)
-##### [View the Secure Score dashboard and improve your secure score](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md)
-##### [View the Threat analytics dashboard and take recommended mitigation actions](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md)
-####Investigate and remediate threats
-#####Alerts queue
+### [Overview](windows-defender-atp/overview.md)
+#### [Attack surface reduction](windows-defender-atp/overview-attack-surface-reduction.md)
+##### [Hardware-based isolation](windows-defender-atp/overview-hardware-based-isolation.md)
+###### [Application isolation](windows-defender-application-guard/wd-app-guard-overview.md)
+###### [System isolation](windows-defender-atp/how-hardware-based-containers-help-protect-windows.md)
+##### [Application control](windows-defender-application-control/windows-defender-application-control.md)
+##### [Exploit protection](windows-defender-exploit-guard/exploit-protection-exploit-guard.md)
+##### [Network protection](windows-defender-exploit-guard/network-protection-exploit-guard.md)
+##### [Controlled folder access](windows-defender-exploit-guard/controlled-folders-exploit-guard.md)
+##### [Attack surface reduction](windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md)
+##### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md)
+#### [Next generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)
+#### [Endpoint detection and response](windows-defender-atp/overview-endpoint-detection-response.md)
+##### [Security operations dashboard](windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md)
+
+
+##### Alerts queue
###### [View and organize the Alerts queue](windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md)
###### [Manage alerts](windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md)
###### [Investigate alerts](windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md)
@@ -45,11 +27,8 @@
###### [Investigate an IP address](windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md)
###### [Investigate a domain](windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md)
###### [Investigate a user account](windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md)
-
-
-
-
-#####Machines list
+
+##### Machines list
###### [View and organize the Machines list](windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md)
###### [Manage machine group and tags](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags)
###### [Alerts related to this machine](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine)
@@ -69,7 +48,7 @@
####### [Isolate machines from the network](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network)
####### [Release machine from isolation](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation)
####### [Check activity details in Action center](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
-
+
###### [Take response actions on a file](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md)
####### [Stop and quarantine files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network)
####### [Remove file from quarantine](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine)
@@ -77,18 +56,238 @@
####### [Remove file from blocked list](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list)
####### [Check activity details in Action center](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
####### [Deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis)
-######## [Submit files for analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis)
-######## [View deep analysis reports](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports)
-######## [Troubleshoot deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis)
+####### [Submit files for analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis)
+####### [View deep analysis reports](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports)
+####### [Troubleshoot deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis)
+
-###### [Query data using Advanced hunting](windows-defender-atp\advanced-hunting-windows-defender-advanced-threat-protection.md)
-####### [Advanced hunting reference](windows-defender-atp\advanced-hunting-reference-windows-defender-advanced-threat-protection.md)
-####### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
+#### [Automated investigation and remediation](windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md)
+##### [Learn about the automated investigation and remediation dashboard](windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md)
-#### [Use Automated investigation to investigate and remediate threats](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md)
-#### [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md)
-####API and SIEM support
+#### [Secure score](windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md)
+##### [Threat analytics](windows-defender-atp/threat-analytics.md)
+###### [Threat analytics for Spectre and Meltdown](windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md)
+#### [Advanced hunting](windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md)
+##### [Query data using Advanced hunting](windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md)
+###### [Advanced hunting reference](windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md)
+###### [Advanced hunting query language best practices](windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
+##### [Custom detections](windows-defender-atp/overview-custom-detections.md)
+###### [Create custom detections rules](windows-defender-atp/custom-detection-rules.md)
+
+
+#### [Management and APIs](windows-defender-atp/management-apis.md)
+##### [Understand threat intelligence concepts](windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
+##### [Supported Windows Defender ATP APIs](windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md)
+######Actor
+####### [Get actor information](windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md)
+####### [Get actor related alerts](windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md)
+######Alerts
+####### [Get alerts](windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md)
+####### [Get alert information by ID](windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md)
+####### [Get alert related actor information](windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md)
+####### [Get alert related domain information](windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md)
+####### [Get alert related file information](windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md)
+####### [Get alert related IP information](windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md)
+####### [Get alert related machine information](windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md)
+#######Domain
+######## [Get domain related alerts](windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md)
+######## [Get domain related machines](windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md)
+######## [Get domain statistics](windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection.md)
+######## [Is domain seen in organization](windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md)
+
+######File
+####### [Block file API](windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md)
+####### [Get file information](windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md)
+####### [Get file related alerts](windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md)
+####### [Get file related machines](windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md)
+####### [Get file statistics](windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md)
+####### [Get FileActions collection API](windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md)
+####### [Unblock file API](windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md)
+
+######IP
+####### [Get IP related alerts](windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md)
+####### [Get IP related machines](windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md)
+####### [Get IP statistics](windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md)
+####### [Is IP seen in organization](windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md)
+######Machines
+####### [Collect investigation package API](windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md)
+####### [Find machine information by IP](windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md)
+####### [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md)
+####### [Get FileMachineAction object API](windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md)
+####### [Get FileMachineActions collection API](windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md)
+####### [Get machine by ID](windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md)
+####### [Get machine log on users](windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md)
+####### [Get machine related alerts](windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md)
+####### [Get MachineAction object API](windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md)
+####### [Get MachineActions collection API](windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md)
+####### [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md)
+####### [Get package SAS URI API](windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md)
+####### [Isolate machine API](windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md)
+####### [Release machine from isolation API](windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md)
+####### [Remove app restriction API](windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md)
+####### [Request sample API](windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md)
+####### [Restrict app execution API](windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md)
+####### [Run antivirus scan API](windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md)
+####### [Stop and quarantine file API](windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md)
+
+######User
+####### [Get alert related user information](windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md)
+####### [Get user information](windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md)
+####### [Get user related alerts](windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md)
+####### [Get user related machines](windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md)
+
+
+##### [Managed service provider provider support](windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md)
+
+#### [Microsoft threat protection](windows-defender-atp/threat-protection-integration.md)
+##### [Protect users, data, and devices with conditional access](windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md)
+##### [Microsoft Cloud App Security integration overview](windows-defender-atp/microsoft-cloud-app-security-integration.md)
+
+
+
+#### [Portal overview](windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md)
+
+
+
+### [Get started](windows-defender-atp/get-started.md)
+#### [Minimum requirements](windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md)
+#### [Validate licensing and complete setup](windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md)
+#### [Preview features](windows-defender-atp/preview-windows-defender-advanced-threat-protection.md)
+#### [Data storage and privacy](windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md)
+#### [Assign user access to the portal](windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md)
+
+#### [Evaluate Windows Defender ATP](windows-defender-atp/evaluate-atp.md)
+#####Evaluate attack surface reduction
+###### [Hardware-based isolation](windows-defender-application-guard/test-scenarios-wd-app-guard.md)
+###### [Application control](windows-defender-application-control/audit-windows-defender-application-control-policies.md)
+###### [Exploit protection](windows-defender-exploit-guard/evaluate-exploit-protection.md)
+###### [Network Protection](windows-defender-exploit-guard/evaluate-network-protection.md)
+###### [Controlled folder access](windows-defender-exploit-guard/evaluate-controlled-folder-access.md)
+###### [Attack surface reduction](windows-defender-exploit-guard/evaluate-attack-surface-reduction.md)
+###### [Network firewall](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md)
+##### [Evaluate next generation protection](windows-defender-antivirus/evaluate-windows-defender-antivirus.md)
+
+#### [Access the Windows Defender Security Center Community Center](windows-defender-atp/community-windows-defender-advanced-threat-protection.md)
+
+### [Configure and manage capabilities](windows-defender-atp/onboard.md)
+#### [Configure attack surface reduction](windows-defender-atp/configure-attack-surface-reduction.md)
+##### [Hardware-based isolation](windows-defender-application-guard/install-wd-app-guard.md)
+###### [Confguration settings](windows-defender-application-guard/configure-wd-app-guard.md)
+##### [Application control](windows-defender-application-control/windows-defender-application-control.md)
+##### [Device control](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
+###### [Memory integrity](windows-defender-exploit-guard/memory-integrity.md)
+####### [Hardware qualifications](windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md)
+####### [Enable HVCI](windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md)
+##### [Exploit protection](windows-defender-exploit-guard/enable-exploit-protection.md)
+###### [Customize exploit protection](windows-defender-exploit-guard/customize-exploit-protection.md)
+###### [Import/export configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md)
+##### [Network protection](windows-defender-exploit-guard/enable-network-protection.md)
+##### [Controlled folder access](windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md)
+###### [Customize controlled folder access](windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md)
+##### [Attack surface reduction controls](windows-defender-exploit-guard/enable-attack-surface-reduction.md)
+###### [Customize attack surface reduction](windows-defender-exploit-guard/customize-attack-surface-reduction.md)
+##### [Network firewall](windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md)
+
+
+
+#### [Configure next generation protection](windows-defender-antivirus/configure-windows-defender-antivirus-features.md)
+##### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md)
+###### [Enable cloud-delivered protection](windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md)
+###### [Specify the cloud-delivered protection level](windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md)
+###### [Configure and validate network connections](windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md)
+###### [Enable Block at first sight](windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md)
+###### [Configure the cloud block timeout period](windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md)
+##### [Configure behavioral, heuristic, and real-time protection](windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md)
+###### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md)
+###### [Enable and configure always-on protection and monitoring](windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md)
+##### [Antivirus on Windows Server 2016](windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md)
+##### [Antivirus compatibility](windows-defender-antivirus/windows-defender-antivirus-compatibility.md)
+###### [Use limited periodic antivirus scanning](windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md)
+
+##### [Deploy, manage updates, and report on antivirus](windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md)
+###### [Deploy and enable antivirus](windows-defender-antivirus/deploy-windows-defender-antivirus.md)
+####### [Deployment guide for VDI environments](windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md)
+###### [Report on antivirus protection](windows-defender-antivirus/report-monitor-windows-defender-antivirus.md)
+####### [Troubleshoot antivirus reporting in Update Compliance](windows-defender-antivirus/troubleshoot-reporting.md)
+###### [Manage updates and apply baselines](windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md)
+####### [Manage protection and definition updates](windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md)
+####### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md)
+####### [Manage updates for endpoints that are out of date](windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md)
+####### [Manage event-based forced updates](windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md)
+####### [Manage updates for mobile devices and VMs](windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md)
+
+##### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md)
+###### [Configure and validate exclusions in antivirus scans](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md)
+####### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md)
+####### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md)
+####### [Configure antivirus exclusions Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md)
+###### [Configure scanning antivirus options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md)
+###### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md)
+###### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md)
+###### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md)
+###### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md)
+###### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md)
+##### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md)
+##### [Manage antivirus in your business](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md)
+###### [Use Group Policy settings to configure and manage antivirus](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md)
+###### [Use System Center Configuration Manager and Microsoft Intune to configure and manage antivirus](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md)
+###### [Use PowerShell cmdlets to configure and manage antivirus](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md)
+###### [Use Windows Management Instrumentation (WMI) to configure and manage antivirus](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md)
+###### [Use the mpcmdrun.exe commandline tool to configure and manage antivirus](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md)
+
+##### [Manage scans and remediation](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md)
+###### [Configure and validate exclusions in antivirus scans](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md)
+####### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md)
+####### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md)
+####### [Configure antivirus exclusions on Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md)
+###### [Configure scanning options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md)
+###### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md)
+###### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md)
+###### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md)
+###### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md)
+###### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md)
+###### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md)
+##### [Manage next generation protection in your business](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md)
+###### [Use Microsoft Intune and System Center Configuration Manager to manage next generation protection](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md)
+###### [Use Group Policy settings to manage next generation protection](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md)
+###### [Use PowerShell cmdlets to manage next generation protection](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md)
+###### [Use Windows Management Instrumentation (WMI) to manage next generation protection](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md)
+###### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md)
+
+
+#### [Configure Secure score dashboard security controls](windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md)
+
+
+#### Management and API support
+##### [Onboard machines](windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md)
+###### [Onboard previous versions of Windows](windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md)
+###### [Onboard Windows 10 machines](windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md)
+####### [Onboard machines using Group Policy](windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
+####### [Onboard machines using System Center Configuration Manager](windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
+####### [Onboard machines using Mobile Device Management tools](windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
+######## [Onboard machines using Microsoft Intune](windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune)
+####### [Onboard machines using a local script](windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md)
+####### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
+###### [Onboard servers](windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md)
+###### [Onboard non-Windows machines](windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
+###### [Run a detection test on a newly onboarded machine](windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md)
+###### [Run simulated attacks on machines](windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md)
+###### [Configure proxy and Internet connectivity settings](windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md)
+###### [Troubleshoot onboarding issues](windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
+####### [Troubleshoot subscription and portal access issues](windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md)
+
+##### API for custom alerts
+###### [Enable the custom threat intelligence application](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md)
+###### [Use the Windows Defender ATP exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md)
+####### [Use the threat intelligence API to create custom alerts](windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md)
+####### [Create custom threat intelligence alerts](windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md)
+####### [PowerShell code examples](windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md)
+####### [Python code examples](windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md)
+####### [Experiment with custom threat intelligence alerts](windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md)
+####### [Troubleshoot custom threat intelligence issues](windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
+
+
##### [Pull alerts to your SIEM tools](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md)
###### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md)
###### [Configure Splunk to pull alerts](windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md)
@@ -97,264 +296,120 @@
###### [Pull alerts using REST API](windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
###### [Troubleshoot SIEM tool integration issues](windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md)
-##### [Use the threat intelligence API to create custom alerts](windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md)
-###### [Understand threat intelligence concepts](windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
-###### [Enable the custom threat intelligence application](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md)
-###### [Create custom threat intelligence alerts](windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md)
-###### [PowerShell code examples](windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md)
-###### [Python code examples](windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md)
-###### [Experiment with custom threat intelligence alerts](windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md)
-###### [Troubleshoot custom threat intelligence issues](windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
-##### [Use the Windows Defender ATP exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md)
-###### [Supported Windows Defender ATP APIs](windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md)
-#######Actor
-######## [Get actor information](windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md)
-######## [Get actor related alerts](windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md)
-#######Alerts
-######## [Get alerts](windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md)
-######## [Get alert information by ID](windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md)
-######## [Get alert related actor information](windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md)
-######## [Get alert related domain information](windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md)
-######## [Get alert related file information](windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md)
-######## [Get alert related IP information](windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md)
-######## [Get alert related machine information](windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md)
-########Domain
-######### [Get domain related alerts](windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md)
-######### [Get domain related machines](windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md)
-######### [Get domain statistics](windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection.md)
-######### [Is domain seen in organization](windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md)
-#######File
-######## [Block file](windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md)
-######## [Get file information](windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md)
-######## [Get file related alerts](windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md)
-######## [Get file related machines](windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md)
-######## [Get file statistics](windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md)
-######## [Get FileActions collection](windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md)
-######## [Unblock file](windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md)
+##### Reporting
+###### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md)
-#######IP
-######## [Get IP related alerts](windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md)
-######## [Get IP related machines](windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md)
-######## [Get IP statistics](windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md)
-######## [Is IP seen in organization](windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md)
-#######Machines
-######## [Collect investigation package](windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md)
-######## [Find machine information by IP](windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md)
-######## [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md)
-######## [Get FileMachineAction object](windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md)
-######## [Get FileMachineActions collection](windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md)
-######## [Get machine by ID](windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md)
-######## [Get machine log on users](windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md)
-######## [Get machine related alerts](windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md)
-######## [Get MachineAction object](windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md)
-######## [Get MachineActions collection](windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md)
-######## [Get machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md)
-######## [Get package SAS URI](windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md)
-######## [Isolate machine](windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md)
-######## [Release machine from isolation](windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md)
-######## [Remove app restriction](windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md)
-######## [Request sample](windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md)
-######## [Restrict app execution](windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md)
-######## [Run antivirus scan](windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md)
-######## [Stop and quarantine file](windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md)
+##### Role-based access control
+###### [Manage portal access using RBAC](windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md)
+####### [Create and manage roles](windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md)
+####### [Create and manage machine groups](windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md)
+######## [Create and manage machine tags](windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md)
+
+
+##### [Configure managed security service provider (MSSP) support](windows-defender-atp/configure-mssp-support-windows-defender-advanced-threat-protection.md)
+
+
+#### Configure Microsoft threat protection integration
+##### [Configure conditional access](windows-defender-atp/configure-conditional-access-windows-defender-advanced-threat-protection.md)
+##### [Configure Microsoft Cloud App Security integration](windows-defender-atp/microsoft-cloud-app-security-config.md)
-#######User
-######## [Get alert related user information](windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md)
-######## [Get user information](windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md)
-######## [Get user related alerts](windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md)
-######## [Get user related machines](windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md)
-
-####Reporting
-##### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md)
-
-####Check service health and sensor state
-##### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md)
-##### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
-##### [Inactive machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines)
-##### [Misconfigured machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines)
-##### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md)
-
-
-####[Configure Windows Defender Security Center settings](windows-defender-atp\preferences-setup-windows-defender-advanced-threat-protection.md)
-#####General
-###### [Update data retention settings](windows-defender-atp\data-retention-settings-windows-defender-advanced-threat-protection.md)
-###### [Configure alert notifications](windows-defender-atp\configure-email-notifications-windows-defender-advanced-threat-protection.md)
-###### [Enable and create Power BI reports using Windows Defender Security center data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md)
-###### [Enable Secure score security controls](windows-defender-atp\enable-secure-score-windows-defender-advanced-threat-protection.md)
-###### [Configure advanced features](windows-defender-atp\advanced-features-windows-defender-advanced-threat-protection.md)
-
-
-#####Permissions
-###### [Manage portal access using RBAC](windows-defender-atp\rbac-windows-defender-advanced-threat-protection.md)
-###### [Create and manage machine groups](windows-defender-atp\machine-groups-windows-defender-advanced-threat-protection.md)
-
-#####APIs
-###### [Enable Threat intel](windows-defender-atp\enable-custom-ti-windows-defender-advanced-threat-protection.md)
-###### [Enable SIEM integration](windows-defender-atp\enable-siem-integration-windows-defender-advanced-threat-protection.md)
+#### [Configure Windows Defender Security Center settings](windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md)
+##### General
+###### [Update data retention settings](windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md)
+###### [Configure alert notifications](windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md)
+###### [Enable and create Power BI reports using Windows Defender Security center data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md)
+###### [Enable Secure score security controls](windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md)
+###### [Configure advanced features](windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md)
+
+##### Permissions
+###### [Use basic permissions to access the portal](windows-defender-atp/basic-permissions-windows-defender-advanced-threat-protection.md)
+###### [Manage portal access using RBAC](windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md)
+####### [Create and manage roles](windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md)
+####### [Create and manage machine groups](windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md)
+######## [Create and manage machine tags](windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md)
+
+##### APIs
+###### [Enable Threat intel](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md)
+###### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md)
+
#####Rules
-###### [Manage suppression rules](windows-defender-atp\manage-suppression-rules-windows-defender-advanced-threat-protection.md)
-###### [Manage automation allowed/blocked](windows-defender-atp\manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
-###### [Manage automation file uploads](windows-defender-atp\manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
-###### [Manage automation folder exclusions](windows-defender-atp\manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
-
+###### [Manage suppression rules](windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md)
+###### [Manage automation allowed/blocked](windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
+###### [Manage automation file uploads](windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
+###### [Manage automation folder exclusions](windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
+
#####Machine management
-###### [Onboarding machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md)
-###### [Offboarding machines](windows-defender-atp\offboard-machines-windows-defender-advanced-threat-protection.md)
+###### [Onboarding machines](windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md)
+###### [Offboarding machines](windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md)
+
+##### [Configure Windows Defender Security Center time zone settings](windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md)
+
-#### [Configure Windows Defender Security Center time zone settings](windows-defender-atp\time-settings-windows-defender-advanced-threat-protection.md)
+### [Troubleshoot Windows Defender ATP](windows-defender-atp/troubleshoot-wdatp.md)
+####Troubleshoot sensor state
+##### [Check sensor state](windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md)
+##### [Fix unhealthy sensors](windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
+##### [Inactive machines](windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines)
+##### [Misconfigured machines](windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines)
+##### [Review sensor events and errors on machines with Event Viewer](windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md)
-#### [Access the Windows Defender Security Center Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md)
-#### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md)
-##### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md)
-#### [Windows Defender Antivirus compatibility with Windows Defender ATP](windows-defender-atp\defender-compatibility-windows-defender-advanced-threat-protection.md)
+#### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md)
+##### [Check service health](windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md)
-### [Windows Defender Antivirus](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md)
-#### [Windows Defender AV in the Windows Defender Security app](windows-defender-antivirus\windows-defender-security-center-antivirus.md)
-#### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md)
-
-#### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md)
-##### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md)
-
-
-#### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md)
-
-
-#### [Deploy, manage updates, and report on Windows Defender Antivirus](windows-defender-antivirus\deploy-manage-report-windows-defender-antivirus.md)
-##### [Deploy and enable Windows Defender Antivirus](windows-defender-antivirus\deploy-windows-defender-antivirus.md)
-###### [Deployment guide for VDI environments](windows-defender-antivirus\deployment-vdi-windows-defender-antivirus.md)
-##### [Report on Windows Defender Antivirus protection](windows-defender-antivirus\report-monitor-windows-defender-antivirus.md)
-###### [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](windows-defender-antivirus\troubleshoot-reporting.md)
-##### [Manage updates and apply baselines](windows-defender-antivirus\manage-updates-baselines-windows-defender-antivirus.md)
-###### [Manage protection and definition updates](windows-defender-antivirus\manage-protection-updates-windows-defender-antivirus.md)
-###### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus\manage-protection-update-schedule-windows-defender-antivirus.md)
-###### [Manage updates for endpoints that are out of date](windows-defender-antivirus\manage-outdated-endpoints-windows-defender-antivirus.md)
-###### [Manage event-based forced updates](windows-defender-antivirus\manage-event-based-updates-windows-defender-antivirus.md)
-###### [Manage updates for mobile devices and VMs](windows-defender-antivirus\manage-updates-mobile-devices-vms-windows-defender-antivirus.md)
-
-
-#### [Configure Windows Defender Antivirus features](windows-defender-antivirus\configure-windows-defender-antivirus-features.md)
-##### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md)
-###### [Enable cloud-delivered protection](windows-defender-antivirus\enable-cloud-protection-windows-defender-antivirus.md)
-###### [Specify the cloud-delivered protection level](windows-defender-antivirus\specify-cloud-protection-level-windows-defender-antivirus.md)
-###### [Configure and validate network connections](windows-defender-antivirus\configure-network-connections-windows-defender-antivirus.md)
-###### [Enable the Block at First Sight feature](windows-defender-antivirus\configure-block-at-first-sight-windows-defender-antivirus.md)
-###### [Configure the cloud block timeout period](windows-defender-antivirus\configure-cloud-block-timeout-period-windows-defender-antivirus.md)
-##### [Configure behavioral, heuristic, and real-time protection](windows-defender-antivirus\configure-protection-features-windows-defender-antivirus.md)
-###### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus\detect-block-potentially-unwanted-apps-windows-defender-antivirus.md)
-###### [Enable and configure always-on protection and monitoring](windows-defender-antivirus\configure-real-time-protection-windows-defender-antivirus.md)
-##### [Configure end-user interaction with Windows Defender AV](windows-defender-antivirus\configure-end-user-interaction-windows-defender-antivirus.md)
-###### [Configure the notifications that appear on endpoints](windows-defender-antivirus\configure-notifications-windows-defender-antivirus.md)
-###### [Prevent users from seeing or interacting with the user interface](windows-defender-antivirus\prevent-end-user-interaction-windows-defender-antivirus.md)
-###### [Prevent or allow users to locally modify policy settings](windows-defender-antivirus\configure-local-policy-overrides-windows-defender-antivirus.md)
-
-
-#### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus\customize-run-review-remediate-scans-windows-defender-antivirus.md)
-##### [Configure and validate exclusions in Windows Defender AV scans](windows-defender-antivirus\configure-exclusions-windows-defender-antivirus.md)
-###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus\configure-extension-file-exclusions-windows-defender-antivirus.md)
-###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus\configure-process-opened-file-exclusions-windows-defender-antivirus.md)
-###### [Configure exclusions in Windows Defender AV on Windows Server 2016](windows-defender-antivirus\configure-server-exclusions-windows-defender-antivirus.md)
-##### [Configure scanning options in Windows Defender AV](windows-defender-antivirus\configure-advanced-scan-types-windows-defender-antivirus.md)
-##### [Configure remediation for scans](windows-defender-antivirus\configure-remediation-windows-defender-antivirus.md)
-##### [Configure scheduled scans](windows-defender-antivirus\scheduled-catch-up-scans-windows-defender-antivirus.md)
-##### [Configure and run scans](windows-defender-antivirus\run-scan-windows-defender-antivirus.md)
-##### [Review scan results](windows-defender-antivirus\review-scan-results-windows-defender-antivirus.md)
-##### [Run and review the results of a Windows Defender Offline scan](windows-defender-antivirus\windows-defender-offline.md)
-#### [Restore quarantined files in Windows Defender AV](windows-defender-antivirus\restore-quarantined-files-windows-defender-antivirus.md)
-
-
-##### [Review event logs and error codes to troubleshoot issues](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md)
-
-
-
-##### [Manage Windows Defender AV in your business](windows-defender-antivirus\configuration-management-reference-windows-defender-antivirus.md)
-###### [Use Group Policy settings to configure and manage Windows Defender AV](windows-defender-antivirus\use-group-policy-windows-defender-antivirus.md)
-###### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](windows-defender-antivirus\use-intune-config-manager-windows-defender-antivirus.md)
-###### [Use PowerShell cmdlets to configure and manage Windows Defender AV](windows-defender-antivirus\use-powershell-cmdlets-windows-defender-antivirus.md)
-###### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](windows-defender-antivirus\use-wmi-windows-defender-antivirus.md)
-###### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](windows-defender-antivirus\command-line-arguments-windows-defender-antivirus.md)
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-### [Windows Defender Exploit Guard](windows-defender-exploit-guard\windows-defender-exploit-guard.md)
-#### [Evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md)
-##### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md)
-##### [View Exploit Guard events](windows-defender-exploit-guard\event-views-exploit-guard.md)
-#### [Exploit protection](windows-defender-exploit-guard\exploit-protection-exploit-guard.md)
-##### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md)
-##### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md)
-##### [Enable Exploit protection](windows-defender-exploit-guard\enable-exploit-protection.md)
-##### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md)
-###### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md)
-##### [Memory integrity](windows-defender-exploit-guard\memory-integrity.md)
-###### [Requirements for virtualization-based protection of code integrity](windows-defender-exploit-guard\requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md)
-###### [Enable virtualization-based protection of code integrity](windows-defender-exploit-guard\enable-virtualization-based-protection-of-code-integrity.md)
-#### [Attack surface reduction](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md)
-##### [Evaluate Attack surface reduction](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md)
-##### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md)
-##### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md)
-##### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md)
-#### [Network Protection](windows-defender-exploit-guard\network-protection-exploit-guard.md)
-##### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md)
-##### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md)
-##### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md)
-#### [Controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md)
-##### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md)
-##### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md)
-##### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md)
-
-
-
-
-### [Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md)
-
-
-
-
-
-
-### [Windows Defender Application Guard](windows-defender-application-guard/wd-app-guard-overview.md)
-#### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md)
-#### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md)
-#### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md)
-#### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md)
-#### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md)
+####Troubleshoot attack surface reduction
+##### [Network protection](windows-defender-exploit-guard/troubleshoot-np.md)
+##### [Attack surface reduction rules](windows-defender-exploit-guard/troubleshoot-asr.md)
+
+#### [Troubleshoot next generation protection](windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md)
## [Security intelligence](intelligence/index.md)
+### [Understand malware & other threats](intelligence/understanding-malware.md)
+#### [Prevent malware infection](intelligence/prevent-malware-infection.md)
+#### [Malware names](intelligence/malware-naming.md)
+#### [Coin miners](intelligence/coinminer-malware.md)
+#### [Exploits and exploit kits](intelligence/exploits-malware.md)
+#### [Macro malware](intelligence/macro-malware.md)
+#### [Phishing](intelligence/phishing.md)
+#### [Ransomware](intelligence/ransomware-malware.md)
+#### [Rootkits](intelligence/rootkits-malware.md)
+#### [Supply chain attacks](intelligence/supply-chain-malware.md)
+#### [Tech support scams](intelligence/support-scams.md)
+#### [Trojans](intelligence/trojans-malware.md)
+#### [Unwanted software](intelligence/unwanted-software.md)
+#### [Worms](intelligence/worms-malware.md)
+### [How Microsoft identifies malware and PUA](intelligence/criteria.md)
+### [Submit files for analysis](intelligence/submission-guide.md)
+### [Safety Scanner download](intelligence/safety-scanner-download.md)
+### [Industry collaboration programs](intelligence/cybersecurity-industry-partners.md)
+#### [Virus information alliance](intelligence/virus-information-alliance-criteria.md)
+#### [Microsoft virus initiative](intelligence/virus-initiative-criteria.md)
+#### [Coordinated malware eradication](intelligence/coordinated-malware-eradication.md)
+### [Information for developers](intelligence/developer-info.md)
+#### [Software developer FAQ](intelligence/developer-faq.md)
+#### [Software developer resources](intelligence/developer-resources.md)
+
+## More Windows 10 security
-## Other security features
### [The Windows Security app](windows-defender-security-center/windows-defender-security-center.md)
#### [Customize the Windows Security app for your organization](windows-defender-security-center/wdsc-customize-contact-information.md)
#### [Hide Windows Security app notifications](windows-defender-security-center/wdsc-hide-notifications.md)
-#### [Manage Windows Security app in Windows 10 in S mode](windows-defender-security-center\wdsc-windows-10-in-s-mode.md)
+#### [Manage Windows Security app in Windows 10 in S mode](windows-defender-security-center/wdsc-windows-10-in-s-mode.md)
#### [Virus and threat protection](windows-defender-security-center/wdsc-virus-threat-protection.md)
-#### [Account protection](windows-defender-security-center\wdsc-account-protection.md)
-#### [Firewall and network protection](windows-defender-security-center\wdsc-firewall-network-protection.md)
-#### [App and browser control](windows-defender-security-center\wdsc-app-browser-control.md)
-#### [Device security](windows-defender-security-center\wdsc-device-security.md)
-#### [Device performance and health](windows-defender-security-center\wdsc-device-performance-health.md)
-#### [Family options](windows-defender-security-center\wdsc-family-options.md)
+#### [Account protection](windows-defender-security-center/wdsc-account-protection.md)
+#### [Firewall and network protection](windows-defender-security-center/wdsc-firewall-network-protection.md)
+#### [App and browser control](windows-defender-security-center/wdsc-app-browser-control.md)
+#### [Device security](windows-defender-security-center/wdsc-device-security.md)
+#### [Device performance and health](windows-defender-security-center/wdsc-device-performance-health.md)
+#### [Family options](windows-defender-security-center/wdsc-family-options.md)
-### [Windows Defender SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md)
-#### [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md)
-#### [Set up and use Windows Defender SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md)
+### [SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md)
+#### [SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md)
+#### [Set up and use SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md)
### [Windows Defender Device Guard: virtualization-based security and WDAC](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
@@ -438,7 +493,7 @@
####### [Event 4733 S: A member was removed from a security-enabled local group.](auditing/event-4733.md)
####### [Event 4734 S: A security-enabled local group was deleted.](auditing/event-4734.md)
####### [Event 4735 S: A security-enabled local group was changed.](auditing/event-4735.md)
-####### [Event 4764 S: A group’s type was changed.](auditing/event-4764.md)
+####### [Event 4764 S: A group�s type was changed.](auditing/event-4764.md)
####### [Event 4799 S: A security-enabled local group membership was enumerated.](auditing/event-4799.md)
###### [Audit User Account Management](auditing/audit-user-account-management.md)
####### [Event 4720 S: A user account was created.](auditing/event-4720.md)
diff --git a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md
index b45cf1d6fb..5fdb1739c0 100644
--- a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md
+++ b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md
index 68c258302e..00ef9a3f98 100644
--- a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md
+++ b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
@@ -48,7 +49,7 @@ The basic security audit policy settings in **Security Settings\\Local Policies\
There are a number of additional differences between the security audit policy settings in these two locations.
-There are nine basic audit policy settings under **Security Settings\\Local Policies\\Audit Policy** and settings under **Advanced Audit Policy Configuration**. The settings available in **Security Settings\\Advanced Audit Policy
+There are nine basic audit policy settings under **Security Settings\\Local Policies\\Audit Policy** and settings under **Advanced Audit Policy Configuration**. The settings available in **Security Settings\\Advanced Audit Policy
Configuration** address similar issues as the nine basic settings in **Local Policies\\Audit Policy**, but they allow administrators to be more selective in the number and types of events to audit. For example, the basic audit policy provides a single setting for account logon, and the advanced audit policy provides four. Enabling the single basic account logon setting would be the equivalent of setting all four advanced account logon settings. In comparison, setting a single advanced audit policy setting does not generate audit events for activities that you are not interested in tracking.
In addition, if you enable success auditing for the basic **Audit account logon events** setting, only success events will be logged for all account logon–related behaviors. In comparison, depending on the needs of your organization, you can configure success auditing for one advanced account logon setting, failure auditing for a second advanced account logon setting, success and failure auditing for a third advanced account logon setting, or no auditing.
@@ -78,7 +79,7 @@ The rules that govern how Group Policy settings are applied propagate to the sub
| - | - | - | -|
| Detailed File Share Auditing | Success | Failure | Success |
| Process Creation Auditing | Disabled | Success | Disabled |
-| Logon Auditing | Success | Failure | Failure |
+| Logon Auditing | Success | Failure | Failure |
## What is the difference between an object DACL and an object SACL?
@@ -170,7 +171,7 @@ In addition, there are a number of computer management products, such as the Aud
Users who examine the security event log for the first time can be a bit overwhelmed by the number of audit events that are stored there (which can quickly number in the thousands) and by the structured information that is included for each audit event. Additional information about these events, and the settings used to generate them, can be obtained from the following resources:
-- [Windows 8 and Windows Server 2012 Security Event Details](http://www.microsoft.com/download/details.aspx?id=35753)
+- [Windows 8 and Windows Server 2012 Security Event Details](https://www.microsoft.com/download/details.aspx?id=35753)
- [Security Audit Events for Windows 7 and Windows Server 2008 R2](https://go.microsoft.com/fwlink/p/?linkid=157780)
- [Security Audit Events for Windows Server 2008 and Windows Vista](https://go.microsoft.com/fwlink/p/?linkid=121868)
- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md)
@@ -180,7 +181,7 @@ Users who examine the security event log for the first time can be a bit overwhe
To learn more about security audit policies, see the following resources:
- [Planning and deploying advanced security audit policies](planning-and-deploying-advanced-security-audit-policies.md)
-- [Security Monitoring and Attack Detection Planning Guide](http://social.technet.microsoft.com/wiki/contents/articles/325.advanced-security-auditing-in-windows-7-and-windows-server-2008-r2.aspx)
+- [Security Monitoring and Attack Detection Planning Guide](https://social.technet.microsoft.com/wiki/contents/articles/325.advanced-security-auditing-in-windows-7-and-windows-server-2008-r2.aspx)
- [Security Audit Events for Windows 7 and Windows Server 2008 R2](https://go.microsoft.com/fwlink/p/?linkid=157780)
- [Security Audit Events for Windows Server 2008 and Windows Vista](https://go.microsoft.com/fwlink/p/?LinkId=121868)
diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing.md b/windows/security/threat-protection/auditing/advanced-security-auditing.md
index d1512606c8..8601d26ede 100644
--- a/windows/security/threat-protection/auditing/advanced-security-auditing.md
+++ b/windows/security/threat-protection/auditing/advanced-security-auditing.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md b/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md
index 9c98ed3fe1..7e40077bc3 100644
--- a/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md
+++ b/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md
index d772192059..e84f020843 100644
--- a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md
+++ b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 07/25/2018
---
diff --git a/windows/security/threat-protection/auditing/audit-account-lockout.md b/windows/security/threat-protection/auditing/audit-account-lockout.md
index 831cb9ee9c..1e4cf0bc0a 100644
--- a/windows/security/threat-protection/auditing/audit-account-lockout.md
+++ b/windows/security/threat-protection/auditing/audit-account-lockout.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 07/16/2018
---
diff --git a/windows/security/threat-protection/auditing/audit-application-generated.md b/windows/security/threat-protection/auditing/audit-application-generated.md
index cd1ac383af..dc4a17983a 100644
--- a/windows/security/threat-protection/auditing/audit-application-generated.md
+++ b/windows/security/threat-protection/auditing/audit-application-generated.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-application-group-management.md b/windows/security/threat-protection/auditing/audit-application-group-management.md
index 3a2fc3505b..54a24aeabd 100644
--- a/windows/security/threat-protection/auditing/audit-application-group-management.md
+++ b/windows/security/threat-protection/auditing/audit-application-group-management.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-audit-policy-change.md b/windows/security/threat-protection/auditing/audit-audit-policy-change.md
index b0735ee0ca..1adb598a89 100644
--- a/windows/security/threat-protection/auditing/audit-audit-policy-change.md
+++ b/windows/security/threat-protection/auditing/audit-audit-policy-change.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-authentication-policy-change.md b/windows/security/threat-protection/auditing/audit-authentication-policy-change.md
index 6046ee0176..e09948e6a9 100644
--- a/windows/security/threat-protection/auditing/audit-authentication-policy-change.md
+++ b/windows/security/threat-protection/auditing/audit-authentication-policy-change.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-authorization-policy-change.md b/windows/security/threat-protection/auditing/audit-authorization-policy-change.md
index 5641c9c572..ec84ce1cdf 100644
--- a/windows/security/threat-protection/auditing/audit-authorization-policy-change.md
+++ b/windows/security/threat-protection/auditing/audit-authorization-policy-change.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md b/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md
index 024a2259ca..f06923aec9 100644
--- a/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md
+++ b/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-certification-services.md b/windows/security/threat-protection/auditing/audit-certification-services.md
index 9b92554529..db60342744 100644
--- a/windows/security/threat-protection/auditing/audit-certification-services.md
+++ b/windows/security/threat-protection/auditing/audit-certification-services.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-computer-account-management.md b/windows/security/threat-protection/auditing/audit-computer-account-management.md
index 62a01d3e22..5b3570b704 100644
--- a/windows/security/threat-protection/auditing/audit-computer-account-management.md
+++ b/windows/security/threat-protection/auditing/audit-computer-account-management.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-credential-validation.md b/windows/security/threat-protection/auditing/audit-credential-validation.md
index 95709c4776..9f9d0cb8f4 100644
--- a/windows/security/threat-protection/auditing/audit-credential-validation.md
+++ b/windows/security/threat-protection/auditing/audit-credential-validation.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md b/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md
index ffc71c1158..0f25203d5d 100644
--- a/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md
+++ b/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-detailed-file-share.md b/windows/security/threat-protection/auditing/audit-detailed-file-share.md
index 72734d1a85..90ea83f0c5 100644
--- a/windows/security/threat-protection/auditing/audit-detailed-file-share.md
+++ b/windows/security/threat-protection/auditing/audit-detailed-file-share.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-directory-service-access.md b/windows/security/threat-protection/auditing/audit-directory-service-access.md
index e30c56fdb8..76de4e61d1 100644
--- a/windows/security/threat-protection/auditing/audit-directory-service-access.md
+++ b/windows/security/threat-protection/auditing/audit-directory-service-access.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-directory-service-changes.md b/windows/security/threat-protection/auditing/audit-directory-service-changes.md
index c454d36c11..d7120d4c5c 100644
--- a/windows/security/threat-protection/auditing/audit-directory-service-changes.md
+++ b/windows/security/threat-protection/auditing/audit-directory-service-changes.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-directory-service-replication.md b/windows/security/threat-protection/auditing/audit-directory-service-replication.md
index db82ae0c8d..3271a1b5fb 100644
--- a/windows/security/threat-protection/auditing/audit-directory-service-replication.md
+++ b/windows/security/threat-protection/auditing/audit-directory-service-replication.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-distribution-group-management.md b/windows/security/threat-protection/auditing/audit-distribution-group-management.md
index 82e9d57a4e..1d9c77ad06 100644
--- a/windows/security/threat-protection/auditing/audit-distribution-group-management.md
+++ b/windows/security/threat-protection/auditing/audit-distribution-group-management.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-dpapi-activity.md b/windows/security/threat-protection/auditing/audit-dpapi-activity.md
index 9b19a0afa1..4b03a1f4a7 100644
--- a/windows/security/threat-protection/auditing/audit-dpapi-activity.md
+++ b/windows/security/threat-protection/auditing/audit-dpapi-activity.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-file-share.md b/windows/security/threat-protection/auditing/audit-file-share.md
index caf010e6a3..4501f8e8f7 100644
--- a/windows/security/threat-protection/auditing/audit-file-share.md
+++ b/windows/security/threat-protection/auditing/audit-file-share.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-file-system.md b/windows/security/threat-protection/auditing/audit-file-system.md
index c7b96db83b..3195fd4e72 100644
--- a/windows/security/threat-protection/auditing/audit-file-system.md
+++ b/windows/security/threat-protection/auditing/audit-file-system.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md b/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md
index ea50e9d98c..9160d63777 100644
--- a/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md
+++ b/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md b/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md
index 56eb441cdd..15e570608f 100644
--- a/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md
+++ b/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md b/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md
index f56147cb4c..cd4c887700 100644
--- a/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md
+++ b/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-group-membership.md b/windows/security/threat-protection/auditing/audit-group-membership.md
index d35bf2344b..2c77196a27 100644
--- a/windows/security/threat-protection/auditing/audit-group-membership.md
+++ b/windows/security/threat-protection/auditing/audit-group-membership.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-handle-manipulation.md b/windows/security/threat-protection/auditing/audit-handle-manipulation.md
index a6c151bdfa..b0c1442c91 100644
--- a/windows/security/threat-protection/auditing/audit-handle-manipulation.md
+++ b/windows/security/threat-protection/auditing/audit-handle-manipulation.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-ipsec-driver.md b/windows/security/threat-protection/auditing/audit-ipsec-driver.md
index 698d063e78..1907464fec 100644
--- a/windows/security/threat-protection/auditing/audit-ipsec-driver.md
+++ b/windows/security/threat-protection/auditing/audit-ipsec-driver.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md
index 40cec9f6a3..41835f6b58 100644
--- a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md
+++ b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md
index ce0f818a58..af0f1a911e 100644
--- a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md
+++ b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md
index 38545197ce..3931177329 100644
--- a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md
+++ b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md b/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md
index 89da3df49c..c27b4bdf2d 100644
--- a/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md
+++ b/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md b/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md
index bab3c845c3..f8827a3cf1 100644
--- a/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md
+++ b/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-kernel-object.md b/windows/security/threat-protection/auditing/audit-kernel-object.md
index 9fa2b580ab..d61d5386f0 100644
--- a/windows/security/threat-protection/auditing/audit-kernel-object.md
+++ b/windows/security/threat-protection/auditing/audit-kernel-object.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-logoff.md b/windows/security/threat-protection/auditing/audit-logoff.md
index 9c9b76a014..347351c797 100644
--- a/windows/security/threat-protection/auditing/audit-logoff.md
+++ b/windows/security/threat-protection/auditing/audit-logoff.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 07/16/2018
---
diff --git a/windows/security/threat-protection/auditing/audit-logon.md b/windows/security/threat-protection/auditing/audit-logon.md
index a5e0c95234..e57df86b17 100644
--- a/windows/security/threat-protection/auditing/audit-logon.md
+++ b/windows/security/threat-protection/auditing/audit-logon.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md b/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md
index 3fb772b9df..8d79ebdaaa 100644
--- a/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md
+++ b/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-network-policy-server.md b/windows/security/threat-protection/auditing/audit-network-policy-server.md
index 11287bd65d..4cd445c0e1 100644
--- a/windows/security/threat-protection/auditing/audit-network-policy-server.md
+++ b/windows/security/threat-protection/auditing/audit-network-policy-server.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md b/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md
index 1d4cac3e10..29a2bf062c 100644
--- a/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md
+++ b/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-other-account-logon-events.md b/windows/security/threat-protection/auditing/audit-other-account-logon-events.md
index 522cbbbda0..212599c38d 100644
--- a/windows/security/threat-protection/auditing/audit-other-account-logon-events.md
+++ b/windows/security/threat-protection/auditing/audit-other-account-logon-events.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-other-account-management-events.md b/windows/security/threat-protection/auditing/audit-other-account-management-events.md
index a4e42c2134..0dada7cc0f 100644
--- a/windows/security/threat-protection/auditing/audit-other-account-management-events.md
+++ b/windows/security/threat-protection/auditing/audit-other-account-management-events.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md b/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md
index 20c7e57792..d1c84998ab 100644
--- a/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md
+++ b/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-other-object-access-events.md b/windows/security/threat-protection/auditing/audit-other-object-access-events.md
index 7a65861136..a100b7f4f4 100644
--- a/windows/security/threat-protection/auditing/audit-other-object-access-events.md
+++ b/windows/security/threat-protection/auditing/audit-other-object-access-events.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 05/29/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-other-policy-change-events.md b/windows/security/threat-protection/auditing/audit-other-policy-change-events.md
index caedc86292..3e9078765c 100644
--- a/windows/security/threat-protection/auditing/audit-other-policy-change-events.md
+++ b/windows/security/threat-protection/auditing/audit-other-policy-change-events.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md
index 7bbf1b96ea..a494cdd7b4 100644
--- a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md
+++ b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-other-system-events.md b/windows/security/threat-protection/auditing/audit-other-system-events.md
index 66a9f4fa1a..a9e385b322 100644
--- a/windows/security/threat-protection/auditing/audit-other-system-events.md
+++ b/windows/security/threat-protection/auditing/audit-other-system-events.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-pnp-activity.md b/windows/security/threat-protection/auditing/audit-pnp-activity.md
index 3e7f6054e9..08dd852a74 100644
--- a/windows/security/threat-protection/auditing/audit-pnp-activity.md
+++ b/windows/security/threat-protection/auditing/audit-pnp-activity.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-process-creation.md b/windows/security/threat-protection/auditing/audit-process-creation.md
index 91ce6e4269..65d9725fb1 100644
--- a/windows/security/threat-protection/auditing/audit-process-creation.md
+++ b/windows/security/threat-protection/auditing/audit-process-creation.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-process-termination.md b/windows/security/threat-protection/auditing/audit-process-termination.md
index 26bdfd3335..ff6e0c7eb7 100644
--- a/windows/security/threat-protection/auditing/audit-process-termination.md
+++ b/windows/security/threat-protection/auditing/audit-process-termination.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-registry.md b/windows/security/threat-protection/auditing/audit-registry.md
index 89c6e2069e..463a01e1f6 100644
--- a/windows/security/threat-protection/auditing/audit-registry.md
+++ b/windows/security/threat-protection/auditing/audit-registry.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-removable-storage.md b/windows/security/threat-protection/auditing/audit-removable-storage.md
index 40a3de6168..d4abe3507f 100644
--- a/windows/security/threat-protection/auditing/audit-removable-storage.md
+++ b/windows/security/threat-protection/auditing/audit-removable-storage.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-rpc-events.md b/windows/security/threat-protection/auditing/audit-rpc-events.md
index 68fe08ab59..a091eac795 100644
--- a/windows/security/threat-protection/auditing/audit-rpc-events.md
+++ b/windows/security/threat-protection/auditing/audit-rpc-events.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-sam.md b/windows/security/threat-protection/auditing/audit-sam.md
index 68cbdf8de2..dc8b55abd1 100644
--- a/windows/security/threat-protection/auditing/audit-sam.md
+++ b/windows/security/threat-protection/auditing/audit-sam.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-security-group-management.md b/windows/security/threat-protection/auditing/audit-security-group-management.md
index 20caac1504..2e14934b51 100644
--- a/windows/security/threat-protection/auditing/audit-security-group-management.md
+++ b/windows/security/threat-protection/auditing/audit-security-group-management.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-security-state-change.md b/windows/security/threat-protection/auditing/audit-security-state-change.md
index 82b7442603..29afe92c74 100644
--- a/windows/security/threat-protection/auditing/audit-security-state-change.md
+++ b/windows/security/threat-protection/auditing/audit-security-state-change.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-security-system-extension.md b/windows/security/threat-protection/auditing/audit-security-system-extension.md
index dd197405eb..695ee99db2 100644
--- a/windows/security/threat-protection/auditing/audit-security-system-extension.md
+++ b/windows/security/threat-protection/auditing/audit-security-system-extension.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md b/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md
index fee5387d6e..d0572e5d91 100644
--- a/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md
+++ b/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-special-logon.md b/windows/security/threat-protection/auditing/audit-special-logon.md
index 4e565482ce..318d0c7c8d 100644
--- a/windows/security/threat-protection/auditing/audit-special-logon.md
+++ b/windows/security/threat-protection/auditing/audit-special-logon.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-system-integrity.md b/windows/security/threat-protection/auditing/audit-system-integrity.md
index d1ab5a9287..27548edf0f 100644
--- a/windows/security/threat-protection/auditing/audit-system-integrity.md
+++ b/windows/security/threat-protection/auditing/audit-system-integrity.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-user-account-management.md b/windows/security/threat-protection/auditing/audit-user-account-management.md
index db25e022e7..8c7ee885fc 100644
--- a/windows/security/threat-protection/auditing/audit-user-account-management.md
+++ b/windows/security/threat-protection/auditing/audit-user-account-management.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/audit-user-device-claims.md b/windows/security/threat-protection/auditing/audit-user-device-claims.md
index d7a6965f65..dbc39068f4 100644
--- a/windows/security/threat-protection/auditing/audit-user-device-claims.md
+++ b/windows/security/threat-protection/auditing/audit-user-device-claims.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md
index fb3376bbfa..94c4b462f1 100644
--- a/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md
+++ b/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/basic-audit-account-management.md b/windows/security/threat-protection/auditing/basic-audit-account-management.md
index 927836fa61..e1ad77ba01 100644
--- a/windows/security/threat-protection/auditing/basic-audit-account-management.md
+++ b/windows/security/threat-protection/auditing/basic-audit-account-management.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md b/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md
index c8c80ce9d6..c0a52a4dc4 100644
--- a/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md
+++ b/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/basic-audit-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-logon-events.md
index 64857a7afb..9f3210eae2 100644
--- a/windows/security/threat-protection/auditing/basic-audit-logon-events.md
+++ b/windows/security/threat-protection/auditing/basic-audit-logon-events.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/basic-audit-object-access.md b/windows/security/threat-protection/auditing/basic-audit-object-access.md
index 38bb2e466d..8492b5fb62 100644
--- a/windows/security/threat-protection/auditing/basic-audit-object-access.md
+++ b/windows/security/threat-protection/auditing/basic-audit-object-access.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/basic-audit-policy-change.md b/windows/security/threat-protection/auditing/basic-audit-policy-change.md
index 19b0d6e645..9ff920eda5 100644
--- a/windows/security/threat-protection/auditing/basic-audit-policy-change.md
+++ b/windows/security/threat-protection/auditing/basic-audit-policy-change.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/basic-audit-privilege-use.md b/windows/security/threat-protection/auditing/basic-audit-privilege-use.md
index 8aa5da56c9..74c74bd180 100644
--- a/windows/security/threat-protection/auditing/basic-audit-privilege-use.md
+++ b/windows/security/threat-protection/auditing/basic-audit-privilege-use.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/basic-audit-process-tracking.md b/windows/security/threat-protection/auditing/basic-audit-process-tracking.md
index af9ea206a6..1282c18871 100644
--- a/windows/security/threat-protection/auditing/basic-audit-process-tracking.md
+++ b/windows/security/threat-protection/auditing/basic-audit-process-tracking.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/basic-audit-system-events.md b/windows/security/threat-protection/auditing/basic-audit-system-events.md
index 06fa199863..2cc15b14cb 100644
--- a/windows/security/threat-protection/auditing/basic-audit-system-events.md
+++ b/windows/security/threat-protection/auditing/basic-audit-system-events.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policies.md b/windows/security/threat-protection/auditing/basic-security-audit-policies.md
index 9ad2959a47..31ba69f0e1 100644
--- a/windows/security/threat-protection/auditing/basic-security-audit-policies.md
+++ b/windows/security/threat-protection/auditing/basic-security-audit-policies.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md
index 933f85b9dc..6f7578b433 100644
--- a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md
+++ b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md b/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md
index 7fbe7ab069..6b329771a8 100644
--- a/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md
+++ b/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-1100.md b/windows/security/threat-protection/auditing/event-1100.md
index ac6f19eefe..13ae345c28 100644
--- a/windows/security/threat-protection/auditing/event-1100.md
+++ b/windows/security/threat-protection/auditing/event-1100.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-1102.md b/windows/security/threat-protection/auditing/event-1102.md
index 6a067516da..61d48236a0 100644
--- a/windows/security/threat-protection/auditing/event-1102.md
+++ b/windows/security/threat-protection/auditing/event-1102.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-1104.md b/windows/security/threat-protection/auditing/event-1104.md
index 0a8546990f..d6928796bc 100644
--- a/windows/security/threat-protection/auditing/event-1104.md
+++ b/windows/security/threat-protection/auditing/event-1104.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-1105.md b/windows/security/threat-protection/auditing/event-1105.md
index a8476fff7b..3fb741e93d 100644
--- a/windows/security/threat-protection/auditing/event-1105.md
+++ b/windows/security/threat-protection/auditing/event-1105.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-1108.md b/windows/security/threat-protection/auditing/event-1108.md
index 017af286c0..53a761ddd3 100644
--- a/windows/security/threat-protection/auditing/event-1108.md
+++ b/windows/security/threat-protection/auditing/event-1108.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4608.md b/windows/security/threat-protection/auditing/event-4608.md
index 1e57fd65bd..40e4b625b8 100644
--- a/windows/security/threat-protection/auditing/event-4608.md
+++ b/windows/security/threat-protection/auditing/event-4608.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4610.md b/windows/security/threat-protection/auditing/event-4610.md
index 58520e1319..97ce41dd27 100644
--- a/windows/security/threat-protection/auditing/event-4610.md
+++ b/windows/security/threat-protection/auditing/event-4610.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4611.md b/windows/security/threat-protection/auditing/event-4611.md
index 38c317122b..97cefc2edc 100644
--- a/windows/security/threat-protection/auditing/event-4611.md
+++ b/windows/security/threat-protection/auditing/event-4611.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4612.md b/windows/security/threat-protection/auditing/event-4612.md
index 10c759d27c..1d0a8fc3ac 100644
--- a/windows/security/threat-protection/auditing/event-4612.md
+++ b/windows/security/threat-protection/auditing/event-4612.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4614.md b/windows/security/threat-protection/auditing/event-4614.md
index fca623f333..83b5ae6f58 100644
--- a/windows/security/threat-protection/auditing/event-4614.md
+++ b/windows/security/threat-protection/auditing/event-4614.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4615.md b/windows/security/threat-protection/auditing/event-4615.md
index 3b59808bcf..37c253f26f 100644
--- a/windows/security/threat-protection/auditing/event-4615.md
+++ b/windows/security/threat-protection/auditing/event-4615.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4616.md b/windows/security/threat-protection/auditing/event-4616.md
index 58f6621355..61bcb648f9 100644
--- a/windows/security/threat-protection/auditing/event-4616.md
+++ b/windows/security/threat-protection/auditing/event-4616.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4618.md b/windows/security/threat-protection/auditing/event-4618.md
index 7ad5986151..624692202b 100644
--- a/windows/security/threat-protection/auditing/event-4618.md
+++ b/windows/security/threat-protection/auditing/event-4618.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4621.md b/windows/security/threat-protection/auditing/event-4621.md
index dfa9094672..b1e1638791 100644
--- a/windows/security/threat-protection/auditing/event-4621.md
+++ b/windows/security/threat-protection/auditing/event-4621.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4622.md b/windows/security/threat-protection/auditing/event-4622.md
index 489d82cb44..b8b8d972af 100644
--- a/windows/security/threat-protection/auditing/event-4622.md
+++ b/windows/security/threat-protection/auditing/event-4622.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md
index bb4d0dfde8..8ee6f8a44b 100644
--- a/windows/security/threat-protection/auditing/event-4624.md
+++ b/windows/security/threat-protection/auditing/event-4624.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4625.md b/windows/security/threat-protection/auditing/event-4625.md
index a156058e1d..f06d559a05 100644
--- a/windows/security/threat-protection/auditing/event-4625.md
+++ b/windows/security/threat-protection/auditing/event-4625.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4626.md b/windows/security/threat-protection/auditing/event-4626.md
index d127aa0e92..804c229ae3 100644
--- a/windows/security/threat-protection/auditing/event-4626.md
+++ b/windows/security/threat-protection/auditing/event-4626.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4627.md b/windows/security/threat-protection/auditing/event-4627.md
index 7b5753c8a2..86c34c7909 100644
--- a/windows/security/threat-protection/auditing/event-4627.md
+++ b/windows/security/threat-protection/auditing/event-4627.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4634.md b/windows/security/threat-protection/auditing/event-4634.md
index 4181c69829..9f05521e12 100644
--- a/windows/security/threat-protection/auditing/event-4634.md
+++ b/windows/security/threat-protection/auditing/event-4634.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 11/20/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4647.md b/windows/security/threat-protection/auditing/event-4647.md
index f302b30dcb..f3f4af3202 100644
--- a/windows/security/threat-protection/auditing/event-4647.md
+++ b/windows/security/threat-protection/auditing/event-4647.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4648.md b/windows/security/threat-protection/auditing/event-4648.md
index c2d202fde2..1614e05097 100644
--- a/windows/security/threat-protection/auditing/event-4648.md
+++ b/windows/security/threat-protection/auditing/event-4648.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4649.md b/windows/security/threat-protection/auditing/event-4649.md
index f9e9bf8138..3b378b7682 100644
--- a/windows/security/threat-protection/auditing/event-4649.md
+++ b/windows/security/threat-protection/auditing/event-4649.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4656.md b/windows/security/threat-protection/auditing/event-4656.md
index 7410f05971..b009f0d8eb 100644
--- a/windows/security/threat-protection/auditing/event-4656.md
+++ b/windows/security/threat-protection/auditing/event-4656.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4657.md b/windows/security/threat-protection/auditing/event-4657.md
index 52063e6430..06375a60e0 100644
--- a/windows/security/threat-protection/auditing/event-4657.md
+++ b/windows/security/threat-protection/auditing/event-4657.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4658.md b/windows/security/threat-protection/auditing/event-4658.md
index 49fd39d667..5ceeb9a280 100644
--- a/windows/security/threat-protection/auditing/event-4658.md
+++ b/windows/security/threat-protection/auditing/event-4658.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4660.md b/windows/security/threat-protection/auditing/event-4660.md
index 19abcd9404..1d464049d7 100644
--- a/windows/security/threat-protection/auditing/event-4660.md
+++ b/windows/security/threat-protection/auditing/event-4660.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4661.md b/windows/security/threat-protection/auditing/event-4661.md
index 2a841eb423..fab58ae85f 100644
--- a/windows/security/threat-protection/auditing/event-4661.md
+++ b/windows/security/threat-protection/auditing/event-4661.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4662.md b/windows/security/threat-protection/auditing/event-4662.md
index 76d00d60be..945efabaa8 100644
--- a/windows/security/threat-protection/auditing/event-4662.md
+++ b/windows/security/threat-protection/auditing/event-4662.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4663.md b/windows/security/threat-protection/auditing/event-4663.md
index bb6612c203..0896af005f 100644
--- a/windows/security/threat-protection/auditing/event-4663.md
+++ b/windows/security/threat-protection/auditing/event-4663.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4664.md b/windows/security/threat-protection/auditing/event-4664.md
index 69474b2b12..23ee991c1a 100644
--- a/windows/security/threat-protection/auditing/event-4664.md
+++ b/windows/security/threat-protection/auditing/event-4664.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4670.md b/windows/security/threat-protection/auditing/event-4670.md
index 4c4b0f7b46..496c9157ff 100644
--- a/windows/security/threat-protection/auditing/event-4670.md
+++ b/windows/security/threat-protection/auditing/event-4670.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4671.md b/windows/security/threat-protection/auditing/event-4671.md
index bb9b80ab81..e8f42c6afa 100644
--- a/windows/security/threat-protection/auditing/event-4671.md
+++ b/windows/security/threat-protection/auditing/event-4671.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4672.md b/windows/security/threat-protection/auditing/event-4672.md
index 5cc1a63520..04962bc557 100644
--- a/windows/security/threat-protection/auditing/event-4672.md
+++ b/windows/security/threat-protection/auditing/event-4672.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4673.md b/windows/security/threat-protection/auditing/event-4673.md
index f9573a09ae..8749baa01b 100644
--- a/windows/security/threat-protection/auditing/event-4673.md
+++ b/windows/security/threat-protection/auditing/event-4673.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4674.md b/windows/security/threat-protection/auditing/event-4674.md
index bca2e5f52e..58934e4de7 100644
--- a/windows/security/threat-protection/auditing/event-4674.md
+++ b/windows/security/threat-protection/auditing/event-4674.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4675.md b/windows/security/threat-protection/auditing/event-4675.md
index 421b82fe4c..f5946c9298 100644
--- a/windows/security/threat-protection/auditing/event-4675.md
+++ b/windows/security/threat-protection/auditing/event-4675.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4688.md b/windows/security/threat-protection/auditing/event-4688.md
index 0b7635c328..eef6cadbee 100644
--- a/windows/security/threat-protection/auditing/event-4688.md
+++ b/windows/security/threat-protection/auditing/event-4688.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4689.md b/windows/security/threat-protection/auditing/event-4689.md
index d7f928b85c..dceac91e41 100644
--- a/windows/security/threat-protection/auditing/event-4689.md
+++ b/windows/security/threat-protection/auditing/event-4689.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4690.md b/windows/security/threat-protection/auditing/event-4690.md
index 708ad3f4b2..88b3db7b2f 100644
--- a/windows/security/threat-protection/auditing/event-4690.md
+++ b/windows/security/threat-protection/auditing/event-4690.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4691.md b/windows/security/threat-protection/auditing/event-4691.md
index 5a62c9c916..2ccb4ed0a9 100644
--- a/windows/security/threat-protection/auditing/event-4691.md
+++ b/windows/security/threat-protection/auditing/event-4691.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4692.md b/windows/security/threat-protection/auditing/event-4692.md
index 81042229eb..e1eaefb348 100644
--- a/windows/security/threat-protection/auditing/event-4692.md
+++ b/windows/security/threat-protection/auditing/event-4692.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4693.md b/windows/security/threat-protection/auditing/event-4693.md
index 139eeb2b7b..e9f776d0ca 100644
--- a/windows/security/threat-protection/auditing/event-4693.md
+++ b/windows/security/threat-protection/auditing/event-4693.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4694.md b/windows/security/threat-protection/auditing/event-4694.md
index 0818b64f14..b8b2d4fde7 100644
--- a/windows/security/threat-protection/auditing/event-4694.md
+++ b/windows/security/threat-protection/auditing/event-4694.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4695.md b/windows/security/threat-protection/auditing/event-4695.md
index 79b6f0de79..5bc050e752 100644
--- a/windows/security/threat-protection/auditing/event-4695.md
+++ b/windows/security/threat-protection/auditing/event-4695.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4696.md b/windows/security/threat-protection/auditing/event-4696.md
index 9f33773c45..94e30520f0 100644
--- a/windows/security/threat-protection/auditing/event-4696.md
+++ b/windows/security/threat-protection/auditing/event-4696.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4697.md b/windows/security/threat-protection/auditing/event-4697.md
index bf57e86499..608cf4412e 100644
--- a/windows/security/threat-protection/auditing/event-4697.md
+++ b/windows/security/threat-protection/auditing/event-4697.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4698.md b/windows/security/threat-protection/auditing/event-4698.md
index b5a3c2eb05..0ea9a8bfcb 100644
--- a/windows/security/threat-protection/auditing/event-4698.md
+++ b/windows/security/threat-protection/auditing/event-4698.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4699.md b/windows/security/threat-protection/auditing/event-4699.md
index 43d2d4038a..f4deaf1e26 100644
--- a/windows/security/threat-protection/auditing/event-4699.md
+++ b/windows/security/threat-protection/auditing/event-4699.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4700.md b/windows/security/threat-protection/auditing/event-4700.md
index a428e5d220..b6550f63e8 100644
--- a/windows/security/threat-protection/auditing/event-4700.md
+++ b/windows/security/threat-protection/auditing/event-4700.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4701.md b/windows/security/threat-protection/auditing/event-4701.md
index 8e7d004bfd..66c0fdbe24 100644
--- a/windows/security/threat-protection/auditing/event-4701.md
+++ b/windows/security/threat-protection/auditing/event-4701.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4702.md b/windows/security/threat-protection/auditing/event-4702.md
index f4965a440b..9b344d520b 100644
--- a/windows/security/threat-protection/auditing/event-4702.md
+++ b/windows/security/threat-protection/auditing/event-4702.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4703.md b/windows/security/threat-protection/auditing/event-4703.md
index 34dac9b054..3a33b7fb1a 100644
--- a/windows/security/threat-protection/auditing/event-4703.md
+++ b/windows/security/threat-protection/auditing/event-4703.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4704.md b/windows/security/threat-protection/auditing/event-4704.md
index e9d8f04685..2f3c13af0b 100644
--- a/windows/security/threat-protection/auditing/event-4704.md
+++ b/windows/security/threat-protection/auditing/event-4704.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4705.md b/windows/security/threat-protection/auditing/event-4705.md
index 83bd4b2090..9411db16ba 100644
--- a/windows/security/threat-protection/auditing/event-4705.md
+++ b/windows/security/threat-protection/auditing/event-4705.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4706.md b/windows/security/threat-protection/auditing/event-4706.md
index 00f7c4abc7..b0d1108d01 100644
--- a/windows/security/threat-protection/auditing/event-4706.md
+++ b/windows/security/threat-protection/auditing/event-4706.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4707.md b/windows/security/threat-protection/auditing/event-4707.md
index ef7889ed6a..85c6887b71 100644
--- a/windows/security/threat-protection/auditing/event-4707.md
+++ b/windows/security/threat-protection/auditing/event-4707.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4713.md b/windows/security/threat-protection/auditing/event-4713.md
index b73f98ed27..f8c17d0d23 100644
--- a/windows/security/threat-protection/auditing/event-4713.md
+++ b/windows/security/threat-protection/auditing/event-4713.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4714.md b/windows/security/threat-protection/auditing/event-4714.md
index 939496efb7..45e1db3e65 100644
--- a/windows/security/threat-protection/auditing/event-4714.md
+++ b/windows/security/threat-protection/auditing/event-4714.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4715.md b/windows/security/threat-protection/auditing/event-4715.md
index 3c44c43d38..31b4ed376d 100644
--- a/windows/security/threat-protection/auditing/event-4715.md
+++ b/windows/security/threat-protection/auditing/event-4715.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4716.md b/windows/security/threat-protection/auditing/event-4716.md
index 627e3b0995..6389cea265 100644
--- a/windows/security/threat-protection/auditing/event-4716.md
+++ b/windows/security/threat-protection/auditing/event-4716.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4717.md b/windows/security/threat-protection/auditing/event-4717.md
index 586027ec44..4921434446 100644
--- a/windows/security/threat-protection/auditing/event-4717.md
+++ b/windows/security/threat-protection/auditing/event-4717.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4718.md b/windows/security/threat-protection/auditing/event-4718.md
index 2717038a73..db47f55f93 100644
--- a/windows/security/threat-protection/auditing/event-4718.md
+++ b/windows/security/threat-protection/auditing/event-4718.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4719.md b/windows/security/threat-protection/auditing/event-4719.md
index 1da37f1754..d67898fd2e 100644
--- a/windows/security/threat-protection/auditing/event-4719.md
+++ b/windows/security/threat-protection/auditing/event-4719.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4720.md b/windows/security/threat-protection/auditing/event-4720.md
index 8fe04dc1e8..c182112703 100644
--- a/windows/security/threat-protection/auditing/event-4720.md
+++ b/windows/security/threat-protection/auditing/event-4720.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4722.md b/windows/security/threat-protection/auditing/event-4722.md
index 8cdab0a747..261f9cb975 100644
--- a/windows/security/threat-protection/auditing/event-4722.md
+++ b/windows/security/threat-protection/auditing/event-4722.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4723.md b/windows/security/threat-protection/auditing/event-4723.md
index 2d4fc27242..d0bea5eb68 100644
--- a/windows/security/threat-protection/auditing/event-4723.md
+++ b/windows/security/threat-protection/auditing/event-4723.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4724.md b/windows/security/threat-protection/auditing/event-4724.md
index ccecd029bd..b3913f0cbe 100644
--- a/windows/security/threat-protection/auditing/event-4724.md
+++ b/windows/security/threat-protection/auditing/event-4724.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4725.md b/windows/security/threat-protection/auditing/event-4725.md
index d98ecec63c..72a9797d2d 100644
--- a/windows/security/threat-protection/auditing/event-4725.md
+++ b/windows/security/threat-protection/auditing/event-4725.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4726.md b/windows/security/threat-protection/auditing/event-4726.md
index 00b157f1a0..b3dfd1467b 100644
--- a/windows/security/threat-protection/auditing/event-4726.md
+++ b/windows/security/threat-protection/auditing/event-4726.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4731.md b/windows/security/threat-protection/auditing/event-4731.md
index acf70d448c..9f840372e7 100644
--- a/windows/security/threat-protection/auditing/event-4731.md
+++ b/windows/security/threat-protection/auditing/event-4731.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4732.md b/windows/security/threat-protection/auditing/event-4732.md
index d7000fb020..b032541291 100644
--- a/windows/security/threat-protection/auditing/event-4732.md
+++ b/windows/security/threat-protection/auditing/event-4732.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4733.md b/windows/security/threat-protection/auditing/event-4733.md
index a5b171538f..5803a7a96d 100644
--- a/windows/security/threat-protection/auditing/event-4733.md
+++ b/windows/security/threat-protection/auditing/event-4733.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4734.md b/windows/security/threat-protection/auditing/event-4734.md
index cdacfc1a47..336f98cd2d 100644
--- a/windows/security/threat-protection/auditing/event-4734.md
+++ b/windows/security/threat-protection/auditing/event-4734.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4735.md b/windows/security/threat-protection/auditing/event-4735.md
index 104f37e498..ea6a0f906b 100644
--- a/windows/security/threat-protection/auditing/event-4735.md
+++ b/windows/security/threat-protection/auditing/event-4735.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4738.md b/windows/security/threat-protection/auditing/event-4738.md
index 0086eae7fe..6a0c6f7fec 100644
--- a/windows/security/threat-protection/auditing/event-4738.md
+++ b/windows/security/threat-protection/auditing/event-4738.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4739.md b/windows/security/threat-protection/auditing/event-4739.md
index d1a83fc01d..b4ce931ca3 100644
--- a/windows/security/threat-protection/auditing/event-4739.md
+++ b/windows/security/threat-protection/auditing/event-4739.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4740.md b/windows/security/threat-protection/auditing/event-4740.md
index 74ca5aa2d4..766edfb035 100644
--- a/windows/security/threat-protection/auditing/event-4740.md
+++ b/windows/security/threat-protection/auditing/event-4740.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4741.md b/windows/security/threat-protection/auditing/event-4741.md
index ae5cc3aad8..9fcabb2b06 100644
--- a/windows/security/threat-protection/auditing/event-4741.md
+++ b/windows/security/threat-protection/auditing/event-4741.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4742.md b/windows/security/threat-protection/auditing/event-4742.md
index 3dbff53ca0..81c06e259a 100644
--- a/windows/security/threat-protection/auditing/event-4742.md
+++ b/windows/security/threat-protection/auditing/event-4742.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4743.md b/windows/security/threat-protection/auditing/event-4743.md
index cf8fe2de93..a6a08ce668 100644
--- a/windows/security/threat-protection/auditing/event-4743.md
+++ b/windows/security/threat-protection/auditing/event-4743.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4749.md b/windows/security/threat-protection/auditing/event-4749.md
index 6fa7e4ad47..adf348858e 100644
--- a/windows/security/threat-protection/auditing/event-4749.md
+++ b/windows/security/threat-protection/auditing/event-4749.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4750.md b/windows/security/threat-protection/auditing/event-4750.md
index 1433514327..c6f9458b13 100644
--- a/windows/security/threat-protection/auditing/event-4750.md
+++ b/windows/security/threat-protection/auditing/event-4750.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4751.md b/windows/security/threat-protection/auditing/event-4751.md
index bccd6fcfd1..a54bc67494 100644
--- a/windows/security/threat-protection/auditing/event-4751.md
+++ b/windows/security/threat-protection/auditing/event-4751.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4752.md b/windows/security/threat-protection/auditing/event-4752.md
index e8aba8e488..67b6917c57 100644
--- a/windows/security/threat-protection/auditing/event-4752.md
+++ b/windows/security/threat-protection/auditing/event-4752.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4753.md b/windows/security/threat-protection/auditing/event-4753.md
index 8723b71531..6f7ea445cc 100644
--- a/windows/security/threat-protection/auditing/event-4753.md
+++ b/windows/security/threat-protection/auditing/event-4753.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4764.md b/windows/security/threat-protection/auditing/event-4764.md
index 2d2eccc064..914faaec85 100644
--- a/windows/security/threat-protection/auditing/event-4764.md
+++ b/windows/security/threat-protection/auditing/event-4764.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4765.md b/windows/security/threat-protection/auditing/event-4765.md
index 5c9dbc3e45..9930e1add7 100644
--- a/windows/security/threat-protection/auditing/event-4765.md
+++ b/windows/security/threat-protection/auditing/event-4765.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4766.md b/windows/security/threat-protection/auditing/event-4766.md
index 8d5dcd247b..03e5f98777 100644
--- a/windows/security/threat-protection/auditing/event-4766.md
+++ b/windows/security/threat-protection/auditing/event-4766.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4767.md b/windows/security/threat-protection/auditing/event-4767.md
index bbce5d97f8..e9c94bc2b7 100644
--- a/windows/security/threat-protection/auditing/event-4767.md
+++ b/windows/security/threat-protection/auditing/event-4767.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4768.md b/windows/security/threat-protection/auditing/event-4768.md
index 142326fd82..dfad68c114 100644
--- a/windows/security/threat-protection/auditing/event-4768.md
+++ b/windows/security/threat-protection/auditing/event-4768.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4769.md b/windows/security/threat-protection/auditing/event-4769.md
index 9c8f497da1..ddc3fc91bd 100644
--- a/windows/security/threat-protection/auditing/event-4769.md
+++ b/windows/security/threat-protection/auditing/event-4769.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4770.md b/windows/security/threat-protection/auditing/event-4770.md
index cfc91281f1..d1fbaec511 100644
--- a/windows/security/threat-protection/auditing/event-4770.md
+++ b/windows/security/threat-protection/auditing/event-4770.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4771.md b/windows/security/threat-protection/auditing/event-4771.md
index ebe86ace57..34add04027 100644
--- a/windows/security/threat-protection/auditing/event-4771.md
+++ b/windows/security/threat-protection/auditing/event-4771.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4772.md b/windows/security/threat-protection/auditing/event-4772.md
index 612b71e2da..3bb2aa354c 100644
--- a/windows/security/threat-protection/auditing/event-4772.md
+++ b/windows/security/threat-protection/auditing/event-4772.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4773.md b/windows/security/threat-protection/auditing/event-4773.md
index 1f809ff2f0..8a65a7df8a 100644
--- a/windows/security/threat-protection/auditing/event-4773.md
+++ b/windows/security/threat-protection/auditing/event-4773.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4774.md b/windows/security/threat-protection/auditing/event-4774.md
index e8304521fa..65edca2761 100644
--- a/windows/security/threat-protection/auditing/event-4774.md
+++ b/windows/security/threat-protection/auditing/event-4774.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4775.md b/windows/security/threat-protection/auditing/event-4775.md
index b8e498ff1a..473697a68f 100644
--- a/windows/security/threat-protection/auditing/event-4775.md
+++ b/windows/security/threat-protection/auditing/event-4775.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4776.md b/windows/security/threat-protection/auditing/event-4776.md
index 17c5196837..ef04b9a13e 100644
--- a/windows/security/threat-protection/auditing/event-4776.md
+++ b/windows/security/threat-protection/auditing/event-4776.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4777.md b/windows/security/threat-protection/auditing/event-4777.md
index 17d6d60001..ec54750c71 100644
--- a/windows/security/threat-protection/auditing/event-4777.md
+++ b/windows/security/threat-protection/auditing/event-4777.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4778.md b/windows/security/threat-protection/auditing/event-4778.md
index 6b9b0ebb67..caa301af26 100644
--- a/windows/security/threat-protection/auditing/event-4778.md
+++ b/windows/security/threat-protection/auditing/event-4778.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4779.md b/windows/security/threat-protection/auditing/event-4779.md
index 27a1850d12..48da89946f 100644
--- a/windows/security/threat-protection/auditing/event-4779.md
+++ b/windows/security/threat-protection/auditing/event-4779.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4780.md b/windows/security/threat-protection/auditing/event-4780.md
index ffaeeb0a6f..26d14f55d5 100644
--- a/windows/security/threat-protection/auditing/event-4780.md
+++ b/windows/security/threat-protection/auditing/event-4780.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4781.md b/windows/security/threat-protection/auditing/event-4781.md
index 653ccce05c..be9c51ab52 100644
--- a/windows/security/threat-protection/auditing/event-4781.md
+++ b/windows/security/threat-protection/auditing/event-4781.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4782.md b/windows/security/threat-protection/auditing/event-4782.md
index 72fb865981..195c2cf4df 100644
--- a/windows/security/threat-protection/auditing/event-4782.md
+++ b/windows/security/threat-protection/auditing/event-4782.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4793.md b/windows/security/threat-protection/auditing/event-4793.md
index bcd5b48e69..b0ac045f2f 100644
--- a/windows/security/threat-protection/auditing/event-4793.md
+++ b/windows/security/threat-protection/auditing/event-4793.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4794.md b/windows/security/threat-protection/auditing/event-4794.md
index 20004e2404..cd85dc1d77 100644
--- a/windows/security/threat-protection/auditing/event-4794.md
+++ b/windows/security/threat-protection/auditing/event-4794.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4798.md b/windows/security/threat-protection/auditing/event-4798.md
index dfb877c452..c432cb8c08 100644
--- a/windows/security/threat-protection/auditing/event-4798.md
+++ b/windows/security/threat-protection/auditing/event-4798.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4799.md b/windows/security/threat-protection/auditing/event-4799.md
index 5a93e06782..1f126c2840 100644
--- a/windows/security/threat-protection/auditing/event-4799.md
+++ b/windows/security/threat-protection/auditing/event-4799.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4800.md b/windows/security/threat-protection/auditing/event-4800.md
index 36e68e0d64..1d4ef520e5 100644
--- a/windows/security/threat-protection/auditing/event-4800.md
+++ b/windows/security/threat-protection/auditing/event-4800.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4801.md b/windows/security/threat-protection/auditing/event-4801.md
index 58137aaf46..7681ec1773 100644
--- a/windows/security/threat-protection/auditing/event-4801.md
+++ b/windows/security/threat-protection/auditing/event-4801.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4802.md b/windows/security/threat-protection/auditing/event-4802.md
index 7947029272..f984fd6753 100644
--- a/windows/security/threat-protection/auditing/event-4802.md
+++ b/windows/security/threat-protection/auditing/event-4802.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4803.md b/windows/security/threat-protection/auditing/event-4803.md
index f2d01eac46..f857dd4f57 100644
--- a/windows/security/threat-protection/auditing/event-4803.md
+++ b/windows/security/threat-protection/auditing/event-4803.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4816.md b/windows/security/threat-protection/auditing/event-4816.md
index aff1f0b7b8..1166587fae 100644
--- a/windows/security/threat-protection/auditing/event-4816.md
+++ b/windows/security/threat-protection/auditing/event-4816.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4817.md b/windows/security/threat-protection/auditing/event-4817.md
index 90db648c38..ce42488f86 100644
--- a/windows/security/threat-protection/auditing/event-4817.md
+++ b/windows/security/threat-protection/auditing/event-4817.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4818.md b/windows/security/threat-protection/auditing/event-4818.md
index 681c20e5ce..147dee2f2b 100644
--- a/windows/security/threat-protection/auditing/event-4818.md
+++ b/windows/security/threat-protection/auditing/event-4818.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4819.md b/windows/security/threat-protection/auditing/event-4819.md
index 945ae256a1..6b7f2516b5 100644
--- a/windows/security/threat-protection/auditing/event-4819.md
+++ b/windows/security/threat-protection/auditing/event-4819.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4826.md b/windows/security/threat-protection/auditing/event-4826.md
index 02fc2b2dbe..d3a1cf34e3 100644
--- a/windows/security/threat-protection/auditing/event-4826.md
+++ b/windows/security/threat-protection/auditing/event-4826.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4864.md b/windows/security/threat-protection/auditing/event-4864.md
index 43d6cf33bb..a4729e4103 100644
--- a/windows/security/threat-protection/auditing/event-4864.md
+++ b/windows/security/threat-protection/auditing/event-4864.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4865.md b/windows/security/threat-protection/auditing/event-4865.md
index 6594212812..843d1542b6 100644
--- a/windows/security/threat-protection/auditing/event-4865.md
+++ b/windows/security/threat-protection/auditing/event-4865.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4866.md b/windows/security/threat-protection/auditing/event-4866.md
index 5cf74949cb..bf32d2daa5 100644
--- a/windows/security/threat-protection/auditing/event-4866.md
+++ b/windows/security/threat-protection/auditing/event-4866.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4867.md b/windows/security/threat-protection/auditing/event-4867.md
index 10367c56b8..cc0c449a75 100644
--- a/windows/security/threat-protection/auditing/event-4867.md
+++ b/windows/security/threat-protection/auditing/event-4867.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4902.md b/windows/security/threat-protection/auditing/event-4902.md
index c94bd3c5bb..9a59309492 100644
--- a/windows/security/threat-protection/auditing/event-4902.md
+++ b/windows/security/threat-protection/auditing/event-4902.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4904.md b/windows/security/threat-protection/auditing/event-4904.md
index 4b1b1d10b6..c529ad4a45 100644
--- a/windows/security/threat-protection/auditing/event-4904.md
+++ b/windows/security/threat-protection/auditing/event-4904.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4905.md b/windows/security/threat-protection/auditing/event-4905.md
index 91c33a149b..5cdb7f8d3c 100644
--- a/windows/security/threat-protection/auditing/event-4905.md
+++ b/windows/security/threat-protection/auditing/event-4905.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4906.md b/windows/security/threat-protection/auditing/event-4906.md
index 09c93dd96b..7ad2014e0c 100644
--- a/windows/security/threat-protection/auditing/event-4906.md
+++ b/windows/security/threat-protection/auditing/event-4906.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4907.md b/windows/security/threat-protection/auditing/event-4907.md
index 6770563571..bd687db23f 100644
--- a/windows/security/threat-protection/auditing/event-4907.md
+++ b/windows/security/threat-protection/auditing/event-4907.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4908.md b/windows/security/threat-protection/auditing/event-4908.md
index 1228c676e7..91100cee21 100644
--- a/windows/security/threat-protection/auditing/event-4908.md
+++ b/windows/security/threat-protection/auditing/event-4908.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4909.md b/windows/security/threat-protection/auditing/event-4909.md
index 256b121950..02c3e26b35 100644
--- a/windows/security/threat-protection/auditing/event-4909.md
+++ b/windows/security/threat-protection/auditing/event-4909.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4910.md b/windows/security/threat-protection/auditing/event-4910.md
index 42981b3496..fcf06907b2 100644
--- a/windows/security/threat-protection/auditing/event-4910.md
+++ b/windows/security/threat-protection/auditing/event-4910.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4911.md b/windows/security/threat-protection/auditing/event-4911.md
index a906f906e4..a613fe1a37 100644
--- a/windows/security/threat-protection/auditing/event-4911.md
+++ b/windows/security/threat-protection/auditing/event-4911.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4912.md b/windows/security/threat-protection/auditing/event-4912.md
index a905f4b664..87d587596b 100644
--- a/windows/security/threat-protection/auditing/event-4912.md
+++ b/windows/security/threat-protection/auditing/event-4912.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4913.md b/windows/security/threat-protection/auditing/event-4913.md
index 53a5d024c1..8c3d47db80 100644
--- a/windows/security/threat-protection/auditing/event-4913.md
+++ b/windows/security/threat-protection/auditing/event-4913.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4928.md b/windows/security/threat-protection/auditing/event-4928.md
index 4c84b51785..615d55926f 100644
--- a/windows/security/threat-protection/auditing/event-4928.md
+++ b/windows/security/threat-protection/auditing/event-4928.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4929.md b/windows/security/threat-protection/auditing/event-4929.md
index 540f77ac0f..f1e2e9044a 100644
--- a/windows/security/threat-protection/auditing/event-4929.md
+++ b/windows/security/threat-protection/auditing/event-4929.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4930.md b/windows/security/threat-protection/auditing/event-4930.md
index f04e61bab7..7063936812 100644
--- a/windows/security/threat-protection/auditing/event-4930.md
+++ b/windows/security/threat-protection/auditing/event-4930.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4931.md b/windows/security/threat-protection/auditing/event-4931.md
index 1ab43a9df6..ef59fb97f9 100644
--- a/windows/security/threat-protection/auditing/event-4931.md
+++ b/windows/security/threat-protection/auditing/event-4931.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4932.md b/windows/security/threat-protection/auditing/event-4932.md
index 888d65a13f..40f8fe939a 100644
--- a/windows/security/threat-protection/auditing/event-4932.md
+++ b/windows/security/threat-protection/auditing/event-4932.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4933.md b/windows/security/threat-protection/auditing/event-4933.md
index a444061003..f1097f928f 100644
--- a/windows/security/threat-protection/auditing/event-4933.md
+++ b/windows/security/threat-protection/auditing/event-4933.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4934.md b/windows/security/threat-protection/auditing/event-4934.md
index 7576f09c73..7df893eab6 100644
--- a/windows/security/threat-protection/auditing/event-4934.md
+++ b/windows/security/threat-protection/auditing/event-4934.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4935.md b/windows/security/threat-protection/auditing/event-4935.md
index c04cd3c3f6..d29e4f36f5 100644
--- a/windows/security/threat-protection/auditing/event-4935.md
+++ b/windows/security/threat-protection/auditing/event-4935.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4936.md b/windows/security/threat-protection/auditing/event-4936.md
index 1a6fe8601e..92b3e6caf5 100644
--- a/windows/security/threat-protection/auditing/event-4936.md
+++ b/windows/security/threat-protection/auditing/event-4936.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4937.md b/windows/security/threat-protection/auditing/event-4937.md
index 05fcc3a155..2b02731d51 100644
--- a/windows/security/threat-protection/auditing/event-4937.md
+++ b/windows/security/threat-protection/auditing/event-4937.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4944.md b/windows/security/threat-protection/auditing/event-4944.md
index b1e940a227..b4169b5915 100644
--- a/windows/security/threat-protection/auditing/event-4944.md
+++ b/windows/security/threat-protection/auditing/event-4944.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4945.md b/windows/security/threat-protection/auditing/event-4945.md
index e75fd5b89d..c759afa1e6 100644
--- a/windows/security/threat-protection/auditing/event-4945.md
+++ b/windows/security/threat-protection/auditing/event-4945.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4946.md b/windows/security/threat-protection/auditing/event-4946.md
index 2ee2573635..9c67d305e2 100644
--- a/windows/security/threat-protection/auditing/event-4946.md
+++ b/windows/security/threat-protection/auditing/event-4946.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4947.md b/windows/security/threat-protection/auditing/event-4947.md
index f6e3914c39..bb9a592ca3 100644
--- a/windows/security/threat-protection/auditing/event-4947.md
+++ b/windows/security/threat-protection/auditing/event-4947.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4948.md b/windows/security/threat-protection/auditing/event-4948.md
index 75dff8ca6c..2a8a1a7a9a 100644
--- a/windows/security/threat-protection/auditing/event-4948.md
+++ b/windows/security/threat-protection/auditing/event-4948.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4949.md b/windows/security/threat-protection/auditing/event-4949.md
index 465f4e4f8e..0454afa9ca 100644
--- a/windows/security/threat-protection/auditing/event-4949.md
+++ b/windows/security/threat-protection/auditing/event-4949.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4950.md b/windows/security/threat-protection/auditing/event-4950.md
index 34f2003512..fd666fc369 100644
--- a/windows/security/threat-protection/auditing/event-4950.md
+++ b/windows/security/threat-protection/auditing/event-4950.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4951.md b/windows/security/threat-protection/auditing/event-4951.md
index 661062f902..a83b9f12c9 100644
--- a/windows/security/threat-protection/auditing/event-4951.md
+++ b/windows/security/threat-protection/auditing/event-4951.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4952.md b/windows/security/threat-protection/auditing/event-4952.md
index b1c36d493f..dfa3de4c4f 100644
--- a/windows/security/threat-protection/auditing/event-4952.md
+++ b/windows/security/threat-protection/auditing/event-4952.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4953.md b/windows/security/threat-protection/auditing/event-4953.md
index 2c36a9d208..d74e0ac560 100644
--- a/windows/security/threat-protection/auditing/event-4953.md
+++ b/windows/security/threat-protection/auditing/event-4953.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4954.md b/windows/security/threat-protection/auditing/event-4954.md
index 73484f44b8..91e3c4833d 100644
--- a/windows/security/threat-protection/auditing/event-4954.md
+++ b/windows/security/threat-protection/auditing/event-4954.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4956.md b/windows/security/threat-protection/auditing/event-4956.md
index b244794b33..2c57e4c683 100644
--- a/windows/security/threat-protection/auditing/event-4956.md
+++ b/windows/security/threat-protection/auditing/event-4956.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4957.md b/windows/security/threat-protection/auditing/event-4957.md
index 5b7eb9a592..135f54ed60 100644
--- a/windows/security/threat-protection/auditing/event-4957.md
+++ b/windows/security/threat-protection/auditing/event-4957.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4958.md b/windows/security/threat-protection/auditing/event-4958.md
index fa45d31733..e04a7c576b 100644
--- a/windows/security/threat-protection/auditing/event-4958.md
+++ b/windows/security/threat-protection/auditing/event-4958.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4964.md b/windows/security/threat-protection/auditing/event-4964.md
index 8e1b38f252..64d80d5bd4 100644
--- a/windows/security/threat-protection/auditing/event-4964.md
+++ b/windows/security/threat-protection/auditing/event-4964.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-4985.md b/windows/security/threat-protection/auditing/event-4985.md
index da38bc5ac3..b5ae0e52fc 100644
--- a/windows/security/threat-protection/auditing/event-4985.md
+++ b/windows/security/threat-protection/auditing/event-4985.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5024.md b/windows/security/threat-protection/auditing/event-5024.md
index e669caf386..41b9e70214 100644
--- a/windows/security/threat-protection/auditing/event-5024.md
+++ b/windows/security/threat-protection/auditing/event-5024.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5025.md b/windows/security/threat-protection/auditing/event-5025.md
index 8771cc7974..1fc4d75d56 100644
--- a/windows/security/threat-protection/auditing/event-5025.md
+++ b/windows/security/threat-protection/auditing/event-5025.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5027.md b/windows/security/threat-protection/auditing/event-5027.md
index 491f846ff8..369785a28c 100644
--- a/windows/security/threat-protection/auditing/event-5027.md
+++ b/windows/security/threat-protection/auditing/event-5027.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5028.md b/windows/security/threat-protection/auditing/event-5028.md
index 6042fef617..426fabfd91 100644
--- a/windows/security/threat-protection/auditing/event-5028.md
+++ b/windows/security/threat-protection/auditing/event-5028.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5029.md b/windows/security/threat-protection/auditing/event-5029.md
index daf0e0248e..b406c84f14 100644
--- a/windows/security/threat-protection/auditing/event-5029.md
+++ b/windows/security/threat-protection/auditing/event-5029.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5030.md b/windows/security/threat-protection/auditing/event-5030.md
index bc11ab187c..48a65fb8f8 100644
--- a/windows/security/threat-protection/auditing/event-5030.md
+++ b/windows/security/threat-protection/auditing/event-5030.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5031.md b/windows/security/threat-protection/auditing/event-5031.md
index f19a1c644a..583721a9fe 100644
--- a/windows/security/threat-protection/auditing/event-5031.md
+++ b/windows/security/threat-protection/auditing/event-5031.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5032.md b/windows/security/threat-protection/auditing/event-5032.md
index 6be54f3206..d15d9f16fa 100644
--- a/windows/security/threat-protection/auditing/event-5032.md
+++ b/windows/security/threat-protection/auditing/event-5032.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5033.md b/windows/security/threat-protection/auditing/event-5033.md
index 6742336fcb..75109ef8f3 100644
--- a/windows/security/threat-protection/auditing/event-5033.md
+++ b/windows/security/threat-protection/auditing/event-5033.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5034.md b/windows/security/threat-protection/auditing/event-5034.md
index 896fe4e94c..0ccd247148 100644
--- a/windows/security/threat-protection/auditing/event-5034.md
+++ b/windows/security/threat-protection/auditing/event-5034.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5035.md b/windows/security/threat-protection/auditing/event-5035.md
index e65b0680cd..175e4aadec 100644
--- a/windows/security/threat-protection/auditing/event-5035.md
+++ b/windows/security/threat-protection/auditing/event-5035.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5037.md b/windows/security/threat-protection/auditing/event-5037.md
index f05fd3be1c..bf4911fb3e 100644
--- a/windows/security/threat-protection/auditing/event-5037.md
+++ b/windows/security/threat-protection/auditing/event-5037.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5038.md b/windows/security/threat-protection/auditing/event-5038.md
index ff00407e6e..3e6b0fb302 100644
--- a/windows/security/threat-protection/auditing/event-5038.md
+++ b/windows/security/threat-protection/auditing/event-5038.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5039.md b/windows/security/threat-protection/auditing/event-5039.md
index fe78230d8c..7b1ba2e281 100644
--- a/windows/security/threat-protection/auditing/event-5039.md
+++ b/windows/security/threat-protection/auditing/event-5039.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
@@ -16,7 +17,7 @@ ms.date: 04/19/2017
- Windows Server 2016
-This event should be generated when registry key was virtualized using [LUAFV](http://blogs.msdn.com/b/alexcarp/archive/2009/06/25/the-deal-with-luafv-sys.aspx).
+This event should be generated when registry key was virtualized using [LUAFV](https://blogs.msdn.com/b/alexcarp/archive/2009/06/25/the-deal-with-luafv-sys.aspx).
This event occurs very rarely during standard LUAFV registry key virtualization.
diff --git a/windows/security/threat-protection/auditing/event-5051.md b/windows/security/threat-protection/auditing/event-5051.md
index 4880ab3e11..73f82089f2 100644
--- a/windows/security/threat-protection/auditing/event-5051.md
+++ b/windows/security/threat-protection/auditing/event-5051.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
@@ -16,7 +17,7 @@ ms.date: 04/19/2017
- Windows Server 2016
-This event should be generated when file was virtualized using [LUAFV](http://blogs.msdn.com/b/alexcarp/archive/2009/06/25/the-deal-with-luafv-sys.aspx).
+This event should be generated when file was virtualized using [LUAFV](https://blogs.msdn.com/b/alexcarp/archive/2009/06/25/the-deal-with-luafv-sys.aspx).
This event occurs very rarely during standard LUAFV file virtualization.
diff --git a/windows/security/threat-protection/auditing/event-5056.md b/windows/security/threat-protection/auditing/event-5056.md
index 108eaf241b..be7ee92421 100644
--- a/windows/security/threat-protection/auditing/event-5056.md
+++ b/windows/security/threat-protection/auditing/event-5056.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5057.md b/windows/security/threat-protection/auditing/event-5057.md
index 4b26c92088..55f1edb854 100644
--- a/windows/security/threat-protection/auditing/event-5057.md
+++ b/windows/security/threat-protection/auditing/event-5057.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5058.md b/windows/security/threat-protection/auditing/event-5058.md
index 50fdab44bf..c0b2c17fe8 100644
--- a/windows/security/threat-protection/auditing/event-5058.md
+++ b/windows/security/threat-protection/auditing/event-5058.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5059.md b/windows/security/threat-protection/auditing/event-5059.md
index c723a6e639..cc890b0727 100644
--- a/windows/security/threat-protection/auditing/event-5059.md
+++ b/windows/security/threat-protection/auditing/event-5059.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5060.md b/windows/security/threat-protection/auditing/event-5060.md
index 984126866d..be31414e13 100644
--- a/windows/security/threat-protection/auditing/event-5060.md
+++ b/windows/security/threat-protection/auditing/event-5060.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5061.md b/windows/security/threat-protection/auditing/event-5061.md
index bf37954b97..cbd18c4c2a 100644
--- a/windows/security/threat-protection/auditing/event-5061.md
+++ b/windows/security/threat-protection/auditing/event-5061.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5062.md b/windows/security/threat-protection/auditing/event-5062.md
index 47e1402ebb..67b9d5b4e3 100644
--- a/windows/security/threat-protection/auditing/event-5062.md
+++ b/windows/security/threat-protection/auditing/event-5062.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5063.md b/windows/security/threat-protection/auditing/event-5063.md
index 54bc56bdc4..b5a82e84e3 100644
--- a/windows/security/threat-protection/auditing/event-5063.md
+++ b/windows/security/threat-protection/auditing/event-5063.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5064.md b/windows/security/threat-protection/auditing/event-5064.md
index c4d034a000..5ee606581a 100644
--- a/windows/security/threat-protection/auditing/event-5064.md
+++ b/windows/security/threat-protection/auditing/event-5064.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5065.md b/windows/security/threat-protection/auditing/event-5065.md
index 8d81a7604f..ee4fae206d 100644
--- a/windows/security/threat-protection/auditing/event-5065.md
+++ b/windows/security/threat-protection/auditing/event-5065.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5066.md b/windows/security/threat-protection/auditing/event-5066.md
index 25b595c19f..c37391a6df 100644
--- a/windows/security/threat-protection/auditing/event-5066.md
+++ b/windows/security/threat-protection/auditing/event-5066.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5067.md b/windows/security/threat-protection/auditing/event-5067.md
index d2fc40cdf7..4928e743c7 100644
--- a/windows/security/threat-protection/auditing/event-5067.md
+++ b/windows/security/threat-protection/auditing/event-5067.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5068.md b/windows/security/threat-protection/auditing/event-5068.md
index dd27edc08d..45904a6ef7 100644
--- a/windows/security/threat-protection/auditing/event-5068.md
+++ b/windows/security/threat-protection/auditing/event-5068.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5069.md b/windows/security/threat-protection/auditing/event-5069.md
index eece0a1b44..6f40c2d61f 100644
--- a/windows/security/threat-protection/auditing/event-5069.md
+++ b/windows/security/threat-protection/auditing/event-5069.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5070.md b/windows/security/threat-protection/auditing/event-5070.md
index 14bf2b591e..dde6756a49 100644
--- a/windows/security/threat-protection/auditing/event-5070.md
+++ b/windows/security/threat-protection/auditing/event-5070.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5136.md b/windows/security/threat-protection/auditing/event-5136.md
index be3cebc546..ac81516d45 100644
--- a/windows/security/threat-protection/auditing/event-5136.md
+++ b/windows/security/threat-protection/auditing/event-5136.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5137.md b/windows/security/threat-protection/auditing/event-5137.md
index 2811ea8260..68e3c16bf6 100644
--- a/windows/security/threat-protection/auditing/event-5137.md
+++ b/windows/security/threat-protection/auditing/event-5137.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5138.md b/windows/security/threat-protection/auditing/event-5138.md
index 0b7bc8bdda..8f8025411c 100644
--- a/windows/security/threat-protection/auditing/event-5138.md
+++ b/windows/security/threat-protection/auditing/event-5138.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5139.md b/windows/security/threat-protection/auditing/event-5139.md
index ca1dcb8760..b949968635 100644
--- a/windows/security/threat-protection/auditing/event-5139.md
+++ b/windows/security/threat-protection/auditing/event-5139.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5140.md b/windows/security/threat-protection/auditing/event-5140.md
index e026048c46..aa0ea5013d 100644
--- a/windows/security/threat-protection/auditing/event-5140.md
+++ b/windows/security/threat-protection/auditing/event-5140.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5141.md b/windows/security/threat-protection/auditing/event-5141.md
index 3bba690ce9..d1a8d52a18 100644
--- a/windows/security/threat-protection/auditing/event-5141.md
+++ b/windows/security/threat-protection/auditing/event-5141.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5142.md b/windows/security/threat-protection/auditing/event-5142.md
index dade8d91b1..e031fd9dbd 100644
--- a/windows/security/threat-protection/auditing/event-5142.md
+++ b/windows/security/threat-protection/auditing/event-5142.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5143.md b/windows/security/threat-protection/auditing/event-5143.md
index 766455cb88..999f6f9f93 100644
--- a/windows/security/threat-protection/auditing/event-5143.md
+++ b/windows/security/threat-protection/auditing/event-5143.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5144.md b/windows/security/threat-protection/auditing/event-5144.md
index 1ea7b1be36..905774bf44 100644
--- a/windows/security/threat-protection/auditing/event-5144.md
+++ b/windows/security/threat-protection/auditing/event-5144.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5145.md b/windows/security/threat-protection/auditing/event-5145.md
index 756dad0627..ec8421bf74 100644
--- a/windows/security/threat-protection/auditing/event-5145.md
+++ b/windows/security/threat-protection/auditing/event-5145.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5148.md b/windows/security/threat-protection/auditing/event-5148.md
index 77116b9355..c4461e26a3 100644
--- a/windows/security/threat-protection/auditing/event-5148.md
+++ b/windows/security/threat-protection/auditing/event-5148.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 05/29/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5149.md b/windows/security/threat-protection/auditing/event-5149.md
index 8e64d233fb..08039b5ca0 100644
--- a/windows/security/threat-protection/auditing/event-5149.md
+++ b/windows/security/threat-protection/auditing/event-5149.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 05/29/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5150.md b/windows/security/threat-protection/auditing/event-5150.md
index 918be364cf..3afbcf26df 100644
--- a/windows/security/threat-protection/auditing/event-5150.md
+++ b/windows/security/threat-protection/auditing/event-5150.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5151.md b/windows/security/threat-protection/auditing/event-5151.md
index d524a4bfcf..4864a283c9 100644
--- a/windows/security/threat-protection/auditing/event-5151.md
+++ b/windows/security/threat-protection/auditing/event-5151.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5152.md b/windows/security/threat-protection/auditing/event-5152.md
index 794e03728c..154a62f07a 100644
--- a/windows/security/threat-protection/auditing/event-5152.md
+++ b/windows/security/threat-protection/auditing/event-5152.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5153.md b/windows/security/threat-protection/auditing/event-5153.md
index 6a80984c62..ffd21c1282 100644
--- a/windows/security/threat-protection/auditing/event-5153.md
+++ b/windows/security/threat-protection/auditing/event-5153.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5154.md b/windows/security/threat-protection/auditing/event-5154.md
index 7bf096f3d4..9dd278c6a8 100644
--- a/windows/security/threat-protection/auditing/event-5154.md
+++ b/windows/security/threat-protection/auditing/event-5154.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5155.md b/windows/security/threat-protection/auditing/event-5155.md
index b4bf0b06ec..8662e186f2 100644
--- a/windows/security/threat-protection/auditing/event-5155.md
+++ b/windows/security/threat-protection/auditing/event-5155.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5156.md b/windows/security/threat-protection/auditing/event-5156.md
index a9eade92a4..bfeaa865c2 100644
--- a/windows/security/threat-protection/auditing/event-5156.md
+++ b/windows/security/threat-protection/auditing/event-5156.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5157.md b/windows/security/threat-protection/auditing/event-5157.md
index 252e41c447..6b91edfeb0 100644
--- a/windows/security/threat-protection/auditing/event-5157.md
+++ b/windows/security/threat-protection/auditing/event-5157.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5158.md b/windows/security/threat-protection/auditing/event-5158.md
index b1faa28a26..d3d62462e1 100644
--- a/windows/security/threat-protection/auditing/event-5158.md
+++ b/windows/security/threat-protection/auditing/event-5158.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5159.md b/windows/security/threat-protection/auditing/event-5159.md
index 3d4b26fdc0..3fdf553811 100644
--- a/windows/security/threat-protection/auditing/event-5159.md
+++ b/windows/security/threat-protection/auditing/event-5159.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5168.md b/windows/security/threat-protection/auditing/event-5168.md
index 8905c824d3..46f401b3a0 100644
--- a/windows/security/threat-protection/auditing/event-5168.md
+++ b/windows/security/threat-protection/auditing/event-5168.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5376.md b/windows/security/threat-protection/auditing/event-5376.md
index 9759e6d0c2..40919244b6 100644
--- a/windows/security/threat-protection/auditing/event-5376.md
+++ b/windows/security/threat-protection/auditing/event-5376.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5377.md b/windows/security/threat-protection/auditing/event-5377.md
index 5d2a1709d1..c55060acff 100644
--- a/windows/security/threat-protection/auditing/event-5377.md
+++ b/windows/security/threat-protection/auditing/event-5377.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5378.md b/windows/security/threat-protection/auditing/event-5378.md
index 3bd452b0c4..47e308e4b7 100644
--- a/windows/security/threat-protection/auditing/event-5378.md
+++ b/windows/security/threat-protection/auditing/event-5378.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5447.md b/windows/security/threat-protection/auditing/event-5447.md
index 73a1f15abe..d946f5bf63 100644
--- a/windows/security/threat-protection/auditing/event-5447.md
+++ b/windows/security/threat-protection/auditing/event-5447.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5632.md b/windows/security/threat-protection/auditing/event-5632.md
index 29bdb8e39c..b84d151c2d 100644
--- a/windows/security/threat-protection/auditing/event-5632.md
+++ b/windows/security/threat-protection/auditing/event-5632.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5633.md b/windows/security/threat-protection/auditing/event-5633.md
index 21fabc1686..7984ff5428 100644
--- a/windows/security/threat-protection/auditing/event-5633.md
+++ b/windows/security/threat-protection/auditing/event-5633.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5712.md b/windows/security/threat-protection/auditing/event-5712.md
index 65544e2603..0588eb54be 100644
--- a/windows/security/threat-protection/auditing/event-5712.md
+++ b/windows/security/threat-protection/auditing/event-5712.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5888.md b/windows/security/threat-protection/auditing/event-5888.md
index 0a962eb85a..28a9434761 100644
--- a/windows/security/threat-protection/auditing/event-5888.md
+++ b/windows/security/threat-protection/auditing/event-5888.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5889.md b/windows/security/threat-protection/auditing/event-5889.md
index c17e01b947..180114aff2 100644
--- a/windows/security/threat-protection/auditing/event-5889.md
+++ b/windows/security/threat-protection/auditing/event-5889.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-5890.md b/windows/security/threat-protection/auditing/event-5890.md
index fa696c09b1..c9dcc8b7e8 100644
--- a/windows/security/threat-protection/auditing/event-5890.md
+++ b/windows/security/threat-protection/auditing/event-5890.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6144.md b/windows/security/threat-protection/auditing/event-6144.md
index 1b7b6cbe26..6001c97965 100644
--- a/windows/security/threat-protection/auditing/event-6144.md
+++ b/windows/security/threat-protection/auditing/event-6144.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6145.md b/windows/security/threat-protection/auditing/event-6145.md
index 5dd2b3ca8b..0c7df89384 100644
--- a/windows/security/threat-protection/auditing/event-6145.md
+++ b/windows/security/threat-protection/auditing/event-6145.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6281.md b/windows/security/threat-protection/auditing/event-6281.md
index aedaab33bb..91740aeefb 100644
--- a/windows/security/threat-protection/auditing/event-6281.md
+++ b/windows/security/threat-protection/auditing/event-6281.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6400.md b/windows/security/threat-protection/auditing/event-6400.md
index cfb77f2b3a..8846fca660 100644
--- a/windows/security/threat-protection/auditing/event-6400.md
+++ b/windows/security/threat-protection/auditing/event-6400.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6401.md b/windows/security/threat-protection/auditing/event-6401.md
index 3d2cdad2e8..eb91491cd0 100644
--- a/windows/security/threat-protection/auditing/event-6401.md
+++ b/windows/security/threat-protection/auditing/event-6401.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6402.md b/windows/security/threat-protection/auditing/event-6402.md
index 25ab43c57a..4a1a25539a 100644
--- a/windows/security/threat-protection/auditing/event-6402.md
+++ b/windows/security/threat-protection/auditing/event-6402.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6403.md b/windows/security/threat-protection/auditing/event-6403.md
index dc6488418a..28eef92c52 100644
--- a/windows/security/threat-protection/auditing/event-6403.md
+++ b/windows/security/threat-protection/auditing/event-6403.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6404.md b/windows/security/threat-protection/auditing/event-6404.md
index 8b687e9d61..2a7e910540 100644
--- a/windows/security/threat-protection/auditing/event-6404.md
+++ b/windows/security/threat-protection/auditing/event-6404.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6405.md b/windows/security/threat-protection/auditing/event-6405.md
index 7fc02c9412..7fc3ad0806 100644
--- a/windows/security/threat-protection/auditing/event-6405.md
+++ b/windows/security/threat-protection/auditing/event-6405.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6406.md b/windows/security/threat-protection/auditing/event-6406.md
index 1dcb6e90d7..8d55408ad9 100644
--- a/windows/security/threat-protection/auditing/event-6406.md
+++ b/windows/security/threat-protection/auditing/event-6406.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6407.md b/windows/security/threat-protection/auditing/event-6407.md
index 1317d12b70..ba34e7a26e 100644
--- a/windows/security/threat-protection/auditing/event-6407.md
+++ b/windows/security/threat-protection/auditing/event-6407.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6408.md b/windows/security/threat-protection/auditing/event-6408.md
index 682546cef4..1f54ca83b1 100644
--- a/windows/security/threat-protection/auditing/event-6408.md
+++ b/windows/security/threat-protection/auditing/event-6408.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6409.md b/windows/security/threat-protection/auditing/event-6409.md
index 133b879966..b5e0e99e03 100644
--- a/windows/security/threat-protection/auditing/event-6409.md
+++ b/windows/security/threat-protection/auditing/event-6409.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6410.md b/windows/security/threat-protection/auditing/event-6410.md
index 7cd9614b30..f1c92358f7 100644
--- a/windows/security/threat-protection/auditing/event-6410.md
+++ b/windows/security/threat-protection/auditing/event-6410.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6416.md b/windows/security/threat-protection/auditing/event-6416.md
index 3fcc8e37dd..812286011b 100644
--- a/windows/security/threat-protection/auditing/event-6416.md
+++ b/windows/security/threat-protection/auditing/event-6416.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6419.md b/windows/security/threat-protection/auditing/event-6419.md
index d185fb6e2c..b2f31d721b 100644
--- a/windows/security/threat-protection/auditing/event-6419.md
+++ b/windows/security/threat-protection/auditing/event-6419.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6420.md b/windows/security/threat-protection/auditing/event-6420.md
index 3c7d9aafa9..da80a07bdc 100644
--- a/windows/security/threat-protection/auditing/event-6420.md
+++ b/windows/security/threat-protection/auditing/event-6420.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6421.md b/windows/security/threat-protection/auditing/event-6421.md
index e82d2c1cce..0b09ff7dee 100644
--- a/windows/security/threat-protection/auditing/event-6421.md
+++ b/windows/security/threat-protection/auditing/event-6421.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6422.md b/windows/security/threat-protection/auditing/event-6422.md
index bbd690551c..42d91b1f65 100644
--- a/windows/security/threat-protection/auditing/event-6422.md
+++ b/windows/security/threat-protection/auditing/event-6422.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6423.md b/windows/security/threat-protection/auditing/event-6423.md
index 6e9a3a1f54..e3eb81e79d 100644
--- a/windows/security/threat-protection/auditing/event-6423.md
+++ b/windows/security/threat-protection/auditing/event-6423.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/event-6424.md b/windows/security/threat-protection/auditing/event-6424.md
index 3afa0bee64..a4ef6c15e8 100644
--- a/windows/security/threat-protection/auditing/event-6424.md
+++ b/windows/security/threat-protection/auditing/event-6424.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md b/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md
index d83ec4b427..7964ac323a 100644
--- a/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md
+++ b/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md b/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md
index 5bcc889fff..439c9c1b3f 100644
--- a/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md
+++ b/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
@@ -18,7 +19,7 @@ ms.date: 04/19/2017
This topic for the IT professional describes how to monitor changes to central access policy and central access rule definitions when you use advanced security auditing options to monitor dynamic access control objects.
Central access policies and rules determine access permissions for multiple files on multiple file servers. Therefore, it is important to monitor changes to them. Like user claim and device claim definitions, central access policy and rule definitions reside in Active Directory Domain Services (AD DS), and they can be monitored just like any other object in Active Directory. Central access policies and rules are critical elements in a Dynamic Access Control deployment. These policies and rules are stored in AD DS, so they should be less likely to be tampered with than other network objects. However, it is important to monitor these objects for potential changes in security auditing and to verify that policies are being enforced.
-Use the following procedures to configure settings to monitor changes to central access policy and central access rule definitions and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx).
+Use the following procedures to configure settings to monitor changes to central access policy and central access rule definitions and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](https://technet.microsoft.com/library/hh846167.aspx).
>**Note:** Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
diff --git a/windows/security/threat-protection/auditing/monitor-claim-types.md b/windows/security/threat-protection/auditing/monitor-claim-types.md
index 410b771c8d..7aeb903d71 100644
--- a/windows/security/threat-protection/auditing/monitor-claim-types.md
+++ b/windows/security/threat-protection/auditing/monitor-claim-types.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
@@ -19,8 +20,8 @@ This topic for the IT professional describes how to monitor changes to claim typ
Claim types are one of the basic building blocks of Dynamic Access Control. Claim types can include attributes such as the departments in an organization or the levels of security clearance that apply to classes of users. You can use security auditing to track whether claims are added, modified, enabled, disabled, or deleted.
-Use the following procedures to configure settings to monitor changes to claim types in AD DS. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic
-Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx).
+Use the following procedures to configure settings to monitor changes to claim types in AD DS. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic
+Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](https://technet.microsoft.com/library/hh846167.aspx).
>**Note:** Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
diff --git a/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md b/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md
index 3b001b7e2a..c99548b8fd 100644
--- a/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md
+++ b/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
@@ -20,7 +21,7 @@ Resource attribute definitions define the basic properties of resource attribute
For information about monitoring changes to the resource attributes that apply to files, see [Monitor the resource attributes on files and folders](monitor-the-resource-attributes-on-files-and-folders.md).
-Use the following procedures to configure settings to monitor changes to resource attribute definitions in AD DS and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx).
+Use the following procedures to configure settings to monitor changes to resource attribute definitions in AD DS and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](https://technet.microsoft.com/library/hh846167.aspx).
>**Note:** Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
diff --git a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md
index a87230b143..a6c28921e2 100644
--- a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md
+++ b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
@@ -21,7 +22,7 @@ This security audit policy and the event that it records are generated when the
For info about monitoring potential central access policy changes for an entire file server, see [Monitor the central access policies that apply on a file server](monitor-the-central-access-policies-that-apply-on-a-file-server.md).
-Use the following procedures to configure settings to monitor central access policies that are associated with files. These procedures assume that you have configured and deployed Dynamic Access Control in your network. For more information about how to configure and deploy Dynamic Access Control, see [Dynamic Access Control: Scenario Overview](http://technet.microsoft.com/library/hh831717.aspx).
+Use the following procedures to configure settings to monitor central access policies that are associated with files. These procedures assume that you have configured and deployed Dynamic Access Control in your network. For more information about how to configure and deploy Dynamic Access Control, see [Dynamic Access Control: Scenario Overview](https://technet.microsoft.com/library/hh831717.aspx).
>**Note:** Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
diff --git a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md
index 54d4d33846..51df126e27 100644
--- a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md
+++ b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
@@ -17,7 +18,7 @@ ms.date: 04/19/2017
This topic for the IT professional describes how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options to monitor dynamic access control objects. Central access policies are created on a domain controller and then applied to file servers through Group Policy management.
-Use the following procedures to configure and verify security auditing settings that are used to monitor changes to the set of central access policies on a file server. The following procedures assume that you have configured and deployed dynamic access control, including central access policies, and claims in your network. If you have not yet deployed dynamic access control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx).
+Use the following procedures to configure and verify security auditing settings that are used to monitor changes to the set of central access policies on a file server. The following procedures assume that you have configured and deployed dynamic access control, including central access policies, and claims in your network. If you have not yet deployed dynamic access control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](https://technet.microsoft.com/library/hh846167.aspx).
**To configure settings to monitor changes to central access policies**
diff --git a/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md b/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md
index c272a341c2..94d8efbfe0 100644
--- a/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md
+++ b/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
@@ -23,7 +24,7 @@ If your organization has a carefully thought out authorization configuration for
- Changing the Retention attribute of files that have been marked for retention.
- Changing the Department attribute of files that are marked as belonging to a particular department.
-Use the following procedures to configure settings to monitor changes to resource attributes on files and folders. These procedures assume that have configured and deployed central access policies in your network. For more information about how to configure and deploy central access policies, see [Dynamic Access Control: Scenario Overview](http://technet.microsoft.com/library/hh831717.aspx) .
+Use the following procedures to configure settings to monitor changes to resource attributes on files and folders. These procedures assume that have configured and deployed central access policies in your network. For more information about how to configure and deploy central access policies, see [Dynamic Access Control: Scenario Overview](https://technet.microsoft.com/library/hh831717.aspx) .
>**Note:** Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
diff --git a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md
index a2ce772425..27794f5009 100644
--- a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md
+++ b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md b/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md
index 0134469570..3f49698848 100644
--- a/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md
+++ b/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md
@@ -6,8 +6,8 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
-
ms.date: 04/19/2017
---
@@ -20,7 +20,7 @@ This topic for the IT professional describes how to monitor user and device clai
Device claims are associated with the system that is used to access resources that are protected with Dynamic Access Control. User claims are attributes that are associated with a user. User claims and device claims are included in the user’s security token used at sign-on. For example, information about Department, Company, Project, or Security clearances might be included in the token.
-Use the following procedures to monitor changes to user claims and device claims in the user’s sign-on token and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](http://technet.microsoft.com/library/hh846167.aspx).
+Use the following procedures to monitor changes to user claims and device claims in the user’s sign-on token and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you have not yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](https://technet.microsoft.com/library/hh846167.aspx).
>**Note:** Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings.
diff --git a/windows/security/threat-protection/auditing/other-events.md b/windows/security/threat-protection/auditing/other-events.md
index d67be8eaff..903d0ff8b6 100644
--- a/windows/security/threat-protection/auditing/other-events.md
+++ b/windows/security/threat-protection/auditing/other-events.md
@@ -5,6 +5,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: Mir0sh
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md b/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md
index 31785c4181..8dee2ff70e 100644
--- a/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md
+++ b/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
@@ -15,7 +16,7 @@ ms.date: 04/19/2017
**Applies to**
- Windows 10
-This topic for the IT professional explains the options that security policy planners must consider and the tasks they must complete to deploy an effective security audit policy in a network that includes advanced security audit
+This topic for the IT professional explains the options that security policy planners must consider and the tasks they must complete to deploy an effective security audit policy in a network that includes advanced security audit
policies.
Organizations invest a large portion of their information technology budgets on security applications and services, such as antimalware software, firewalls, and encryption. But no matter how much security hardware or software you deploy, how tightly you control the rights of users, or how carefully you configure security permissions on your data, you should not consider the job complete unless you have a well-defined, timely auditing strategy to track the effectiveness of your defenses and identify attempts to circumvent them.
@@ -114,9 +115,9 @@ The following table provides an example of a resource analysis for an organizati
| Resource class | Where stored | Organizational unit | Business impact | Security or regulatory requirements |
| - | - | - | - | - |
-| Payroll data| Corp-Finance-1| Accounting: Read/Write on Corp-Finance-1 Departmental Payroll Managers: Write only on Corp-Finance-1| High| Financial integrity and employee privacy|
+| Payroll data| Corp-Finance-1| Accounting: Read/Write on Corp-Finance-1 Departmental Payroll Managers: Write only on Corp-Finance-1| High| Financial integrity and employee privacy|
| Patient medical records| MedRec-2| Doctors and Nurses: Read/Write on Med/Rec-2 Lab Assistants: Write only on MedRec-2 Accounting: Read only on MedRec-2| High| Strict legal and regulatory standards|
-| Consumer health information| Web-Ext-1| Public Relations Web Content Creators: Read/Write on Web-Ext-1 Public: Read only on Web-Ext-1| Low| Public education and corporate image|
+| Consumer health information| Web-Ext-1| Public Relations Web Content Creators: Read/Write on Web-Ext-1 Public: Read only on Web-Ext-1| Low| Public education and corporate image|
### Users
@@ -136,7 +137,7 @@ The following table illustrates an analysis of users on a network. Although our
| - | - | - |
| Account administrators| User accounts and security groups| Account administrators have full privileges to create new user accounts, reset passwords, and modify security group memberships. We need a mechanism to monitor these changes. |
| Members of the Finance OU| Financial records| Users in Finance have Read/Write access to critical financial records, but no ability to change permissions on these resources. These financial records are subject to government regulatory compliance requirements. |
-| External partners | Project Z| Employees of partner organizations have Read/Write access to certain project data and servers relating to Project Z, but not to other servers or data on the network.|
+| External partners | Project Z| Employees of partner organizations have Read/Write access to certain project data and servers relating to Project Z, but not to other servers or data on the network.|
### Computers
@@ -145,10 +146,10 @@ Security and auditing requirements and audit event volume can vary considerably
- If the computers are servers, desktop computers, or portable computers.
- The important applications the computers run, such as Exchange Server, SQL Server, or Forefront Identity Manager.
- >**Note:** If the server applications (including Exchange Server and SQL Server) have audit settings. For more information about auditing in Exchange Server, see the [Exchange 2010 Security Guide](https://go.microsoft.com/fwlink/p/?linkid=128052). For more information about auditing in SQL Server 2008, see [Auditing (Database Engine)](https://go.microsoft.com/fwlink/p/?LinkId=163434). For SQL Server 2012, see [SQL Server Audit (Database Engine)](http://technet.microsoft.com/library/cc280386.aspx).
+ >**Note:** If the server applications (including Exchange Server and SQL Server) have audit settings. For more information about auditing in Exchange Server, see the [Exchange 2010 Security Guide](https://go.microsoft.com/fwlink/p/?linkid=128052). For more information about auditing in SQL Server 2008, see [Auditing (Database Engine)](https://go.microsoft.com/fwlink/p/?LinkId=163434). For SQL Server 2012, see [SQL Server Audit (Database Engine)](https://technet.microsoft.com/library/cc280386.aspx).
- The operating system versions.
-
+
>**Note:** The operating system version determines which auditing options are available and the volume of audit event data.
- The business value of the data.
@@ -159,20 +160,20 @@ The following table illustrates an analysis of computers in an organization.
| Type of computer and applications | Operating system version | Where located |
| - | - | - |
-| Servers hosting Exchange Server| Windows Server 2008 R2| ExchangeSrv OU|
-| File servers | Windows Server 2012| Separate resource OUs by department and (in some cases) by location|
+| Servers hosting Exchange Server| Windows Server 2008 R2| ExchangeSrv OU|
+| File servers | Windows Server 2012| Separate resource OUs by department and (in some cases) by location|
| Portable computers | Windows Vista and Windows 7| Separate portable computer OUs by department and (in some cases) by location|
-| Web servers | Windows Server 2008 R2 | WebSrv OU|
+| Web servers | Windows Server 2008 R2 | WebSrv OU|
### Regulatory requirements
Many industries and locales have strict and specific requirements for network operations and how resources are protected. In the health care and financial industries, for example, there are strict guidelines for who has access to records and how they are used. Many countries have strict privacy rules. To identify regulatory requirements, work with your organization's legal department and other departments responsible for these requirements. Then consider the security configuration and auditing options that can be used to comply with and verify compliance with these regulations.
-For more info, see the [System Center Process Pack for IT GRC](http://technet.microsoft.com/library/dd206732.aspx).
+For more info, see the [System Center Process Pack for IT GRC](https://technet.microsoft.com/library/dd206732.aspx).
## Mapping the security audit policy to groups of users, computers, and resources in your organization
-By using Group Policy, you can apply your security audit policy to defined groups of users, computers, and resources. To map a security auditing policy to these defined groups in your organization, you should understand the
+By using Group Policy, you can apply your security audit policy to defined groups of users, computers, and resources. To map a security auditing policy to these defined groups in your organization, you should understand the
following considerations for using Group Policy to apply security audit policy settings:
- The policy settings you identify can be applied by using one or more GPOs. To create and edit a GPO, use the Group Policy Management Console (GPMC). By using the GPMC to link a GPO to selected Active Directory sites, domains, and OUs, you apply the policy settings in the GPO to the users and computers in those Active Directory objects. An OU is the lowest-level Active Directory container to which you can assign Group Policy settings.
@@ -188,7 +189,7 @@ following considerations for using Group Policy to apply security audit policy s
- Advanced security audit policy settings were introduced in Windows Server 2008 R2 or Windows 7 and can be applied to those operating systems and later. These advanced audit polices can only be applied by using Group Policy.
>**Important:** Whether you apply advanced audit policies by using Group Policy or by using logon scripts, do not use both the basic audit policy settings under **Local Policies\\Audit Policy** and the advanced settings under **Security Settings\\Advanced Audit Policy Configuration**. Using both basic and advanced audit policy settings can cause unexpected results in audit reporting.
-
+
If you use **Advanced Audit Policy Configuration** settings or use logon scripts to apply advanced audit policies, be sure to enable the **Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings** policy setting under **Local Policies\\Security Options**. This will prevent conflicts between similar settings by forcing basic security auditing to be ignored.
@@ -230,7 +231,7 @@ Depending on your goals, different sets of audit settings may be of particular v
### Data and resource activity
-For many organizations, compromising the organization's data resources can cause tremendous financial losses, in addition to lost prestige and legal liability. If your organization has critical data resources that need to be
+For many organizations, compromising the organization's data resources can cause tremendous financial losses, in addition to lost prestige and legal liability. If your organization has critical data resources that need to be
protected against any breach, the following settings can provide extremely valuable monitoring and forensic data:
- Object Access\\[Audit File Share](audit-file-share.md). This policy setting allows you to track what content was accessed, the source (IP address and port) of the request, and the user account that was used for the access. The volume of event data generated by this setting will vary depending on the number of client computers that attempt to access the file share. On a file server or domain controller, volume may be high due to SYSVOL access by client computers for policy processing. If you do not need to record routine access by client computers that have permissions on the file share, you may want to log audit events only for failed attempts to access the file share.
@@ -241,7 +242,7 @@ protected against any breach, the following settings can provide extremely valua
>**Note:** To audit user attempts to access all file system objects on a computer, use the Global Object Access Auditing settings [Registry (Global Object Access Auditing)](registry-global-object-access-auditing.md) or [File System (Global Object Access Auditing)](file-system-global-object-access-auditing.md).
- Object Access\\[Audit Handle Manipulation](audit-handle-manipulation.md). This policy setting determines whether the operating system generates audit events when a handle to an object is opened or closed. Only objects with configured SACLs generate these events, and only if the attempted handle operation matches the SACL.
-
+
Event volume can be high, depending on how SACLs are configured. When used together with the **Audit File System** or **Audit Registry** policy settings, the **Audit Handle Manipulation** policy setting can provide an administrator with useful "reason for access" audit data that details the precise permissions on which the audit event is based. For example, if a file is configured as a Read-only resource but a user attempts to save changes to the file, the audit event will log not only the event, but also the permissions that were used (or attempted to be used) to save the file changes.
- **Global Object Access Auditing**. A growing number of organizations are using security auditing to comply with regulatory requirements that govern data security and privacy. But demonstrating that strict controls are being enforced can be extremely difficult. To address this issue, the supported versions of Windows include two **Global Object Access Auditing** policy settings, one for the registry and one for the file system. When you configure these settings, they apply a global system access control SACL on all objects of that class on a system, which cannot be overridden or circumvented.
@@ -296,7 +297,7 @@ Not all versions of Windows support advanced audit policy settings or the use of
The audit policy settings under **Local Policies\\Audit Policy** overlap with audit policy settings under **Security Settings\\Advanced Audit Policy Configuration**. However, the advanced audit policy categories and subcategories make it possible to focus your auditing efforts on the most critical activities while reducing the amount of audit data that is less important to your organization.
-For example, **Local Policies\\Audit Policy** contains a single setting called [Audit account logon events](http://technet.microsoft.com/library/cc787176.aspx). When this setting is configured, it generates at least 10 types of audit events.
+For example, **Local Policies\\Audit Policy** contains a single setting called [Audit account logon events](https://technet.microsoft.com/library/cc787176.aspx). When this setting is configured, it generates at least 10 types of audit events.
In comparison, the Account Logon category under **Security Settings\\Advanced Audit Policy Configuration** provides the following advanced settings, which allow you to focus your auditing:
@@ -328,7 +329,7 @@ In addition, whether you choose to leave audit data on an individual computer or
- **Archive the log when full, do not overwrite events**. This option can be used when all log data needs to be saved, but it also suggests that you may not be reviewing audit data frequently enough.
- **Do not overwrite events (Clear logs manually)**. This option stops the collection of audit data when the log file reaches its maximum size. Older data is retained at the expense of the most recent audit events. Use this option only if you do not want to lose any audit data, do not want to create an archive of the event log, and are committed to reviewing data before the maximum log size is reached.
-You can also configure the audit log size and other key management options by using Group Policy settings. You can configure the event log settings in the following locations within the GPMC: **Computer
+You can also configure the audit log size and other key management options by using Group Policy settings. You can configure the event log settings in the following locations within the GPMC: **Computer
Configuration\\Administrative Templates\\Windows Components\\Event Log Service\\Security**. These options include:
- **Maximum Log Size (KB)**. This policy setting specifies the maximum size of the log files. The user interfaces in the Local Group Policy Editor and Event Viewer allow you to enter values as large as 2 TB. If this setting is not configured, event logs have a default maximum size of 20 megabytes.
diff --git a/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md b/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md
index 175aee073f..ae9bb6e67a 100644
--- a/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md
+++ b/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/security-auditing-overview.md b/windows/security/threat-protection/auditing/security-auditing-overview.md
index 2ee5032e3b..8c5ba869ef 100644
--- a/windows/security/threat-protection/auditing/security-auditing-overview.md
+++ b/windows/security/threat-protection/auditing/security-auditing-overview.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md b/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md
index 63da4cc404..f71f318cd8 100644
--- a/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md
+++ b/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
@@ -17,7 +18,7 @@ ms.date: 04/19/2017
This guide explains the process of setting up advanced security auditing capabilities that are made possible through settings and events that were introduced in Windows 8 and Windows Server 2012.
-These procedures can be deployed with the advanced security auditing capabilities described in [Deploy Security Auditing with Central Audit Policies (Demonstration Steps)](http://technet.microsoft.com/library/hh831542.aspx).
+These procedures can be deployed with the advanced security auditing capabilities described in [Deploy Security Auditing with Central Audit Policies (Demonstration Steps)](https://technet.microsoft.com/library/hh831542.aspx).
## In this guide
@@ -29,12 +30,12 @@ Domain administrators can create and deploy expression-based security audit poli
| - | - |
| [Monitor the central access policies that apply on a file server](monitor-the-central-access-policies-that-apply-on-a-file-server.md) | This topic for the IT professional describes how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options to monitor dynamic access control objects. Central access policies are created on a domain controller and then applied to file servers through Group Policy management. |
| [Monitor the use of removable storage devices](monitor-the-use-of-removable-storage-devices.md) | This topic for the IT professional describes how to monitor attempts to use removable storage devices to access network resources. It describes how to use advanced security auditing options to monitor dynamic access control objects. |
-| [Monitor resource attribute definitions](monitor-resource-attribute-definitions.md)| This topic for the IT professional describes how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects.|
+| [Monitor resource attribute definitions](monitor-resource-attribute-definitions.md)| This topic for the IT professional describes how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects.|
| [Monitor central access policy and rule definitions](monitor-central-access-policy-and-rule-definitions.md) | This topic for the IT professional describes how to monitor changes to central access policy and central access rule definitions when you use advanced security auditing options to monitor dynamic access control objects. |
| [Monitor user and device claims during sign-in](monitor-user-and-device-claims-during-sign-in.md)| This topic for the IT professional describes how to monitor user and device claims that are associated with a user’s security token when you are using advanced security auditing options to monitor dynamic access control objects. |
| [Monitor the resource attributes on files and folders](monitor-the-resource-attributes-on-files-and-folders.md)| This topic for the IT professional describes how to monitor attempts to change settings to the resource attributes on files when you are using advanced security auditing options to monitor dynamic access control objects. |
| [Monitor the central access policies associated with files and folders](monitor-the-central-access-policies-associated-with-files-and-folders.md)| This topic for the IT professional describes how to monitor changes to the central access policies that are associated with files and folders when you are using advanced security auditing options to monitor dynamic access control objects. |
-| [Monitor claim types](monitor-claim-types.md) | This topic for the IT professional describes how to monitor changes to claim types that are associated with dynamic access control when you are using advanced security auditing options.|
+| [Monitor claim types](monitor-claim-types.md) | This topic for the IT professional describes how to monitor changes to claim types that are associated with dynamic access control when you are using advanced security auditing options.|
>**Important:** This procedure can be configured on computers running any of the supported Windows operating systems. The other monitoring procedures can be configured only as part of a functioning dynamic access control deployment.
diff --git a/windows/security/threat-protection/auditing/view-the-security-event-log.md b/windows/security/threat-protection/auditing/view-the-security-event-log.md
index d491761c2a..5669c302b9 100644
--- a/windows/security/threat-protection/auditing/view-the-security-event-log.md
+++ b/windows/security/threat-protection/auditing/view-the-security-event-log.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md b/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md
index 0c5a957bec..8b97c1b72b 100644
--- a/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md
+++ b/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/change-history-for-threat-protection.md b/windows/security/threat-protection/change-history-for-threat-protection.md
index 79880c8d9b..dfa28ec177 100644
--- a/windows/security/threat-protection/change-history-for-threat-protection.md
+++ b/windows/security/threat-protection/change-history-for-threat-protection.md
@@ -1,81 +1,21 @@
---
-title: Change history for threat protection (Windows 10)
-description: This topic lists new and updated topics in the Windows 10 threat protection documentation for Windows 10 and Windows 10 Mobile.
+title: Change history for Windows Defender Advanced Threat Protection (Windows Defender ATP)
+description: This topic lists new and updated topics in the WWindows Defender ATP content set.
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: brianlic-msft
-ms.date: 10/31/2017
+ms.date: 08/11/2018
+ms.localizationpriority: medium
---
# Change history for threat protection
-This topic lists new and updated topics in the [Threat protection](index.md) documentation.
+This topic lists new and updated topics in the [Windows Defender ATP](windows-defender-atp/windows-defender-advanced-threat-protection.md) documentation.
-## February 2018
+## August 2018
New or changed topic | Description
---------------------|------------
-[Security Compliance Toolkit](security-compliance-toolkit-10.md) | Added Office 2016 Security Baseline.
-[Audit security group management](auditing/audit-security-group-management.md)| Added recommendation to audit Failure events.
+[Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md) | Reorganized Windows 10 security topics to reflect the Windows Defender ATP platform.
-## January 2018
-|New or changed topic |Description |
-|---------------------|------------|
-|[Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md)|New topic. WDAC replaces cofigurable code integrity policies. |
-
-## November 2017
-|New or changed topic |Description |
-|---------------------|------------|
-| [How to enable virtualization-based protection of code integrity](windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md)| New. Explains how to enable HVCI. |
-
-
-## October 2017
-|New or changed topic |Description |
-|---------------------|------------|
-|[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md)|Added auto-recovery section.
-|[Create a Windows Information Protection (WIP) policy with MAM using the Azure portal for Microsoft Intune](/windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md)|New topic for MAM using the Azure portal.|
-| [TPM fundamentals](/windows/security/hardware-protection/tpm/tpm-fundamentals.md) [BitLocker Group Policy settings](/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md) | Explained the change to allow reducing the maximum PIN length from 6 characters to 4. |
-| [Windows security baselines](windows-security-baselines.md) | New. Security baselines added for Windows 10, versions 1703 and 1709. |
-| [Security Compliance Toolkit](security-compliance-toolkit-10.md) | New. Includes a link to tools for managing security baselines. |
-| [Get support for security baselines](get-support-for-security-baselines.md) | New. Explains supported versions for security baselines and other support questions. |
-
-## August 2017
-|New or changed topic |Description |
-|---------------------|------------|
-| [BitLocker: Management recommendations for enterprises](/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md) | New BitLocker security topic. |
-| [Accounts: Block Microsoft accounts](security-policy-settings/accounts-block-microsoft-accounts.md) | Revised description |
-
-
-## July 2017
-|New or changed topic |Description |
-|---------------------|------------|
-| [How Windows 10 uses the Trusted Platform Module](/windows/security/hardware-protection/tpm/how-windows-uses-the-tpm.md) | New TPM security topic. |
-
-
-## June 2017
-|New or changed topic |Description |
-|---------------------|------------|
-|[Create a Windows Information Protection (WIP) with enrollment policy using the Azure portal for Microsoft Intune](\windows\security\information-protection\windows-information-protection\create-wip-policy-using-intune-azure.md)|New topic for MDM using the Azure portal.|
-|[Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune](\windows\security\information-protection\windows-information-protection\deploy-wip-policy-using-intune-azure.md)|New topic for MDM using the Azure portal.|
-|[Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune](\windows\security\information-protection\windows-information-protection\create-vpn-and-wip-policy-using-intune-azure.md)|New topic for MDM using the Azure portal.|
-|[List of enlightened Microsoft apps for use with Windows Information Protection (WIP)](\windows\security\information-protection\windows-information-protection\enlightened-microsoft-apps-and-wip.md)|Updated to include newly enlightened and supported apps.|
-|[Secure the Windows 10 boot process](/windows/security/hardware-protection/secure-the-windows-10-boot-process.md)| Updated from existing applicable and relevant Windows 8.1 content |
-
-## May 2017
-|New or changed topic |Description |
-|---------------------|------------|
-| [BitLocker Group Policy settings](/windows/security//information-protection/bitlocker/bitlocker-group-policy-settings.md) | Changed startup PIN minimun length from 4 to 6. |
-| [Network access: Restrict clients allowed to make remote calls to SAM](security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md) | New security policy setting. |
-
-
-## March 2017
-|New or changed topic |Description |
-|---------------------|------------|
-|[How to collect Windows Information Protection (WIP) audit event logs](/windows/security//information-protection/windows-information-protection/collect-wip-audit-event-logs.md) |New |
-|[Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](/windows/security//information-protection/windows-information-protection/mandatory-settings-for-wip.md) |Updated based on Windows 10, version 1703. |
-|[Limitations while using Windows Information Protection (WIP)](/windows/security//information-protection/windows-information-protection/limitations-with-wip.md) |Added additional limitations for Windows 10, version 1703.|
-|[Windows Defender SmartScreen overview](windows-defender-smartscreen\windows-defender-smartscreen-overview.md)|New |
-|[Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen\windows-defender-smartscreen-available-settings.md)|New |
-|[Use Windows Defender Security Center to set Windows Defender SmartScreen for individual devices](windows-defender-smartscreen\windows-defender-smartscreen-set-individual-device.md)|New |
-|[Overview of threat mitigations in Windows 10](overview-of-threat-mitigations-in-windows-10.md) | Reorganized from existing content, to provide a better overview of threat mitigations. Explains how mitigations in the Enhanced Mitigation Experience Toolkit (EMET) relate to those in Windows 10. |
diff --git a/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md b/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md
index 805eeff313..b56a7a46b9 100644
--- a/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md
+++ b/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md
@@ -1,42 +1,42 @@
---
-title: Device Guard is the combination of Windows Defender Application Control and Virtualization-based security (Windows 10)
+title: Device Guard is the combination of Windows Defender Application Control and virtualization-based protection of code integrity (Windows 10)
description: Device Guard consists of both hardware and software system integrity hardening capabilites that can be deployed separately or in combination.
keywords: virtualization, security, malware
ms.prod: w10
ms.mktglfcycl: deploy
ms.localizationpriority: medium
author: mdsakibMSFT
-ms.date: 08/23/2018
+ms.date: 09/07/2018
---
-# Device Guard: Windows Defender Application Control Configurable Code Integrity and Virtualization-based security
+# Device Guard: Windows Defender Application Control and virtualization-based protection of code integrity
**Applies to**
- Windows 10
- Windows Server 2016
-Windows 10 includes a set of hardware and OS technologies that, when configured together, allow enterprises to "lock down" Windows systems so they operate with many of the properties of mobile devices. In this configuration, specific technologies work together to restrict devices to only run authorized apps by using a feature called configurable code integrity (CI), while simultaneously hardening the OS against kernel memory attacks through the use of virtualization-based protection of code integrity (more specifically, HVCI).
+Windows 10 includes a set of hardware and OS technologies that, when configured together, allow enterprises to "lock down" Windows systems so they operate with many of the properties of mobile devices. In this configuration, specific technologies work together to restrict devices to only run authorized apps by using a feature called configurable code integrity, while simultaneously hardening the OS against kernel memory attacks through the use of virtualization-based protection of code integrity (more specifically, HVCI).
-Configurable CI and HVCI are very powerful protections that can be used separately. However, when these two technologies are configured to work together, they present a very strong protection capability for Windows 10 devices. Starting with the Windows 10 Anniversary Update (1607), this combined "configuration state" of Configurable CI and HVCI has been referred to as Windows Defender Device Guard.
+Configurable code integrity policies and HVCI are very powerful protections that can be used separately. However, when these two technologies are configured to work together, they present a very strong protection capability for Windows 10 devices. This combined "configuration state" of configurable code integrity and HVCI has been referred to as Windows Defender Device Guard.
-Using Configurable CI to restrict devices to only autherized apps has these advantages over other solutions:
+Using configurable code integrity to restrict devices to only authorized apps has these advantages over other solutions:
-1. Configurable CI policy is enforced by the Windows kernel itself. As such, the policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run.
-2. Configurable CI allows customers to set application control policy not only over code running in user mode, but also kernel mode hardware and software drivers and even code that runs as part of Windows.
-3. Customers can protect the configurable CI policy even from local administrator tampering by digitally signing the policy. This would mean that changing the policy would require both administrative privilege and access to the organization’s digital signing process, making it extremely difficult for an attacker with administrative privledge, or malicious software that managed to gain administrative privilege, to alter the application control policy.
-4. The entire configurable CI enforcement mechanism can be protected by HVCI, where even if a vulnerability exists in kernel mode code, the likelihood that an attacker could successfully exploit it is significantly diminished. Why is this relevant? That’s because an attacker that compromises the kernel would otherwise have enough privilege to disable most system defenses and override the application control policies enforced by configurable CI or any other application control solution.
+1. Configurable code integrity policy is enforced by the Windows kernel itself. As such, the policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run.
+2. Configurable code integrity allows customers to set application control policy not only over code running in user mode, but also kernel mode hardware and software drivers and even code that runs as part of Windows.
+3. Customers can protect the configurable code integrity policy even from local administrator tampering by digitally signing the policy. This would mean that changing the policy would require both administrative privilege and access to the organization’s digital signing process, making it extremely difficult for an attacker with administrative privledge, or malicious software that managed to gain administrative privilege, to alter the application control policy.
+4. The entire configurable code integrity enforcement mechanism can be protected by HVCI, where even if a vulnerability exists in kernel mode code, the likelihood that an attacker could successfully exploit it is significantly diminished. Why is this relevant? That’s because an attacker that compromises the kernel would otherwise have enough privilege to disable most system defenses and override the application control policies enforced by configurable code integrity or any other application control solution.
## (Re-)Introducing Windows Defender Application Control
-When we originally designed the configuration state that we have referred to as Windows Defender Device Guard, we did so with a specific security promise in mind. Although there were no direct dependencies between the two main OS features of the Device Guard configuration, configurable CI and HVCI, we intentionally focused our discussion around the Device Guard lockdown state you achieve when deploying them together.
+When we originally designed the configuration state that we have referred to as Windows Defender Device Guard, we did so with a specific security promise in mind. Although there were no direct dependencies between the two main OS features of the Device Guard configuration, configurable code integrity and HVCI, we intentionally focused our discussion around the Device Guard lockdown state you achieve when deploying them together.
However, the use of the term Device Guard to describe this configuration state has unintentionally left an impression for many IT professionals that the two features were inexorably linked and could not be deployed separately.
Additionally, given that HVCI relies on Windows virtualization-based security, it comes with additional hardware, firmware, and kernel driver compatibility requirements that some older systems can’t meet.
-As a result, many IT Professionals assumed that because some systems couldn't use HVCI, they couldn’t use configurable CI either.
-But configurable CI carries no specific hardware or software requirements other than running Windows 10, which means many IT professionals were wrongly denied the benefits of this powerful application control capability.
+As a result, many IT Professionals assumed that because some systems couldn't use HVCI, they couldn’t use configurable code integrity either.
+But configurable code integrity carries no specific hardware or software requirements other than running Windows 10, which means many IT professionals were wrongly denied the benefits of this powerful application control capability.
-Since the initial release of Windows 10, the world has witnessed numerous hacking and malware attacks where application control alone could have prevented the attack altogether. With this in mind, we are discussing and documenting configurable CI as a independent technology within our security stack and giving it a name of its own: [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control).
+Since the initial release of Windows 10, the world has witnessed numerous hacking and malware attacks where application control alone could have prevented the attack altogether. With this in mind, we are discussing and documenting configurable code integrity as a independent technology within our security stack and giving it a name of its own: [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control).
We hope this change will help us better communicate options for adopting application control within an organization.
Does this mean Windows Defender Device Guard configuration state is going away? Not at all. The term Device Guard will continue to be used as a way to describe the fully locked down state achieved through the use of Windows Defender Application Control (WDAC), HVCI, and hardware and firmware security features. It also allows us to work with our OEM partners to identify specifications for devices that are “Device Guard capable” so that our joint customers can easily purchase devices that meet all of the hardware and firmware requirements of the original "Device Guard" locked down scenario for Windows 10 based devices.
diff --git a/windows/security/threat-protection/images/AH_icon.png b/windows/security/threat-protection/images/AH_icon.png
new file mode 100644
index 0000000000..ff9c97c86e
Binary files /dev/null and b/windows/security/threat-protection/images/AH_icon.png differ
diff --git a/windows/security/threat-protection/images/AR_icon.png b/windows/security/threat-protection/images/AR_icon.png
new file mode 100644
index 0000000000..887498f7bc
Binary files /dev/null and b/windows/security/threat-protection/images/AR_icon.png differ
diff --git a/windows/security/threat-protection/images/ASR_icon.png b/windows/security/threat-protection/images/ASR_icon.png
new file mode 100644
index 0000000000..28b5b3156f
Binary files /dev/null and b/windows/security/threat-protection/images/ASR_icon.png differ
diff --git a/windows/security/threat-protection/images/EDR_icon.png b/windows/security/threat-protection/images/EDR_icon.png
new file mode 100644
index 0000000000..7e6df62bdf
Binary files /dev/null and b/windows/security/threat-protection/images/EDR_icon.png differ
diff --git a/windows/security/threat-protection/images/NGP_icon.png b/windows/security/threat-protection/images/NGP_icon.png
new file mode 100644
index 0000000000..df1b70e041
Binary files /dev/null and b/windows/security/threat-protection/images/NGP_icon.png differ
diff --git a/windows/security/threat-protection/images/SS_icon.png b/windows/security/threat-protection/images/SS_icon.png
new file mode 100644
index 0000000000..95908405ce
Binary files /dev/null and b/windows/security/threat-protection/images/SS_icon.png differ
diff --git a/windows/security/threat-protection/images/wdatp-pillars2.png b/windows/security/threat-protection/images/wdatp-pillars2.png
index 60725244e5..8a67d190b7 100644
Binary files a/windows/security/threat-protection/images/wdatp-pillars2.png and b/windows/security/threat-protection/images/wdatp-pillars2.png differ
diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md
index b589ac9a69..4ec7962649 100644
--- a/windows/security/threat-protection/index.md
+++ b/windows/security/threat-protection/index.md
@@ -1,35 +1,134 @@
---
title: Threat Protection (Windows 10)
-description: Learn more about how to help protect against threats in Windows 10 and Windows 10 Mobile.
+description: Learn how Windows Defender ATP helps protect against threats.
+keywords: threat protection, windows defender advanced threat protection, attack surface reduction, next generation protection, endpoint detection and response, automated investigation and response, secure score, advanced hunting
+search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
-author: brianlic-msft
-ms.date: 02/05/2018
+author: dansimp
+ms.localizationpriority: medium
+ms.date: 09/07/2018
---
# Threat Protection
-Windows Defender Advanced Threat Protection (ATP) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Windows Defender ATP protects endpoints from cyber threats; detects advanced attacks and data breaches, automates security incidents and improves security posture.
+Windows Defender Advanced Threat Protection (Windows Defender ATP) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Windows Defender ATP protects endpoints from cyber threats; detects advanced attacks and data breaches, automates security incidents and improves security posture.
-
+
+
-The following capabilities are available across multiple products that make up the Windows Defender ATP platform.
+
+
**Attack surface reduction**
The attack surface reduction set of capabilities provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations.
+- [Hardware based isolation](windows-defender-atp/overview-hardware-based-isolation.md)
+- [Application control](windows-defender-application-control/windows-defender-application-control.md)
+- [Exploit protection](windows-defender-exploit-guard/exploit-protection-exploit-guard.md)
+- [Network protection](windows-defender-exploit-guard/network-protection-exploit-guard.md)
+- [Controlled folder access](windows-defender-exploit-guard/controlled-folders-exploit-guard.md)
+- [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md)
+- [Attack surface reduction controls](windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md)
+
+
+
**Next generation protection**
To further reinforce the security perimeter of your network, Windows Defender ATP uses next generation protection designed to catch all types of emerging threats.
+- [Windows Defender Antivirus](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)
+- [Machine learning](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md)
+- [Automated sandbox service](windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md)
+
+
+
+
**Endpoint protection and response**
+
Endpoint protection and response capabilities are put in place to detect, investigate, and respond to advanced threats that may have made it past the first two security pillars.
-**Auto investigation and remediation**
+- [Alerts](windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md)
+- [Historical endpoint data](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline)
+- [Response orchestration](windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md)
+- [Forensic collection](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines)
+- [Threat intelligence](windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
+- [Advanced detonation and analysis service](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis)
+
+
+
+**Automated investigation and remediation**
In conjunction with being able to quickly respond to advanced attacks, Windows Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale.
-**Security posture**
-Windows Defender ATP provides a security posture capability to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security state of your network.
+- [Automated investigation and remediation](windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md)
+- [Threat remediation](windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md#how-threats-are-remediated)
+- [Manage automated investigations](windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md)
+- [Analyze automated investigation](windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md#analyze-automated-investigations)
+
+
+
+**Secure score**
+
+Windows Defender ATP includes a secure score to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security of your organization.
+- [Asset inventory](windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md)
+- [Recommended improvement actions](windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md)
+- [Secure score](windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md)
+- [Threat analytics](windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md)
+
+
+
+**Advanced hunting**
+Create custom threat intelligence and use a powerful search and query tool to hunt for possible threats in your organization.
+
+- [Custom detection](windows-defender-atp/overview-custom-detections.md)
+- [Realtime and historical hunting](windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md)
+
+
+
+**Management and APIs**
+Integrate Windows Defender Advanced Threat Protection into your existing workflows.
+- [Onboarding](windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md)
+- [API and SIEM integration](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md)
+- [Exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md)
+- [Role-based access control (RBAC)](windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md)
+- [Reporting and trends](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md)
+
+
+
+**Microsoft threat protection**
+Bring the power of Microsoft threat protection to your organization.
+- [Conditional access](windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md)
+- [O365 ATP](windows-defender-atp/threat-protection-integration.md)
+- [Azure ATP](windows-defender-atp/threat-protection-integration.md)
+- [Azure Security Center](windows-defender-atp/threat-protection-integration.md)
+- [Skype for Business](windows-defender-atp/threat-protection-integration.md)
+- [Microsoft Cloud App Security](windows-defender-atp/microsoft-cloud-app-security-integration.md)
+
+
+
+
+
+
+
+
+
diff --git a/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md b/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md
index 95f08cac80..5c1f9d33d8 100644
--- a/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md
+++ b/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md
@@ -32,4 +32,4 @@ Organizations participating in the CME effort work together to help eradicate se
Any organization that is involved in cybersecurity and antimalware or interested in fighting cybercrime can participate in CME campaigns by enrolling in the [Virus Information Alliance (VIA) program](virus-information-alliance-criteria.md). It ensures that everyone agrees to use the information and tools available for campaigns for their intended purpose (that is, the eradication of malware).
-Please apply using our [membership application form](http://www.microsoft.com/security/portal/partnerships/apply.aspx) to get started.
\ No newline at end of file
+Please apply using our [membership application form](https://www.microsoft.com/security/portal/partnerships/apply.aspx) to get started.
\ No newline at end of file
diff --git a/windows/security/threat-protection/intelligence/criteria.md b/windows/security/threat-protection/intelligence/criteria.md
index 908368bb4b..ab053f956f 100644
--- a/windows/security/threat-protection/intelligence/criteria.md
+++ b/windows/security/threat-protection/intelligence/criteria.md
@@ -155,7 +155,7 @@ Our PUA protection aims to safeguard user productivity and ensure enjoyable Wind
Microsoft uses specific categories and the category definitions to classify software as a PUA.
-* **Browser advertising software:** Software that displays advertisements or promotions, or prompts the user to complete surveys for other products or services in software other than itself. This includes software that inserts advertisements to webpages.
+* **Advertising software:** Software that displays advertisements or promotions, or prompts the user to complete surveys for other products or services in software other than itself. This includes software that inserts advertisements to webpages.
* **Torrent software:** Software that is used to create or download torrents or other files specifically used with peer-to-peer file-sharing technologies.
diff --git a/windows/security/threat-protection/intelligence/index.md b/windows/security/threat-protection/intelligence/index.md
index 07161132ac..1b234b902e 100644
--- a/windows/security/threat-protection/intelligence/index.md
+++ b/windows/security/threat-protection/intelligence/index.md
@@ -19,6 +19,6 @@ Here you will find information about different types of malware, safety tips on
* [Submit files for analysis](submission-guide.md)
* [Safety Scanner download](safety-scanner-download.md)
-Keep up with the latest malware news and research. Check out our [Windows security blogs](http://aka.ms/wdsecurityblog) and follow us on [Twitter](https://twitter.com/wdsecurity) for the latest news, discoveries, and protections.
+Keep up with the latest malware news and research. Check out our [Windows security blogs](https://aka.ms/wdsecurityblog) and follow us on [Twitter](https://twitter.com/wdsecurity) for the latest news, discoveries, and protections.
Learn more about [Windows security](https://docs.microsoft.com/windows/security/index).
\ No newline at end of file
diff --git a/windows/security/threat-protection/intelligence/prevent-malware-infection.md b/windows/security/threat-protection/intelligence/prevent-malware-infection.md
index 012725bac4..731b7e0e95 100644
--- a/windows/security/threat-protection/intelligence/prevent-malware-infection.md
+++ b/windows/security/threat-protection/intelligence/prevent-malware-infection.md
@@ -40,7 +40,7 @@ To identify potentially harmful websites, keep the following in mind:
* Sites that aggressively open popups and display misleading buttons often trick users into accepting content through constant popups or mislabeled buttons.
-To block malicious websites, use a modern web browser like [Microsoft Edge](http://www.microsoft.com/windows/microsoft-edge?ocid=cx-wdsi-articles) which identifies phishing and malware websites and checks downloads for malware.
+To block malicious websites, use a modern web browser like [Microsoft Edge](https://www.microsoft.com/windows/microsoft-edge?ocid=cx-wdsi-articles) which identifies phishing and malware websites and checks downloads for malware.
If you encounter an unsafe site, click **More […] > Send feedback** on Microsoft Edge. You can also [report unsafe sites directly to Microsoft](https://www.microsoft.com/wdsi/support/report-unsafe-site).
diff --git a/windows/security/threat-protection/intelligence/rootkits-malware.md b/windows/security/threat-protection/intelligence/rootkits-malware.md
index 9ceee1ebb4..24d7b3ca8a 100644
--- a/windows/security/threat-protection/intelligence/rootkits-malware.md
+++ b/windows/security/threat-protection/intelligence/rootkits-malware.md
@@ -22,17 +22,17 @@ For example, if you were to ask a device to list all of the programs that are ru
Many modern malware families use rootkits to try and avoid detection and removal, including:
-* [Alureon](http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fAlureon)
+* [Alureon](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fAlureon)
-* [Cutwail](http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fCutwail)
+* [Cutwail](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fCutwail)
* [Datrahere](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win64/Detrahere) (Zacinlo)
-* [Rustock](http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Win32%2fRustock)
+* [Rustock](https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Win32%2fRustock)
-* [Sinowal](http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fSinowal)
+* [Sinowal](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fSinowal)
-* [Sirefef](http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fSirefef)
+* [Sirefef](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fSirefef)
## How to protect against rootkits
@@ -50,7 +50,7 @@ For more general tips, see [prevent malware infection](prevent-malware-infection
Microsoft security software includes a number of technologies designed specifically to remove rootkits. If you think you might have a rootkit on your device and your antimalware software isn’t detecting it, you might need an extra tool that lets you boot to a known trusted environment.
-[Windows Defender Offline](http://windows.microsoft.com/windows/what-is-windows-defender-offline) can be launched from Windows Security Center and has the latest anti-malware updates from Microsoft. It’s designed to be used on devices that aren't working correctly due to a possible malware infection.
+[Windows Defender Offline](https://windows.microsoft.com/windows/what-is-windows-defender-offline) can be launched from Windows Security Center and has the latest anti-malware updates from Microsoft. It’s designed to be used on devices that aren't working correctly due to a possible malware infection.
[System Guard](https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/hardening-the-system-and-maintaining-integrity-with-windows-defender-system-guard/) in Windows 10 protects against rootkits and threats that impact system integrity.
diff --git a/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md b/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md
index 662286f60b..e984e5abab 100644
--- a/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md
+++ b/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md
@@ -1,6 +1,6 @@
---
title: Top scoring in industry antivirus tests
-description: Industry antivirus tests landing page
+description: Windows Defender Antivirus consistently achieves high scores in independent tests. View the latest scores and analysis.
keywords: security, malware, av-comparatives, av-test, av, antivirus
ms.prod: w10
ms.mktglfcycl: secure
@@ -8,16 +8,16 @@ ms.sitesec: library
ms.localizationpriority: medium
ms.author: ellevin
author: levinec
-ms.date: 08/17/2018
+ms.date: 09/05/2018
---
# Top scoring in industry antivirus tests
-[Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10?ocid=cx-docs-avreports) **consistently achieves high scores** from independent tests, displaying how it is a top choice in the antivirus market.
+[Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10?ocid=cx-docs-avreports) **consistently achieves high scores** in independent tests, displaying how it is a top choice in the antivirus market.
We want to be transparent and have gathered top industry reports that demonstrate our enterprise antivirus capabilities. Note that these tests only provide results for antivirus and do not test for additional security protections.
-In the real world, millions of devices are protected from cyberattacks every day, sometimes [milliseconds after a campaign starts](https://cloudblogs.microsoft.com/microsoftsecure/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign?ocid=cx-docs-avreports). In many cases, customers might not even know they were protected. That's because Windows Defender Advanced Threat Protection ([Windows Defender ATP](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=cx-docs-avreports)) [next generation protection](https://www.youtube.com/watch?v=Xy3MOxkX_o4) detects and stops malware at first sight by using predictive technologies, [machine learning](https://cloudblogs.microsoft.com/microsoftsecure/2018/06/07/machine-learning-vs-social-engineering?ocid=cx-docs-avreports), [artificial intelligence](https://cloudblogs.microsoft.com/microsoftsecure/2018/02/14/how-artificial-intelligence-stopped-an-emotet-outbreak?ocid=cx-docs-avreports), behavioral analysis, and other advanced technologies.
+In the real world, millions of devices are protected from cyberattacks every day, sometimes [milliseconds after a campaign starts](https://cloudblogs.microsoft.com/microsoftsecure/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign?ocid=cx-docs-avreports). Windows Defender AV is part of the [next generation](https://www.youtube.com/watch?v=Xy3MOxkX_o4) Windows Defender Advanced Threat Protection ([Windows Defender ATP](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=cx-docs-avreports)) security stack which addresses the latest and most sophisticated threats today. In many cases, customers might not even know they were protected. That's because Windows Defender AV detects and stops malware at first sight by using [machine learning](https://cloudblogs.microsoft.com/microsoftsecure/2018/06/07/machine-learning-vs-social-engineering?ocid=cx-docs-avreports), [artificial intelligence](https://cloudblogs.microsoft.com/microsoftsecure/2018/02/14/how-artificial-intelligence-stopped-an-emotet-outbreak?ocid=cx-docs-avreports), behavioral analysis, and other advanced technologies.
> [!TIP]
> Learn why [Windows Defender Antivirus is the most deployed in the enterprise](https://cloudblogs.microsoft.com/microsoftsecure/2018/03/22/why-windows-defender-antivirus-is-the-most-deployed-in-the-enterprise?ocid=cx-docs-avreports).
@@ -27,24 +27,20 @@ In the real world, millions of devices are protected from cyberattacks every day
## AV-TEST: Perfect protection score of 6.0/6.0 in the latest test
-**[Analysis of the latest AV-TEST results](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2v60I?ocid=cx-docs-avreports)**
-The AV-TEST Product Review and Certification Report tests on three categories: protection, performance, and usability. The scores listed below are for the protection category which has two scores: real world testing and the AV-TEST reference set (known as "prevalent malware").
+The AV-TEST Product Review and Certification Report tests on three categories: protection, performance, and usability. The scores listed below are for the Protection category which has two scores: Real-World Testing and the AV-TEST reference set (known as "Prevalent Malware").
-**Real-World testing** as defined by AV-TEST attempts to test protection against zero-day malware attacks, inclusive of web and email threats.
+### May-June 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/june-2018/microsoft-windows-defender-antivirus-4.12-182374/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2v60I?ocid=cx-docs-avreports) **Latest**
-**Prevalent malware** as defined by AV-TEST attempts to test detection of widespread and prevalent malware discovered in the last four weeks.
+ Windows Defender AV achieved an overall Protection score of 6.0/6.0, detecting 100% of 5,790 malware samples. With the latest results, Windows Defender AV has achieved 100% on 10 of the 12 most recent antivirus tests (combined "Real-World" and "Prevalent malware").
-The below scores are the results of AV-TEST's evaluations on **Windows Defender Antivirus**.
+### March-April 2018 AV-TEST Business User test: [Protection score 5.5/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/april-2018/microsoft-windows-defender-antivirus-4.12-181574/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2ouJA?ocid=cx-docs-avreports)
-|Month (2018)|Real-World test score| Prevalent malware test score | AV-TEST report| Microsoft analysis|
-|---|---|---|---|---|
-|January| 100.00%| 99.92%| [Report (Jan-Feb)](https://www.av-test.org/en/antivirus/home-windows/windows-7/february-2018/kaspersky-lab-internet-security-18.0-180557/)| [Analysis (Jan-Feb)](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE27O5A?ocid=cx-docs-avreports)|
-|February| 100.00% | 100.00%|[Report (Jan-Feb)](https://www.av-test.org/en/antivirus/home-windows/windows-7/february-2018/kaspersky-lab-internet-security-18.0-180557/)| [Analysis (Jan-Feb)](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE27O5A?ocid=cx-docs-avreports)|
-March |98.00%| 100.00%|[Report (Mar-Apr)](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/april-2018/microsoft-windows-defender-antivirus-4.12-181574/)|[Analysis (Mar-Apr)](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2ouJA?ocid=cx-docs-avreports)|
-April|100.00%| 100.00%|[Report (Mar-Apr)](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/april-2018/microsoft-windows-defender-antivirus-4.12-181574/)|[Analysis (Mar-Apr)](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2ouJA?ocid=cx-docs-avreports)|
-May|100.00%| 100.00%| [Report (May-Jun)](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/june-2018/microsoft-windows-defender-antivirus-4.12-182374/) |[Analysis (May-Jun)](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2v60I?ocid=cx-docs-avreports) **Latest**|
-June|100.00%| 100.00%| [Report (May-Jun)](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/june-2018/microsoft-windows-defender-antivirus-4.12-182374/)|[Analysis (May-Jun)](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2v60I?ocid=cx-docs-avreports) **Latest**|
+ Windows Defender AV achieved an overall Protection score of 5.5/6.0, missing 2 out of 5,680 malware samples (0.035% miss rate).
+
+### January-February 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/february-2018/microsoft-windows-defender-antivirus-4.12-180674/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE27O5A?ocid=cx-docs-avreports)
+
+Windows Defender AV achieved an overall Protection score of 6.0/6.0, with 5,105 malware samples tested.
|||
|---|---|
@@ -57,33 +53,26 @@ June|100.00%| 100.00%| [Report (May-Jun)](https://www.av-test.org/en/antivirus/b
AV-Comparatives is an independent organization offering systematic testing for security software such as PC/Mac-based antivirus products and mobile security solutions.
-The **Real-World Protection Test (Enterprise)** as defined by AV-Comparatives attempts to evaluate the “real-world” protection capabilities with default settings. The goal is to find out whether the security software protects the computer by either hindering the malware from changing any systems or remediating all changes if any were made.
+### Real-World Protection Test July (Consumer): [Protection Rate 100%](https://www.av-comparatives.org/tests/real-world-protection-test-july-2018-factsheet/) **Latest**
-The **Malware Protection Test Enterprise** as defined by AV-Comparatives attempts to assesses a security program’s ability to protect a system against infection by malicious files before, during or after execution. It is only tested every six months.
+The results are based on testing against 186 malicious URLs that have working exploits or point directly to malware.
-The below scores are the results of AV-Comparatives tests on **Windows Defender Antivirus**. The scores represent the percentage of blocked malware.
+### Real-World Protection Test March - June (Enterprise): [Protection Rate 98.7%](https://www.av-comparatives.org/tests/real-world-protection-test-enterprise-march-june-2018-testresult/)
-|Month (2018)| Real-World test score| Malware test score (every 6 months)|
-|---|---|---|
-|February| 100.00%| N/A|
-|March| 94.40%| 99.90%|
-|April| 96.40%| N/A|
-|May| 100.00%| N/A|
-|June| 99.50%| N/A|
-|July| 100.00%| N/A|
+This test, as defined by AV-Comparatives, attempts to assess the effectiveness of each security program to protect a computer against active malware threats while online.
-* [Real-World Protection Test (Enterprise) February - June 2018](https://www.av-comparatives.org/tests/real-world-protection-test-february-june-2018/)
+### Malware Protection Test March 2018 (Enterprise): [Protection Rate 99.9%](https://www.av-comparatives.org/tests/malware-protection-test-enterprise-march-2018-testresult/)
-* [Malware Protection Test Enterprise March 2018](https://www.av-comparatives.org/tests/malware-protection-test-enterprise-march-2018-testresult/)
+This test, as defined by AV-Comparatives, attempts to assesses a security program’s ability to protect a system against infection by malicious files before, during or after execution.
-* [Real-World Protection Test (Enterprise) July 2018](https://www.av-comparatives.org/tests/real-world-protection-test-july-2018-factsheet/) **Latest**
+[Historical AV-Comparatives Microsoft tests](https://www.av-comparatives.org/vendors/microsoft/)
## To what extent are tests representative of protection in the real world?
-It is important to remember that Microsoft sees a wider and broader set of threats beyond just what’s tested in the AV evaluations highlighted above. The capabilities within [Windows Defender ATP](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=cx-docs-avreports) also provide [additional layers of protection](https://cloudblogs.microsoft.com/microsoftsecure/2017/12/11/detonating-a-bad-rabbit-windows-defender-antivirus-and-layered-machine-learning-defenses?ocid=cx-docs-avreports) that are not factored into AV tests. Using these tests, customer can view one aspect of their security suite but can't assess the complete protection of all the security features.
+It is important to remember that Microsoft sees a wider and broader set of threats beyond what’s tested in the antivirus evaluations highlighted above. Windows Defender AV encounters ~200 million samples every month, and the typical antivirus test consists of between 100-5,000 samples. The vastness of the malware landscape makes it extremely difficult to evaluate the quality of protection against real world threats.
-There are other technologies in nearly every endpoint security suite not represented in AV tests that address some of the latest and most sophisticated threats. For example, the capabilities such as attack surface reduction and endpoint detection & response help prevent malware from getting onto devices in the first place.
+The capabilities within [Windows Defender ATP](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=cx-docs-avreports) also provide [additional layers of protection](https://cloudblogs.microsoft.com/microsoftsecure/2017/12/11/detonating-a-bad-rabbit-windows-defender-antivirus-and-layered-machine-learning-defenses?ocid=cx-docs-avreports) that are not factored into industry tests. These technologies address some of the latest and most sophisticated threats. Isolating AV from the rest of Windows Defender ATP creates a partial picture of how our security stack operates in the real world. For example, attack surface reduction and endpoint detection & response capabilities can help prevent malware from getting onto devices in the first place. We have proven that Windows Defender ATP components [catch samples that Windows Defender AV missed](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2ouJA?ocid=cx-docs-avreports) in these industry tests, which is more representative of how effectively our security suite protects customers in the real world.
-Microsoft is highly engaged in working with several independent testers to evolve security testing to focus on the end-to-end security stack. In the meantime, customers can evaluate Windows Defender Advanced Threat Protection in their own networks by signing up for a [90-day trial of Windows Defender ATP](https://www.microsoft.com/windowsforbusiness/windows-atp?ocid=cx-docs-avreports), or [enabling Preview features on existing tenants](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection?ocid=cx-docs-avreports).
+Using independent tests, customers can view one aspect of their security suite but can't assess the complete protection of all the security features. Microsoft is highly engaged in working with several independent testers to evolve security testing to focus on the end-to-end security stack. In the meantime, customers can evaluate Windows Defender Advanced Threat Protection in their own networks by signing up for a [90-day trial of Windows Defender ATP](https://www.microsoft.com/windowsforbusiness/windows-atp?ocid=cx-docs-avreports), or [enabling Preview features on existing tenants](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection?ocid=cx-docs-avreports).
diff --git a/windows/security/threat-protection/intelligence/understanding-malware.md b/windows/security/threat-protection/intelligence/understanding-malware.md
index a96d24adc6..f2ed89b560 100644
--- a/windows/security/threat-protection/intelligence/understanding-malware.md
+++ b/windows/security/threat-protection/intelligence/understanding-malware.md
@@ -34,6 +34,6 @@ There are many types of malware, including:
- [Unwanted software](unwanted-software.md)
- [Worms](worms-malware.md)
-Keep up with the latest malware news and research. Check out our [Windows security blogs](http://aka.ms/wdsecurityblog) and follow us on [Twitter](https://twitter.com/wdsecurity) for the latest news, discoveries, and protections.
+Keep up with the latest malware news and research. Check out our [Windows security blogs](https://aka.ms/wdsecurityblog) and follow us on [Twitter](https://twitter.com/wdsecurity) for the latest news, discoveries, and protections.
Learn more about [Windows security](https://docs.microsoft.com/en-us/windows/security/index).
\ No newline at end of file
diff --git a/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md b/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md
index fdf32ac7d8..d08b16e029 100644
--- a/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md
+++ b/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md
@@ -46,6 +46,6 @@ To be eligible for VIA your organization must:
3. Be willing to sign and adhere to the VIA membership agreement.
-If your organization wants to apply and meets this criteria, you can apply using our [membership application form](http://www.microsoft.com/security/portal/partnerships/apply.aspx).
+If your organization wants to apply and meets this criteria, you can apply using our [membership application form](https://www.microsoft.com/security/portal/partnerships/apply.aspx).
-If you have any questions, you can also contact us using our [partnerships contact form](http://www.microsoft.com/security/portal/partnerships/contactus.aspx).
\ No newline at end of file
+If you have any questions, you can also contact us using our [partnerships contact form](https://www.microsoft.com/security/portal/partnerships/contactus.aspx).
\ No newline at end of file
diff --git a/windows/security/threat-protection/intelligence/virus-initiative-criteria.md b/windows/security/threat-protection/intelligence/virus-initiative-criteria.md
index d61818ec93..6edc83eaba 100644
--- a/windows/security/threat-protection/intelligence/virus-initiative-criteria.md
+++ b/windows/security/threat-protection/intelligence/virus-initiative-criteria.md
@@ -54,4 +54,4 @@ Your organization must meet the following eligibility requirements to participat
### Apply to MVI
-If your organization wants to apply and meets this criteria, you can apply using our [membership application form](http://www.microsoft.com/security/portal/partnerships/apply.aspx).
\ No newline at end of file
+If your organization wants to apply and meets this criteria, you can apply using our [membership application form](https://www.microsoft.com/security/portal/partnerships/apply.aspx).
\ No newline at end of file
diff --git a/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md b/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md
index e786911e28..18ed7cdaff 100644
--- a/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md
+++ b/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md
@@ -8,6 +8,7 @@ ms.mktglfcycl: deploy
ms.pagetype: security
ms.sitesec: library
ms.date: 04/19/2017
+ms.localizationpriority: medium
---
diff --git a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md
index 6c5e5a372b..6095365e62 100644
--- a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md
+++ b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md
@@ -10,6 +10,7 @@ ms.pagetype: security, devices
author: arnaudjumelet
ms.date: 10/13/2017
+ms.localizationpriority: medium
---
# Control the health of Windows 10-based devices
diff --git a/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller.md b/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller.md
index 57d0ce525d..c8c5edd48a 100644
--- a/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller.md
+++ b/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md b/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md
index adc562d497..00f750f49c 100644
--- a/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md
+++ b/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md b/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md
index 7da0245da9..c86030f41b 100644
--- a/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md
+++ b/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md b/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md
index 16a6c63d06..b85e285e97 100644
--- a/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md
+++ b/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md b/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md
index 73c16a319d..1023c1e03f 100644
--- a/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md
+++ b/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/account-policies.md b/windows/security/threat-protection/security-policy-settings/account-policies.md
index 28bda81eec..6108d6b607 100644
--- a/windows/security/threat-protection/security-policy-settings/account-policies.md
+++ b/windows/security/threat-protection/security-policy-settings/account-policies.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status.md b/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status.md
index 9328293eb5..69c08ad276 100644
--- a/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status.md
+++ b/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/01/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts.md b/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts.md
index 8a75825556..8a72fe5f92 100644
--- a/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts.md
+++ b/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/10/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status.md b/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status.md
index 6025b06bc7..7f99611e70 100644
--- a/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status.md
+++ b/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md b/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md
index a46b765862..be82562767 100644
--- a/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md
+++ b/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account.md b/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account.md
index a37109ddc4..ddb53a6141 100644
--- a/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account.md
+++ b/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account.md b/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account.md
index e4c76cf159..a40ed288a9 100644
--- a/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account.md
+++ b/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system.md b/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system.md
index 9703104c06..13a891b6a7 100644
--- a/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system.md
+++ b/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain.md b/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain.md
index a784ec1b27..723fd057b5 100644
--- a/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain.md
+++ b/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process.md b/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process.md
index 19363b3e59..b84c11a4b2 100644
--- a/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process.md
+++ b/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md b/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md
index d8074abc4f..ef91abb02b 100644
--- a/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md
+++ b/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
@@ -80,7 +81,7 @@ Over time, new ways to manage security policy settings have been introduced, whi
Software Restriction Policies
-
See [Administer Software Restriction Policies](http://technet.microsoft.com/library/hh994606.aspx).
+
See [Administer Software Restriction Policies](https://technet.microsoft.com/library/hh994606.aspx).
Gpedit.msc
Software Restriction Policies (SRP) is a Group Policy-based feature that identifies software programs running on computers in a domain, and it controls the ability of those programs to run.
@@ -135,7 +136,7 @@ The Security Compliance Manager is a downloadable tool that helps you plan, depl
## Using the Security Configuration Wizard
-The Security Configuration Wizard (SCW) guides you through the process of creating, editing, applying, or rolling back a security policy. A security policy that you create with SCW is an .xml file that, when applied, configures services, network security, specific registry values, and audit policy.
+The Security Configuration Wizard (SCW) guides you through the process of creating, editing, applying, or rolling back a security policy. A security policy that you create with SCW is an .xml file that, when applied, configures services, network security, specific registry values, and audit policy.
SCW is a role-based tool: You can use it to create a policy that enables services, firewall rules, and settings that are required for a selected server to perform specific roles. For example, a server might be a file server, a print server, or a domain controller.
The following are considerations for using SCW:
@@ -158,13 +159,13 @@ The SCW can be accessed through Server Manager or by running scw.exe. The wizard
The Security Policy Wizard configures services and network security based on the server’s role, as well as configures auditing and registry settings.
-For more information about SCW, including procedures, see [Security Configuration Wizard](http://technet.microsoft.com/library/cc754997.aspx).
+For more information about SCW, including procedures, see [Security Configuration Wizard](https://technet.microsoft.com/library/cc754997.aspx).
## Working with the Security Configuration Manager
The Security Configuration Manager tool set allows you to create, apply, and edit the security for your local device, organizational unit, or domain.
-For procedures on how to use the Security Configuration Manager, see [Security Configuration Manager](http://technet.microsoft.com/library/cc758219(WS.10).aspx).
+For procedures on how to use the Security Configuration Manager, see [Security Configuration Manager](https://technet.microsoft.com/library/cc758219(WS.10).aspx).
The following table lists the features of the Security Configuration Manager.
@@ -212,7 +213,7 @@ The state of the operating system and apps on a device is dynamic. For example,
Regular analysis enables you to track and ensure an adequate level of security on each computer as part of an enterprise risk management program. You can tune the security levels and, most importantly, detect any security flaws that may occur in the system over time.
-Security Configuration and Analysis enables you to quickly review security analysis results. It presents recommendations alongside of current system settings and uses visual flags or remarks to highlight any areas where the current settings do not match the proposed level of security. Security
+Security Configuration and Analysis enables you to quickly review security analysis results. It presents recommendations alongside of current system settings and uses visual flags or remarks to highlight any areas where the current settings do not match the proposed level of security. Security
Configuration and Analysis also offers the ability to resolve any discrepancies that analysis reveals.
### Security configuration
@@ -282,7 +283,7 @@ If you modify the security settings on your local device by using the local secu
### Using the Security Configuration Manager
-For procedures on how to use the Security Configuration Manager, see [Security Configuration Manager How To](http://technet.microsoft.com/library/cc784762(WS.10).aspx). This section contains information in this topic about:
+For procedures on how to use the Security Configuration Manager, see [Security Configuration Manager How To](https://technet.microsoft.com/library/cc784762(WS.10).aspx). This section contains information in this topic about:
- [Applying security settings](#bkmk-applysecsettings)
- [Importing and exporting security templates](#bkmk-impexpsectmpl)
@@ -306,7 +307,7 @@ For security settings that are defined by more than one policy, the following or
3. Site Policy
4. Local computer Policy
-For example, a workstation that is joined to a domain will have its local security settings overridden by the domain policy wherever there is a conflict. Likewise, if the same workstation is a member of an Organizational Unit, the settings applied from the Organizational Unit's policy will override
+For example, a workstation that is joined to a domain will have its local security settings overridden by the domain policy wherever there is a conflict. Likewise, if the same workstation is a member of an Organizational Unit, the settings applied from the Organizational Unit's policy will override
both the domain and local settings. If the workstation is a member of more than one Organizational Unit, then the Organizational Unit that immediately contains the workstation has the highest order of precedence.
> **Note** Use gpresult.exe to find out what policies are applied to a device and in what order.
For domain accounts, there can be only one account policy that includes password policies, account lockout policies, and Kerberos policies.
diff --git a/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md b/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md
index bb487621e3..6b377b9dfa 100644
--- a/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md
+++ b/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md b/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md
index f03676f04f..f2aff6558e 100644
--- a/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md
+++ b/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md b/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md
index edf83067c0..63c0113000 100644
--- a/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md
+++ b/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md b/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md
index 88fb383f82..32b6e39da1 100644
--- a/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md
+++ b/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md b/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md
index 1bf9663ec0..321a577f5e 100644
--- a/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md
+++ b/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/audit-policy.md b/windows/security/threat-protection/security-policy-settings/audit-policy.md
index 9dedcad594..e0330e6edf 100644
--- a/windows/security/threat-protection/security-policy-settings/audit-policy.md
+++ b/windows/security/threat-protection/security-policy-settings/audit-policy.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md b/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md
index fd3dfb48ce..5b63d093b8 100644
--- a/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md
+++ b/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories.md b/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories.md
index e35bdba108..5c444a35f5 100644
--- a/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories.md
+++ b/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md b/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md
index 27869c656f..142040f18f 100644
--- a/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md
+++ b/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/change-the-system-time.md b/windows/security/threat-protection/security-policy-settings/change-the-system-time.md
index 6d8bbb9216..4536e9d634 100644
--- a/windows/security/threat-protection/security-policy-settings/change-the-system-time.md
+++ b/windows/security/threat-protection/security-policy-settings/change-the-system-time.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/change-the-time-zone.md b/windows/security/threat-protection/security-policy-settings/change-the-time-zone.md
index 3ea2370308..c9d0ba95b7 100644
--- a/windows/security/threat-protection/security-policy-settings/change-the-time-zone.md
+++ b/windows/security/threat-protection/security-policy-settings/change-the-time-zone.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/create-a-pagefile.md b/windows/security/threat-protection/security-policy-settings/create-a-pagefile.md
index 6970d1da6a..f1bfda3737 100644
--- a/windows/security/threat-protection/security-policy-settings/create-a-pagefile.md
+++ b/windows/security/threat-protection/security-policy-settings/create-a-pagefile.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/create-a-token-object.md b/windows/security/threat-protection/security-policy-settings/create-a-token-object.md
index d8fb3590da..f19009955d 100644
--- a/windows/security/threat-protection/security-policy-settings/create-a-token-object.md
+++ b/windows/security/threat-protection/security-policy-settings/create-a-token-object.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/create-global-objects.md b/windows/security/threat-protection/security-policy-settings/create-global-objects.md
index b8a4c7c248..f89ff1f37f 100644
--- a/windows/security/threat-protection/security-policy-settings/create-global-objects.md
+++ b/windows/security/threat-protection/security-policy-settings/create-global-objects.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects.md b/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects.md
index e934ed4cd0..4cff161fe5 100644
--- a/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects.md
+++ b/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/create-symbolic-links.md b/windows/security/threat-protection/security-policy-settings/create-symbolic-links.md
index 25890fd436..73ae7b6fc0 100644
--- a/windows/security/threat-protection/security-policy-settings/create-symbolic-links.md
+++ b/windows/security/threat-protection/security-policy-settings/create-symbolic-links.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md
index f59c6c8bcd..f8daf37229 100644
--- a/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md
+++ b/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md
index 1fb8892b80..e88c9397bb 100644
--- a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md
+++ b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md
@@ -6,8 +6,8 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
-
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/debug-programs.md b/windows/security/threat-protection/security-policy-settings/debug-programs.md
index 2859c4bbe7..5bd7b3951b 100644
--- a/windows/security/threat-protection/security-policy-settings/debug-programs.md
+++ b/windows/security/threat-protection/security-policy-settings/debug-programs.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network.md b/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network.md
index 7f442354a9..659f95a2b8 100644
--- a/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network.md
+++ b/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job.md b/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job.md
index de37314441..8d227032ee 100644
--- a/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job.md
+++ b/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service.md b/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service.md
index ed2f25dd74..156963e0e5 100644
--- a/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service.md
+++ b/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/deny-log-on-locally.md b/windows/security/threat-protection/security-policy-settings/deny-log-on-locally.md
index 66f3796a26..8db35c7d85 100644
--- a/windows/security/threat-protection/security-policy-settings/deny-log-on-locally.md
+++ b/windows/security/threat-protection/security-policy-settings/deny-log-on-locally.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services.md b/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services.md
index b04d06b392..092ab076ff 100644
--- a/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services.md
+++ b/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on.md b/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on.md
index 9ec5cd6013..88275821af 100644
--- a/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on.md
+++ b/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md b/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md
index 0fb15e5558..4994799f27 100644
--- a/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md
+++ b/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md b/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md
index 2f97023f61..e41c0c5067 100644
--- a/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md
+++ b/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md b/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md
index 23b2d882a6..b15160364d 100644
--- a/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md
+++ b/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md b/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md
index c3738380c8..2a3bb79a6f 100644
--- a/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md
+++ b/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md b/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md
index 7d02b9d124..66bdcc3368 100644
--- a/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md
+++ b/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements.md b/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements.md
index 2528f5af05..f138f45684 100644
--- a/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements.md
+++ b/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md b/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md
index 6dd76544ba..f6e9ee94a1 100644
--- a/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md
+++ b/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md
index 8a661f02cc..4f45c4dc2d 100644
--- a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md
+++ b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md
index c1502c4e4a..70d087e8d7 100644
--- a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md
+++ b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md
index e9fb1c3dc5..4ca8bd53b8 100644
--- a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md
+++ b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes.md b/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes.md
index c6a7699292..e54ec081e3 100644
--- a/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes.md
+++ b/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md b/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md
index c9cb9862fb..78d2942171 100644
--- a/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md
+++ b/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 05/31/2018
---
diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md b/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md
index 16f9f08ed7..a07c07bfbc 100644
--- a/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md
+++ b/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md b/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md
index 42a984338a..8f0fbcb870 100644
--- a/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md
+++ b/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/enforce-password-history.md b/windows/security/threat-protection/security-policy-settings/enforce-password-history.md
index de7e1af7ba..085a3a3c54 100644
--- a/windows/security/threat-protection/security-policy-settings/enforce-password-history.md
+++ b/windows/security/threat-protection/security-policy-settings/enforce-password-history.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions.md b/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions.md
index e01fcbf962..5b79cc17d6 100644
--- a/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions.md
+++ b/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system.md b/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system.md
index 29afe2f595..07d249dcd0 100644
--- a/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system.md
+++ b/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/generate-security-audits.md b/windows/security/threat-protection/security-policy-settings/generate-security-audits.md
index 6f88087bae..b74521a317 100644
--- a/windows/security/threat-protection/security-policy-settings/generate-security-audits.md
+++ b/windows/security/threat-protection/security-policy-settings/generate-security-audits.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings.md b/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings.md
index 17b8bfcec6..7653e023d7 100644
--- a/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings.md
+++ b/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication.md b/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication.md
index 31ab10b629..e07c18c86d 100644
--- a/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication.md
+++ b/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set.md b/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set.md
index 34706bd79f..7ce527ad66 100644
--- a/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set.md
+++ b/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority.md b/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority.md
index 871e2e7d7f..1ae321bd87 100644
--- a/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority.md
+++ b/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 07/13/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md
index 6efa45a50a..897e2f2549 100644
--- a/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md
+++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
@@ -66,7 +67,7 @@ Clients that run Windows 10 version 1607 will not show details on the sign-in sc
If the **Privacy** setting is turned on, details will show.
The **Privacy** setting cannot be changed for clients in bulk.
-Instead, apply [KB 4013429](http://www.catalog.update.microsoft.com/Search.aspx?q=KB4013429) to clients that run Windows 10 version 1607 so they behave similarly to previous versions of Windows.
+Instead, apply [KB 4013429](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4013429) to clients that run Windows 10 version 1607 so they behave similarly to previous versions of Windows.
Clients that run later versions of Windows 10 do not require a hotfix.
There are related Group Policy settings:
@@ -83,7 +84,7 @@ If **Block user from showing account details on sign-in** is enabled, then only
Users will not be able to show details.
If **Block user from showing account details on sign-in** is not enabled, then you can set **Interactive logon: Display user information when the session is locked** to **User display name, domain and user names** to show additional details such as domain\username.
-In this case, clients that run Windows 10 version 1607 need [KB 4013429](http://www.catalog.update.microsoft.com/Search.aspx?q=KB4013429) applied.
+In this case, clients that run Windows 10 version 1607 need [KB 4013429](https://www.catalog.update.microsoft.com/Search.aspx?q=KB4013429) applied.
Users will not be able to hide additional details.
If **Block user from showing account details on sign-in** is not enabled and **Don’t display last signed-in** is enabled, the username will not be shown.
diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md
index 30ac4426eb..e3afc8ee01 100644
--- a/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md
+++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md
@@ -5,6 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md
index a0e2d4207d..e39fec421b 100644
--- a/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md
+++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md
index cf495671ea..dd30bc56ba 100644
--- a/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md
+++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md
index b2dfa5f7dc..babebadd11 100644
--- a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md
+++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md
index f3cadccfc5..eec6a03a0a 100644
--- a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md
+++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md
index 3134a03c07..fb7ddb1250 100644
--- a/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md
+++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md
index 1e37715589..e98f13cc83 100644
--- a/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md
+++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md
index 6b8b3f2fad..d8dab27bda 100644
--- a/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md
+++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md
index b32948c986..da69589771 100644
--- a/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md
+++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md
index 19bfe5c981..b7dd20ed15 100644
--- a/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md
+++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md
index eafc069b2f..42081cd402 100644
--- a/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md
+++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md
index 3540a9f09f..636bd2ec6f 100644
--- a/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md
+++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/kerberos-policy.md b/windows/security/threat-protection/security-policy-settings/kerberos-policy.md
index 3d1366b626..ac070c7702 100644
--- a/windows/security/threat-protection/security-policy-settings/kerberos-policy.md
+++ b/windows/security/threat-protection/security-policy-settings/kerberos-policy.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers.md b/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers.md
index fdc92d8744..75fb5939bd 100644
--- a/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers.md
+++ b/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory.md b/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory.md
index b95d2d4210..4e94af24de 100644
--- a/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory.md
+++ b/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job.md b/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job.md
index 6669963069..1636ce5414 100644
--- a/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job.md
+++ b/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/log-on-as-a-service.md b/windows/security/threat-protection/security-policy-settings/log-on-as-a-service.md
index 602b204581..57568063b4 100644
--- a/windows/security/threat-protection/security-policy-settings/log-on-as-a-service.md
+++ b/windows/security/threat-protection/security-policy-settings/log-on-as-a-service.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log.md b/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log.md
index 8a2d799d66..b49be1c41c 100644
--- a/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log.md
+++ b/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket.md b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket.md
index 087dc4ed6c..84ae8e5274 100644
--- a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket.md
+++ b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md
index 09d483458c..f1397bc889 100644
--- a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md
+++ b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket.md b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket.md
index 218c85c6c7..412af6ec04 100644
--- a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket.md
+++ b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md
index 7057705ad8..0cd52584a2 100644
--- a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md
+++ b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md b/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md
index b8541be161..cf13ab2714 100644
--- a/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md
+++ b/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md
index 779be1af43..14202023a8 100644
--- a/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md
+++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: justinha
ms.date: 06/28/2018
---
diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md
index 55e4e0410e..7427a0898e 100644
--- a/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md
+++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md
index bed0312e47..72ceae633e 100644
--- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md
+++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md
index 082fce0199..ac82806b49 100644
--- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md
+++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md
index 740aad436d..cd24f66c87 100644
--- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md
+++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 06/21/2018
---
diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md
index 2efe7661e7..f966580dff 100644
--- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md
+++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md
index febb391d27..e5b6a658ce 100644
--- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md
+++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/minimum-password-age.md b/windows/security/threat-protection/security-policy-settings/minimum-password-age.md
index 5aa52eaa25..6028668431 100644
--- a/windows/security/threat-protection/security-policy-settings/minimum-password-age.md
+++ b/windows/security/threat-protection/security-policy-settings/minimum-password-age.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/minimum-password-length.md b/windows/security/threat-protection/security-policy-settings/minimum-password-length.md
index 91b22ce8ae..9a65820d67 100644
--- a/windows/security/threat-protection/security-policy-settings/minimum-password-length.md
+++ b/windows/security/threat-protection/security-policy-settings/minimum-password-length.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/modify-an-object-label.md b/windows/security/threat-protection/security-policy-settings/modify-an-object-label.md
index 9bc859d8ef..da8d2ab5cf 100644
--- a/windows/security/threat-protection/security-policy-settings/modify-an-object-label.md
+++ b/windows/security/threat-protection/security-policy-settings/modify-an-object-label.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values.md b/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values.md
index 1ea9cb284b..f4abcd62e5 100644
--- a/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values.md
+++ b/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md b/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md
index b684158c99..f18bfcb85a 100644
--- a/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md
+++ b/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md
index b56cb79eab..ed0c582609 100644
--- a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md
+++ b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md
index 8a24119ceb..dba5ef3e9d 100644
--- a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md
+++ b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md
@@ -6,8 +6,8 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
-
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md
index 7c017c5b0c..6ca86aeb84 100644
--- a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md
+++ b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md b/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md
index 0b5d5d3df4..d767ea7088 100644
--- a/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md
+++ b/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md b/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md
index 4db7cdc5d5..d99e3aded9 100644
--- a/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md
+++ b/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md b/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md
index cfec2fafb7..eafe932536 100644
--- a/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md
+++ b/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md b/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md
index 0297e485f5..0207f7e66b 100644
--- a/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md
+++ b/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md b/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md
index 9a858f2da5..fce80319bb 100644
--- a/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md
+++ b/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md
index b672362f53..6b9f166e9f 100644
--- a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md
+++ b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md
@@ -6,6 +6,7 @@ ms.mktglfcycl: explore
ms.sitesec: library
ms.pagetype: security
ms.localizationpriority: medium
+ms.localizationpriority: medium
author: justinha
ms.date: 07/27/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md b/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md
index b5e5008271..aa5c1ab5dd 100644
--- a/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md
+++ b/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md b/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md
index 3674843d0e..a6a303f5bf 100644
--- a/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md
+++ b/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-list-manager-policies.md b/windows/security/threat-protection/security-policy-settings/network-list-manager-policies.md
index e2e72db46d..e5215a392c 100644
--- a/windows/security/threat-protection/security-policy-settings/network-list-manager-policies.md
+++ b/windows/security/threat-protection/security-policy-settings/network-list-manager-policies.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md b/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md
index 51b259cf4e..27d191495c 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md b/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md
index da0ccc7bb9..21de9aeec4 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md b/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md
index 77d4038a3d..be635dcfef 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md b/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md
index c4dd4a08f4..3874bf7655 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
@@ -21,18 +22,18 @@ Describes the best practices, location, values and security considerations for t
This policy setting allows you to set the encryption types that the Kerberos protocol is allowed to use. If it is not selected, the encryption type will not be allowed. This setting might affect compatibility with client computers or services and applications. Multiple selections are permitted.
-For more information, see [article 977321](http://support.microsoft.com/kb/977321) in the Microsoft Knowledge Base.
+For more information, see [article 977321](https://support.microsoft.com/kb/977321) in the Microsoft Knowledge Base.
The following table lists and explains the allowed encryption types.
| Encryption type | Description and version support |
| - | - |
-| DES_CBC_CRC | Data Encryption Standard with Cipher Block Chaining using the Cyclic Redundancy Check function Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7 and Windows Server 2008 R2 operating systems do not support DES| by default.
+| DES_CBC_CRC | Data Encryption Standard with Cipher Block Chaining using the Cyclic Redundancy Check function Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7 and Windows Server 2008 R2 operating systems do not support DES| by default.
| DES_CBC_MD5| Data Encryption Standard with Cipher Block Chaining using the Message-Digest algorithm 5 checksum function Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7 and Windows Server 2008 R2 operating systems do not support DES by default. |
-| RC4_HMAC_MD5| Rivest Cipher 4 with Hashed Message Authentication Code using the Message-Digest algorithm 5 checksum function Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.|
+| RC4_HMAC_MD5| Rivest Cipher 4 with Hashed Message Authentication Code using the Message-Digest algorithm 5 checksum function Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.|
| AES128_HMAC_SHA1| Advanced Encryption Standard in 128 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1). Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2. |
| AES256_HMAC_SHA1| Advanced Encryption Standard in 256 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1). Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2. |
-| Future encryption types| Reserved by Microsoft for additional encryption types that might be implemented.|
+| Future encryption types| Reserved by Microsoft for additional encryption types that might be implemented.|
### Possible values
@@ -59,12 +60,12 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec
### Default values
| Server type or Group Policy Object (GPO) | Default value |
| - | - |
-| Default domain policy| Not defined|
-| Default domain controller policy| Not defined|
-| Stand-alone server default settings | Not defined|
-| Domain controller effective default settings | None of these encryption types that are available in this policy are allowed.|
-| Member server effective default settings | None of these encryption types that are available in this policy are allowed.|
-| Effective GPO default settings on client computers | None of these encryption types that are available in this policy are allowed.|
+| Default domain policy| Not defined|
+| Default domain controller policy| Not defined|
+| Stand-alone server default settings | Not defined|
+| Domain controller effective default settings | None of these encryption types that are available in this policy are allowed.|
+| Member server effective default settings | None of these encryption types that are available in this policy are allowed.|
+| Effective GPO default settings on client computers | None of these encryption types that are available in this policy are allowed.|
## Security considerations
@@ -72,7 +73,7 @@ This section describes how an attacker might exploit a feature or its configurat
### Vulnerability
-Windows Server 2008 R2 and Windows 7 do not support the DES cryptographic suites because stronger ones are available. To enable Kerberos interoperability with non-Windows versions of the Kerberos protocol, these suites can be enabled. However, doing so might open attack vectors on computers running
+Windows Server 2008 R2 and Windows 7 do not support the DES cryptographic suites because stronger ones are available. To enable Kerberos interoperability with non-Windows versions of the Kerberos protocol, these suites can be enabled. However, doing so might open attack vectors on computers running
Windows Server 2008 R2 and Windows 7. You can also disable DES for your computers running Windows Vista and Windows Server 2008.
### Countermeasure
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md b/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md
index a33fcc6cfe..42f411a872 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md b/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md
index 572d2ac031..3b064f6908 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level.md b/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level.md
index f4ae3d7ec6..1b73389dbb 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
@@ -55,10 +56,14 @@ authentication level that servers accept. The following table identifies the pol
- Best practices are dependent on your specific security and authentication requirements.
-### Location
+### Policy Location
Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options
+### Registry Location
+
+HKLM\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel
+
### Default values
The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page.
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements.md b/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements.md
index f22f62b0b2..428b113fe1 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md b/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md
index fd7b375759..94cd2f2a3b 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 07/27/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md b/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md
index a1a72b97d9..2b4aa59ac0 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md
index 943d99b774..b3724d05f6 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md
index 2a7f3ce456..e3a706d5e9 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md
index de492a6900..9007808fc8 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md
index 08335febc9..588e68efbb 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md
index 841ed44541..1fdac0f27c 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md
index cbef99d80f..6751800e93 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md
index 59346ccb54..c5a14b24b3 100644
--- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md
+++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md
index bb0ef8c128..bfdf5f299a 100644
--- a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md
+++ b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/08/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/password-policy.md b/windows/security/threat-protection/security-policy-settings/password-policy.md
index c4974cf71c..49e90f010b 100644
--- a/windows/security/threat-protection/security-policy-settings/password-policy.md
+++ b/windows/security/threat-protection/security-policy-settings/password-policy.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks.md b/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks.md
index c382fb66e7..2eee65e68b 100644
--- a/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks.md
+++ b/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/profile-single-process.md b/windows/security/threat-protection/security-policy-settings/profile-single-process.md
index 5fbb3b3076..90776ad589 100644
--- a/windows/security/threat-protection/security-policy-settings/profile-single-process.md
+++ b/windows/security/threat-protection/security-policy-settings/profile-single-process.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/profile-system-performance.md b/windows/security/threat-protection/security-policy-settings/profile-system-performance.md
index fa2a4609bc..9b538889f1 100644
--- a/windows/security/threat-protection/security-policy-settings/profile-system-performance.md
+++ b/windows/security/threat-protection/security-policy-settings/profile-system-performance.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md b/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md
index 1f8dabdc28..ad5a2f6f14 100644
--- a/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md
+++ b/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md b/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md
index 55fea42ddb..a513560166 100644
--- a/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md
+++ b/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station.md b/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station.md
index c25cf8e2ba..43278adbbf 100644
--- a/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station.md
+++ b/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token.md b/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token.md
index f002ef3118..afebd10193 100644
--- a/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token.md
+++ b/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md b/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md
index 13163b2d93..e735885b8d 100644
--- a/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md
+++ b/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/restore-files-and-directories.md b/windows/security/threat-protection/security-policy-settings/restore-files-and-directories.md
index 856437c766..3b09600257 100644
--- a/windows/security/threat-protection/security-policy-settings/restore-files-and-directories.md
+++ b/windows/security/threat-protection/security-policy-settings/restore-files-and-directories.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md b/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md
index 09c52294bb..ef50b18745 100644
--- a/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md
+++ b/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/security-options.md b/windows/security/threat-protection/security-policy-settings/security-options.md
index b4d90dc74c..8a6cd11350 100644
--- a/windows/security/threat-protection/security-policy-settings/security-options.md
+++ b/windows/security/threat-protection/security-policy-settings/security-options.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: justinha
ms.date: 06/28/2018
---
diff --git a/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference.md b/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference.md
index 36c19f08f0..051808cb85 100644
--- a/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference.md
+++ b/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/security-policy-settings.md b/windows/security/threat-protection/security-policy-settings/security-policy-settings.md
index 4f24fe003a..6711b70593 100644
--- a/windows/security/threat-protection/security-policy-settings/security-policy-settings.md
+++ b/windows/security/threat-protection/security-policy-settings/security-policy-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/shut-down-the-system.md b/windows/security/threat-protection/security-policy-settings/shut-down-the-system.md
index 3c7cbedb11..ef46b8301e 100644
--- a/windows/security/threat-protection/security-policy-settings/shut-down-the-system.md
+++ b/windows/security/threat-protection/security-policy-settings/shut-down-the-system.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md b/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md
index ef32c15b9a..b74494656b 100644
--- a/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md
+++ b/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md b/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md
index 8458d32a52..12b6755312 100644
--- a/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md
+++ b/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/01/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-always.md b/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-always.md
index c8cb5783ba..988d211159 100644
--- a/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-always.md
+++ b/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-always.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 06/19/2018
---
diff --git a/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-if-server-agrees.md b/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-if-server-agrees.md
index 707cdf82c8..16cffebd8d 100644
--- a/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-if-server-agrees.md
+++ b/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-if-server-agrees.md
@@ -6,8 +6,8 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
-
ms.date: 06/19/2018
---
# SMBv1 Microsoft network client: Digitally sign communications (if server agrees)
diff --git a/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-always.md b/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-always.md
index cff5d35423..8e2cdd2740 100644
--- a/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-always.md
+++ b/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-always.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 06/19/201
---
diff --git a/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees.md b/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees.md
index 637fa2d2a5..654a737d1a 100644
--- a/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees.md
+++ b/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 06/19/2018
---
diff --git a/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md b/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md
index 6b0bae4976..d7c75a3d4f 100644
--- a/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md
+++ b/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data.md b/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data.md
index 740d9d0593..16c68a6929 100644
--- a/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data.md
+++ b/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md b/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md
index 7e9d1f3acd..0398bbbc89 100644
--- a/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md
+++ b/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md b/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md
index 18de1ae022..bba7a2624e 100644
--- a/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md
+++ b/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/29/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md b/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md
index 6f5095b542..7e0ca59069 100644
--- a/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md
+++ b/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md b/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md
index e1466cb95c..c5de4856e1 100644
--- a/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md
+++ b/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems.md b/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems.md
index c82b0dffa3..c81039c024 100644
--- a/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems.md
+++ b/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md b/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md
index 7bc764769a..63c46fc928 100644
--- a/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md
+++ b/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects.md b/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects.md
index 50ee559766..ffa2941137 100644
--- a/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects.md
+++ b/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md b/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md
index 827068144d..fa31fb16e4 100644
--- a/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md
+++ b/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/08/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md b/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md
index ce00295661..64449e0bec 100644
--- a/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md
+++ b/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md
index 41a9379d1f..27cfc0dcfb 100644
--- a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md
+++ b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md
@@ -6,6 +6,7 @@ ms.prod: ws10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/08/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md
index 866d8ae86d..b8620f41a5 100644
--- a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md
+++ b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md b/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md
index ab6b837747..de3df48df1 100644
--- a/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md
+++ b/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md b/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md
index 6d75c0225d..54ad96d58f 100644
--- a/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md
+++ b/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md b/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md
index a56e37647a..80a4e5f969 100644
--- a/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md
+++ b/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md b/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md
index 1a79e80070..0e931e969d 100644
--- a/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md
+++ b/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md b/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md
index 2b87555ed9..40cce0498e 100644
--- a/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md
+++ b/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md b/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md
index 7fba0a0991..d6ba8a9479 100644
--- a/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md
+++ b/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/security-policy-settings/user-rights-assignment.md b/windows/security/threat-protection/security-policy-settings/user-rights-assignment.md
index 249e7ff426..931d388344 100644
--- a/windows/security/threat-protection/security-policy-settings/user-rights-assignment.md
+++ b/windows/security/threat-protection/security-policy-settings/user-rights-assignment.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md
index 35ab89b19d..61a5bb0ce0 100644
--- a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md
+++ b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md
@@ -8,6 +8,7 @@ ms.sitesec: library
ms.pagetype: security
author: tedhardyMSFT
ms.date: 02/16/2018
+ms.localizationpriority: medium
---
# Use Windows Event Forwarding to help with intrusion detection
@@ -19,7 +20,7 @@ Learn about an approach to collect events from devices in your organization. Thi
Windows Event Forwarding (WEF) reads any operational or administrative event log on a device in your organization and forwards the events you choose to a Windows Event Collector (WEC) server.
-To accomplish this, there are two different of subscriptions published to client devices - the Baseline subscription and the suspect subscription. The Baseline subscription enrolls all devices in your organization, and a Suspect subscription only includes devices that have been added by you. The
+To accomplish this, there are two different of subscriptions published to client devices - the Baseline subscription and the suspect subscription. The Baseline subscription enrolls all devices in your organization, and a Suspect subscription only includes devices that have been added by you. The
Suspect subscription collects additional events to help build context for system activity and can quickly be updated to accommodate new events and/or scenarios as needed without impacting baseline operations.
This implementation helps differentiate where events are ultimately stored. Baseline events can be sent to devices with online analytical capability, such as Security Event Manager (SEM), while also sending events to a MapReduce system, such as HDInsight or Hadoop, for long-term storage and deeper analysis. Events from the Suspect subscription are sent directly to a MapReduce system due to volume and lower signal/noise ratio, they are largely used for host forensic analysis.
@@ -73,7 +74,7 @@ WEF handles VPN, RAS, and DirectAccess scenarios well and will reconnect and sen
### How is client progress tracked?
-The WEC server maintains in its registry the bookmark information and last heartbeat time for each event source for each WEF subscription. When an event source re-connects to a WEC server, the last bookmark position is sent to the device to use as a starting point to resume forwarding events. If a
+The WEC server maintains in its registry the bookmark information and last heartbeat time for each event source for each WEF subscription. When an event source re-connects to a WEC server, the last bookmark position is sent to the device to use as a starting point to resume forwarding events. If a
WEF client has no events to send, the WEF client will connect periodically to send a Heartbeat to the WEC server to indicate it is active. This heartbeat value can be individually configured for each subscription.
### Will WEF work in an IPv4, IPv6, or mixed IPv4/IPv6 environment?
@@ -96,7 +97,7 @@ When the event log overwrites existing events (resulting in data loss if the dev
### What format is used for forwarded events?
-WEF has two modes for forwarded events. The default is “Rendered Text” which includes the textual description of the event as you would see it in Event Viewer. This means that the event size is effectively doubled or tripled depending on the size of the rendered description. The alternative mode is
+WEF has two modes for forwarded events. The default is “Rendered Text” which includes the textual description of the event as you would see it in Event Viewer. This means that the event size is effectively doubled or tripled depending on the size of the rendered description. The alternative mode is
“Events” (also sometimes referred to as “Binary” format) – which is just the event XML itself sent in binary XML format (as it would be written to the evtx file.) This is very compact and can more than double the event volume a single WEC server can accommodate.
A subscription “testSubscription” can be configured to use the Events format through the WECUTIL utility:
@@ -118,7 +119,7 @@ This table outlines the built-in delivery options:
| Minimize bandwidth | This option ensures that the use of network bandwidth for event delivery is strictly controlled. It is an appropriate choice if you want to limit the frequency of network connections made to deliver events. It uses push delivery mode and sets a batch timeout of 6 hours. In addition, it uses a heartbeat interval of 6 hours. |
| Minimize latency | This option ensures that events are delivered with minimal delay. It is an appropriate choice if you are collecting alerts or critical events. It uses push delivery mode and sets a batch timeout of 30 seconds. |
-For more info about delivery options, see [Configure Advanced Subscription Settings](http://technet.microsoft.com/library/cc749167.aspx).
+For more info about delivery options, see [Configure Advanced Subscription Settings](https://technet.microsoft.com/library/cc749167.aspx).
The primary difference is in the latency which events are sent from the client. If none of the built-in options meet your requirements you can set Custom event delivery options for a given subscription from an elevated command prompt:
@@ -640,15 +641,15 @@ Here are the minimum steps for WEF to operate:
-
+
```
## Appendix G - Online resources
You can get more info with the following links:
-- [Event Selection](http://msdn.microsoft.com/library/aa385231.aspx)
-- [Event Queries and Event XML](http://msdn.microsoft.com/library/bb399427.aspx)
-- [Event Query Schema](http://msdn.microsoft.com/library/aa385760.aspx)
-- [Windows Event Collector](http://msdn.microsoft.com/library/windows/desktop/bb427443.aspx)
+- [Event Selection](https://msdn.microsoft.com/library/aa385231.aspx)
+- [Event Queries and Event XML](https://msdn.microsoft.com/library/bb399427.aspx)
+- [Event Query Schema](https://msdn.microsoft.com/library/aa385760.aspx)
+- [Windows Event Collector](https://msdn.microsoft.com/library/windows/desktop/bb427443.aspx)
diff --git a/windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md b/windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md
index 6e8c26d829..b07e349659 100644
--- a/windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md
+++ b/windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md
@@ -13,7 +13,7 @@ ms.date: 07/27/2017
---
# WannaCrypt ransomware worm targets out-of-date systems
-
+
On May 12, 2017 we detected a new ransomware that spreads like a worm by leveraging vulnerabilities that have been previously fixed. While security updates are automatically applied in most computers, some users and enterprises may delay deployment of patches. Unfortunately, the ransomware, known as [WannaCrypt](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/WannaCrypt), appears to have affected computers that have not applied the patch for these vulnerabilities. While the attack is unfolding, we remind users to install [MS17-010](https://technet.microsoft.com/en-us/library/security/ms17-010.aspx) if they have not already done so.
@@ -30,10 +30,10 @@ WannaCrypt's spreading mechanism is borrowed from [well-known](https://packetsto
The exploit code used by WannaCrypt was designed to work only against unpatched Windows 7 and Windows Server 2008 (or earlier OS) systems, so Windows 10 PCs are not affected by this attack.
We haven't found evidence of the exact initial entry vector used by this threat, but there are two scenarios that we believe are highly possible explanations for the spread of this ransomware:
-
+
- Arrival through social engineering emails designed to trick users to run the malware and activate the worm-spreading functionality with the SMB exploit
- Infection through SMB exploit when an unpatched computer is addressable from other infected machines
-
+
## Dropper
The threat arrives as a dropper Trojan that has the following two components:
@@ -42,14 +42,14 @@ The threat arrives as a dropper Trojan that has the following two components:
2. The ransomware known as WannaCrypt
The dropper tries to connect the following domains using the API `InternetOpenUrlA()`:
-
+
- www[.]iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com
- www[.]ifferfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com
-
+
If connection to the domains is successful, the dropper does not infect the system further with ransomware or try to exploit other systems to spread; it simply stops execution. However, if the connection fails, the threat proceeds to drop the ransomware and creates a service on the system.
In other words, unlike in most malware infections, **IT Administrators should NOT block these domains**. Note that the malware is not proxy-aware, so a local DNS record may be required. This does not need to point to the Internet, but can resolve to any accessible server which will accept connections on TCP 80.
-
+
The threat creates a service named *mssecsvc2.0*, whose function is to exploit the SMB vulnerability in other computers accessible from the infected system:
@@ -58,7 +58,7 @@ Service Name: mssecsvc2.0
Service Description: (Microsoft Security Center (2.0) Service)
Service Parameters: '-m security'
```
-
+
## WannaCrypt ransomware
@@ -66,16 +66,16 @@ Service Parameters: '-m security'
The ransomware component is a dropper that contains a password-protected .zip archive in its resource section. The document encryption routine and the files in the .zip archive contain support tools, a decryption tool, and the ransom message. In the samples we analyzed, the password for the .zip archive is 'WNcry@2ol7'.
When run, WannaCrypt creates the following registry keys:
-
+
- *HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\\ = '\\tasksche.exe'*
- *HKLM\SOFTWARE\WanaCrypt0r\\wd = '\'*
-
+
It changes the wallpaper to a ransom message by modifying the following registry key:
-
+
- *HKCU\Control Panel\Desktop\Wallpaper: '\\\@WanaDecryptor@.bmp'*
-
+
It creates the following files in the malware's working directory:
-
+
- *00000000.eky*
- *00000000.pky*
- *00000000.res*
@@ -131,13 +131,13 @@ It creates the following files in the malware's working directory:
- *taskdl.exe*
- *taskse.exe*
- *u.wnry*
-
+
WannaCrypt may also create the following files:
-
+
- *%SystemRoot%\tasksche.exe*
- *%SystemDrive%\intel\\\\tasksche.exe*
- *%ProgramData%\\\\tasksche.exe*
-
+
It may create a randomly named service that has the following associated ImagePath: `cmd.exe /c '\tasksche.exe'`.
It then searches the whole computer for any file with any of the following file name extensions: *.123, .jpeg , .rb , .602 , .jpg , .rtf , .doc , .js , .sch , .3dm , .jsp , .sh , .3ds , .key , .sldm , .3g2 , .lay , .sldm , .3gp , .lay6 , .sldx , .7z , .ldf , .slk , .accdb , .m3u , .sln , .aes , .m4u , .snt , .ai , .max , .sql , .ARC , .mdb , .sqlite3 , .asc , .mdf , .sqlitedb , .asf , .mid , .stc , .asm , .mkv , .std , .asp , .mml , .sti , .avi , .mov , .stw , .backup , .mp3 , .suo , .bak , .mp4 , .svg , .bat , .mpeg , .swf , .bmp , .mpg , .sxc , .brd , .msg , .sxd , .bz2 , .myd , .sxi , .c , .myi , .sxm , .cgm , .nef , .sxw , .class , .odb , .tar , .cmd , .odg , .tbk , .cpp , .odp , .tgz , .crt , .ods , .tif , .cs , .odt , .tiff , .csr , .onetoc2 , .txt , .csv , .ost , .uop , .db , .otg , .uot , .dbf , .otp , .vb , .dch , .ots , .vbs , .der' , .ott , .vcd , .dif , .p12 , .vdi , .dip , .PAQ , .vmdk , .djvu , .pas , .vmx , .docb , .pdf , .vob , .docm , .pem , .vsd , .docx , .pfx , .vsdx , .dot , .php , .wav , .dotm , .pl , .wb2 , .dotx , .png , .wk1 , .dwg , .pot , .wks , .edb , .potm , .wma , .eml , .potx , .wmv , .fla , .ppam , .xlc , .flv , .pps , .xlm , .frm , .ppsm , .xls , .gif , .ppsx , .xlsb , .gpg , .ppt , .xlsm , .gz , .pptm , .xlsx , .h , .pptx , .xlt , .hwp , .ps1 , .xltm , .ibd , .psd , .xltx , .iso , .pst , .xlw , .jar , .rar , .zip , .java , .raw.*
@@ -152,15 +152,15 @@ After completing the encryption process, the malware deletes the volume shadow c
It then replaces the desktop background image with the following message:
-
+
It also runs an executable showing a ransom note which indicates a $300 ransom in Bitcoins as well as a timer:
-
+
The text is localized into the following languages: Bulgarian, Chinese (simplified), Chinese (traditional), Croatian, Czech, Danish, Dutch, English, Filipino, Finnish, French, German, Greek, Indonesian, Italian, Japanese, Korean, Latvian, Norwegian, Polish, Portuguese, Romanian, Russian, Slovak, Spanish, Swedish, Turkish, and Vietnamese.
The ransomware also demonstrates the decryption capability by allowing the user to decrypt a few random files, free of charge. It then quickly reminds the user to pay the ransom to decrypt all the remaining files.
-
+
## Spreading capability
@@ -168,15 +168,15 @@ The ransomware also demonstrates the decryption capability by allowing the user
The worm functionality attempts to infect unpatched Windows machines in the local network. At the same time, it also executes massive scanning on Internet IP addresses to find and infect other vulnerable computers. This activity results in large SMB traffic from the infected host, which can be observed by SecOps personnel, as shown below.
-
+
The Internet scanning routine randomly generates octets to form the IPv4 address. The malware then targets that IP to attempt to exploit CVE-2017-0145. The threat avoids infecting the IPv4 address if the randomly generated value for first octet is 127 or if the value is equal to or greater than 224, in order to skip local loopback interfaces. Once a vulnerable machine is found and infected, it becomes the next hop to infect other machines. The vicious infection cycle continues as the scanning routing discovers unpatched computers.
When it successfully infects a vulnerable computer, the malware runs kernel-level shellcode that seems to have been copied from the public backdoor known as DOUBLEPULSAR, but with certain adjustments to drop and execute the ransomware dropper payload, both for x86 and x64 systems.
-
+
-
+
## Protection against the WannaCrypt attack
To get the latest protection from Microsoft, upgrade to [Windows 10](https://www.microsoft.com/en-us/windows/windows-10-upgrade). Keeping your computers [up-to-date](https://www.microsoft.com/en-us/security/portal/mmpc/help/updatefaqs.aspx) gives you the benefits of the latest features and proactive mitigations built into the latest versions of Windows.
@@ -185,20 +185,20 @@ We recommend customers that have not yet installed the security update [MS17-010
- Disable SMBv1 with the steps documented at [Microsoft Knowledge Base Article 2696547](https://support.microsoft.com/kb/2696547) and as [recommended previously](https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/)
- Consider adding a rule on your router or firewall to block incoming SMB traffic on port 445
-
+
[Windows Defender Antivirus](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/windows-defender-in-windows-10) detects this threat as [Ransom:Win32/WannaCrypt](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/WannaCrypt) as of the *1.243.297.0* update. Windows Defender Antivirus uses cloud-based protection, helping to protect you from the latest threats.
For enterprises, use [Device Guard](https://technet.microsoft.com/itpro/windows/keep-secure/device-guard-deployment-guide) to lock down devices and provide kernel-level virtualization-based security, allowing only trusted applications to run, effectively preventing malware from running.
Use [Office 365 Advanced Threat Protection](https://blogs.office.com/2015/04/08/introducing-exchange-online-advanced-threat-protection/), which has machine learning capability that blocks dangerous email threats, such as the emails carrying ransomware.
-Monitor networks with [Windows Defender Advanced Threat Protection](http://www.microsoft.com/en-us/WindowsForBusiness/windows-atp), which alerts security operations teams about suspicious activities. Download this playbook to see how you can leverage Windows Defender ATP to detect, investigate, and mitigate ransomware in networks: [Windows Defender Advanced Threat Protection - Ransomware response playbook](https://www.microsoft.com/en-us/download/details.aspx?id=55090).
+Monitor networks with [Windows Defender Advanced Threat Protection](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp), which alerts security operations teams about suspicious activities. Download this playbook to see how you can leverage Windows Defender ATP to detect, investigate, and mitigate ransomware in networks: [Windows Defender Advanced Threat Protection - Ransomware response playbook](https://www.microsoft.com/en-us/download/details.aspx?id=55090).
## Resources
Download English language security updates: [Windows Server 2003 SP2 x64](http://download.windowsupdate.com/d/csa/csa/secu/2017/02/windowsserver2003-kb4012598-x64-custom-enu_f24d8723f246145524b9030e4752c96430981211.exe), [Windows Server 2003 SP2 x86,](http://download.windowsupdate.com/c/csa/csa/secu/2017/02/windowsserver2003-kb4012598-x86-custom-enu_f617caf6e7ee6f43abe4b386cb1d26b3318693cf.exe) [Windows XP SP2 x64](http://download.windowsupdate.com/d/csa/csa/secu/2017/02/windowsserver2003-kb4012598-x64-custom-enu_f24d8723f246145524b9030e4752c96430981211.exe), [Windows XP SP3 x86](http://download.windowsupdate.com/d/csa/csa/secu/2017/02/windowsxp-kb4012598-x86-custom-enu_eceb7d5023bbb23c0dc633e46b9c2f14fa6ee9dd.exe), [Windows XP Embedded SP3 x86](http://download.windowsupdate.com/c/csa/csa/secu/2017/02/windowsxp-kb4012598-x86-embedded-custom-enu_8f2c266f83a7e1b100ddb9acd4a6a3ab5ecd4059.exe), [Windows 8 x86,](http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows8-rt-kb4012598-x86_a0f1c953a24dd042acc540c59b339f55fb18f594.msu) [Windows 8 x64](http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows8-rt-kb4012598-x64_f05841d2e94197c2dca4457f1b895e8f632b7f8e.msu)
-Download localized language security updates: [Windows Server 2003 SP2 x64](http://www.microsoft.com/downloads/details.aspx?FamilyId=d3cb7407-3339-452e-8371-79b9c301132e), [Windows Server 2003 SP2 x86](http://www.microsoft.com/downloads/details.aspx?FamilyId=350ec04d-a0ba-4a50-9be3-f900dafeddf9), [Windows XP SP2 x64](http://www.microsoft.com/downloads/details.aspx?FamilyId=5fbaa61b-15ce-49c7-9361-cb5494f9d6aa), [Windows XP SP3 x86](http://www.microsoft.com/downloads/details.aspx?FamilyId=7388c05d-9de6-4c6a-8b21-219df407754f), [Windows XP Embedded SP3 x86](http://www.microsoft.com/downloads/details.aspx?FamilyId=a1db143d-6ad2-4e7e-9e90-2a73316e1add), [Windows 8 x86](http://www.microsoft.com/downloads/details.aspx?FamilyId=6e2de6b7-9e43-4b42-aca2-267f24210340), [Windows 8 x64](http://www.microsoft.com/downloads/details.aspx?FamilyId=b08bb3f1-f156-4e61-8a68-077963bae8c0)
+Download localized language security updates: [Windows Server 2003 SP2 x64](https://www.microsoft.com/downloads/details.aspx?FamilyId=d3cb7407-3339-452e-8371-79b9c301132e), [Windows Server 2003 SP2 x86](https://www.microsoft.com/downloads/details.aspx?FamilyId=350ec04d-a0ba-4a50-9be3-f900dafeddf9), [Windows XP SP2 x64](https://www.microsoft.com/downloads/details.aspx?FamilyId=5fbaa61b-15ce-49c7-9361-cb5494f9d6aa), [Windows XP SP3 x86](https://www.microsoft.com/downloads/details.aspx?FamilyId=7388c05d-9de6-4c6a-8b21-219df407754f), [Windows XP Embedded SP3 x86](https://www.microsoft.com/downloads/details.aspx?FamilyId=a1db143d-6ad2-4e7e-9e90-2a73316e1add), [Windows 8 x86](https://www.microsoft.com/downloads/details.aspx?FamilyId=6e2de6b7-9e43-4b42-aca2-267f24210340), [Windows 8 x64](https://www.microsoft.com/downloads/details.aspx?FamilyId=b08bb3f1-f156-4e61-8a68-077963bae8c0)
MS17-010 Security Update: [https://technet.microsoft.com/en-us/library/security/ms17-010.aspx](https://technet.microsoft.com/en-us/library/security/ms17-010.aspx)
@@ -209,12 +209,12 @@ General information on ransomware: [https://www.microsoft.com/en-us/security/por
## Indicators of compromise
SHA1 of samples analyzed:
-
+
- 51e4307093f8ca8854359c0ac882ddca427a813c
- e889544aff85ffaf8b0d0da705105dee7c97fe26
-
+
Files created:
-
+
- %SystemRoot%\mssecsvc.exe
- %SystemRoot%\tasksche.exe
- %SystemRoot%\qeriuwjhrf
@@ -240,12 +240,12 @@ Files created:
- Taskse.exe
- Files with '.wnry' extension
- Files with '.WNCRY' extension
-
+
Registry keys created:
-
+
- HKLM\SOFTWARE\WanaCrypt0r\wd
-
-
-
+
+
+
*Karthik Selvaraj, Elia Florio, Andrea Lelli, and Tanmay Ganacharya* *Microsoft Malware Protection Center*
-
+
diff --git a/windows/security/threat-protection/windows-10-mobile-security-guide.md b/windows/security/threat-protection/windows-10-mobile-security-guide.md
index 1abe679c9e..3e0f5269e9 100644
--- a/windows/security/threat-protection/windows-10-mobile-security-guide.md
+++ b/windows/security/threat-protection/windows-10-mobile-security-guide.md
@@ -17,13 +17,13 @@ ms.date: 10/13/2017
>This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security.
-Smartphones now serve as a primary productivity tool for business workers and, just like desktops or laptops, need to be secured against malware and data theft. Protecting these devices can be challenging due to the wide range of device operating systems and configurations and the fact that many employees use their own personal devices. IT needs to secure corporate assets on every device, but also ensure the privacy of the user’s personal apps and data.
+Smartphones now serve as a primary productivity tool for business workers and, just like desktops or laptops, need to be secured against malware and data theft. Protecting these devices can be challenging due to the wide range of device operating systems and configurations and the fact that many employees use their own personal devices. IT needs to secure corporate assets on every device, but also ensure the privacy of the user’s personal apps and data.
Windows 10 Mobile addresses these security concerns directly, whether workers are using personal or corporate-owned devices. It uses the same security technologies as the Windows 10 operating system to help protect against known and emerging security threats across the spectrum of attack vectors. These technologies include:
-- **Windows Hello for Business** Enhanced identity and access control features ensure that only authorized users can access corporate data and resources. Windows Hello simplifies multifactor authentication (MFA) deployment and use, offering PIN, companion device, and biometric authentication methods.
+- **Windows Hello for Business** Enhanced identity and access control features ensure that only authorized users can access corporate data and resources. Windows Hello simplifies multifactor authentication (MFA) deployment and use, offering PIN, companion device, and biometric authentication methods.
- **Windows Information Protection** Automatic data separation keeps corporate information from being shared with personal data and apps.
-- **Malware resistance** Multi-layered protections built into the device hardware, startup processes, and app platform help reduce the threat of malware that can compromise employee devices.
+- **Malware resistance** Multi-layered protections built into the device hardware, startup processes, and app platform help reduce the threat of malware that can compromise employee devices.
-This guide helps IT administrators better understand the security features in Windows 10 Mobile, which can be used to improve protection against unauthorized access, data leakage, and malware.
+This guide helps IT administrators better understand the security features in Windows 10 Mobile, which can be used to improve protection against unauthorized access, data leakage, and malware.
**In this article:**
- Windows Hello for Business
@@ -32,25 +32,25 @@ This guide helps IT administrators better understand the security features in Wi
## Windows Hello
-Windows 10 Mobile includes Windows Hello, a simple, yet powerful, multifactor authentication solution that confirms a user’s identity before allowing access to corporate confidential information and resources. Multifactor authentication is a more secure alternative to password-based device security. Users dislike having to enter long, complex passwords – particularly on a mobile device touch screen – that corporate policy requires they change frequently. This leads to poor security practices like password reuse, written down passwords, or weak password creation.
+Windows 10 Mobile includes Windows Hello, a simple, yet powerful, multifactor authentication solution that confirms a user’s identity before allowing access to corporate confidential information and resources. Multifactor authentication is a more secure alternative to password-based device security. Users dislike having to enter long, complex passwords – particularly on a mobile device touch screen – that corporate policy requires they change frequently. This leads to poor security practices like password reuse, written down passwords, or weak password creation.
-Windows Hello offers a simple, cost-effective way to deploy multifactor authentication across your organization. Unlike smart cards, it does not require public key infrastructure or the implementation of additional hardware. Workers use a PIN, a companion device (like Microsoft Band), or biometrics to validate their identity for accessing corporate resources on their Azure Active Directory (Azure AD) registered Windows 10 Mobile device.
+Windows Hello offers a simple, cost-effective way to deploy multifactor authentication across your organization. Unlike smart cards, it does not require public key infrastructure or the implementation of additional hardware. Workers use a PIN, a companion device (like Microsoft Band), or biometrics to validate their identity for accessing corporate resources on their Azure Active Directory (Azure AD) registered Windows 10 Mobile device.
Because Windows Hello is supported across all Windows 10 devices, organizations can uniformly implement multifactor authentication across their environment. Deploying Windows Hello on Windows 10 Mobile devices does require Azure AD (sold separately), but you can use Azure AD Connect to synchronize with your on-premises Active Directory services.
-Windows Hello supports iris scan, fingerprint, and facial recognition-based authentication for devices that have biometric sensors.
+Windows Hello supports iris scan, fingerprint, and facial recognition-based authentication for devices that have biometric sensors.
->**Note:** When Windows 10 first shipped, it included **Microsoft Passport** and **Windows Hello**, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the **Windows Hello** name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics.
+>**Note:** When Windows 10 first shipped, it included **Microsoft Passport** and **Windows Hello**, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the **Windows Hello** name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics.
### Secured credentials
-Windows Hello eliminates the use of passwords for login, reducing the risk that an attacker will steal and reuse a user’s credentials. Windows 10 Mobile devices are required to have a Trusted Platform Module (TPM), a microchip that enables advanced security features. The TPM creates encryption keys that are “wrapped” with the TPM’s own storage root key, which is itself stored within the TPM to prevent credentials from being compromised. Encryption keys created by the TPM can only be decrypted by the same TPM, which protects the key material from attackers who want to capture and reuse it.
+Windows Hello eliminates the use of passwords for login, reducing the risk that an attacker will steal and reuse a user’s credentials. Windows 10 Mobile devices are required to have a Trusted Platform Module (TPM), a microchip that enables advanced security features. The TPM creates encryption keys that are “wrapped” with the TPM’s own storage root key, which is itself stored within the TPM to prevent credentials from being compromised. Encryption keys created by the TPM can only be decrypted by the same TPM, which protects the key material from attackers who want to capture and reuse it.
To compromise Windows Hello credentials, an attacker would need access to the physical device, and then find a way to spoof the user’s biometric identity or guess his or her PIN. All of this would have to be accomplished before TPM brute-force resistance capabilities lock the mobile device, the theft-protection mechanism kicks in, or the user or corporate administrator remotely wipes the device. With TPM-based protection, an attacker’s window of opportunity for compromising a user’s credentials is greatly reduced.
### Support for biometrics
-Biometrics help prevent credential theft and make it easier for users to login to their devices. Users always have their biometric identity with them – there is nothing to forget, lose, or leave behind. Attackers would need to have both access to the user’s device and be able to impersonate the user’s biometric identity to gain access to corporate resources, which is far more difficult than stealing a password.
+Biometrics help prevent credential theft and make it easier for users to login to their devices. Users always have their biometric identity with them – there is nothing to forget, lose, or leave behind. Attackers would need to have both access to the user’s device and be able to impersonate the user’s biometric identity to gain access to corporate resources, which is far more difficult than stealing a password.
Windows Hello supports three biometric sensor scenarios:
- **Facial recognition** uses special IR cameras to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major manufacturers are already shipping laptops with integrated facial-recognition technology. Both Surface Pro 4 and Surface Book support this technology.
@@ -71,9 +71,9 @@ A Windows Hello companion device enables a physical device, like a wearable, to
In some cases, the companion device for Windows Hello enables a physical device, like a phone, wearable, or other types of device to store all of the user’s credentials. Storage of the credentials on a mobile device makes it possible to use them on any supporting device, like a kiosk or family PC, and eliminates the need to enroll Windows Hello on each device. Companion devices also help enable organizations to meet regulatory requirements, such as Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS 140-2).
-### Standards-based approach
+### Standards-based approach
-The Fast Identity Online (FIDO) Alliance is a nonprofit organization that works to address the lack of interoperability among strong authentication devices and the problems users face in creating and remembering multiple user names and passwords. FIDO standards help reduce reliance on passwords to authenticate users of online services securely, allowing any business network, app, website, or cloud application to interface with a broad variety of existing and future FIDO-enabled devices and operating system platforms.
+The Fast Identity Online (FIDO) Alliance is a nonprofit organization that works to address the lack of interoperability among strong authentication devices and the problems users face in creating and remembering multiple user names and passwords. FIDO standards help reduce reliance on passwords to authenticate users of online services securely, allowing any business network, app, website, or cloud application to interface with a broad variety of existing and future FIDO-enabled devices and operating system platforms.
In 2014, Microsoft joined the board of the FIDO Alliance. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards. Microsoft has contributed Windows Hello technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for both enterprises and consumers.
@@ -81,7 +81,7 @@ In 2014, Microsoft joined the board of the FIDO Alliance. The FIDO 1.0 specifica
Enterprises have seen huge growth in the convergence of personal and corporate data storage. Personal data is frequently stored on corporate devices and vice versa. This fluidity increases the potential for sensitive corporate data to be accidentally compromised.
-Inadvertent disclosure is rapidly becoming the biggest source of confidential data leakage as organizations allow personal devices to access corporate resources. It’s easy to imagine that an employee using work email on their personal phone could unintentionally save an attachment containing sensitive company information to personal cloud storage, which could be shared with unauthorized people. This accidental sharing of corporate data is just one example of the challenges common to using mobile devices in the workplace. To prevent this type of data leakage, most solutions require users to login with a separate username and password to a container that stores all corporate apps and data, an experience that degrades user productivity.
+Inadvertent disclosure is rapidly becoming the biggest source of confidential data leakage as organizations allow personal devices to access corporate resources. It’s easy to imagine that an employee using work email on their personal phone could unintentionally save an attachment containing sensitive company information to personal cloud storage, which could be shared with unauthorized people. This accidental sharing of corporate data is just one example of the challenges common to using mobile devices in the workplace. To prevent this type of data leakage, most solutions require users to login with a separate username and password to a container that stores all corporate apps and data, an experience that degrades user productivity.
Windows 10 Mobile includes Windows Information Protection to transparently keep corporate data secure and personal data private. Because corporate data is always protected, users cannot inadvertently copy it or share it with unauthorized users or apps. Key features include:
- Automatically tag personal and corporate data.
@@ -89,13 +89,13 @@ Windows 10 Mobile includes Windows Information Protection to transparently keep
- Control which apps can access corporate data.
- Control which apps can access a virtual private network (VPN) connection.
- Prevent users from copying corporate data to public locations.
-- Help ensure business data is inaccessible when the device is in a locked state.
+- Help ensure business data is inaccessible when the device is in a locked state.
### Enlightened apps
Third-party data loss protection solutions usually require developers to wrap their apps. However, Windows Information Protection builds this intelligence right into Windows 10 Mobile so most apps require nothing extra to prevent inappropriate corporate data sharing.
-Windows Information Protection classifies apps into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on internal policies. Corporate data will be encrypted on the managed device and attempts to copy/paste or share this information with non-corporate apps or users will fail. Unenlightened apps, when marked as corporate-managed, consider all data corporate and encrypt everything by default.
+Windows Information Protection classifies apps into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on internal policies. Corporate data will be encrypted on the managed device and attempts to copy/paste or share this information with non-corporate apps or users will fail. Unenlightened apps, when marked as corporate-managed, consider all data corporate and encrypt everything by default.
When you do not want all data encrypted by default – because it would create a poor user experience – developers should consider enlightening apps by adding code and compiling them using the Windows Information Protection application programming interfaces. The most likely candidates for enlightenment are apps that:
- Don’t use common controls for saving files.
@@ -104,14 +104,14 @@ When you do not want all data encrypted by default – because it would create a
In many cases, most apps don’t require enlightenment for them to use Windows Information Protection. Simply adding them to the allow list is the only step you need to take. Line-of-Business (LOB) apps are a good example of where this works well because they only handle corporate data.
-**When is app enlightenment required?**
-- **Required**
+**When is app enlightenment required?**
+- **Required**
- App needs to work with both personal and enterprise data.
-- **Recommended**
+- **Recommended**
- App handles only corporate data, but needs to modify a file (such as a configuration file) in order to launch, uninstall itself, update etc. Without enlightenment you wouldn’t be able to properly revoke these apps.
- App needs to access enterprise data, while protection under lock is activated.
- **Not required**
- - App handles only corporate data
+ - App handles only corporate data
- App handles only personal data
### Data leakage control
@@ -130,17 +130,17 @@ The extent to which users will be prevented from copying and pasting data from a
Most third-party solutions require an app wrapper that directs enterprise data into a password-protected container and keeps personal data outside the container. Depending on the implementation, this may require two different versions of the same apps to be running on the device: one for personal data and another for enterprise data.
-Windows Information Protection provides data separation without requiring a container or special version of an app to access business or personal data. There is no separate login required to see your corporate data or open your corporate applications. Windows Information Protection identifies enterprise data and encrypts it to only enterprise use. Data separation is automatic and seamless.
+Windows Information Protection provides data separation without requiring a container or special version of an app to access business or personal data. There is no separate login required to see your corporate data or open your corporate applications. Windows Information Protection identifies enterprise data and encrypts it to only enterprise use. Data separation is automatic and seamless.
### Encryption
Windows 10 Mobile uses device encryption, based on BitLocker technology, to encrypt all internal storage, including operating systems and data storage partitions. The user can activate device encryption, or the IT department can activate and enforce encryption for company-managed devices through MDM tools. When device encryption is turned on, all data stored on the phone is encrypted automatically. A Windows 10 Mobile device with encryption turned on helps protect the confidentiality of data stored – even if the device is lost or stolen. The combination of Windows Hello lock and data encryption makes it extremely difficult for an unauthorized party to retrieve sensitive information from the device.
You can customize how device encryption works to meet your unique security requirements. Device encryption even enables you to define your own cipher suite. For example, you can specify the algorithm and key size that Windows 10 Mobile uses for data encryption, which Transport Layer Security (TLS) cipher suites are permitted, and whether Federal Information Processing Standard (FIPS) policy is enabled. The list below shows the policies you can change to customize device encryption on Windows 10 Mobile devices.
-- Cryptography
+- Cryptography
- Allow FIPS Algorithm: This policy enables or disable the FIPS policy. A restart is needed to enforce this policy. The default value is disabled.
- TLS Cipher Suite: This policy contains a list of the cryptographic cipher algorithms allowed for Secure Sockets Layer connections.
-- BitLocker
+- BitLocker
- Encryption Method: Configures the BitLocker Drive Encryption Method and cipher strength. The default value is AES-CBC 128-bit. If the device cannot use the value specified, it will use another one.
To help make the device even more secured against outside interference, Windows 10 Mobile also now includes protection-under-lock. That means that encryption keys are removed from memory whenever a device is locked. Apps are unable to access sensitive data while the device is in a locked state, so hackers and malware have no way to find and co-opt keys. Everything is locked up tight with the TPM until the user unlocks the device with Windows Hello.
@@ -218,7 +218,7 @@ UEFI can run internal integrity checks that verify the firmware’s digital sign
When a mobile device with UEFI and Secure Boot starts, the UEFI firmware verifies the bootloader’s digital signature to verify that no one has modified it after it was digitally signed. The firmware also verifies that a trusted authority issued the bootloader’s digital signature. This check helps to ensure that the system starts only after checking that the bootloader is both trusted and unmodified since signing.
-All Windows 10 Mobile devices always have Secure Boot enabled. In addition, they trust only the Windows operating system signature. Neither Windows 10 Mobile, apps, or even malware can change the UEFI configuration. For more information about UEFI with Secure Boot, read [Protecting the pre-OS environment with UEFI](http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx)
+All Windows 10 Mobile devices always have Secure Boot enabled. In addition, they trust only the Windows operating system signature. Neither Windows 10 Mobile, apps, or even malware can change the UEFI configuration. For more information about UEFI with Secure Boot, read [Protecting the pre-OS environment with UEFI](https://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx)
### Trusted Platform Module
@@ -264,7 +264,7 @@ In earlier versions of Windows, the biggest challenge with rootkits and bootkits
Windows 10 Mobile implements the Measured Boot feature, which uses the TPM hardware component to record a series of measurements for critical startup-related components, including firmware, Windows boot components, and drivers. Because Measured Boot uses the hardware-based security capabilities of TPM, which isolates and protects the measurement data against malware attacks, the log data is well protected against even sophisticated attacks.
-Measured Boot focuses on acquiring the measurement data and protecting it against tampering. To provide more complete security, it must be coupled with a service that can analyze the data to determine device health.
+Measured Boot focuses on acquiring the measurement data and protecting it against tampering. To provide more complete security, it must be coupled with a service that can analyze the data to determine device health.
### Device Health Attestation
@@ -327,7 +327,7 @@ You cannot configure CFG; rather, an application developer can take advantage of
### Protected Processes
-Unfortunately, no device is immune to malware. Despite all the best preventative controls, malware can eventually find a way to infect any operating system or hardware platform. So, although prevention with a defense-in-depth strategy is important, additional malware controls are required.
+Unfortunately, no device is immune to malware. Despite all the best preventative controls, malware can eventually find a way to infect any operating system or hardware platform. So, although prevention with a defense-in-depth strategy is important, additional malware controls are required.
If malware is running on a system, you need to limit what it can do Protected Processes prevents untrusted processes from tampering with those that have been specially signed. Protected Processes defines levels of trust for processes: it prevents less trusted processes from interacting with and therefore attacking more trusted processes. Windows 10 Mobile uses Protected Processes broadly throughout the operating system.
### AppContainer
@@ -352,13 +352,13 @@ The combination of Device Guard and AppContainer help to prevent unauthorized ap
The web browser is a critical component of any security strategy. It is the user’s interface to the Internet, an environment teeming with malicious sites and potentially dangerous content. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the number one pathway from which malicious hackers initiate their attacks.
Windows 10 Mobile includes Microsoft Edge, an entirely new web browser that goes beyond browsing with features like Reading View. Microsoft Edge is more secure than previous Microsoft web browsers in several ways:
-- **Microsoft Edge on Windows 10 Mobile does not support extensions.** Microsoft Edge has built-in PDF viewing capability.
+- **Microsoft Edge on Windows 10 Mobile does not support extensions.** Microsoft Edge has built-in PDF viewing capability.
- **Microsoft Edge is designed as a UWP app.** It is inherently compartmentalized and runs in an AppContainer that sandboxes the browser from the system, data, and other apps.
- **Microsoft Edge simplifies security configuration tasks.** Because Microsoft Edge uses a simplified application structure and a single sandbox configuration, fewer security settings are required. In addition, Microsoft established Microsoft Edge default settings that align with security best practices, making it more secure by design.
## Summary
-Windows 10 Mobile provides security on personal and corporate-owned devices to protect against unauthorized access, data leakage, and malware threats. All of the features covered in this paper – multifactor authentication, data separation, and malware resistance – are seamlessly incorporated into the operating system. This means enterprises are protected without compromising the productivity and ease of use that drives users to bring mobile devices into the workplace.
+Windows 10 Mobile provides security on personal and corporate-owned devices to protect against unauthorized access, data leakage, and malware threats. All of the features covered in this paper – multifactor authentication, data separation, and malware resistance – are seamlessly incorporated into the operating system. This means enterprises are protected without compromising the productivity and ease of use that drives users to bring mobile devices into the workplace.
## Revision History
diff --git a/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md b/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md
index d0e001795a..2e776ea30d 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md
@@ -1,6 +1,6 @@
---
-title: Collect diagnostic data for Update Compliance and Windows Defender AV
-description: Use a tool to collect data to troubleshoot Update Compliance issues when using the Windows Defender AV Assessment add in
+title: Collect diagnostic data for Update Compliance and Windows Defender Windows Defender Antivirus
+description: Use a tool to collect data to troubleshoot Update Compliance issues when using the Windows Defender Antivirus Assessment add in
keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, windows defender av
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
@@ -11,23 +11,18 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 09/12/2017
+ms.date: 09/03/2018
---
# Collect Update Compliance diagnostic data for Windows Defender AV Assessment
**Applies to:**
-- Windows 10
-
-**Audience**
-
-- IT administrators
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
This topic describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Windows Defender AV Assessment section in the Update Compliance add-in.
-Before attempting this process, ensure you have read the [Troubleshoot Windows Defender Antivirus reporting](troubleshoot-reporting.md) topic, met all require pre-requisites, and taken any other suggested troubleshooting steps.
-
+Before attempting this process, ensure you have read [Troubleshoot Windows Defender Antivirus reporting](troubleshoot-reporting.md), met all require pre-requisites, and taken any other suggested troubleshooting steps.
1. On at least two endpoints that are not reporting or showing up in Update Compliance, obtain the .cab diagnostic file by following this process:
@@ -57,21 +52,17 @@ Before attempting this process, ensure you have read the [Troubleshoot Windows D
3. Send an email using the Update Compliance support email template, and fill out the template with the following information:
-
```
- I am encountering the following issue when using Windows Defender AV in Update Compliance:
+ I am encountering the following issue when using Windows Defender Antivirus in Update Compliance:
I have provided at least 2 support .cab files at the following location:
- My OMS workspace ID is:
+ My OMS workspace ID is:
- Please contact me at:
+ Please contact me at:
```
-
-
-
## Related topics
-- [Troubleshoot Windows Defender Antivirus reporting](troubleshoot-reporting.md)
+- [Troubleshoot Windows Defender Windows Defender Antivirus reporting](troubleshoot-reporting.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md
index 16ef07c3fd..5544020384 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md
@@ -1,6 +1,6 @@
---
-title: Use the command line to manage Windows Defender AV
-description: Windows Defender AV has a dedicated command-line utility that can run scans and configure protection.
+title: Use the command line to manage Windows Defender Antivirus
+description: Run Windows Defender Antivirus scans and configure next gen protection with a dedicated command-line utility.
keywords: run windows defender scan, run antivirus scan from command line, run windows defender scan from command line, mpcmdrun, defender
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
@@ -11,31 +11,24 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 08/26/2017
+ms.date: 09/03/2018
---
-
-# Use the mpcmdrun.exe command-line tool to configure and manage Windows Defender Antivirus
+# Configure and manage Windows Defender Antivirus with the mpcmdrun.exe command-line tool
**Applies to:**
-- Windows 10
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
+You can perform various Windows Defender Antivirus functions with the dedicated command-line tool mpcmdrun.exe.
-- Enterprise security administrators
+This utility can be useful when you want to automate Windows Defender Antivirus use.
-
-You can use a dedicated command-line tool to perform various functions in Windows Defender Antivirus.
-
-This utility can be useful when you want to automate the use of Windows Defender Antivirus.
-
-The utility is available in _%ProgramFiles%\Windows Defender\MpCmdRun.exe_ and must be run from a command prompt.
+You can find the utility in _%ProgramFiles%\Windows Defender\MpCmdRun.exe_. You must run it from a command prompt.
> [!NOTE]
> You may need to open an administrator-level version of the command prompt. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt.
-
The utility has the following commands:
```DOS
@@ -55,12 +48,7 @@ Command | Description
\-ValidateMapsConnection | Used to validate connection to the [cloud-delivered protection service](configure-network-connections-windows-defender-antivirus.md)
\-SignatureUpdate [-UNC [-Path ]] | Checks for new definition updates
-
-
-
## Related topics
- [Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md)
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
-
-
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md
index 09fefe72e5..c11220d5fc 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md
@@ -1,5 +1,5 @@
---
-title: Manage Windows Defender AV in your business
+title: Manage Windows Defender in your business
description: Learn how to use Group Policy, Configuration Manager, PowerShell, WMI, Intune, and the comman line to manage Windows Defender AV
keywords: group policy, gpo, config manager, sccm, scep, powershell, wmi, intune, defender, antivirus, antimalware, security, protection
search.product: eADQiWindows 10XVcnh
@@ -11,36 +11,32 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 03/01/2018
+ms.date: 09/03/2018
---
-# Manage Windows Defender AV in your business
+# Manage Windows Defender Antivirus in your business
**Applies to:**
-- Windows 10
-
-**Audience**
-
-- Enterprise security administrators
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
You can manage and configure Windows Defender Antivirus with the following tools:
+- Microsoft Intune
+- System Center Configuration Manager
- Group Policy
-- System Center Configuration Manager and Microsoft Intune
- PowerShell cmdlets
- Windows Management Instruction (WMI)
- The mpcmdrun.exe utility
-The topics in this section provide further information, links, and resources for using these tools in conjunction with Windows Defender AV.
+The topics in this section provide further information, links, and resources for using these tools to manage and configure Windows Defender Antivirus.
## In this section
-Topic | Description
+Topic | Description
---|---
-[Use Group Policy settings to configure and manage Windows Defender AV](use-group-policy-windows-defender-antivirus.md)|List of all Group Policy settings located in the Windows 10, version 1703 ADMX templates
-[Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](use-intune-config-manager-windows-defender-antivirus.md)|Information on using System Center Configuration Manager and Microsoft Intune to deploy, manage, report, and configure Windows Defender AV
-[Use PowerShell cmdlets to configure and manage Windows Defender AV](use-powershell-cmdlets-windows-defender-antivirus.md)|Instructions on using PowerShell cmdlets in the Defender Module and links to documentation for all cmdlets and allowed parameters
-[Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](use-wmi-windows-defender-antivirus.md)| Instructions on using WMI to manage Windows Defender AV and links to documentation for the Windows Defender WMIv2 APIs (including all classes, methods, and properties)
-[Use the mpcmdrun.exe command-line tool to configure and manage Windows Defender Antivirus](command-line-arguments-windows-defender-antivirus.md)|Instructions on using the dedicated command-line tool to manage and use Windows Defender AV
-
+[Manage Windows Defender Antivirus with Microsoft Intune and System Center Configuration Manager](use-intune-config-manager-windows-defender-antivirus.md)|Information about using Intune and System Center Configuration Manager to deploy, manage, report, and configure Windows Defender Antivirus
+[Manage Windows Defender Antivirus with Group Policy settings](use-group-policy-windows-defender-antivirus.md)|List of all Group Policy settings located in ADMX templates
+[Manage Windows Defender Antivirus with PowerShell cmdlets](use-powershell-cmdlets-windows-defender-antivirus.md)|Instructions for using PowerShell cmdlets to manage Windows Defender Antivirus, plus links to documentation for all cmdlets and allowed parameters
+[Manage Windows Defender Antivirus with Windows Management Instrumentation (WMI)](use-wmi-windows-defender-antivirus.md)| Instructions for using WMI to manage Windows Defender Antivirus, plus links to documentation for the WMIv2 APIs (including all classes, methods, and properties)
+[Manage Windows Defender Antivirus with the mpcmdrun.exe command-line tool](command-line-arguments-windows-defender-antivirus.md)|Instructions on using the dedicated command-line tool to manage and use Windows Defender Antivirus
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md
index 77cc805406..673fc41138 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md
@@ -11,42 +11,37 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/10/2018
+ms.date: 09/03/2018
---
-# Configure scanning options in Windows Defender AV
+# Configure Windows Defender Antivirus scanning options
+**Applies to:**
-**Applies to**
-- Windows 10
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
+**Use Microsoft Intune to configure scanning options**
-- Enterprise security administrators
+See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details.
-**Manageability available with**
+
-- Group Policy
-- PowerShell
-- Windows Management Instrumentation (WMI)
-- System Center Configuration Manager
-- Microsoft Intune
+**Use Configuration Manager to configure scanning options:**
+See [How to create and deploy antimalware policies: Scan settings]( https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#scan-settings) for details on configuring System Center Configuration Manager (current branch).
+
+**Use Group Policy to configure scanning options**
To configure the Group Policy settings described in the following table:
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below.
+3. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below.
-6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings.
-
-See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
-
-For using WMI classes, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx).
+4. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings.
Description | Location and setting | Default setting (if not configured) | PowerShell `Set-MpPreference` parameter or WMI property for `MSFT_MpPreference` class
---|---|---|---
@@ -61,24 +56,22 @@ Specify the level of subfolders within an archive folder to scan | Scan > Specif
Specify the maximum CPU load (as a percentage) during a scan. Note: This is not a hard limit but rather a guidance for the scanning engine to not exceed this maximum on average. | Scan > Specify the maximum percentage of CPU utilization during a scan | 50 | `-ScanAvgCPULoadFactor`
Specify the maximum size (in kilobytes) of archive files that should be scanned. The default, **0**, applies no limit | Scan > Specify the maximum size of archive files to be scanned | No limit | Not available
-**Use Configuration Manager to configure scanning options:**
+**Use PowerShell to configure scanning options**
-See [How to create and deploy antimalware policies: Scan settings]( https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#scan-settings) for details on configuring System Center Configuration Manager (current branch).
+See [Manage Windows Defender Antivirus with PowerShell cmdlets](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
+**Use WMI to configure scanning options**
-**Use Microsoft Intune to configure scanning options**
+For using WMI classes, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx).
-See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details.
-
-
-
-
### Email scanning limitations
+
We recommend using [always-on real-time protection](configure-real-time-protection-windows-defender-antivirus.md) to protect against email-based malware.
Always-on protection scans emails as they arrive and as they are manipulated, just like normal files in the operating system. This provides the strongest form of protection and is the recommended setting for scanning emails.
-You can use this Group Policy to also enable scanning of older email files used by Outlook 2003 and older during on-demand and scheduled scans. Embedded objects within an email file (such as attachments and archived files) are also scanned. The following file format types can be scanned and remediated:
+You can also use this Group Policy to enable scanning of older email files used by Outlook 2003 and older during on-demand and scheduled scans. Embedded objects within an email file (such as attachments and archived files) are also scanned. The following file format types can be scanned and remediated:
+
- DBX
- MBX
- MIME
@@ -86,17 +79,19 @@ You can use this Group Policy to also enable scanning of older email files used
PST files used by Outlook 2003 or older (where the archive type is set to non-unicode) can also be scanned, but Windows Defender cannot remediate threats detected inside PST files. This is another reason why we recommend using [always-on real-time protection](configure-real-time-protection-windows-defender-antivirus.md) to protect against email-based malware.
If Windows Defender Antivirus detects a threat inside an email, it will show you the following information to assist you in identifying the compromised email, so you can remediate the threat:
-- Email subject
-- Attachment name
+
+- Email subject
+- Attachment name
>[!WARNING]
>There are some risks associated with scanning some Microsoft Outlook files and email messages. You can read about tips and risks associated with scanning Outlook files and email messages in the following articles:
-- [Scanning Outlook files in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-1)
-- [Scanning email messages in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-2)
+>
+> - [Scanning Outlook files in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-1)
+> - [Scanning email messages in Outlook 2013](https://technet.microsoft.com/library/dn769141.aspx#bkmk-2)
## Related topics
-- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
-- [Configure and run on-demand Windows Defender AV scans](run-scan-windows-defender-antivirus.md)
-- [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md)
+- [Customize, initiate, and review the results of Windows Defender Antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
+- [Configure and run on-demand Windows Defender Antivirus scans](run-scan-windows-defender-antivirus.md)
+- [Configure scheduled Windows Defender Antivirus scans](scheduled-catch-up-scans-windows-defender-antivirus.md)
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md
index d5bdf282dc..728e03873e 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md
@@ -11,27 +11,16 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/02/2018
+ms.date: 09/03/2018
---
-# Enable the Block at First Sight feature
+# Enable block at first sight
-**Applies to**
+**Applies to:**
-- Windows 10, version 1703 and later
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Enterprise security administrators
-
-**Manageability available with**
-
-- Intune
-- Group Policy
-- Windows Defender Security Center app
-
-
-Block at first sight is a feature of Windows Defender Antivirus cloud-delivered protection that provides a way to detect and block new malware within seconds.
+Block at first sight is a feature of next gen protection that provides a way to detect and block new malware within seconds.
It is enabled by default when certain pre-requisite settings are also enabled. In most cases, these pre-requisite settings are also enabled by default, so the feature is running without any intervention. You can use group policy settings to confirm the feature is enabled.
@@ -40,128 +29,117 @@ You can [specify how long the file should be prevented from running](configure-c
You can also [customize the message displayed on users' desktops](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information) when a file is blocked. You can change the company name, contact information, and message URL.
> [!IMPORTANT]
-> There is no specific individual setting in System Center Configuration Manager to enable or disable Block at First Sight. It is enabled by default when the pre-requisite settings are configured correctly. You must use Group Policy settings to enable or disable the feature.
-
+> There is no specific individual setting in System Center Configuration Manager to enable or disable block at first sight. It is enabled by default when the pre-requisite settings are configured correctly. You must use Group Policy settings to enable or disable the feature.
>[!TIP]
->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work.
-
+>You can also visit the Windows Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work.
## How it works
-When a Windows Defender Antivirus client encounters a suspicious but undetected file, it queries our cloud protection backend. The cloud backend will apply heuristics, machine learning, and automated analysis of the file to determine the files as malicious or clean.
+When Windows Defender Antivirus encounters a suspicious but undetected file, it queries our cloud protection backend. The cloud backend applies heuristics, machine learning, and automated analysis of the file to determine whether the files are malicious or clean.
-In Windows 10, version 1803, the Block at First Sight feature can now block non-portable executable files (such as JS, VBS, or macros) as well as executable files.
+In Windows 10, version 1803, block at first sight can now block non-portable executable files (such as JS, VBS, or macros) as well as executable files.
-The Block at First Sight feature only uses the cloud protection backend for executable files and non-portable executable files that are downloaded from the Internet, or originating from the Internet zone. A hash value of the .exe file is checked via the cloud backend to determine if this is a previously undetected file.
+Block at first sight only uses the cloud protection backend for executable files and non-portable executable files that are downloaded from the Internet, or that originate from the Internet zone. A hash value of the .exe file is checked via the cloud backend to determine if this is a previously undetected file.
-If the cloud backend is unable to make a determination, the file will be locked by Windows Defender AV while a copy is uploaded to the cloud. The cloud will perform additional analysis to reach a determination before it allows the file to run or blocks it in all future encounters, depending on whether the file is determined to be malicious or safe.
+If the cloud backend is unable to make a determination, Windows Defender Antivirus locks the file and uploads a copy to the cloud. The cloud performs additional analysis to reach a determination before it either allows the file to run or blocks it in all future encounters, depending on whether it determines the file to be malicious or safe.
-In many cases this process can reduce the response time for new malware from hours to seconds.
+In many cases, this process can reduce the response time for new malware from hours to seconds.
+## Confirm and validate that block at first sight is enabled
-## Confirm and validate Block at First Sight is enabled
+Block at first sight requires a number of Group Policy settings to be configured correctly or it will not work. These settings are enabled by default in most enterprise Windows Defender Antivirus deployments.
-Block at First Sight requires a number of Group Policy settings to be configured correctly or it will not work. Usually, these settings are already enabled in most default Windows Defender AV deployments in enterprise networks.
-
-### Confirm Block at First Sight is enabled with Intune
+### Confirm block at first sight is enabled with Intune
1. In Intune, navigate to **Device configuration - Profiles > *Profile name* > Device restrictions > Windows Defender Antivirus**.
- > [!NOTE]
- > The profile you select must be a Device Restriction profile type, not an Endpoint Protection profile type.
+> [!NOTE]
+> The profile you select must be a Device Restriction profile type, not an Endpoint Protection profile type.
2. Verify these settings are configured as follows:
- - **Cloud-delivered protection**: **Enable**
- - **File Blocking Level**: **High**
- - **Time extension for file scanning by the cloud**: **50**
- - **Prompt users before sample submission**: **Send all data without prompting**
+ - **Cloud-delivered protection**: **Enable**
+ - **File Blocking Level**: **High**
+ - **Time extension for file scanning by the cloud**: **50**
+ - **Prompt users before sample submission**: **Send all data without prompting**
-For more information about configuring Windows Defender AV device restrictions in Intune, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure).
+For more information about configuring Windows Defender Antivirus device restrictions in Intune, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure).
-For a list of Windows Defender AV device restrictions in Intune, see [Device restriction for Windows 10 (and newer) settings in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus).
+For a list of Windows Defender Antivirus device restrictions in Intune, see [Device restriction for Windows 10 (and newer) settings in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus).
+### Confirm block at first sight is enabled with Group Policy
-### Confirm Block at First Sight is enabled with Group Policy
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+3. Expand the tree to **Windows components > Windows Defender Antivirus > MAPS** and configure the following Group Policies:
-5. Expand the tree to **Windows components > Windows Defender Antivirus > MAPS** and configure the following Group Policies:
-
- 1. Double-click the **Join Microsoft MAPS** setting and ensure the option is set to **Enabled**. Click **OK**.
-
- 1. Double-click the **Send file samples when further analysis is required** setting and ensure the option is set to **Enabled** and the additional options are either of the following:
-
- 1. Send safe samples (1)
-
- 1. Send all samples (3)
+ 1. Double-click **Join Microsoft MAPS** and ensure the option is set to **Enabled**. Click **OK**.
+
+ 2. Double-click **Send file samples when further analysis is required** and ensure the option is set to **Enabled** and the additional options are either of the following:
+
+ - Send safe samples (1)
+ - Send all samples (3)
> [!WARNING]
- > Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the "Block at First Sight" feature will not function.
+ > Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means block at first sight will not function.
- 1. Click **OK**.
+ 3. Click **OK**.
-1. In the **Group Policy Management Editor**, expand the tree to **Windows components > Windows Defender Antivirus > Real-time Protection**:
-
- 1. Double-click the **Scan all downloaded files and attachments** setting and ensure the option is set to **Enabled**. Click **OK**.
-
- 1. Double-click the **Turn off real-time protection** setting and ensure the option is set to **Disabled**. Click **OK**.
+4. In the **Group Policy Management Editor**, expand the tree to **Windows components > Windows Defender Antivirus > Real-time Protection**:
+
+ 1. Double-click **Scan all downloaded files and attachments** and ensure the option is set to **Enabled**. Click **OK**.
+
+ 2. Double-click **Turn off real-time protection** and ensure the option is set to **Disabled**. Click **OK**.
If you had to change any of the settings, you should re-deploy the Group Policy Object across your network to ensure all endpoints are covered.
+### Confirm block at first sight is enabled with the Windows Defender Security Center app
-### Confirm Block at First Sight is enabled with the Windows Defender Security Center app
+You can confirm that block at first sight is enabled in Windows Settings.
-You can confirm that Block at First Sight is enabled in Windows Settings.
-
-The feature is automatically enabled as long as **Cloud-based protection** and **Automatic sample submission** are both turned on.
+Block at first sight is automatically enabled as long as **Cloud-based protection** and **Automatic sample submission** are both turned on.
**Confirm Block at First Sight is enabled on individual clients**
-1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
+1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar.
-2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label:
+2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then click **Virus & threat protection settings**:
-
-3. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**.
+
+3. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**.
> [!NOTE]
> If the pre-requisite settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings.
+### Validate block at first sight is working
-### Validate Block at First Sight is working
+You can validate that the feature is working by following the steps outlined in [Validate connections between your network and the cloud](configure-network-connections-windows-defender-antivirus.md#validate).
-You can validate that the feature is working by following the steps outlined in the [Validate connections between your network and the cloud](configure-network-connections-windows-defender-antivirus.md#validate) topic.
-
-
-## Disable Block at First Sight
+## Disable block at first sight
> [!WARNING]
-> Disabling the Block at First Sight feature will lower the protection state of the endpoint and your network.
+> Disabling block at first sight will lower the protection state of the endpoint and your network.
-You may choose to disable the Block at First Sight feature if you want to retain the pre-requisite settings without using Block at First Sight protection. You might wish to do this if you are experiencing latency issues or you want to test the feature's impact on your network.
+You may choose to disable block at first sight if you want to retain the pre-requisite settings without using block at first sight protection. You might wish to do this if you are experiencing latency issues or you want to test the feature's impact on your network.
-**Disable Block at First Sight with Group Policy**
+**Disable block at first sight with Group Policy**
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-5. Expand the tree through **Windows components > Windows Defender Antivirus > MAPS**.
+3. Expand the tree through **Windows components > Windows Defender Antivirus > MAPS**.
-1. Double-click the **Configure the 'Block at First Sight' feature** setting and set the option to **Disabled**.
+4. Double-click **Configure the 'Block at First Sight' feature** and set the option to **Disabled**.
> [!NOTE]
- > Disabling the Block at First Sight feature will not disable or alter the pre-requisite group policies.
-
+ > Disabling block at first sight will not disable or alter the pre-requisite group policies.
## Related topics
-- [Windows Defender in Windows 10](windows-defender-antivirus-in-windows-10.md)
+- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
- [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md)
-
-
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md
index 247e68bc23..c4712bd823 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md
@@ -11,64 +11,40 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
# Configure the cloud block timeout period
-
-
**Applies to:**
-- Windows 10, version 1703 and later
-
-**Audience**
-
-- Enterprise security administrators
-
-**Manageability available with**
-
-- Group Policy
-
-
-
-
-
-
-When Windows Defender Antivirus is suspicious of a file, it can prevent the file from running while it queries the [Windows Defender Antivirus cloud-protection service](utilize-microsoft-cloud-protection-windows-defender-antivirus.md).
-
-The default period that the file will be [blocked](configure-block-at-first-sight-windows-defender-antivirus.md) for is 10 seconds. You can specify an additional period of time to wait before the file is allowed to run. This can help ensure there is enough time to receive a proper determination from the Windows Defender Antivirus cloud.
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+When Windows Defender Antivirus finds a suspicious file, it can prevent the file from running while it queries the [Windows Defender Antivirus cloud service](utilize-microsoft-cloud-protection-windows-defender-antivirus.md).
+The default period that the file will be [blocked](configure-block-at-first-sight-windows-defender-antivirus.md) is 10 seconds. You can specify an additional period of time to wait before the file is allowed to run. This can help ensure there is enough time to receive a proper determination from the Windows Defender Antivirus cloud service.
## Prerequisites to use the extended cloud block timeout
-The [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature and its prerequisites must be enabled before you can specify an extended timeout period.
-
+[Block at first sight](configure-block-at-first-sight-windows-defender-antivirus.md) and its prerequisites must be enabled before you can specify an extended timeout period.
+
## Specify the extended timeout period
You can use Group Policy to specify an extended timeout for cloud checks.
-**Use Group Policy to specify an extended timeout period:**
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+3. Expand the tree to **Windows components > Windows Defender Antivirus > MpEngine**
-4. Expand the tree to **Windows components > Windows Defender Antivirus > MpEngine**
-
-5. Double-click the **Configure extended cloud check** setting and ensure the option is enabled. Specify the additional amount of time to prevent the file from running while waiting for a cloud determination. You can specify the additional time, in seconds, from 1 second to 50 seconds. This time will be added to the default 10 seconds.
-
-6. Click **OK**.
+4. Double-click **Configure extended cloud check** and ensure the option is enabled. Specify the additional amount of time to prevent the file from running while waiting for a cloud determination. You can specify the additional time, in seconds, from 1 second to 50 seconds. This time will be added to the default 10 seconds.
+5. Click **OK**.
## Related topics
-- [Windows Defender in Windows 10](windows-defender-antivirus-in-windows-10.md)
-- [Utilize Microsoft cloud-delivered protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md)
-- [Configure the Block at First Sight feature](configure-block-at-first-sight-windows-defender-antivirus.md)
+- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
+- [Use next-gen antivirus technologies through cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md)
+- [Configure block at first sight](configure-block-at-first-sight-windows-defender-antivirus.md)
- [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md)
-
-
-
-
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md
index 8ff899a974..a4e4d1798a 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md
@@ -11,31 +11,23 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 08/26/2017
+ms.date: 09/03/2018
---
# Configure end-user interaction with Windows Defender Antivirus
**Applies to:**
-- Windows 10
-
-**Audience**
-
-- Enterprise security administrators
-
-**Manageability available with**
-
-- Group Policy
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
You can configure how users of the endpoints on your network can interact with Windows Defender Antivirus.
-This includes whether they see the Windows Defender AV interface, what notifications they see, and if they can locally override globally deployed Group Policy settings.
+This includes whether they see the Windows Defender Antivirus interface, what notifications they see, and if they can locally override globally-deployed Group Policy settings.
## In this section
Topic | Description
---|---
-[Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md) | Configure and customize additional notifications, customized text for notifications, and notifications about reboots for remediation
-[Prevent users from seeing or interacting with the Windows Defender AV user interface](prevent-end-user-interaction-windows-defender-antivirus.md) | Hide the user interface from users
+[Configure notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md) | Configure and customize additional notifications, customized text for notifications, and notifications about reboots for remediation
+[Prevent users from seeing or interacting with the Windows Defender Antivirus user interface](prevent-end-user-interaction-windows-defender-antivirus.md) | Hide the user interface from users
[Prevent users from locally modifying policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) | Prevent (or allow) users from overriding policy settings on their individual endpoints
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md
index ce689900bf..05da87967e 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md
@@ -11,47 +11,30 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/27/2017
+ms.date: 09/03/2018
---
-# Configure and validate exclusions for Windows Defender AV scans (client)
-
+# Configure and validate exclusions for Windows Defender Antivirus scans
**Applies to:**
-- Windows 10
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Group Policy
-- PowerShell
-- Windows Management Instrumentation (WMI)
-- System Center Configuration Manager
-- Microsoft Intune
-- Windows Defender Security Center
-
-You can exclude certain files, folders, processes, and process-opened files from being scanned by Windows Defender Antivirus.
+You can exclude certain files, folders, processes, and process-opened files from Windows Defender Antivirus scans.
The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). Exclusions for process-opened files only apply to real-time protection.
Exclusions can be useful to avoid incorrect detections on files or software that are unique or customized to your organization.
-Windows Server 2016 also features automatic exclusions that are defined by the server roles you enable. See the [Windows Defender AV exclusions on Windows Server 2016](configure-server-exclusions-windows-defender-antivirus.md) topic for more information and a list of the automatic exclusions.
+Windows Server 2016 also features automatic exclusions that are defined by the server roles you enable. See the [Windows Defender Antivirus exclusions on Windows Server 2016](configure-server-exclusions-windows-defender-antivirus.md) topic for more information and a list of the automatic exclusions.
>[!WARNING]
->Defining exclusions lowers the protection offered by Windows Defender AV. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious.
+>Defining exclusions lowers the protection offered by Windows Defender Antivirus. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious.
## In this section
Topic | Description
---|---
-[Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) | Exclude files from Windows Defender AV scans based on their file extension, file name, or location
-[Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) | You can exclude files from scans that have been opened by a specific process
-[Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) | Windows Server 2016 includes automatic exclusions, based on the defined Server Role. You can also add custom exclusions
-
+[Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) | Exclude files from Windows Defender Antivirus scans based on their file extension, file name, or location
+[Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) | Exclude files from scans that have been opened by a specific process
+[Configure Windows Defender Antivirus exclusions on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) | Windows Server 2016 includes automatic exclusions, based on the defined server role. You can also add custom exclusions.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md
index 9381eb05f6..4c95157a94 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md
@@ -1,6 +1,6 @@
---
title: Configure and validate exclusions based on extension, name, or location
-description: Exclude files from Windows Defender AV scans based on their file extension, file name, or location.
+description: Exclude files from Windows Defender Antivirus scans based on their file extension, file name, or location.
keywords: exclusions, files, extension, file type, folder name, file name, scans
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
@@ -11,34 +11,18 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/10/2018
+ms.date: 09/03/2018
---
# Configure and validate exclusions based on file extension and folder location
-
**Applies to:**
-- Windows 10
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
+You can exclude certain files from Windows Defender Antivirus scans by modifying exclusion lists.
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Group Policy
-- PowerShell
-- Windows Management Instrumentation (WMI)
-- System Center Configuration Manager
-- Microsoft Intune
-- Windows Defender Security Center
-
-You can exclude certain files from being scanned by Windows Defender AV by modifying exclusion lists.
-
-Generally, you shouldn't need to apply exclusions. Windows Defender AV includes a number of automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.
+Generally, you shouldn't need to apply exclusions. Windows Defender Antivirus includes a number of automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations.
>[!TIP]
>The default antimalware policy we deploy at Microsoft doesn't set any exclusions by default.
@@ -53,6 +37,7 @@ A specific file in a specific folder | The file c:\sample\sample.test only | Fil
A specific process | The executable file c:\test\process.exe | File and folder exclusions
This means the exclusion lists have the following characteristics:
+
- Folder exclusions will apply to all files and folders under that folder, unless the subfolder is a reparse point. Reparse point subfolders must be excluded separately.
- File extensions will apply to any file name with the defined extension if a path or folder is not defined.
@@ -61,70 +46,64 @@ This means the exclusion lists have the following characteristics:
>
>You cannot exclude mapped network drives. You must specify the actual network path.
>
->Folders that are reparse points that are created after the Windows Defender AV service starts and that have been added to the exclusion list will not be included. You must restart the service (by restarting Windows) for new reparse points to be recognized as a valid exclusion target.
-
-
-
-
-To exclude files opened by a specific process, see the [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) topic.
+>Folders that are reparse points that are created after the Windows Defender Antivirus service starts and that have been added to the exclusion list will not be included. You must restart the service (by restarting Windows) for new reparse points to be recognized as a valid exclusion target.
+To exclude files opened by a specific process, see [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md).
The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [real-time protection](configure-real-time-protection-windows-defender-antivirus.md).
>[!IMPORTANT]
->Changes made via Group Policy to the exclusion lists **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions).
+>Exclusion list changes made with Group Policy **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions).
>
>Changes made in the Windows Defender Security Center app **will not show** in the Group Policy lists.
-
-
-By default, local changes made to the lists (by users with administrator privileges; this includes changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists will take precedence in the case of conflicts.
+By default, local changes made to the lists (by users with administrator privileges, including changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists will take precedence in case of conflicts.
You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-windows-defender-antivirus.md#merge-lists) to allow local changes to override managed deployment settings.
-
-
-
-
-
## Configure the list of exclusions based on folder name or file extension
-
+**Use Intune to configure file name, folder, or file extension exclusions:**
+
+See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details.
+
+**Use Configuration Manager to configure file name, folder, or file extension exclusions:**
+
+See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch).
+
**Use Group Policy to configure folder or file extension exclusions:**
>[!NOTE]
->If you specify a fully qualified path to a file, then only that file will be excluded. If a folder is defined in the exclusion, then all files and subdirectories under that folder will be excluded.
+>If you specify a fully qualified path to a file, then only that file is excluded. If a folder is defined in the exclusion, then all files and subdirectories under that folder are excluded.
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**.
+3. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**.
-
-6. Double-click the **Path Exclusions** setting and add the exclusions:
+4. Double-click the **Path Exclusions** setting and add the exclusions:
1. Set the option to **Enabled**.
- 2. Under the **Options** section, click **Show...**
+ 2. Under the **Options** section, click **Show...**.
3. Enter each folder on its own line under the **Value name** column. If you are entering a file, ensure you enter a fully qualified path to the file, including the drive letter, folder path, filename, and extension. Enter **0** in the **Value** column.
-7. Click **OK**.
+5. Click **OK**.
-
+ 
-8. Double-click the **Extension Exclusions** setting and add the exclusions:
+6. Double-click the **Extension Exclusions** setting and add the exclusions:
- 1. Set the option to **Enabled**.
- 2. Under the **Options** section, click **Show...**
+ 1. Set the option to **Enabled**.
+ 2. Under the **Options** section, click **Show...**.
3. Enter each file extension on its own line under the **Value name** column. Enter **0** in the **Value** column.
+7. Click **OK**.
-9. Click **OK**.
-
-
-
+ 
+
**Use PowerShell cmdlets to configure file name, folder, or file extension exclusions:**
Using PowerShell to add or remove exclusions for files based on the extension, location, or file name requires using a combination of three cmdlets and the appropriate exclusion list parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/defender).
@@ -139,9 +118,9 @@ The following are allowed as the \:
Configuration action | PowerShell cmdlet
---|---
-Create or overwrite the list | `Set-MpPreference`
-Add to the list | `Add-MpPreference`
-Remove item from the list | `Remove-MpPreference`
+Create or overwrite the list | `Set-MpPreference`
+Add to the list | `Add-MpPreference`
+Remove item from the list | `Remove-MpPreference`
The following are allowed as the \:
@@ -150,10 +129,8 @@ Exclusion type | PowerShell parameter
All files with a specified file extension | `-ExclusionExtension`
All files under a folder (including files in subdirectories), or a specific file | `-ExclusionPath`
-
>[!IMPORTANT]
->If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list.
-
+>If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list.
For example, the following code snippet would cause Windows Defender AV scans to exclude any file with the **.test** file extension:
@@ -163,7 +140,6 @@ Add-MpPreference -ExclusionExtension ".test"
See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
-
**Use Windows Management Instruction (WMI) to configure file name, folder, or file extension exclusions:**
Use the [ **Set**, **Add**, and **Remove** methods of the **MSFT_MpPreference**](https://msdn.microsoft.com/en-us/library/dn455323(v=vs.85).aspx) class for the following properties:
@@ -176,25 +152,15 @@ ExclusionPath
The use of **Set**, **Add**, and **Remove** is analogous to their counterparts in PowerShell: `Set-MpPreference`, `Add-MpPreference`, and `Remove-MpPreference`.
See the following for more information and allowed parameters:
+
- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx)
-**Use Configuration Manager to configure file name, folder, or file extension exclusions:**
-
-See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch).
-
-
-**Use Microsoft Intune to configure file name, folder, or file extension exclusions:**
-
-See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details.
-
**Use the Windows Defender Security Center app to configure file name, folder, or file extension exclusions:**
See [Add exclusions in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions) for instructions.
-
-
## Use wildcards in the file name and folder path or extension exclusion lists
@@ -205,8 +171,7 @@ You can use the asterisk `*`, question mark `?`, or environment variables (such
>
>- Environment variable usage is limited to machine variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account.
>- You cannot use a wildcard in place of a drive letter.
->- The use of asterisk `*` in a folder exclusion will stand in place for a single folder. Use multiple instances of `\*\` to indicate multiple nested folders with unspecified names.
-
+>- An asterisk `*` in a folder exclusion will stand in place for a single folder. Use multiple instances of `\*\` to indicate multiple nested folders with unspecified names.
The following table describes how the wildcards can be used and provides some examples.
@@ -231,7 +196,7 @@ The following table describes how the wildcards can be used and provides some ex
C:\MyData\\notes.txt
-
Any file in:
+
Any file in:
C:\somepath\\Archives\Data and its subfolders
C:\somepath\\Authorized\Data and its subfolders
@@ -246,7 +211,7 @@ The following table describes how the wildcards can be used and provides some ex
- ? (question mark)
+ ? (question mark)
Replaces a single character.
@@ -295,23 +260,23 @@ The following table describes how the wildcards can be used and provides some ex
>
>This argument, however, will not match any files in **subfolders** under *c:\data\final\marked* or *c:\data\review\marked*.
-
+
## Review the list of exclusions
-You can retrieve the items in the exclusion list with PowerShell, [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), [Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune), or the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions).
+You can retrieve the items in the exclusion list with [Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune), [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), PowerShell, or the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions).
>[!IMPORTANT]
->Changes made via Group Policy to the exclusion lists **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions).
+>Exclusion list changes made with Group Policy **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions).
>
>Changes made in the Windows Defender Security Center app **will not show** in the Group Policy lists.
If you use PowerShell, you can retrieve the list in two ways:
-- Retrieve the status of all Windows Defender AV preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line.
+- Retrieve the status of all Windows Defender Antivirus preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line.
- Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line.
-**Review the list of exclusions alongside all other Windows Defender AV preferences:**
+**Review the list of exclusions alongside all other Windows Defender Antivirus preferences:**
Use the following cmdlet:
@@ -320,13 +285,11 @@ Get-MpPreference
```
In the following example, the items contained in the `ExclusionExtension` list are highlighted:
-
See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
-
**Retrieve a specific exclusions list:**
Use the following code snippet (enter each line as a separate command); replace **WDAVprefs** with whatever label you want to name the variable:
@@ -341,14 +304,10 @@ In the following example, the list is split into new lines for each use of the `
-
See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
-
-
-
-
+
## Validate exclusions lists with the EICAR test file
You can validate that your exclusion lists are working by using PowerShell with either the `Invoke-WebRequest` cmdlet or the .NET WebClient class to download a test file.
@@ -359,11 +318,11 @@ In the following PowerShell snippet, replace *test.txt* with a file that conform
Invoke-WebRequest "http://www.eicar.org/download/eicar.com.txt" -OutFile "test.txt"
```
-If Windows Defender AV reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR testfile website](http://www.eicar.org/86-0-Intended-use.html).
+If Windows Defender Antivirus reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR testfile website](http://www.eicar.org/86-0-Intended-use.html).
You can also use the following PowerShell code, which calls the .NET WebClient class to download the testfile - as with the `Invoke-WebRequest` cmdlet; replace *c:\test.txt* with a file that conforms to the rule you are validating:
-```PowerShell
+```PowerShell
$client = new-object System.Net.WebClient
$client.DownloadFile("http://www.eicar.org/download/eicar.com.txt","c:\test.txt")
```
@@ -376,12 +335,10 @@ If you do not have Internet access, you can create your own EICAR test file by w
You can also copy the string into a blank text file and attempt to save it with the file name or in the folder you are attempting to exclude.
-
-
## Related topics
-- [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md)
+- [Configure and validate exclusions in Windows Defender Antivirus scans](configure-exclusions-windows-defender-antivirus.md)
- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md)
-- [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md)
-- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
+- [Configure Windows Defender Antivirus exclusions on Windows Server](configure-server-exclusions-windows-defender-antivirus.md)
+- [Customize, initiate, and review the results of Windows Defender Antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md
index 55f4c3f930..013ef4ec60 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md
@@ -11,29 +11,20 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
-# Prevent or allow users to locally modify Windows Defender AV policy settings
+# Prevent or allow users to locally modify Windows Defender Antivirus policy settings
**Applies to:**
-- Windows 10
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Enterprise security administrators
-
-**Manageability available with**
-
-- Group Policy
-
-
-By default, Windows Defender AV settings that are deployed via a Group Policy Object to the endpoints in your network will prevent users from locally changing the settings. You can change this in some instances.
+By default, Windows Defender Antivirus settings that are deployed via a Group Policy Object to the endpoints in your network will prevent users from locally changing the settings. You can change this in some instances.
For example, it may be necessary to allow certain user groups (such as security researchers and threat investigators) further control over individual settings on the endpoints they use.
-## Configure local overrides for Windows Defender AV settings
+## Configure local overrides for Windows Defender Antivirus settings
The default setting for these policies is **Disabled**.
@@ -43,25 +34,25 @@ The following table lists each of the override policy setting and the configurat
To configure these settings:
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below.
+3. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below.
-6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings.
+4. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings.
-7. Deploy the Group Policy Object as usual.
+5. Deploy the Group Policy Object as usual.
Location | Setting | Configuration topic
---|---|---|---
MAPS | Configure local setting override for reporting to Microsoft MAPS | [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md)
Quarantine | Configure local setting override for the removal of items from Quarantine folder | [Configure remediation for scans](configure-remediation-windows-defender-antivirus.md)
-Real-time protection | Configure local setting override for monitoring file and program activity on your computer | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
-Real-time protection | Configure local setting override for monitoring for incoming and outgoing file activity | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
-Real-time protection | Configure local setting override for scanning all downloaded files and attachments | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
-Real-time protection | Configure local setting override for turn on behavior monitoring | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
-Real-time protection | Configure local setting override to turn on real-time protection | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
+Real-time protection | Configure local setting override for monitoring file and program activity on your computer | [Enable and configure Windows Defender Antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
+Real-time protection | Configure local setting override for monitoring for incoming and outgoing file activity | [Enable and configure Windows Defender Antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
+Real-time protection | Configure local setting override for scanning all downloaded files and attachments | [Enable and configure Windows Defender Antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
+Real-time protection | Configure local setting override for turn on behavior monitoring | [Enable and configure Windows Defender Antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
+Real-time protection | Configure local setting override to turn on real-time protection | [Enable and configure Windows Defender Antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
Remediation | Configure local setting override for the time of day to run a scheduled full scan to complete remediation | [Configure remediation for scans](configure-remediation-windows-defender-antivirus.md)
Scan | Configure local setting override for maximum percentage of CPU utilization | [Configure and run scans](run-scan-windows-defender-antivirus.md)
Scan | Configure local setting override for schedule scan day | [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md)
@@ -69,35 +60,30 @@ Scan | Configure local setting override for scheduled quick scan time | [Configu
Scan | Configure local setting override for scheduled scan time | [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md)
Scan | Configure local setting override for the scan type to use for a scheduled scan | [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md)
-
-
-
-
+
## Configure how locally and globally defined threat remediation and exclusions lists are merged
You can also configure how locally defined lists are combined or merged with globally defined lists. This setting applies to [exclusion lists](configure-exclusions-windows-defender-antivirus.md) and [specified remediation lists](configure-remediation-windows-defender-antivirus.md).
-By default, lists that have been configured in local group policy and the Windows Defender Security Center app are merged with lists that are defined by the appropriate GPO that you have deployed on your network. Where there are conflicts, the globally defined list takes precedence.
-
-You can disable this setting to ensure that only globally defined lists (such as those from any deployed GPOs) are used.
+By default, lists that have been configured in local group policy and the Windows Defender Security Center app are merged with lists that are defined by the appropriate Group Policy Object that you have deployed on your network. Where there are conflicts, the globally-defined list takes precedence.
+You can disable this setting to ensure that only globally-defined lists (such as those from any deployed GPOs) are used.
**Use Group Policy to disable local list merging:**
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus**.
+3. Expand the tree to **Windows components > Windows Defender Antivirus**.
-6. Double-click the **Configure local administrator merge behavior for lists** setting and set the option to **Enabled**. Click **OK**.
+4. Double-click **Configure local administrator merge behavior for lists** and set the option to **Enabled**. Click **OK**.
> [!NOTE]
-> If you disable local list merging, it will override Controlled folder access settings in Windows Defender Exploit Guard. It also overrides any protected folders or allowed apps set by the local administrator. For more information about Controlled folder access settings, see [Enable Controlled folder access](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard).
-
+> If you disable local list merging, it will override controlled folder access settings. It also overrides any protected folders or allowed apps set by the local administrator. For more information about controlled folder access settings, see [Enable controlled folder access](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard).
## Related topics
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
-- [Configure end-user interaction with Windows Defender AV](configure-end-user-interaction-windows-defender-antivirus.md)
\ No newline at end of file
+- [Configure end-user interaction with Windows Defender Antivirus](configure-end-user-interaction-windows-defender-antivirus.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md
index b4751e5cad..69728c47d8 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md
@@ -1,7 +1,7 @@
---
-title: Configure and test Windows Defender Antivirus network connections
-description: Configure and test your connection to the Windows Defender Antivirus cloud-delivered protection service.
-keywords: windows defender antivirus, antimalware, security, defender, cloud, aggressiveness, protection level
+title: Configure and validate Windows Defender Antivirus network connections
+description: Configure and test your connection to the Windows Defender Antivirus cloud protection service.
+keywords: antivirus, windows defender antivirus, antimalware, security, defender, cloud, aggressiveness, protection level
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
ms.prod: w10
@@ -11,20 +11,14 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
-# Configure and validate network connections for Windows Defender Antivirus
-
+# Configure and validate Windows Defender Antivirus network connections
**Applies to:**
-- Windows 10 (some instructions are only applicable for Windows 10, version 1703 or later)
-
-**Audience**
-
-- Enterprise security administrators
-
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
To ensure Windows Defender Antivirus cloud-delivered protection works properly, you need to configure your network to allow connections between your endpoints and certain Microsoft servers.
@@ -33,19 +27,20 @@ This topic lists the connections that must be allowed, such as by using firewall
See the Enterprise Mobility and Security blog post [Important changes to Microsoft Active Protection Services endpoint](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/important-changes-to-microsoft-active-protection-service-maps-endpoint/) for some details about network connectivity.
>[!TIP]
->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working:
+>You can also visit the Windows Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working:
+>
>- Cloud-delivered protection
->- Fast learning (including Block at first sight)
+>- Fast learning (including block at first sight)
>- Potentially unwanted application blocking
-## Allow connections to the Windows Defender Antivirus cloud
+## Allow connections to the Windows Defender Antivirus cloud service
-The Windows Defender Antivirus cloud provides fast, strong protection for your endpoints. Enabling the cloud-delivered protection service is optional, however it is highly recommend as it provides very important protection against malware on your endpoints and across your network.
+The Windows Defender Antivirus cloud service provides fast, strong protection for your endpoints. Enabling the cloud-delivered protection service is optional, however it is highly recommended because it provides very important protection against malware on your endpoints and across your network.
->[!NOTE]
+>[!NOTE]
>The Windows Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud, rather it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional signature updates.
-See the [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) topic for details on enabling the service with Group Policy, System Center Configuration Manager, PowerShell cmdlets, Microsoft Intune, or on individual clients in the Windows Defender Security Center app.
+See [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) for details on enabling the service with Intune, System Center Configuration Manager, Group Policy, PowerShell cmdlets, or on individual clients in the Windows Defender Security Center app.
After you've enabled the service, you may need to configure your network or firewall to allow connections between it and your endpoints.
@@ -133,44 +128,43 @@ https://msdl.microsoft.com/download/symbols
Universal Telemetry Client
-Used by Windows to send client diagnostic data, Windows Defender Antivirus uses this for product quality monitoring purposes
+Used by Windows to send client diagnostic data; Windows Defender Antivirus uses this for product quality monitoring purposes
This update uses SSL (TCP Port 443) to download manifests and upload diagnostic data to Microsoft that uses the following DNS endpoints:
vortex-win.data.microsoft.com
settings-win.data.microsoft.com
-
-
## Validate connections between your network and the cloud
-After whitelisting the URLs listed above, you can test if you are connected to the Windows Defender AV cloud and are correctly reporting and receiving information to ensure you are fully protected.
+After whitelisting the URLs listed above, you can test if you are connected to the Windows Defender Antivirus cloud service and are correctly reporting and receiving information to ensure you are fully protected.
**Use the cmdline tool to validate cloud-delivered protection:**
-Use the following argument with the Windows Defender AV command line utility (*mpcmdrun.exe*) to verify that your network can communicate with the Windows Defender AV cloud:
+Use the following argument with the Windows Defender Antivirus command line utility (*mpcmdrun.exe*) to verify that your network can communicate with the Windows Defender Antivirus cloud service:
```DOS
-MpCmdRun -ValidateMapsConnection
+MpCmdRun -ValidateMapsConnection
```
-> [!NOTE]
-> You need to open an administrator-level version of the command prompt. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. This command will only work on Windows 10, version 1703.
-See [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender Antivirus](command-line-arguments-windows-defender-antivirus.md) for more information on how to use the *mpcmdrun.exe* utility.
+> [!NOTE]
+> You need to open an administrator-level version of the command prompt. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. This command will only work on Windows 10, version 1703 or higher.
+
+See [Manage Windows Defender Antivirus with the mpcmdrun.exe commandline tool](command-line-arguments-windows-defender-antivirus.md) for more information on how to use the *mpcmdrun.exe* utility.
**Attempt to download a fake malware file from Microsoft:**
-You can download a sample file that Windows Defender AV will detect and block if you are properly connected to the cloud.
+You can download a sample file that Windows Defender Antivirus will detect and block if you are properly connected to the cloud.
Download the file by visiting the following link:
- http://aka.ms/ioavtest
->[!NOTE]
+>[!NOTE]
>This file is not an actual piece of malware. It is a fake file that is designed to test if you are properly connected to the cloud.
-If you are properly connected, you will see a warning notification from Windows Defender Antivirus:
+If you are properly connected, you will see a warning Windows Defender Antivirus notification:
@@ -189,23 +183,22 @@ You will also see a detection under **Quarantined threats** in the **Scan histor
2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Scan history** label:
-
+
3. Under the **Quarantined threats** section, click the **See full history** label to see the detected fake malware:
>[!NOTE]
->Versions of Windows 10 before version 1703 have a different user interface. See the [Windows Defender Antivirus in the Windows Defender Security Center](windows-defender-security-center-antivirus.md) topic for more information about the differences between versions, and instructions on how to perform common tasks in the different interfaces.
+>Versions of Windows 10 before version 1703 have a different user interface. See [Windows Defender Antivirus in the Windows Defender Security Center](windows-defender-security-center-antivirus.md) for more information about the differences between versions, and instructions on how to perform common tasks in the different interfaces.
The Windows event log will also show [Windows Defender client event ID 2050](troubleshoot-windows-defender-antivirus.md).
>[!IMPORTANT]
->You will not be able to use a proxy auto-config (.pac) file to test network connections to these URLs. You will need to verify your proxy servers and any network filtering tools manually to ensure connectivity.
-
+>You will not be able to use a proxy auto-config (.pac) file to test network connections to these URLs. You will need to verify your proxy servers and any network filtering tools manually to ensure connectivity.
## Related topics
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
- [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md)
-- [Run a Windows Defender scan from the command line](command-line-arguments-windows-defender-antivirus.md) and [Command line arguments](command-line-arguments-windows-defender-antivirus.md)
+- [Run an Windows Defender Antivirus scan from the command line](command-line-arguments-windows-defender-antivirus.md) and [Command line arguments](command-line-arguments-windows-defender-antivirus.md)
- [Important changes to Microsoft Active Protection Services endpoint](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/important-changes-to-microsoft-active-protection-service-maps-endpoint/)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md
index 060372f38b..6985bdef52 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md
@@ -1,7 +1,7 @@
---
-title: Configure notifications for Windows Defender Antivirus
-description: Configure and customize notifications from Windows Defender AV.
-keywords: notifications, defender, endpoint, management, admin
+title: Configure Windows Defender Antivirus notifications
+description: Configure and customize Windows Defender Antivirus notifications.
+keywords: notifications, defender, antivirus, endpoint, management, admin
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
ms.prod: w10
@@ -11,27 +11,18 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
# Configure the notifications that appear on endpoints
**Applies to:**
-- Windows 10, version 1703 and later
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
+In Windows 10, application notifications about malware detection and remediation are more robust, consistent, and concise.
-- Enterprise security administrators
-
-**Manageability available with**
-
-- Group Policy
-- Windows Defender Security Center app
-
-In Windows 10, application notifications about malware detection and remediation by Windows Defender are more robust, consistent, and concise.
-
-Notifications will appear on endpoints when manually triggered and scheduled scans are completed and threats are detected. These notifications will also be seen in the **Notification Center**, and a summary of scans and threat detections will also appear at regular time intervals.
+Notifications appear on endpoints when manually triggered and scheduled scans are completed and threats are detected. These notifications also appear in the **Notification Center**, and a summary of scans and threat detections appear at regular time intervals.
You can also configure how standard notifications appear on endpoints, such as notifications for reboot or when a threat has been detected and remediated.
@@ -40,78 +31,73 @@ You can also configure how standard notifications appear on endpoints, such as n
You can configure the display of additional notifications, such as recent threat detection summaries, in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md) and with Group Policy.
> [!NOTE]
-> In Windows 10, version 1607 the feature was called **Enhanced notifications** and could be configured under **Windows Settings** > **Update & security** > **Windows Defender**. In Group Policy settings in all versions of Windows 10 it is called **Enhanced notifications**.
+> In Windows 10, version 1607 the feature was called **Enhanced notifications** and could be configured under **Windows Settings** > **Update & security** > **Windows Defender**. In Group Policy settings in all versions of Windows 10, it is called **Enhanced notifications**.
> [!IMPORTANT]
> Disabling additional notifications will not disable critical notifications, such as threat detection and remediation alerts.
-**Use the Windows Defender Security Center app to disable additional notifications:**
+**Use the Windows Defender Security Center app to disable additional notifications:**
1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**.
2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label:
-
-
-3. Scroll to the **Notifications** section and click **Change notification settings**.
+ 
+
+3. Scroll to the **Notifications** section and click **Change notification settings**.
4. Slide the switch to **Off** or **On** to disable or enable additional notifications.
**Use Group Policy to disable additional notifications:**
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
+2. In the **Group Policy Management Editor** go to **Computer configuration**.
-4. Click **Administrative templates**.
+3. Click **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Reporting**.
-
-6. Double-click the **Turn off enhanced notifications** setting and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing.
+4. Expand the tree to **Windows components > Windows Defender Antivirus > Reporting**.
+5. Double-click **Turn off enhanced notifications** and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing.
## Configure standard notifications on endpoints
You can use Group Policy to:
+
- Display additional, customized text on endpoints when the user needs to perform an action
- Hide all notifications on endpoints
- Hide reboot notifications on endpoints
-Hiding notifications can be useful in situations where you cannot hide the entire Windows Defender AV interface. See [Prevent users from seeing or interacting with the Windows Defender AV user interface](prevent-end-user-interaction-windows-defender-antivirus.md) for more information.
+Hiding notifications can be useful in situations where you can't hide the entire Windows Defender Antivirus interface. See [Prevent users from seeing or interacting with the Windows Defender Antivirus user interface](prevent-end-user-interaction-windows-defender-antivirus.md) for more information.
> [!NOTE]
> Hiding notifications will only occur on endpoints to which the policy has been deployed. Notifications related to actions that must be taken (such as a reboot) will still appear on the [System Center Configuration Manager Endpoint Protection monitoring dashboard and reports](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/monitor-endpoint-protection).
-See the [Customize the Windows Defender Security Center app for your organization](/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md) topic for instructions to add custom contact information to the notifications that users see on their machines.
+See [Customize the Windows Defender Security Center app for your organization](/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md) for instructions to add custom contact information to the notifications that users see on their machines.
**Use Group Policy to hide notifications:**
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure, and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Client interface**.
+3. Expand the tree to **Windows components > Windows Defender Antivirus > Client interface**.
-6. Double-click the **Suppress all notifications** setting and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing.
+4. Double-click **Suppress all notifications** and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing.
**Use Group Policy to hide reboot notifications:**
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Administrative templates**.
-
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Client interface**.
-
-6. Double-click the **Suppresses reboot notifications** setting and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing.
-
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+2. In the **Group Policy Management Editor** go to **Computer configuration**.
+3. Click **Administrative templates**.
+4. Expand the tree to **Windows components > Windows Defender Antivirus > Client interface**.
+5. Double-click **Suppresses reboot notifications** and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing.
## Related topics
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
-- [Configure end-user interaction with Windows Defender AV](configure-end-user-interaction-windows-defender-antivirus.md)
+- [Configure end-user interaction with Windows Defender Antivirus](configure-end-user-interaction-windows-defender-antivirus.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md
index 43501a9510..57a4d03e85 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md
@@ -1,7 +1,7 @@
---
title: Configure exclusions for files opened by specific processes
description: You can exclude files from scans if they have been opened by a specific process.
-keywords: process, exclusion, files, scans
+keywords: Windows Defender Antivirus, process, exclusion, files, scans
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
ms.prod: w10
@@ -11,83 +11,73 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/10/2018
+ms.date: 09/03/2018
---
# Configure exclusions for files opened by processes
**Applies to:**
-- Windows 10
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Group Policy
-- PowerShell
-- Windows Management Instrumentation (WMI)
-- System Center Configuration Manager
-- Microsoft Intune
-- Windows Defender Security Center
-
-You can exclude files that have been opened by specific processes from being scanned by Windows Defender AV.
+You can exclude files that have been opened by specific processes from Windows Defender Antivirus scans.
This topic describes how to configure exclusion lists for the following:
-Exclusion | Example
+Exclusion | Example
---|---
Any file on the machine that is opened by any process with a specific file name | Specifying "test.exe" would exclude files opened by:
c:\sample\test.exe
d:\internal\files\test.exe
Any file on the machine that is opened by any process under a specific folder | Specifying "c:\test\sample\\*" would exclude files opened by:
c:\test\sample\test.exe
c:\test\sample\test2.exe
c:\test\sample\utility.exe
Any file on the machine that is opened by a specific process in a specific folder | Specifying "c:\test\process.exe" would exclude files only opened by c:\test\process.exe
-When you add a process to the process exclusion list, Windows Defender AV will not scan files opened by that process, no matter where the files are located. The process itself, however, will be scanned unless it has also been added to the [file exclusion list](configure-extension-file-exclusions-windows-defender-antivirus.md).
+When you add a process to the process exclusion list, Windows Defender Antivirus won't scan files opened by that process, no matter where the files are located. The process itself, however, will be scanned unless it has also been added to the [file exclusion list](configure-extension-file-exclusions-windows-defender-antivirus.md).
-The exclusions only apply to [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). They do not apply to scheduled or on-demand scans.
+The exclusions only apply to [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). They don't apply to scheduled or on-demand scans.
-Changes made via Group Policy to the exclusion lists **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). However, changes made in the Windows Defender Security Center app **will not show** in the Group Policy lists.
+Changes made with Group Policy to the exclusion lists **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). However, changes made in the Windows Defender Security Center app **will not show** in the Group Policy lists.
You can add, remove, and review the lists for exclusions in [Group Policy](#gp), [System Center Configuration Manager, Microsoft Intune, and with the Windows Defender Security Center app](#man-tools), and you can [use wildcards](#wildcards) to further customize the lists.
-You can also [use PowerShell cmdlets and WMI to configure the exclusion lists](#ps), including [reviewing](#review) your lists.
+You can also [use PowerShell cmdlets and WMI to configure the exclusion lists](#ps), including [reviewing](#review) your lists.
-
-By default, local changes made to the lists (by users with administrator privileges; this includes changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists will take precedence in the case of conflicts.
+By default, local changes made to the lists (by users with administrator privileges; this includes changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists will take precedence in the case of conflicts.
You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-windows-defender-antivirus.md#merge-lists) to allow local changes to override managed deployment settings.
-
## Configure the list of exclusions for files opened by specified processes
-
+
+**Use Microsoft Intune to exclude files that have been opened by specified processes from scans:**
+
+See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details.
+
+**Use System Center Configuration Manager to exclude files that have been opened by specified processes from scans:**
+
+See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch).
+
**Use Group Policy to exclude files that have been opened by specified processes from scans:**
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**.
+3. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**.
+4. Double-click **Process Exclusions** and add the exclusions:
-6. Double-click the **Process Exclusions** setting and add the exclusions:
-
- 1. Set the option to **Enabled**.
- 2. Under the **Options** section, click **Show...**
+ 1. Set the option to **Enabled**.
+ 2. Under the **Options** section, click **Show...**.
3. Enter each process on its own line under the **Value name** column. See the [example table](#examples) for the different types of process exclusions. Enter **0** in the **Value** column for all processes.
-7. Click **OK**.
+5. Click **OK**.
-
+
**Use PowerShell cmdlets to exclude files that have been opened by specified processes from scans:**
Using PowerShell to add or remove exclusions for files that have been opened by processes requires using a combination of three cmdlets with the `-ExclusionProcess` parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/defender).
@@ -102,14 +92,12 @@ The following are allowed as the \:
Configuration action | PowerShell cmdlet
---|---
-Create or overwrite the list | `Set-MpPreference`
-Add to the list | `Add-MpPreference`
-Remove items from the list | `Remove-MpPreference`
-
+Create or overwrite the list | `Set-MpPreference`
+Add to the list | `Add-MpPreference`
+Remove items from the list | `Remove-MpPreference`
>[!IMPORTANT]
->If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list.
-
+>If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list.
For example, the following code snippet would cause Windows Defender AV scans to exclude any file that is opened by the specified process:
@@ -117,9 +105,7 @@ For example, the following code snippet would cause Windows Defender AV scans to
Add-MpPreference -ExclusionProcess "c:\internal\test.exe"
```
-
-See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
-
+See [Manage antivirus with PowerShell cmdlets](use-powershell-cmdlets-windows-defender-Windows Defender Antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
**Use Windows Management Instruction (WMI) to exclude files that have been opened by specified processes from scans:**
@@ -132,26 +118,17 @@ ExclusionProcess
The use of **Set**, **Add**, and **Remove** is analogous to their counterparts in PowerShell: `Set-MpPreference`, `Add-MpPreference`, and `Remove-MpPreference`.
See the following for more information and allowed parameters:
+
- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx)
-**Use Configuration Manager to exclude files that have been opened by specified processes from scans:**
-
-See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch).
-
-
-**Use Microsoft Intune to exclude files that have been opened by specified processes from scans:**
-
-See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details.
-
**Use the Windows Defender Security Center app to exclude files that have been opened by specified processes from scans:**
See [Add exclusions in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions) for instructions.
-
-
+
## Use wildcards in the process exclusion list
The use of wildcards in the process exclusion list is different from their use in other exclusion lists.
@@ -166,20 +143,18 @@ Wildcard | Use | Example use | Example matches
? (question mark) | Not available | \- | \-
Environment variables | The defined variable will be populated as a path when the exclusion is evaluated |
%ALLUSERSPROFILE%\CustomLogFiles\file.exe
|
Any file opened by C:\ProgramData\CustomLogFiles\file.exe
-
-
-
+
## Review the list of exclusions
You can retrieve the items in the exclusion list with PowerShell, [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), [Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure), or the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions).
If you use PowerShell, you can retrieve the list in two ways:
-- Retrieve the status of all Windows Defender AV preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line.
+- Retrieve the status of all Windows Defender Antivirus preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line.
- Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line.
-**Review the list of exclusions alongside all other Windows Defender AV preferences:**
+**Review the list of exclusions alongside all other Windows Defender Antivirus preferences:**
Use the following cmdlet:
@@ -187,10 +162,8 @@ Use the following cmdlet:
Get-MpPreference
```
-
See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
-
**Retrieve a specific exclusions list:**
Use the following code snippet (enter each line as a separate command); replace **WDAVprefs** with whatever label you want to name the variable:
@@ -200,18 +173,12 @@ $WDAVprefs = Get-MpPreference
$WDAVprefs.ExclusionProcess
```
-
-
See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
-
-
-
-
## Related topics
-- [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md)
+- [Configure and validate exclusions in Windows Defender Antivirus scans](configure-exclusions-windows-defender-antivirus.md)
- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md)
-- [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md)
-- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
-- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
\ No newline at end of file
+- [Configure Windows Defender Antivirus exclusions on Windows Server](configure-server-exclusions-windows-defender-antivirus.md)
+- [Customize, initiate, and review the results of Windows Defender Antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
+- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md
index 8eaf0cfc8f..61d9ada7c2 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md
@@ -1,5 +1,5 @@
---
-title: Enable and configure protection features in Windows Defender AV
+title: Enable and configure Windows Defender Antivirus protection features
description: Enable behavior-based, heuristic, and real-time protection in Windows Defender AV.
keywords: heuristic, machine-learning, behavior monitor, real-time protection, always-on, windows defender antivirus, antimalware, security, defender
search.product: eADQiWindows 10XVcnh
@@ -11,18 +11,14 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 08/26/2017
+ms.date: 09/03/2018
---
# Configure behavioral, heuristic, and real-time protection
**Applies to:**
-- Windows 10
-
-**Audience**
-
-- Enterprise security administrators
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
Windows Defender Antivirus uses several methods to provide threat protection:
@@ -30,16 +26,15 @@ Windows Defender Antivirus uses several methods to provide threat protection:
- Always-on scanning, using file and process behavior monitoring and other heuristics (also known as "real-time protection")
- Dedicated protection updates based on machine-learning, human and automated big-data analysis, and in-depth threat resistance research
-You can configure how Windows Defender AV uses these methods with Group Policy, System Center Configuration Manage, PowerShell cmdlets, and Windows Management Instrumentation (WMI).
+You can configure how Windows Defender Antivirus uses these methods with Group Policy, System Center Configuration Manage, PowerShell cmdlets, and Windows Management Instrumentation (WMI).
-This section covers configuration for always-on scanning, including how to detect and block apps that are deemed unsafe, but may not be detected as malware.
-
-See the [Utilize Microsoft cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) section for how to enable and configure Windows Defender AV cloud-delivered protection.
+This section covers configuration for always-on scanning, including how to detect and block apps that are deemed unsafe, but may not be detected as malware.
+See [Use next-gen Windows Defender Antivirus technologies through cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) for how to enable and configure Windows Defender Antivirus cloud-delivered protection.
## In this section
- Topic | Description
+ Topic | Description
---|---
[Detect and block potentially unwanted applications](detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) | Detect and block apps that may be unwanted in your network, such as adware, browser modifiers and toolbars, and rogue or fake antivirus apps
-[Enable and configure Windows Defender AV protection capabilities](configure-real-time-protection-windows-defender-antivirus.md) | Enable and configure real-time protection, heuristics, and other always-on antivirus monitoring features
\ No newline at end of file
+[Enable and configure Windows Defender Antivirus protection capabilities](configure-real-time-protection-windows-defender-antivirus.md) | Enable and configure real-time protection, heuristics, and other always-on Windows Defender Antivirus monitoring features
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md
index d97f720028..d5a83c1e36 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md
@@ -1,7 +1,7 @@
---
-title: Configure always-on real-time protection in Windows Defender AV
-description: Enable and configure real-time protection features such as behavior monitoring, heuristics, and machine-learning in Windows Defender AV
-keywords: real-time protection, rtp, machine-learning, behavior monitoring, heuristics
+title: Configure always-on real-time Windows Defender Antivirus protection
+description: Enable and configure Windows Defender Antivirus real-time protection features such as behavior monitoring, heuristics, and machine-learning
+keywords: antivirus, real-time protection, rtp, machine-learning, behavior monitoring, heuristics
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
ms.prod: w10
@@ -11,69 +11,45 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
-
-
-# Enable and configure Windows Defender AV always-on protection and monitoring
-
-
+# Enable and configure antivirius always-on protection and monitoring
**Applies to:**
-- Windows 10
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-**Audience**
-
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Group Policy
-
-
-
-
-Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities.
+Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities.
These activities include events such as processes making unusual changes to existing files, modifying or creating automatic startup registry keys and startup locations (also known as auto-start extensibility points, or ASEPs), and other changes to the file system or file structure.
-
## Configure and enable always-on protection
You can configure how always-on protection works with the Group Policy settings described in this section.
To configure these settings:
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-
-3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-
-5. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below.
-
-6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+3. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below.
+4. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK** and repeat for any other settings.
Location | Setting | Description | Default setting (if not configured)
---|---|---|---
-Real-time protection | Monitor file and program activity on your computer | The AV engine makes note of any file changes (file writes, such as moves, copies, or modifications) and general program activity (programs that are opened or running and that cause other programs to run) | Enabled
-Real-time protection | Scan all downloaded files and attachments | Downloaded files and attachments are automatically scanned. This operates in addition to Windows Defender SmartScreen filter, which scans files before and during downloading | Enabled
-Real-time protection | Turn on process scanning whenever real-time protection is enabled | You can independently enable the AV engine to scan running processes for suspicious modifications or behaviors. This is useful if you have disabled real-time protection | Enabled
+Real-time protection | Monitor file and program activity on your computer | The Windows Defender Antivirus engine makes note of any file changes (file writes, such as moves, copies, or modifications) and general program activity (programs that are opened or running and that cause other programs to run) | Enabled
+Real-time protection | Scan all downloaded files and attachments | Downloaded files and attachments are automatically scanned. This operates in addition to the SmartScreen filter, which scans files before and during downloading | Enabled
+Real-time protection | Turn on process scanning whenever real-time protection is enabled | You can independently enable the Windows Defender Antivirus engine to scan running processes for suspicious modifications or behaviors. This is useful if you have disabled real-time protection | Enabled
Real-time protection | Turn on behavior monitoring | The AV engine will monitor file processes, file and registry changes, and other events on your endpoints for suspicious and known malicious activity | Enabled
Real-time protection | Turn on raw volume write notifications | Information about raw volume writes will be analyzed by behavior monitoring | Enabled
-Real-time protection | Define the maximum size of downloaded files and attachments to be scanned | You can define the size in kilobytes | Enabled
-Real-time protection | Configure monitoring for incoming and outgoing file and program activity | Specify whether monitoring should occur on incoming, outgoing, both, or neither direction. This is relevant for Windows Server installations where you have defined specific servers or Server Roles that see large amounts of file changes in only one direction and you want to improve network performance. Note that fully updated endpoints (and servers) on a network will see little performance impact irrespective of the number or direction of file changes. | Enabled (both directions)
-Scan | Turn on heuristics | Heuristic protection will disable or block suspicious activity immediately before the AV engine is asked to detect the activity | Enabled
-Root | Allow antimalware service to startup with normal priority | You can lower the priority of the AV engine, which may be useful in lightweight deployments where you want to have as lean a startup process as possible. This may impact protection on the endpoint. | Enabled
-Root | Allow antimalware service to remain running always | If protection updates have been disabled, you can set Windows Defender AV to still run. This lowers the protection on the endpoint. | Disabled
-
-
-
+Real-time protection | Define the maximum size of downloaded files and attachments to be scanned | You can define the size in kilobytes | Enabled
+Real-time protection | Configure monitoring for incoming and outgoing file and program activity | Specify whether monitoring should occur on incoming, outgoing, both, or neither direction. This is relevant for Windows Server installations where you have defined specific servers or Server Roles that see large amounts of file changes in only one direction and you want to improve network performance. Note that fully updated endpoints (and servers) on a network will see little performance impact irrespective of the number or direction of file changes. | Enabled (both directions)
+Scan | Turn on heuristics | Heuristic protection will disable or block suspicious activity immediately before the Windows Defender Antivirus engine is asked to detect the activity | Enabled
+Root | Allow antimalware service to startup with normal priority | You can lower the priority of the Windows Defender Antivirus engine, which may be useful in lightweight deployments where you want to have as lean a startup process as possible. This may impact protection on the endpoint. | Enabled
+Root | Allow antimalware service to remain running always | If protection updates have been disabled, you can set Windows Defender Antivirus to still run. This lowers the protection on the endpoint. | Disabled
## Disable real-time protection
> [!WARNING]
@@ -83,15 +59,13 @@ The main real-time protection capability is enabled by default, but you can disa
**Use Group Policy to disable real-time protection:**
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Real-time protection**.
-
-6. Double-click the **Turn off real-time protection** setting and set the option to **Enabled**. Click **OK**.
+2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+3. Expand the tree to **Windows components > Windows Defender Antivirus > Real-time protection**.
+4. Double-click the **Turn off real-time protection** setting and set the option to **Enabled**. Click **OK**.
## Related topics
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md
index c409e9402c..87ab0e1b1a 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md
@@ -1,6 +1,6 @@
---
-title: Remediate and resolve infections detected by Windows Defender AV
-description: Configure what Windows Defender AV should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder
+title: Remediate and resolve infections detected by Windows Defender Antivirus
+description: Configure what Windows Defender Antivirus should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder
keywords: remediation, fix, remove, threats, quarantine, scan, restore
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
@@ -11,29 +11,16 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/10/2018
+ms.date: 09/03/2018
---
+# Configure remediation for Windows Defender Antivirus scans
+**Applies to:**
-# Configure remediation for Windows Defender AV scans
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Applies to**
-- Windows 10
-
-**Audience**
-
-- Enterprise security administrators
-
-**Manageability available with**
-
-- Group Policy
-- System Center Configuration Manager
-- PowerShell
-- Windows Management Instrumentation (WMI)
-- Microsoft Intune
-
-When Windows Defender Antivirus runs a scan, it will attempt to remediate or remove threats that it finds. You can configure how Windows Defender AV should react to certain threats, whether it should create a restore point before remediating, and when it should remove remediated threats.
+When Windows Defender Antivirus runs a scan, it will attempt to remediate or remove threats that it finds. You can configure how Windows Defender Antivirus should react to certain threats, whether it should create a restore point before remediating, and when it should remove remediated threats.
This topic describes how to configure these settings with Group Policy, but you can also use [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#threat-overrides-settings) and [Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure).
@@ -45,40 +32,38 @@ You can configure how remediation works with the Group Policy settings described
To configure these settings:
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below.
-
-6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings.
+3. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below.
+4. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings.
Location | Setting | Description | Default setting (if not configured)
---|---|---|---
Scan | Create a system restore point | A system restore point will be created each day before cleaning or scanning is attempted | Disabled
Scan | Turn on removal of items from scan history folder | Specify how many days items should be kept in the scan history | 30 days
-Root | Turn off routine remediation | You can specify whether Windows Defender AV automatically remediates threats, or if it should ask the endpoint user what to do. | Disabled (threats are remediated automatically)
+Root | Turn off routine remediation | You can specify whether Windows Defender Antivirus automatically remediates threats, or if it should ask the endpoint user what to do. | Disabled (threats are remediated automatically)
Quarantine | Configure removal of items from Quarantine folder | Specify how many days items should be kept in quarantine before being removed | Never removed
-Threats | Specify threat alert levels at which default action should not be taken when detected | Every threat that is detected by Windows Defender AV is assigned a threat level (low, medium, high, or severe). You can use this setting to define how all threats for each of the threat levels should be remediated (quarantined, removed, or ignored) | Not applicable
+Threats | Specify threat alert levels at which default action should not be taken when detected | Every threat that is detected by Windows Defender Antivirus is assigned a threat level (low, medium, high, or severe). You can use this setting to define how all threats for each of the threat levels should be remediated (quarantined, removed, or ignored) | Not applicable
Threats | Specify threats upon which default action should not be taken when detected | Specify how specific threats (using their threat ID) should be remediated. You can specify whether the specific threat should be quarantined, removed, or ignored | Not applicable
>[!IMPORTANT]
->Windows Defender Antivirus detects and remediates files based on many factors. Sometimes, completing a remediation requires a reboot. Even if the detection is later determined to be a false positive, the reboot must be completed to ensure all additional remediation steps have been completed.
+>Windows Defender Antivirus detects and remediates files based on many factors. Sometimes, completing a remediation requires a reboot. Even if the detection is later determined to be a false positive, the reboot must be completed to ensure all additional remediation steps have been completed.
>
->If you are certain Windows Defender AV quarantined a file based on a false positive, you can restore the file from quarantine after the device reboots. See [Restore quarantined files in Windows Defender AV](restore-quarantined-files-windows-defender-antivirus.md).
+>If you are certain Windows Defender Antivirus quarantined a file based on a false positive, you can restore the file from quarantine after the device reboots. See [Restore quarantined files in Windows Defender Antivirus](restore-quarantined-files-windows-defender-antivirus.md).
>
->To avoid this problem in the future, you can exclude files from the scans. See [Configure and validate exclusions for Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md).
+>To avoid this problem in the future, you can exclude files from the scans. See [Configure and validate exclusions for Windows Defender Antivirus scans](configure-exclusions-windows-defender-antivirus.md).
-
-Also see the [Configure remediation-required scheduled full scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md#remed) topic for more remediation-related settings.
+Also see [Configure remediation-required scheduled full Windows Defender Antivirus scans](scheduled-catch-up-scans-windows-defender-antivirus.md#remed) for more remediation-related settings.
## Related topics
-- [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md)
-- [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md)
-- [Configure and run on-demand Windows Defender AV scans](run-scan-windows-defender-antivirus.md)
+- [Configure Windows Defender Antivirus scanning options](configure-advanced-scan-types-windows-defender-antivirus.md)
+- [Configure scheduled Windows Defender Antivirus scans](scheduled-catch-up-scans-windows-defender-antivirus.md)
+- [Configure and run on-demand Windows Defender Antivirus scans](run-scan-windows-defender-antivirus.md)
- [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md)
-- [Configure end-user interaction with Windows Defender AV](configure-end-user-interaction-windows-defender-antivirus.md)
-- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
+- [Configure end-user Windows Defender Antivirus interaction](configure-end-user-interaction-windows-defender-antivirus.md)
+- [Customize, initiate, and review the results of Windows Defender Antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md
index 1b9179c6b3..968c4850cb 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md
@@ -1,7 +1,7 @@
---
-title: Automatic and customized exclusions for Windows Defender AV on Windows Server 2016
-description: Windows Server 2016 includes automatic exclusions, based on Server Role. You can also add custom exclusions.
-keywords: exclusions, server, auto-exclusions, automatic, custom, scans
+title: Configure Windows Defender Antivirus exclusions on Windows Server 2016
+description: Windows Server 2016 includes automatic exclusions, based on server role. You can also add custom exclusions.
+keywords: exclusions, server, auto-exclusions, automatic, custom, scans, Windows Defender Antivirus
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
ms.prod: w10
@@ -11,46 +11,34 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/17/2018
+ms.date: 09/03/2018
---
-# Configure exclusions in Windows Defender AV on Windows Server
-
+# Configure Windows Defender Antivirus exclusions on Windows Server
**Applies to:**
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Group Policy
-- PowerShell
-- Windows Management Instrumentation (WMI)
-
-If you are using Windows Defender Antivirus to protect Windows Server 2016 machines, you are automatically enrolled in certain exclusions, as defined by your specified Windows Server Role. A list of these exclusions is provided at [the end of this topic](#list-of-automatic-exclusions).
+Windows Defender Antivirus on Windows Server 2016 computers automatically enrolls you in certain exclusions, as defined by your specified server role. See [the end of this topic](#list-of-automatic-exclusions) for a list of these exclusions.
These exclusions will not appear in the standard exclusion lists shown in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions).
-You can still add or remove custom exclusions (in addition to the Server Role-defined automatic exclusions) as described in the other exclusion-related topics:
+You can still add or remove custom exclusions (in addition to the server role-defined automatic exclusions) as described in these exclusion-related topics:
+
- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md)
- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md)
-Custom exclusions take precedence over the automatic exclusions.
+Custom exclusions take precedence over automatic exclusions.
> [!TIP]
> Custom and duplicate exclusions do not conflict with automatic exclusions.
-Windows Defender AV uses the Deployment Image Servicing and Management (DSIM) tools to determine which roles are installed on your computer.
-
+Windows Defender Antivirus uses the Deployment Image Servicing and Management (DISM) tools to determine which roles are installed on your computer.
## Opt out of automatic exclusions
-In Windows Server 2016 the predefined exclusions delivered by definition updates only exclude the default paths for a role or feature. If you installed a role or feature in a custom path, or you want to manually control the set of exclusions, you need to opt-out of the automatic exclusions delivered in definition updates.
+In Windows Server 2016, the predefined exclusions delivered by definition updates only exclude the default paths for a role or feature. If you installed a role or feature in a custom path, or you want to manually control the set of exclusions, you need to opt out of the automatic exclusions delivered in definition updates.
> [!WARNING]
> Opting out of automatic exclusions may adversely impact performance, or result in data corruption. The exclusions that are delivered automatically are optimized for Windows Server 2016 roles.
@@ -58,17 +46,17 @@ In Windows Server 2016 the predefined exclusions delivered by definition updates
> [!NOTE]
> This setting is only supported on Windows Server 2016. While this setting exists in Windows 10, it doesn't have an effect on exclusions.
-You can disable the auto-exclusions lists with Group Policy, PowerShell cmdlets, and WMI.
+You can disable the automatic exclusion lists with Group Policy, PowerShell cmdlets, and WMI.
**Use Group Policy to disable the auto-exclusions list on Windows Server 2016:**
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**.
+3. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**.
-6. Double-click the **Turn off Auto Exclusions** setting and set the option to **Enabled**. Click **OK**.
+4. Double-click **Turn off Auto Exclusions** and set the option to **Enabled**. Click **OK**.
**Use PowerShell cmdlets to disable the auto-exclusions list on Windows Server 2016:**
@@ -91,311 +79,305 @@ DisableAutoExclusions
See the following for more information and allowed parameters:
- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx)
-
## List of automatic exclusions
The following sections contain the exclusions that are delivered with automatic exclusions file paths and file types.
### Default exclusions for all roles
This section lists the default exclusions for all Windows Server 2016 roles.
-- Windows "temp.edb" files:
+- Windows "temp.edb" files:
- - *%windir%*\SoftwareDistribution\Datastore\\*\tmp.edb
+ - *%windir%*\SoftwareDistribution\Datastore\\*\tmp.edb
- - *%ProgramData%*\Microsoft\Search\Data\Applications\Windows\\*\\\*.log
+ - *%ProgramData%*\Microsoft\Search\Data\Applications\Windows\\*\\\*.log
-- Windows Update files or Automatic Update files:
+- Windows Update files or Automatic Update files:
- - *%windir%*\SoftwareDistribution\Datastore\\*\Datastore.edb
+ - *%windir%*\SoftwareDistribution\Datastore\\*\Datastore.edb
- - *%windir%*\SoftwareDistribution\Datastore\\*\edb.chk
+ - *%windir%*\SoftwareDistribution\Datastore\\*\edb.chk
- - *%windir%*\SoftwareDistribution\Datastore\\*\edb\*.log
+ - *%windir%*\SoftwareDistribution\Datastore\\*\edb\*.log
- - *%windir%*\SoftwareDistribution\Datastore\\*\Edb\*.jrs
+ - *%windir%*\SoftwareDistribution\Datastore\\*\Edb\*.jrs
- - *%windir%*\SoftwareDistribution\Datastore\\*\Res\*.log
+ - *%windir%*\SoftwareDistribution\Datastore\\*\Res\*.log
-- Windows Security files:
+- Windows Security files:
- - *%windir%*\Security\database\\*.chk
+ - *%windir%*\Security\database\\*.chk
- - *%windir%*\Security\database\\*.edb
+ - *%windir%*\Security\database\\*.edb
- - *%windir%*\Security\database\\*.jrs
+ - *%windir%*\Security\database\\*.jrs
- - *%windir%*\Security\database\\*.log
+ - *%windir%*\Security\database\\*.log
- - *%windir%*\Security\database\\*.sdb
+ - *%windir%*\Security\database\\*.sdb
-- Group Policy files:
+- Group Policy files:
- - *%allusersprofile%*\NTUser.pol
+ - *%allusersprofile%*\NTUser.pol
- - *%SystemRoot%*\System32\GroupPolicy\Machine\registry.pol
+ - *%SystemRoot%*\System32\GroupPolicy\Machine\registry.pol
- - *%SystemRoot%*\System32\GroupPolicy\User\registry.pol
+ - *%SystemRoot%*\System32\GroupPolicy\User\registry.pol
-- WINS files:
+- WINS files:
- - *%systemroot%*\System32\Wins\\*\\\*.chk
+ - *%systemroot%*\System32\Wins\\*\\\*.chk
- - *%systemroot%*\System32\Wins\\*\\\*.log
+ - *%systemroot%*\System32\Wins\\*\\\*.log
- - *%systemroot%*\System32\Wins\\*\\\*.mdb
+ - *%systemroot%*\System32\Wins\\*\\\*.mdb
- - *%systemroot%*\System32\LogFiles\
+ - *%systemroot%*\System32\LogFiles\
- - *%systemroot%*\SysWow64\LogFiles\
+ - *%systemroot%*\SysWow64\LogFiles\
-- File Replication Service (FRS) exclusions:
+- File Replication Service (FRS) exclusions:
- - Files in the File Replication Service (FRS) working folder. The FRS working folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Working Directory`
+ - Files in the File Replication Service (FRS) working folder. The FRS working folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Working Directory`
- - *%windir%*\Ntfrs\jet\sys\\*\edb.chk
+ - *%windir%*\Ntfrs\jet\sys\\*\edb.chk
- - *%windir%*\Ntfrs\jet\\*\Ntfrs.jdb
+ - *%windir%*\Ntfrs\jet\\*\Ntfrs.jdb
- - *%windir%*\Ntfrs\jet\log\\*\\\*.log
+ - *%windir%*\Ntfrs\jet\log\\*\\\*.log
- - FRS Database log files. The FRS Database log file folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\Ntfrs\Parameters\DB Log File Directory`
+ - FRS Database log files. The FRS Database log file folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\Ntfrs\Parameters\DB Log File Directory`
- - *%windir%*\Ntfrs\\*\Edb\*.log
+ -*%windir%*\Ntfrs\\*\Edb\*.log
- - The FRS staging folder. The staging folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\NtFrs\Parameters\Replica Sets\GUID\Replica Set Stage`
+ - The FRS staging folder. The staging folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\NtFrs\Parameters\Replica Sets\GUID\Replica Set Stage`
- - *%systemroot%*\Sysvol\\*\Nntfrs_cmp\*\
+ - *%systemroot%*\Sysvol\\*\Nntfrs_cmp\*\
- - The FRS preinstall folder. This folder is specified by the folder `Replica_root\DO_NOT_REMOVE_NtFrs_PreInstall_Directory`
+ - The FRS preinstall folder. This folder is specified by the folder `Replica_root\DO_NOT_REMOVE_NtFrs_PreInstall_Directory`
- - *%systemroot%*\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory\\*\Ntfrs\*\
+ - *%systemroot%*\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory\\*\Ntfrs\*\
- - The Distributed File System Replication (DFSR) database and working folders. These folders are specified by the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\DFSR\Parameters\Replication Groups\GUID\Replica Set Configuration File`
+ - The Distributed File System Replication (DFSR) database and working folders. These folders are specified by the registry key `HKEY_LOCAL_MACHINE\System\Currentcontrolset\Services\DFSR\Parameters\Replication Groups\GUID\Replica Set Configuration File`
- - *%systemdrive%*\System Volume Information\DFSR\\$db_normal$
+ - *%systemdrive%*\System Volume Information\DFSR\\$db_normal$
- - *%systemdrive%*\System Volume Information\DFSR\FileIDTable_*
+ - *%systemdrive%*\System Volume Information\DFSR\FileIDTable_*
- - *%systemdrive%*\System Volume Information\DFSR\SimilarityTable_*
+ - *%systemdrive%*\System Volume Information\DFSR\SimilarityTable_*
- - *%systemdrive%*\System Volume Information\DFSR\\*.XML
+ - *%systemdrive%*\System Volume Information\DFSR\\*.XML
- - *%systemdrive%*\System Volume Information\DFSR\\$db_dirty$
+ - *%systemdrive%*\System Volume Information\DFSR\\$db_dirty$
- - *%systemdrive%*\System Volume Information\DFSR\\$db_clean$
+ - *%systemdrive%*\System Volume Information\DFSR\\$db_clean$
- - *%systemdrive%*\System Volume Information\DFSR\\$db_lostl$
+ - *%systemdrive%*\System Volume Information\DFSR\\$db_lostl$
- - *%systemdrive%*\System Volume Information\DFSR\Dfsr.db
+ - *%systemdrive%*\System Volume Information\DFSR\Dfsr.db
- - *%systemdrive%*\System Volume Information\DFSR\\*.frx
+ - *%systemdrive%*\System Volume Information\DFSR\\*.frx
- - *%systemdrive%*\System Volume Information\DFSR\\*.log
+ - *%systemdrive%*\System Volume Information\DFSR\\*.log
- - *%systemdrive%*\System Volume Information\DFSR\Fsr*.jrs
+ - *%systemdrive%*\System Volume Information\DFSR\Fsr*.jrs
- - *%systemdrive%*\System Volume Information\DFSR\Tmp.edb
+ - *%systemdrive%*\System Volume Information\DFSR\Tmp.edb
-- Process exclusions
+- Process exclusions
- - *%systemroot%*\System32\dfsr.exe
+ - *%systemroot%*\System32\dfsr.exe
- - *%systemroot%*\System32\dfsrs.exe
+ - *%systemroot%*\System32\dfsrs.exe
-- Hyper-V exclusions:
+- Hyper-V exclusions:
- - This section lists the file type exclusions, folder exclusions, and process exclusions that are delivered automatically when you install the Hyper-V role
+ - This section lists the file type exclusions, folder exclusions, and process exclusions that are delivered automatically when you install the Hyper-V role
- - File type exclusions:
+ - File type exclusions:
- - *.vhd
+ - *.vhd
- - *.vhdx
+ - *.vhdx
- - *.avhd
+ - *.avhd
- - *.avhdx
+ - *.avhdx
- - *.vsv
+ - *.vsv
- - *.iso
+ - *.iso
- - *.rct
+ - *.rct
- - *.vmcx
+ - *.vmcx
- - *.vmrs
+ - *.vmrs
- - Folder exclusions:
+ - Folder exclusions:
- - *%ProgramData%*\Microsoft\Windows\Hyper-V
+ - *%ProgramData%*\Microsoft\Windows\Hyper-V
- - *%ProgramFiles%*\Hyper-V
+ - *%ProgramFiles%*\Hyper-V
- - *%SystemDrive%*\ProgramData\Microsoft\Windows\Hyper-V\Snapshots
+ - *%SystemDrive%*\ProgramData\Microsoft\Windows\Hyper-V\Snapshots
- - *%Public%*\Documents\Hyper-V\Virtual Hard Disks
+ - *%Public%*\Documents\Hyper-V\Virtual Hard Disks
- - Process exclusions:
+ - Process exclusions:
- - *%systemroot%*\System32\Vmms.exe
+ - *%systemroot%*\System32\Vmms.exe
- - *%systemroot%*\System32\Vmwp.exe
+ - *%systemroot%*\System32\Vmwp.exe
-- SYSVOL files:
+- SYSVOL files:
- - *%systemroot%*\Sysvol\Domain\\*.adm
+ - *%systemroot%*\Sysvol\Domain\\*.adm
- - *%systemroot%*\Sysvol\Domain\\*.admx
+ - *%systemroot%*\Sysvol\Domain\\*.admx
- - *%systemroot%*\Sysvol\Domain\\*.adml
+ - *%systemroot%*\Sysvol\Domain\\*.adml
- - *%systemroot%*\Sysvol\Domain\Registry.pol
+ - *%systemroot%*\Sysvol\Domain\Registry.pol
- - *%systemroot%*\Sysvol\Domain\\*.aas
+ - *%systemroot%*\Sysvol\Domain\\*.aas
- - *%systemroot%*\Sysvol\Domain\\*.inf
+ - *%systemroot%*\Sysvol\Domain\\*.inf
- - *%systemroot%*\Sysvol\Domain\\*.Scripts.ini
+ - *%systemroot%*\Sysvol\Domain\\*.Scripts.ini
- - *%systemroot%*\Sysvol\Domain\\*.ins
+ - *%systemroot%*\Sysvol\Domain\\*.ins
- - *%systemroot%*\Sysvol\Domain\Oscfilter.ini
+ - *%systemroot%*\Sysvol\Domain\Oscfilter.ini
### Active Directory exclusions
This section lists the exclusions that are delivered automatically when you install Active Directory Domain Services.
-- NTDS database files. The database files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Database File`
+- NTDS database files. The database files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Database File`
- - %windir%\Ntds\ntds.dit
+ - %windir%\Ntds\ntds.dit
- - %windir%\Ntds\ntds.pat
+ - %windir%\Ntds\ntds.pat
-- The AD DS transaction log files. The transaction log files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files`
+- The AD DS transaction log files. The transaction log files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files`
- - %windir%\Ntds\EDB*.log
+ - %windir%\Ntds\EDB*.log
- - %windir%\Ntds\Res*.log
+ - %windir%\Ntds\Res*.log
- - %windir%\Ntds\Edb*.jrs
+ - %windir%\Ntds\Edb*.jrs
- - %windir%\Ntds\Ntds*.pat
+ - %windir%\Ntds\Ntds*.pat
- - %windir%\Ntds\EDB*.log
+ - %windir%\Ntds\EDB*.log
- - %windir%\Ntds\TEMP.edb
+ - %windir%\Ntds\TEMP.edb
-- The NTDS working folder. This folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory`
+- The NTDS working folder. This folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory`
- - %windir%\Ntds\Temp.edb
+ - %windir%\Ntds\Temp.edb
- - %windir%\Ntds\Edb.chk
+ - %windir%\Ntds\Edb.chk
-- Process exclusions for AD DS and AD DS-related support files:
+- Process exclusions for AD DS and AD DS-related support files:
- - %systemroot%\System32\ntfrs.exe
+ - %systemroot%\System32\ntfrs.exe
- - %systemroot%\System32\lsass.exe
+ - %systemroot%\System32\lsass.exe
### DHCP Server exclusions
This section lists the exclusions that are delivered automatically when you install the DHCP Server role. The DHCP Server file locations are specified by the *DatabasePath*, *DhcpLogFilePath*, and *BackupDatabasePath* parameters in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DHCPServer\Parameters`
-- *%systemroot%*\System32\DHCP\\*\\\*.mdb
+- *%systemroot%*\System32\DHCP\\*\\\*.mdb
-- *%systemroot%*\System32\DHCP\\*\\\*.pat
+- *%systemroot%*\System32\DHCP\\*\\\*.pat
-- *%systemroot%*\System32\DHCP\\*\\\*.log
+- *%systemroot%*\System32\DHCP\\*\\\*.log
-- *%systemroot%*\System32\DHCP\\*\\\*.chk
+- *%systemroot%*\System32\DHCP\\*\\\*.chk
-- *%systemroot%*\System32\DHCP\\*\\\*.edb
+- *%systemroot%*\System32\DHCP\\*\\\*.edb
### DNS Server exclusions
This section lists the file and folder exclusions and the process exclusions that are delivered automatically when you install the DNS Server role.
-- File and folder exclusions for the DNS Server role:
+- File and folder exclusions for the DNS Server role:
- - *%systemroot%*\System32\Dns\\*\\\*.log
+ - *%systemroot%*\System32\Dns\\*\\\*.log
- - *%systemroot%*\System32\Dns\\*\\\*.dns
+ - *%systemroot%*\System32\Dns\\*\\\*.dns
- - *%systemroot%*\System32\Dns\\*\\\*.scc
+ - *%systemroot%*\System32\Dns\\*\\\*.scc
- - *%systemroot%*\System32\Dns\\*\BOOT
+ - *%systemroot%*\System32\Dns\\*\BOOT
-- Process exclusions for the DNS Server role:
+- Process exclusions for the DNS Server role:
- - *%systemroot%*\System32\dns.exe
-
-
+ - *%systemroot%*\System32\dns.exe
### File and Storage Services exclusions
This section lists the file and folder exclusions that are delivered automatically when you install the File and Storage Services role. The exclusions listed below do not include exclusions for the Clustering role.
-- *%SystemDrive%*\ClusterStorage
+- *%SystemDrive%*\ClusterStorage
-- *%clusterserviceaccount%*\Local Settings\Temp
+- *%clusterserviceaccount%*\Local Settings\Temp
-- *%SystemDrive%*\mscs
+- *%SystemDrive%*\mscs
### Print Server exclusions
This section lists the file type exclusions, folder exclusions, and the process exclusions that are delivered automatically when you install the Print Server role.
-- File type exclusions:
+- File type exclusions:
- - *.shd
+ - *.shd
- - *.spl
+ - *.spl
-- Folder exclusions. This folder is specified in the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory`
+- Folder exclusions. This folder is specified in the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory`
- - *%system32%*\spool\printers\\*
+ - *%system32%*\spool\printers\\*
-- Process exclusions:
+- Process exclusions:
- - spoolsv.exe
+ - spoolsv.exe
### Web Server exclusions
This section lists the folder exclusions and the process exclusions that are delivered automatically when you install the Web Server role.
-- Folder exclusions:
+- Folder exclusions:
- - *%SystemRoot%*\IIS Temporary Compressed Files
+ - *%SystemRoot%*\IIS Temporary Compressed Files
- - *%SystemDrive%*\inetpub\temp\IIS Temporary Compressed Files
+ - *%SystemDrive%*\inetpub\temp\IIS Temporary Compressed Files
- - *%SystemDrive%*\inetpub\temp\ASP Compiled Templates
+ - *%SystemDrive%*\inetpub\temp\ASP Compiled Templates
- - *%systemDrive%*\inetpub\logs
+ - *%systemDrive%*\inetpub\logs
- - *%systemDrive%*\inetpub\wwwroot
+ - *%systemDrive%*\inetpub\wwwroot
-- Process exclusions:
+- Process exclusions:
- - *%SystemRoot%*\system32\inetsrv\w3wp.exe
+ - *%SystemRoot%*\system32\inetsrv\w3wp.exe
- - *%SystemRoot%*\SysWOW64\inetsrv\w3wp.exe
+ - *%SystemRoot%*\SysWOW64\inetsrv\w3wp.exe
- - *%SystemDrive%*\PHP5433\php-cgi.exe
+ - *%SystemDrive%*\PHP5433\php-cgi.exe
### Windows Server Update Services exclusions
This section lists the folder exclusions that are delivered automatically when you install the Windows Server Update Services (WSUS) role. The WSUS folder is specified in the registry key `HKEY_LOCAL_MACHINE\Software\Microsoft\Update Services\Server\Setup`
-- *%systemroot%*\WSUS\WSUSContent
-
-- *%systemroot%*\WSUS\UpdateServicesDBFiles
-
-- *%systemroot%*\SoftwareDistribution\Datastore
-
-- *%systemroot%*\SoftwareDistribution\Download
+- *%systemroot%*\WSUS\WSUSContent
+- *%systemroot%*\WSUS\UpdateServicesDBFiles
+- *%systemroot%*\SoftwareDistribution\Datastore
+- *%systemroot%*\SoftwareDistribution\Download
## Related topics
-- [Configure and validate exclusions for Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md)
+- [Configure and validate exclusions for Windows Defender Antivirus scans](configure-exclusions-windows-defender-antivirus.md)
- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md)
- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md)
-- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
+- [Customize, initiate, and review the results of Windows Defender Antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md b/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md
index ecc4190de1..03b6bf2fc1 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md
@@ -1,7 +1,7 @@
---
-title: Configure Windows Defender Antivirus features (Windows 10)
-description: You can configure features for Windows Defender Antivirus using Configuration Manager, MDM software (such as Intune), PowerShell, and with Group Policy settings.
-keywords: windows defender antivirus, antimalware, security, defender, configure, configuration, Config Manager, System Center Configuration Manager, SCCM, Intune, MDM, mobile device management, GP, group policy, PowerShell
+title: Configure Windows Defender Antivirus features
+description: You can configure Windows Defender Antivirus features with Intune, System Center Configuration Manager, Group Policy, and PowerShell.
+keywords: Windows Defender Antivirus, antimalware, security, defender, configure, configuration, Config Manager, System Center Configuration Manager, SCCM, Intune, MDM, mobile device management, GP, group policy, PowerShell
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
ms.prod: w10
@@ -11,28 +11,22 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 08/26/2017
+ms.date: 09/03/2018
---
# Configure Windows Defender Antivirus features
-
**Applies to:**
-- Windows 10
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
+You can configure Windows Defender Antivirus with a number of tools, including:
-- Enterprise security administrators
-
-Windows Defender Antivirus can be configured with a number of tools, including:
-
-- Group Policy settings
+- Microsoft Intune
- System Center Configuration Manager
+- Group Policy
- PowerShell cmdlets
- Windows Management Instrumentation (WMI)
-- Microsoft Intune
-
The following broad categories of features can be configured:
@@ -40,17 +34,13 @@ The following broad categories of features can be configured:
- Always-on real-time protection, including behavioral, heuristic, and machine-learning-based protection
- How end-users interact with the client on individual endpoints
-The topics in this section describe how to perform key tasks when configuring Windows Defender AV. Each topic includes instructions for the applicable configuration tool (or tools).
+The topics in this section describe how to perform key tasks when configuring Windows Defender Antivirus. Each topic includes instructions for the applicable configuration tool (or tools).
You can also review the [Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md) topic for an overview of each tool and links to further help.
-
## In this section
Topic | Description
:---|:---
-[Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) | Cloud-delivered protection provides an advanced level of fast, robust antivirus detection
-[Configure behavioral, heuristic, and real-time protection](configure-protection-features-windows-defender-antivirus.md)|Enable behavior-based, heuristic, and real-time protection in Windows Defender AV
-[Configure end-user interaction with Windows Defender Antivirus](configure-end-user-interaction-windows-defender-antivirus.md)|Configure how end-users interact with Windows Defender AV, what notifications they see, and if they can override settings
-
-
-
+[Utilize Microsoft cloud-provided Windows Defender Antivirus protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) | Cloud-delivered protection provides an advanced level of fast, robust antivirus detection
+[Configure behavioral, heuristic, and real-time protection](configure-protection-features-windows-defender-antivirus.md)|Enable behavior-based, heuristic, and real-time antivirus protection
+[Configure end-user interaction with Windows Defender Antivirus](configure-end-user-interaction-windows-defender-antivirus.md)|Configure how end-users interact with Windows Defender Antivirus, what notifications they see, and whether they can override settings
diff --git a/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md
index 5c57af4d4c..4487dc5453 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md
@@ -1,7 +1,7 @@
---
title: Run and customize scheduled and on-demand scans
-description: Customize and initiate scans using Windows Defender AV on endpoints across your network.
-keywords: scan, schedule, customize, exclusions, exclude files, remediation, scan results, quarantine, remove threat, quick scan, full scan
+description: Customize and initiate Windows Defender Antivirus scans on endpoints across your network.
+keywords: scan, schedule, customize, exclusions, exclude files, remediation, scan results, quarantine, remove threat, quick scan, full scan, Windows Defender Antivirus
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
ms.prod: w10
@@ -11,32 +11,24 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 08/26/2017
+ms.date: 09/03/2018
---
-# Customize, initiate, and review the results of Windows Defender AV scans and remediation
+# Customize, initiate, and review the results of Windows Defender Antivirus scans and remediation
**Applies to:**
-- Windows 10
-
-**Audience**
-
-- Enterprise security administrators
-
-
-You can use Group Policy, PowerShell, and Windows Management Instrumentation (WMI) to configure scans run by Windows Defender Antivirus.
-
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+You can use Group Policy, PowerShell, and Windows Management Instrumentation (WMI) to configure Windows Defender Antivirus scans.
## In this section
-Topic | Description
+Topic | Description
---|---
-[Configure and validate file, folder, and process-opened file exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md) | You can exclude files (including files modified by specified processes) and folders from on-demand scans, scheduled scans, and always-on real-time protection monitoring and scanning
-[Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) | You can configure Windows Defender AV to include certain types of email storage files, back-up or reparse points, and archived files (such as .zip files) in scans. You can also enable network file scanning
-[Configure remediation for scans](configure-remediation-windows-defender-antivirus.md) | Configure what Windows Defender AV should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder
+[Configure and validate file, folder, and process-opened file exclusions in Windows Defender Antivirus scans](configure-exclusions-windows-defender-antivirus.md) | You can exclude files (including files modified by specified processes) and folders from on-demand scans, scheduled scans, and always-on real-time protection monitoring and scanning
+[Configure Windows Defender Antivirus scanning options](configure-advanced-scan-types-windows-defender-antivirus.md) | You can configure Windows Defender Antivirus to include certain types of email storage files, back-up or reparse points, and archived files (such as .zip files) in scans. You can also enable network file scanning
+[Configure remediation for scans](configure-remediation-windows-defender-antivirus.md) | Configure what Windows Defender Antivirus should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder
[Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md) | Set up recurring (scheduled) scans, including when they should run and whether they run as full or quick scans
-[Configure and run scans](run-scan-windows-defender-antivirus.md) | Run and configure on-demand scans using PowerShell, Windows Management Instrumentation, or individually on endpoints with the Windows Defender Security Center app
+[Configure and run scans](run-scan-windows-defender-antivirus.md) | Run and configure on-demand scans using PowerShell, Windows Management Instrumentation, or individually on endpoints with the Windows Defender Security Center app
[Review scan results](review-scan-results-windows-defender-antivirus.md) | Review the results of scans using System Center Configuration Manager, Microsoft Intune, or the Windows Defender Security Center app
-
diff --git a/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md
index 12275ec64d..4c1673e6f4 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md
@@ -1,6 +1,6 @@
---
title: Deploy, manage, and report on Windows Defender Antivirus
-description: You can deploy and manage Windows Defender Antivirus with Group Policy, Configuration Manager, WMI, PowerShell, or Intune
+description: You can deploy and manage Windows Defender Antivirus with Intune, System Center Configuration Manager, Group Policy, PowerShell, or WMI
keywords: deploy, manage, update, protection, windows defender antivirus
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
@@ -11,40 +11,36 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/19/2018
+ms.date: 09/03/2018
---
# Deploy, manage, and report on Windows Defender Antivirus
**Applies to:**
-- Windows 10
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
+You can deploy, manage, and report on Windows Defender Antivirus in a number of ways.
-- IT administrators
+Because the Windows Defender Antivirus client is installed as a core part of Windows 10, traditional deployment of a client to your endpoints does not apply.
-You can deploy, manage, and report on Windows Defender Antivirus in a number of ways.
-
-As the Windows Defender AV client is installed as a core part of Windows 10, traditional deployment of a client to your endpoints does not apply.
-
-However, in most cases you will still need to enable the protection service on your endpoints with System Center Configuration Manager, Microsoft Intune, Azure Security Center, or Group Policy Objects, which is described in the following table.
+However, in most cases you will still need to enable the protection service on your endpoints with Microsoft Intune, System Center Configuration Manager, Azure Security Center, or Group Policy Objects, which is described in the following table.
You'll also see additional links for:
+
- Managing Windows Defender Antivirus protection, including managing product and protection updates
- Reporting on Windows Defender Antivirus protection
> [!IMPORTANT]
-> In most cases, Windows 10 will disable Windows Defender Antivirus if it finds another antivirus product running and up-to-date. You must disable or uninstall third-party antivirus products before Windows Defender Antivirus will be functioning. If you re-enable or install third-party antivirus products, then Windows 10 will automatically disable Windows Defender Antivirus.
-
+> In most cases, Windows 10 will disable Windows Defender Antivirus if it finds another antivirus product that is running and up-to-date. You must disable or uninstall third-party antivirus products before Windows Defender Antivirus will function. If you re-enable or install third-party antivirus products, then Windows 10 automatically disables Windows Defender Antivirus.
Tool|Deployment options (2)|Management options (network-wide configuration and policy or baseline deployment) ([3](#fn3))|Reporting options
---|---|---|---
-System Center Configuration Manager ([1](#fn1))|Use the [Endpoint Protection point site system role][] and [enable Endpoint Protection with custom client settings][]|With [default and customized antimalware policies][] and [client management][]|With the default [Configuration Manager Monitoring workspace][] and [email alerts][]
Microsoft Intune|[Add endpoint protection settings in Intune](https://docs.microsoft.com/en-us/intune/endpoint-protection-configure)|[Configure device restriction settings in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure)| [Use the Intune console to manage devices](https://docs.microsoft.com/en-us/intune/device-management)
-Windows Management Instrumentation|Deploy with Group Policy, System Center Configuration Manager, or manually on individual endpoints.|Use the [Set method of the MSFT_MpPreference class][] and the [Update method of the MSFT_MpSignature class][]|Use the [MSFT_MpComputerStatus][] class and the get method of associated classes in the [Windows Defender WMIv2 Provider][]
-PowerShell|Deploy with Group Policy, System Center Configuration Manager, or manually on individual endpoints.|Use the [Set-MpPreference][] and [Update-MpSignature] [] cmdlets available in the Defender module|Use the appropriate [Get- cmdlets available in the Defender module][]
+System Center Configuration Manager ([1](#fn1))|Use the [Endpoint Protection point site system role][] and [enable Endpoint Protection with custom client settings][]|With [default and customized antimalware policies][] and [client management][]|With the default [Configuration Manager Monitoring workspace][] and [email alerts][]
Group Policy and Active Directory (domain-joined)|Use a Group Policy Object to deploy configuration changes and ensure Windows Defender Antivirus is enabled.|Use Group Policy Objects (GPOs) to [Configure update options for Windows Defender Antivirus][] and [Configure Windows Defender features][]|Endpoint reporting is not available with Group Policy. You can generate a list of [Group Policies to determine if any settings or policies are not applied][]
+PowerShell|Deploy with Group Policy, System Center Configuration Manager, or manually on individual endpoints.|Use the [Set-MpPreference][] and [Update-MpSignature] [] cmdlets available in the Defender module|Use the appropriate [Get- cmdlets available in the Defender module][]
+Windows Management Instrumentation|Deploy with Group Policy, System Center Configuration Manager, or manually on individual endpoints.|Use the [Set method of the MSFT_MpPreference class][] and the [Update method of the MSFT_MpSignature class][]|Use the [MSFT_MpComputerStatus][] class and the get method of associated classes in the [Windows Defender WMIv2 Provider][]
Microsoft Azure|Deploy Microsoft Antimalware for Azure in the [Azure portal, by using Visual Studio virtual machine configuration, or using Azure PowerShell cmdlets](https://docs.microsoft.com/en-us/azure/security/azure-security-antimalware#antimalware-deployment-scenarios). You can also [Install Endpoint protection in Azure Security Center](https://docs.microsoft.com/en-us/azure/security-center/security-center-install-endpoint-protection)|Configure [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](https://docs.microsoft.com/en-us/powershell/servicemanagement/azure.antimalware/v3.4.0/azure.antimalware) or [use code samples](https://gallery.technet.microsoft.com/Antimalware-For-Azure-5ce70efe)|Use [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](https://docs.microsoft.com/en-us/powershell/servicemanagement/azure.antimalware/v3.4.0/azure.antimalware) to enable monitoring. You can also review usage reports in Azure Active Directory to determine suspicious activity, including the [Possibly infected devices][] report and configure an SIEM tool to report on [Windows Defender Antivirus events][] and add that tool as an app in AAD.
1. The availability of some functions and features, especially related to cloud-delivered protection, differ between System Center Configuration Manager (Current Branch) and System Center Configuration Manager 2012. In this library, we've focused on Windows 10, Windows Server 2016, and System Center Configuration Manager (Current Branch). See [Use Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) for a table that describes the major differences. [(Return to table)](#ref2)
@@ -53,8 +49,6 @@ Microsoft Azure|Deploy Microsoft Antimalware for Azure in the [Azure portal, by
3. Configuration of features and protection, including configuring product and protection updates, are further described in the [Configure Windows Defender Antivirus features](configure-notifications-windows-defender-antivirus.md) section in this library. [(Return to table)](#ref2)
-
-
[Endpoint Protection point site system role]: https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-protection-site-role
[default and customized antimalware policies]: https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies
[client management]: https://docs.microsoft.com/en-us/sccm/core/clients/manage/manage-clients
@@ -79,13 +73,10 @@ Microsoft Azure|Deploy Microsoft Antimalware for Azure in the [Azure portal, by
[Possibly infected devices]: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-reporting-sign-ins-from-possibly-infected-devices
[Windows Defender Antivirus events]: troubleshoot-windows-defender-antivirus.md
-
## In this section
-Topic | Description
+Topic | Description
---|---
[Deploy and enable Windows Defender Antivirus protection](deploy-windows-defender-antivirus.md) | While the client is installed as a core part of Windows 10, and traditional deployment does not apply, you will still need to enable the client on your endpoints with System Center Configuration Manager, Microsoft Intune, or Group Policy Objects.
[Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) | There are two parts to updating Windows Defender Antivirus: updating the client on endpoints (product updates), and updating definitions (protection updates). You can update definitions in a number of ways, using System Center Configuration Manager, Group Policy, PowerShell, and WMI.
-[Monitor and report on Windows Defender Antivirus protection](report-monitor-windows-defender-antivirus.md) | You can use System Center Configuration Manager, the Update Compliance add-in for Microsoft Operations Management Suite, a third-party SIEM product (by consuming Windows event logs), or Microsoft Intune to monitor protection status and create reports about endpoint protection
-
-
+[Monitor and report on Windows Defender Antivirus protection](report-monitor-windows-defender-antivirus.md) | You can use Microsoft Intune, System Center Configuration Manager, the Update Compliance add-in for Microsoft Operations Management Suite, or a third-party SIEM product (by consuming Windows event logs) to monitor protection status and create reports about endpoint protection.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md
index dbd8572db4..6efcc0eeef 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md
@@ -1,7 +1,7 @@
---
title: Deploy and enable Windows Defender Antivirus
-description: Deploy Windows Defender AV for protection of your endpoints with Configuration Manager, Microsoft Intune, Group Policy, PowerShell cmdlets, or WMI.
-keywords: deploy, enable, windows defender av
+description: Deploy Windows Defender Antivirus for protection of your endpoints with Microsoft Intune, System Center Configuration Manager, Group Policy, PowerShell cmdlets, or WMI.
+keywords: deploy, enable, Windows Defender Antivirus
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
ms.prod: w10
@@ -11,29 +11,22 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
# Deploy and enable Windows Defender Antivirus
-
**Applies to:**
-- Windows 10
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
+Depending on the management tool you are using, you may need to specifically enable or configure Windows Defender Antivirus protection.
-- Network administrators
-- IT administrators
+See the table in [Deploy, manage, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md#ref2) for instructions on how to enable protection with Microsoft Intune, System Center Configuration Manager, Group Policy, Active Directory, Microsoft Azure, PowerShell cmdlets, and Windows Management Instruction (WMI).
+Some scenarios require additional guidance on how to successfully deploy or configure Windows Defender Antivirus protection, such as Virtual Desktop Infrastructure (VDI) environments.
-Depending on the management tool you are using, you may need to specifically enable or configure Windows Defender AV protection.
-
-See the table in the [Deploy, manage, and report on Windows Defender AV](deploy-manage-report-windows-defender-antivirus.md#ref2) topic for instructions on how to enable protection with System Center Configuration Manager, Group Policy, Active Directory, Microsoft Azure, Microsoft Intune, PowerShell cmdlets, and Windows Management Instruction (WMI).
-
-Some scenarios require additional guidance on how to successfully deploy or configure Windows Defender AV protection, such as Virtual Desktop Infrastructure (VDI) environments.
-
-The remaining topic in this section provides end-to-end advice and best practices for [setting up Windows Defender AV on virtual machines (VMs) in a VDI or Remote Desktop Services (RDS) environment](deployment-vdi-windows-defender-antivirus.md).
+The remaining topic in this section provides end-to-end advice and best practices for [setting up Windows Defender Antivirus on virtual machines (VMs) in a VDI or Remote Desktop Services (RDS) environment](deployment-vdi-windows-defender-antivirus.md).
## Related topics
diff --git a/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md
index 41343abb5c..b0a425bb2b 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md
@@ -11,31 +11,20 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
# Deployment guide for Windows Defender Antivirus in a virtual desktop infrastructure (VDI) environment
**Applies to:**
-- Windows 10
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
+In addition to standard on-premises or hardware configurations, you can also use Windows Defender Antivirus in a remote desktop (RDS) or virtual desktop infrastructure (VDI) environment.
-- Enterprise security administrators
+Boot storms can be a problem in large-scale VDIs; this guide will help reduce the overall network bandwidth and performance impact on your hardware.
-**Manageability available with**
-
-- System Center Configuration Manager (current branch)
-- Group Policy
-
-
-
-In addition to standard on-premises or hardware configurations, you can also use Windows Defender Antivirus (Windows Defender AV) in a remote desktop (RDS) or virtual desktop infrastructure (VDI) environment.
-
-Boot storms can be a problem in large-scale VDIs; this guide will help reduce the overall network bandwidth and performance impact on your hardware.
-
-We recommend setting the following when deploying Windows Defender AV in a VDI environment:
+We recommend setting the following when deploying Windows Defender Antivirus in a VDI environment:
Location | Setting | Suggested configuration
---|---|---
@@ -46,17 +35,20 @@ Root | Randomize scheduled task times | Enabled
Signature updates | Turn on scan after signature update | Enabled
Scan | Turn on catch up quick scan | Enabled
-For more details on the best configuration options to ensure a good balance between performance and protection, including detailed instructions for Group Policy and System Center Configuration Manager, see the [Configure endpoints for optimal performance](#configure-endpoints-for-optimal-performance) section.
+For more details on the best configuration options to ensure a good balance between performance and protection, including detailed instructions for System Center Configuration Manager and Group Policy, see the [Configure endpoints for optimal performance](#configure-endpoints-for-optimal-performance) section.
See the [Microsoft Desktop virtualization site](https://www.microsoft.com/en-us/server-cloud/products/virtual-desktop-infrastructure/) for more details on Microsoft Remote Desktop Services and VDI support.
For Azure-based virtual machines, you can also review the [Install Endpoint Protection in Azure Security Center](https://docs.microsoft.com/en-us/azure/security-center/security-center-install-endpoint-protection) topic.
-There are three main steps in this guide to help roll out Windows Defender AV protection across your VDI:
+There are three main steps in this guide to help roll out Windows Defender Antivirus protection across your VDI:
+
+1. [Create and deploy the base image (for example, as a virtual hard disk (VHD)) that your virtual machines (VMs) will use](#create-and-deploy-the-base-image)
+
+2. [Manage the base image and updates for your VMs](#manage-your-vms-and-base-image)
+
+3. [Configure the VMs for optimal protection and performance](#configure-endpoints-for-optimal-performance), including:
-1. [Create and deploy the base image (for example, as a virtual hard disk (VHD)) that your virtual machines (VMs) will use](#create-and-deploy-the-base-image)
-2. [Manage the base image and updates for your VMs](#manage-your-vms-and-base-image)
-3. [Configure the VMs for optimal protection and performance](#configure-endpoints-for-optimal-performance), including:
- [Randomize scheduled scans](#randomize-scheduled-scans)
- [Use quick scans](#use-quick-scans)
- [Prevent notifications](#prevent-notifications)
@@ -66,27 +58,29 @@ There are three main steps in this guide to help roll out Windows Defender AV pr
>[!IMPORTANT]
> While the VDI can be hosted on Windows Server 2012 or Windows Server 2016, the virtual machines (VMs) should be running Windows 10, 1607 at a minimum, due to increased protection technologies and features that are unavailable in earlier versions of Windows.
->[!NOTE]
->When you manage Windows with System Center Configuration Manager, Windows Defender AV protection will be referred to as Endpoint Protection or System Center Endpoint Protection. See the [Endpoint Protection section at the Configuration Manager library]( https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-protection) for more information.
+>[!NOTE]
+>When you manage Windows with System Center Configuration Manager, Windows Defender Antivirus protection will be referred to as Endpoint Protection or System Center Endpoint Protection. See the [Endpoint Protection section at the Configuration Manager library]( https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-protection) for more information.
-
-
-## Create and deploy the base image
+## Create and deploy the base image
The main steps in this section include:
-1. Create your standard base image according to your requirements
-2. Apply Windows Defender AV protection updates to your base image
-3. Seal or “lock” the image to create a “known-good” image
-4. Deploy your image to your VMs
+
+1. Create your standard base image according to your requirements
+2. Apply Windows Defender AV protection updates to your base image
+3. Seal or “lock” the image to create a “known-good” image
+4. Deploy your image to your VMs
### Create the base image
+
First, you should create your base image according to your business needs, applying or installing the relevant line of business (LOB) apps and settings as you normally would. Typically, this would involve creating a VHD or customized .iso, depending on how you will deploy the image to your VMs.
### Apply protection updates to the base image
-After creating the image, you should ensure it is fully updated. See [Configure Windows Defender in Windows 10]( https://technet.microsoft.com/en-us/itpro/windows/keep-secure/configure-windows-defender-in-windows-10) for instructions on how to update Windows Defender AV protection via WSUS, Microsoft Update, the MMPC site, or UNC file shares. You should ensure that your initial base image is also fully patched with Microsoft and Windows updates and patches.
+
+After creating the image, you should ensure it is fully updated. See [Configure Windows Defender in Windows 10]( https://technet.microsoft.com/en-us/itpro/windows/keep-secure/configure-windows-defender-in-windows-10) for instructions on how to update Windows Defender Antivirus protection via WSUS, Microsoft Update, the MMPC site, or UNC file shares. You should ensure that your initial base image is also fully patched with Microsoft and Windows updates and patches.
### Seal the base image
-When the base image is fully updated, you should run a quick scan on the image.
+
+When the base image is fully updated, you should run a quick scan on the image.
After running a scan and buliding the cache, remove the machine GUID that uniquely identifies the device in telemetry for both Windows Defender Antivirus and the Microsoft Security Removal Tool. This key is located here:
@@ -94,19 +88,19 @@ After running a scan and buliding the cache, remove the machine GUID that unique
Remove the string found in the 'GUID' value
-This “sealing” or “locking” of the image helps Windows Defender AV build a cache of known-good files and avoid scanning them again on your VMs. In turn, this can help ensure performance on the VM is not impacted.
+This “sealing” or “locking” of the image helps Windows Defender Antivirus build a cache of known-good files and avoid scanning them again on your VMs. In turn, this can help ensure performance on the VM is not impacted.
You can run a quick scan [from the command line](command-line-arguments-windows-defender-antivirus.md) or via [System Center Configuration Manager](run-scan-windows-defender-antivirus.md).
->[!NOTE]
+>[!NOTE]
>Quick scan versus full scan
>Quick scan looks at all the locations where there could be malware registered to start with the system, such as registry keys and known Windows startup folders. Combined with our always on real-time protection capability - which reviews files when they are opened and closed, and whenever a user navigates to a folder – quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware.
->Therefore, when considering performance – especially for creating a new or updated image in preparation for deployment – it makes sense to use a quick scan only.
+>Therefore, when considering performance – especially for creating a new or updated image in preparation for deployment – it makes sense to use a quick scan only.
>A full scan, however, can be useful on a VM that has encountered a malware threat to identify if there are any inactive components lying around and help perform a thorough clean-up.
+### Deploy the base image
-### Deploy the base image
-You'll then need to deploy the base image across your VDI. For example, you can create or clone a VHD from your base image, and then use that VHD when you create or start your VMs.
+You'll then need to deploy the base image across your VDI. For example, you can create or clone a VHD from your base image, and then use that VHD when you create or start your VMs.
The following references provide ways you can create and deploy the base image across your VDI:
@@ -116,58 +110,57 @@ The following references provide ways you can create and deploy the base image a
- [Create a virtual machine in Hyper-V (with a VHD)](https://technet.microsoft.com/en-us/windows-server-docs/compute/hyper-v/get-started/create-a-virtual-machine-in-hyper-v)
- [Build Virtual Desktop templates]( https://technet.microsoft.com/en-us/library/dn645526(v=ws.11).aspx)
-
-
-
-
## Manage your VMs and base image
+
How you manage your VDI will affect the performance impact of Windows Defender AV on your VMs and infrastructure.
-Because Windows Defender AV downloads protection updates every day, or [based on your protection update settings](manage-protection-updates-windows-defender-antivirus.md), network bandwidth can be a problem if multiple VMs attempt to download updates at the same time.
+Because Windows Defender Antivirus downloads protection updates every day, or [based on your protection update settings](manage-protection-updates-windows-defender-antivirus.md), network bandwidth can be a problem if multiple VMs attempt to download updates at the same time.
Following the guidelines in this means the VMs will only need to download “delta” updates, which are the differences between an existing definition set and the next one. Delta updates are typically much smaller (a few kilobytes) than a full definition download (which can average around 150 mb).
-
### Manage updates for persistent VDIs
If you are using a persistent VDI, you should update the base image monthly, and set up protection updates to be delivered daily via a file share, as follows:
+
1. Create a dedicated file share location on your network that can be accessed by your VMs and your VM host (or other, persistent machine, such as a dedicated admin console that you use to manage your VMs).
+
2. Set up a scheduled task on your VM host to automatically download updates from the MMPC website or Microsoft Update and save them to the file share (the [SignatureDownloadCustomTask PowerShell script](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4/DisplayScript) can help with this).
+
3. [Configure the VMs to pull protection updates from the file share](manage-protection-updates-windows-defender-antivirus.md).
+
4. Disable or delay automatic Microsoft updates on your VMs. See [Update Windows 10 in the enterprise](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-update-windows-10) for information on managing operating system updates with WSUS, SCCM, and others.
+
5. On or just after each Patch Tuesday (the second Tuesday of each month), [update your base image with the latest protection updates from the MMPC website, WSUS, or Microsoft Update](manage-protection-updates-windows-defender-antivirus.md) Also apply all other Windows patches and fixes that were delivered on the Patch Tuesday. You can automate this by following the instructions in [Orchestrated offline VM Patching using Service Management Automation](https://blogs.technet.microsoft.com/privatecloud/2013/12/06/orchestrated-offline-vm-patching-using-service-management-automation/).
-5. [Run a quick scan](run-scan-windows-defender-antivirus.md) on your base image before deploying it to your VMs.
-A benefit to aligning your image update to the monthly Microsoft Update is that you ensure your VMs will have the latest Windows security patches and other important Microsoft updates without each VM needing to individually download them.
+6. [Run a quick scan](run-scan-windows-defender-antivirus.md) on your base image before deploying it to your VMs.
+A benefit to aligning your image update to the monthly Microsoft Update is that you ensure your VMs will have the latest Windows security patches and other important Microsoft updates without each VM needing to individually download them.
### Manage updates for non-persistent VDIs
If you are using a non-persistent VDI, you can update the base image daily (or nightly) and directly apply the latest updates to the image.
An example:
+
1. Every night or other time when you can safely take your VMs offline, update your base image with the latest [protection updates from the MMPC website, WSUS, or Microsoft Update](manage-protection-updates-windows-defender-antivirus.md).
+
2. [Run a quick scan](run-scan-windows-defender-antivirus.md) on your base image before deploying it to your VMs.
-
-
-
## Configure endpoints for optimal performance
+
There are a number of settings that can help ensure optimal performance on your VMs and VDI without affecting the level of protection, including:
- - [Randomize scheduled scans](#randomize-scheduled-scans)
- - [Use quick scans](#use-quick-scans)
- - [Prevent notifications](#prevent-notifications)
- - [Disable scans from occurring after every update](#disable-scans-after-an-update)
- - [Scan out-of-date machines or machines that have been offline for a while](#scan-vms-that-have-been-offline)
+
+- [Randomize scheduled scans](#randomize-scheduled-scans)
+- [Use quick scans](#use-quick-scans)
+- [Prevent notifications](#prevent-notifications)
+- [Disable scans from occurring after every update](#disable-scans-after-an-update)
+- [Scan out-of-date machines or machines that have been offline for a while](#scan-vms-that-have-been-offline)
These settings can be configured as part of creating your base image, or as a day-to-day management function of your VDI infrastructure or network.
-
-
-
### Randomize scheduled scans
-Windows Defender AV supports the randomization of scheduled scans and signature updates. This can be extremely helpful in reducing boot storms (especially when used in conjunction with [Disable scans from occurring after every update](#disable-scans-after-an-update) and [Scan out-of-date machines or machines that have been offline for a while](#scan-vms-that-have-been-offline).
+Windows Defender Antivirus supports the randomization of scheduled scans and signature updates. This can be extremely helpful in reducing boot storms (especially when used in conjunction with [Disable scans from occurring after every update](#disable-scans-after-an-update) and [Scan out-of-date machines or machines that have been offline for a while](#scan-vms-that-have-been-offline).
Scheduled scans run in addition to [real-time protection and scanning](configure-real-time-protection-windows-defender-antivirus.md).
@@ -177,17 +170,17 @@ The start time of the scan itself is still based on the scheduled scan policy
**Use Group Policy to randomize scheduled scan start times:**
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
+2. In the **Group Policy Management Editor** go to **Computer configuration**.
-4. Click **Policies** then **Administrative templates**.
+3. Click **Policies** then **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender** and configure the following setting:
-
- 1. Double-click the **Randomize scheduled task times** setting and set the option to **Enabled**. Click **OK**. This adds a true randomization (it is still random if the disk image is replicated) of plus or minus 30 minutes (using all of the intervals) to the start of the scheduled scan and the signature update. For example, if the schedule start time was set at 2.30pm, then enabling this setting could cause one machine to scan and update at 2.33pm and another machine to scan and update at 2.14pm.
+4. Expand the tree to **Windows components > Windows Defender** and configure the following setting:
-**Use Configuration Manager to randomize schedule scans:**
+ - Double-click **Randomize scheduled task times** and set the option to **Enabled**. Click **OK**. This adds a true randomization (it is still random if the disk image is replicated) of plus or minus 30 minutes (using all of the intervals) to the start of the scheduled scan and the signature update. For example, if the schedule start time was set at 2.30pm, then enabling this setting could cause one machine to scan and update at 2.33pm and another machine to scan and update at 2.14pm.
+
+**Use Configuration Manager to randomize scheduled scans:**
See [How to create and deploy antimalware policies: Advanced settings]( https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#advanced-settings) for details on configuring System Center Configuration Manager (current branch).
@@ -196,18 +189,19 @@ See [Schedule scans](scheduled-catch-up-scans-windows-defender-antivirus.md) for
### Use quick scans
You can specify the type of scan that should be performed during a scheduled scan.
-Quick scans are the preferred approach as they are designed to look in all places where malware needs to reside to be active.
+Quick scans are the preferred approach as they are designed to look in all places where malware needs to reside to be active.
**Use Group Policy to specify the type of scheduled scan:**
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-2. In the **Group Policy Management Editor** go to **Computer configuration**.
+2. In the **Group Policy Management Editor** go to **Computer configuration**.
-3. Click **Policies** then **Administrative templates**.
+3. Click **Policies** then **Administrative templates**.
-4. Expand the tree to **Windows components > Windows Defender > Scan** and configure the following setting:
- 1. Double-click the **Specify the scan type to use for a scheduled scan** setting and set the option to **Enabled** and **Quick scan**. Click **OK**.
+4. Expand the tree to **Windows components > Windows Defender > Scan** and configure the following setting:
+
+ - Double-click **Specify the scan type to use for a scheduled scan** and set the option to **Enabled** and **Quick scan**. Click **OK**.
**Use Configuration Manager to specify the type of scheduled scan:**
@@ -217,34 +211,34 @@ See [Schedule scans](scheduled-catch-up-scans-windows-defender-antivirus.md) for
### Prevent notifications
-Sometimes, Windows Defender AV notifications may be sent to or persist across multiple sessions. In order to minimize this problem, you can use the lock down the user interface for Windows Defender AV.
+Sometimes, Windows Defender Antivirus notifications may be sent to or persist across multiple sessions. In order to minimize this problem, you can use the lock down the Windows Defender Antivirus user interface.
**Use Group Policy to hide notifications:**
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
+2. In the **Group Policy Management Editor** go to **Computer configuration**.
-4. Click **Policies** then **Administrative templates**.
+3. Click **Policies** then **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender > Client Interface** and configure the following settings:
-
-1. Double-click the **Suppress all notifications** setting and set the option to **Enabled**. Click **OK**. This prevents notifications from Windows Defender AV appearing in the action center on Windows 10 when scans or remediation is performed.
-2. Double-click the **Enable headless UI mode** setting and set the option to **Enabled**. Click **OK**. This hides the entire Windows Defender AV user interface from users.
+4. Expand the tree to **Windows components > Windows Defender > Client Interface** and configure the following settings:
+ - Double-click **Suppress all notifications** and set the option to **Enabled**. Click **OK**. This prevents notifications from Windows Defender AV appearing in the action center on Windows 10 when scans or remediation is performed.
+ - Double-click **Enable headless UI mode** and set the option to **Enabled**. Click **OK**. This hides the entire Windows Defender AV user interface from users.
**Use Configuration Manager to hide notifications:**
-1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**)
+1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**)
-2. Go to the **Advanced** section and configure the following settings:
+2. Go to the **Advanced** section and configure the following settings:
-1. Set **Disable the client user interface** to **Yes**. This hides the entire Windows Defender AV user interface.
-2. Set **Show notifications messages on the client computer...** to **Yes**. This hides notifications from appearing.
+ 1. Set **Disable the client user interface** to **Yes**. This hides the entire Windows Defender AV user interface.
-3. Click **OK**.
+ 2. Set **Show notifications messages on the client computer...** to **Yes**. This hides notifications from appearing.
-3. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers).
+ 3. Click **OK**.
+
+3. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers).
### Disable scans after an update
@@ -255,73 +249,63 @@ This setting will prevent a scan from occurring after receiving an update. You c
**Use Group Policy to disable scans after an update:**
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
+2. In the **Group Policy Management Editor** go to **Computer configuration**.
-4. Click **Policies** then **Administrative templates**.
+3. Click **Policies** then **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender > Signature Updates** and configure the following setting:
-
-1. Double-click the **Turn on scan after signature update** setting and set the option to **Disabled**. Click **OK**. This prevents a scan from running immediately after an update.
+4. Expand the tree to **Windows components > Windows Defender > Signature Updates** and configure the following setting:
+ - Double-click **Turn on scan after signature update** and set the option to **Disabled**. Click **OK**. This prevents a scan from running immediately after an update.
**Use Configuration Manager to disable scans after an update:**
-1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**)
-
-2. Go to the **Scheduled scans** section and configure the following setting:
-
-1. Set **Check for the latest definition updates before running a scan** to **No**. This prevents a scan after an update.
-
-3. Click **OK**.
-
-2. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers).
+1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**)
+2. Go to the **Scheduled scans** section and configure the following setting:
+3. Set **Check for the latest definition updates before running a scan** to **No**. This prevents a scan after an update.
+4. Click **OK**.
+5. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers).
### Scan VMs that have been offline
-This setting will help ensure protection for a VM that has been offline for some time or has otherwise missed a scheduled scan.
+This setting will help ensure protection for a VM that has been offline for some time or has otherwise missed a scheduled scan.
**Use Group Policy to enable a catch-up scan:**
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Policies** then **Administrative templates**.
-
-5. Expand the tree to **Windows components > Windows Defender > Scan** and configure the following setting:
-
-1. Double-click the **Turn on catch-up quick scan** setting and set the option to **Enabled**. Click **OK**. This forces a scan if the VM has missed two or more consecutive scheduled scans.
+2. In the **Group Policy Management Editor** go to **Computer configuration**.
+3. Click **Policies** then **Administrative templates**.
+4. Expand the tree to **Windows components > Windows Defender > Scan** and configure the following setting:
+5. Double-click the **Turn on catch-up quick scan** setting and set the option to **Enabled**. Click **OK**. This forces a scan if the VM has missed two or more consecutive scheduled scans.
**Use Configuration Manager to disable scans after an update:**
-1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**)
+1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**)
-2. Go to the **Scheduled scans** section and configure the following setting:
+2. Go to the **Scheduled scans** section and configure the following setting:
-1. Set **Force a scan of the selected scan type if client computer is offline during...** to **Yes**. This forces a scan if the VM has missed two or more consecutive scheduled scans.
-
-3. Click **OK**.
-
-2. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers).
+3. Set **Force a scan of the selected scan type if client computer is offline during...** to **Yes**. This forces a scan if the VM has missed two or more consecutive scheduled scans.
+4. Click **OK**.
+5. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers).
### Exclusions
-Windows Server 2016 contains Windows Defender Antivirus and will automatically deliver the right exclusions for servers running a VDI environment. However, if you are running an older Windows server version, you can refer to the exclusions that are applied on this page:
+On Windows Server 2016, Windows Defender Antivirus will automatically deliver the right exclusions for servers running a VDI environment. However, if you are running an older Windows server version, you can refer to the exclusions that are applied on this page:
- [Automatic exclusions for Windows Server Antimalware](https://technet.microsoft.com/en-us/windows-server-docs/security/windows-defender/automatic-exclusions-for-windows-defender)
## Additional resources
- [Video: Microsoft Senior Program Manager Bryan Keller on how System Center Configuration Manger 2012 manages VDI and integrates with App-V]( http://channel9.msdn.com/Shows/Edge/Edge-Show-5-Manage-VDI-using-SCCM-2012#time=03m02s)
-- [Project VRC: Antivirus impact and best practices on VDI](https://blogs.technet.microsoft.com/privatecloud/2013/12/06/orchestrated-offline-vm-patching-using-service-management-automation/)
+- [Project VRC: Windows Defender Antivirus impact and best practices on VDI](https://blogs.technet.microsoft.com/privatecloud/2013/12/06/orchestrated-offline-vm-patching-using-service-management-automation/)
- [TechNet forums on Remote Desktop Services and VDI](https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverTS)
-- [SignatureDownloadCustomTask PowerShell script](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4/DisplayScript)
+- [SignatureDownloadCustomTask PowerShell script](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4/DisplayScript)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md
index fa6dae36c3..692b68e71c 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md
@@ -1,7 +1,7 @@
---
-title: Block Potentially Unwanted Applications with Windows Defender AV
-description: Enable the Potentially Unwanted Application (PUA) feature in Windows Defender Antivirus to block unwanted software such as adware.
-keywords: pua, enable, unwanted software, unwanted apps, adware, browser toolbar, detect, block, windows defender
+title: Block potentially unwanted applications with Windows Defender Antivirus
+description: Enable the potentially unwanted application (PUA) antivirus feature to block unwanted software such as adware.
+keywords: pua, enable, unwanted software, unwanted apps, adware, browser toolbar, detect, block, Windows Defender Antivirus
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
ms.prod: w10
@@ -11,76 +11,69 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/10/2018
+ms.date: 09/03/2018
---
-# Detect and block Potentially Unwanted Applications
+# Detect and block potentially unwanted applications
**Applies to:**
-- Windows 10
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Enterprise security administrators
-
-**Manageability available with**
-
-- System Center Configuration Manager
-- PowerShell cmdlets
-- Microsoft Intune
-
-The Potentially Unwanted Application (PUA) protection feature in Windows Defender Antivirus can identify and block PUAs from downloading and installing on endpoints in your network.
+The potentially unwanted application (PUA) protection feature in Windows Defender Antivirus can identify and block PUAs from downloading and installing on endpoints in your network.
These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. PUA can also refer to applications that are considered to have a poor reputation.
Typical PUA behavior includes:
+
- Various types of software bundling
-- Ad-injection into web browsers
+- Ad injection into web browsers
- Driver and registry optimizers that detect issues, request payment to fix the errors, but remain on the endpoint and make no changes or optimizations (also known as "rogue antivirus" programs)
These applications can increase the risk of your network being infected with malware, cause malware infections to be harder to identify, and can waste IT resources in cleaning up the applications.
>[!TIP]
->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
+>You can also visit the Windows Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
## How it works
PUAs are blocked when a user attempts to download or install the detected file, and if the file meets one of the following conditions:
+
- The file is being scanned from the browser
- The file is in a folder with "**downloads**" in the path
- The file is in a folder with "**temp**" in the path
-- The file is on the user's Desktop
+- The file is on the user's desktop
- The file does not meet one of these conditions and is not under *%programfiles%*, *%appdata%*, or *%windows%*
-The file is placed in the quarantine section so it won't run.
+The file is placed in the quarantine section so it won't run.
When a PUA is detected on an endpoint, the endpoint will present a notification to the user ([unless notifications have been disabled](configure-notifications-windows-defender-antivirus.md)) in the same format as normal threat detections (prefaced with "PUA:").
They will also appear in the usual [quarantine list in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md#detection-history).
-
## View PUA events
-PUA events are reported in the Windows Event Viewer and not in System Center Configuration Manager or Intune.
+PUA events are reported in the Windows Event Viewer and not in System Center Configuration Manager or Intune.
Hoever, PUA detections will be reported if you have set up email notifications for detections.
See [Troubleshoot event IDs](troubleshoot-windows-defender-antivirus.md) for details on viewing Windows Defender Antivirus events. PUA events are recorded under event ID 1160.
+## Configure PUA protection
-## Configure the PUA protection feature
+You can enable PUA protection with Microsoft Intune, System Center Configuration Manager, or PowerShell cmdlets.
-You can enable the PUA protection feature with System Center Configuration Manager, PowerShell cmdlets, or Microsoft Intune.
-
-You can also use the PUA audit mode to detect PUA without blocking them. The detections will be captured in the Windows event log.
+You can also use the PUA audit mode to detect PUA without blocking them. The detections will be captured in the Windows event log.
This feature is useful if your company is conducting an internal software security compliance check and you'd like to avoid any false positives.
+**Use Intune to configure the PUA protection feature**
+
+See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details.
**Use Configuration Manager to configure the PUA protection feature:**
-PUA protection is enabled by default in System Center Configuration Manager (current branch), including version 1606 and later.
+PUA protection is enabled by default in System Center Configuration Manager (current branch), including version 1606 and later.
See [How to create and deploy antimalware policies: Scheduled scans settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#real-time-protection-settings) for details on configuring System Center Configuration Manager (current branch).
@@ -103,16 +96,7 @@ Setting `AuditMode` will detect PUAs but will not block them.
See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus.
-
-
-**Use Intune to configure the PUA protection feature**
-
-See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure) and [Windows Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-windows-10#windows-defender-antivirus) for more details.
-
-
## Related topics
-- [Windows Defender Antivirus](windows-defender-antivirus-in-windows-10.md)
+- [Next gen protection](windows-defender-antivirus-in-windows-10.md)
- [Configure behavioral, heuristic, and real-time protection](configure-protection-features-windows-defender-antivirus.md)
-
-
diff --git a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md
index da5b515967..67c5b7bdfa 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md
@@ -11,74 +11,72 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/10/2018
+ms.date: 09/03/2018
---
-# Enable cloud-delivered protection in Windows Defender AV
-
-
+# Enable cloud-delivered protection
**Applies to:**
-- Windows 10
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
+>[!NOTE]
+>The Windows Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud; rather, it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional signature updates.
-- Enterprise security administrators
+You can enable or disable Windows Defender Antivirus cloud-delivered protection with Microsoft Intune, System Center Configuration Manager, Group Policy, PowerShell cmdlets, or on individual clients in the Windows Defender Security Center app.
-**Manageability available with**
+See [Use Microsoft cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) for an overview of Windows Defender Antivirus cloud-delivered protection.
-- Group Policy
-- System Center Configuration Manager
-- PowerShell cmdlets
-- Windows Management Instruction (WMI)
-- Microsoft Intune
-- Windows Defender Security Center app
-
-
->[!NOTE]
->The Windows Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud, rather it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional signature updates.
-
-
-
-You can enable or disable Windows Defender Antivirus cloud-delivered protection with Group Policy, System Center Configuration Manager, PowerShell cmdlets, Microsoft Intune, or on individual clients in the Windows Defender Security Center app.
-
-See [Utilize Microsoft cloud-delivered protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) for an overview of Windows Defender Antivirus cloud-delivered protection.
-
-There are specific network-connectivity requirements to ensure your endpoints can connect to the cloud-delivered protection service. See [Configure and validate network connections for Windows Defender AV](configure-network-connections-windows-defender-antivirus.md) for more details.
+There are specific network-connectivity requirements to ensure your endpoints can connect to the cloud-delivered protection service. See [Configure and validate network connections](configure-network-connections-windows-defender-antivirus.md) for more details.
>[!NOTE]
>In Windows 10, there is no difference between the **Basic** and **Advanced** options described in this topic. This is a legacy distinction and choosing either setting will result in the same level of cloud-delivered protection. There is no difference in the type or amount of information that is shared. See the [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=521839) for more information on what we collect.
+**Use Intune to enable cloud-delivered protection**
-**Use Group Policy to enable cloud-delivered protection:**
+1. Sign in to the [Azure portal](https://portal.azure.com).
+2. Select **All services > Intune**.
+3. In the **Intune** pane, select **Device configuration > Profiles**, and then select the **Device restrictions** profile type you want to configure. If you haven't yet created a **Device restrictions** profile type, or if you want to create a new one, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure).
+4. Select **Properties**, select **Settings: Configure**, and then select **Windows Defender Antivirus**.
+5. On the **Cloud-delivered protection** switch, select **Enable**.
+6. In the **Prompt users before sample submission** dropdown, select **Send all data without prompting**.
+7. In the **Submit samples consent** dropdown, select one of the following:
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Administrative templates**.
-
-5. Expand the tree to **Windows components > Windows Defender Antivirus > MAPS**
-
-1. Double-click the **Join Microsoft MAPS** setting and ensure the option is enabled and set to **Basic MAPS** or **Advanced MAPS**. Click **OK**.
-
-1. Double-click the **Send file samples when further analysis is required** setting and ensure the option is set to **Enabled** and the additional options are either of the following:
-
- 1. **Send safe samples** (1)
- 1. **Send all samples** (3)
+ - **Send safe samples automatically**
+ - **Send all samples automatically**
> [!WARNING]
- > Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function.
-
-1. Click **OK**.
+ > Setting to **Always Prompt** will lower the protection state of the device. Setting to **Never send** means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function.
+8. Click **OK** to exit the **Windows Defender Antivirus** settings pane, click **OK** to exit the **Device restrictions** pane, and then click **Save** to save the changes to your **Device restrictions** profile.
+For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](https://docs.microsoft.com/en-us/intune/device-profiles)
**Use Configuration Manager to enable cloud-delivered protection:**
See [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) for details on configuring System Center Configuration Manager (current branch).
+**Use Group Policy to enable cloud-delivered protection:**
+
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+
+2. In the **Group Policy Management Editor** go to **Computer configuration**.
+
+3. Click **Administrative templates**.
+
+4. Expand the tree to **Windows components > Windows Defender Antivirus > MAPS**
+
+5. Double-click **Join Microsoft MAPS** and ensure the option is enabled and set to **Basic MAPS** or **Advanced MAPS**. Click **OK**.
+
+6. Double-click **Send file samples when further analysis is required** and ensure the option is set to **Enabled** and the additional options are either of the following:
+
+ 1. **Send safe samples** (1)
+ 2. **Send all samples** (3)
+
+ > [!WARNING]
+ > Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function.
+
+7. Click **OK**.
**Use PowerShell cmdlets to enable cloud-delivered protection:**
@@ -88,10 +86,10 @@ Use the following cmdlets to enable cloud-delivered protection:
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent Always
```
+
>[!NOTE]
>You can also set -SubmitSamplesConsent to `None`. Setting it to `Never` will lower the protection state of the device, and setting it to 2 means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function.
-
See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus.
**Use Windows Management Instruction (WMI) to enable cloud-delivered protection:**
@@ -106,36 +104,18 @@ SubmitSamplesConsent
See the following for more information and allowed parameters:
- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx)
-**Use Intune to enable cloud-delivered protection**
-
-1. Sign in to the [Azure portal](https://portal.azure.com).
-2. Select **All services > Intune**.
-3. In the **Intune** pane, select **Device configuration > Profiles**, and then select the **Device restrictions** profile type you want to configure. If you haven't yet created a **Device restrictions** profile type, or if you want to create a new one, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-restrictions-configure).
-4. Select **Properties**, select **Settings: Configure**, and then select **Windows Defender Antivirus**.
-5. On the **Cloud-delivered protection** switch, select **Enable**.
-6. In the **Prompt users before sample submission** dropdown, select **Send all data without prompting**.
-7. In the **Submit samples consent** dropdown, select one of the following:
- 1. **Send safe samples automatically**
- 2. **Send all samples automatically**
-
- > [!WARNING]
- > Setting to **Always Prompt** will lower the protection state of the device. Setting to **Never send** means the [Block at First Sight](configure-block-at-first-sight-windows-defender-antivirus.md) feature will not function.
-8. Click **OK** to exit the **Windows Defender Antivirus** settings pane, click **OK** to exit the **Device restrictions** pane, and then click **Save** to save the changes to your **Device restrictions** profile.
-
-For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](https://docs.microsoft.com/en-us/intune/device-profiles)
-
**Enable cloud-delivered protection on individual clients with the Windows Defender Security Center app**
+
> [!NOTE]
> If the **Configure local setting override for reporting Microsoft MAPS** Group Policy setting is set to **Disabled**, then the **Cloud-based protection** setting in Windows Settings will be greyed-out and unavailable. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings.
-
1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label:
-
-
-3. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**.
+ 
+
+3. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**.
>[!NOTE]
>If automatic sample submission has been configured with Group Policy then the setting will be greyed-out and unavailable.
@@ -143,8 +123,8 @@ For more information about Intune device profiles, including how to create and c
## Related topics
- [Configure the cloud block timeout period](configure-cloud-block-timeout-period-windows-defender-antivirus.md)
-- [Configure the block at first sight feature](configure-block-at-first-sight-windows-defender-antivirus.md)
-- [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md)
+- [Configure block at first sight](configure-block-at-first-sight-windows-defender-antivirus.md)
+- [Use PowerShell cmdlets to manage Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md)
- [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune)]
- [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx)
- [Utilize Microsoft cloud-delivered protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md
index 225ea553da..72996630cf 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md
@@ -11,50 +11,41 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
-# Evaluate Windows Defender Antivirus protection
-
+# Evaluate Windows Defender Antivirus
**Applies to:**
-- Windows 10, version 1703 and later
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Enterprise security administrators
-
-
-If you're an enterprise security administrator, and you want to determine how well Windows Defender Antivirus protects you from viruses, malware, and potentially unwanted applications, then you can use this guide to help you evaluate Microsoft protection.
+Use this guide to determine how well Windows Defender Antivirus protects you from viruses, malware, and potentially unwanted applications.
>[!TIP]
->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work:
+>You can also visit the Windows Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work:
>- Cloud-delivered protection
>- Fast learning (including Block at first sight)
>- Potentially unwanted application blocking
-
-It explains the important features available for both small and large enterprises in Windows Defender, and how they will increase malware detection and protection across your network.
+It explains the important next generation protection features of Windows Defender Antivirus available for both small and large enterprises, and how they increase malware detection and protection across your network.
You can choose to configure and evaluate each setting independently, or all at once. We have grouped similar settings based upon typical evaluation scenarios, and include instructions for using PowerShell to enable the settings.
The guide is available in PDF format for offline viewing:
+
- [Download the guide in PDF format](https://www.microsoft.com/download/details.aspx?id=54795)
You can also download a PowerShell that will enable all the settings described in the guide automatically. You can obtain the script alongside the PDF download above, or individually from PowerShell Gallery:
+
- [Download the PowerShell script to automatically configure the settings](https://www.powershellgallery.com/packages/WindowsDefender_InternalEvaluationSettings/1.2/DisplayScript)
> [!IMPORTANT]
-> The guide is currently intended for single-machine evaluation of Windows Defender Antivirus protection. Enabling all of the settings in this guide may not be suitable for real-world deployment.
+> The guide is currently intended for single-machine evaluation of Windows Defender Antivirus. Enabling all of the settings in this guide may not be suitable for real-world deployment.
>
-> For the latest recommendations for real-world deployment and monitoring of Windows Defender Antivirus across a network, see the [Deploy, manage, and report](deploy-manage-report-windows-defender-antivirus.md) topic in this library.
-
+> For the latest recommendations for real-world deployment and monitoring of Windows Defender Antivirus across a network, see [Deploy Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md).
## Related topics
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
-- [Deploy, manage, and report](deploy-manage-report-windows-defender-antivirus.md)
-
-
-
+- [Deploy Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md
index d0d4cfd9db..d35db44c87 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md
@@ -1,6 +1,6 @@
---
-title: Enable the limited periodic scanning feature in Windows Defender AV
-description: Limited periodic scanning lets you use Windows Defender AV in addition to your other installed AV providers
+title: Enable the limited periodic Windows Defender Antivirus scanning feature
+description: Limited periodic scanning lets you use Windows Defender Antivirus in addition to your other installed AV providers
keywords: lps, limited, periodic, scan, scanning, compatibility, 3rd party, other av, disable
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
@@ -11,61 +11,42 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
-# Use limited periodic scanning in Windows Defender AV
-
-
+# Use limited periodic scanning in Windows Defender Antivirus
**Applies to:**
-- Windows 10, version 1703 and later
-
-
-**Audience**
-
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Windows Defender Security Center app
-
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
Limited periodic scanning is a special type of threat detection and remediation that can be enabled when you have installed another antivirus product on a Windows 10 device.
-It can only be enabled in certain situations. See the [Windows Defender Antivirus compatibility](windows-defender-antivirus-compatibility.md) topic for more information on when limited periodic scanning can be enabled, and how Windows Defender Antivirus works with other AV products.
+It can only be enabled in certain situations. See [Windows Defender Antivirus compatibility](windows-defender-antivirus-compatibility.md) for more information on when limited periodic scanning can be enabled, and how Windows Defender Antivirus works with other AV products.
-**Microsoft does not recommend using this feature in enterprise environments. This is a feature primarily intended for consumers.** This feature only uses a very limited subset of the capabilities of Windows Defender Antivirus to detect malware, and will not be able to detect most malware and potentially unwanted software. Also, management and reporting capabilities will be limited. Microsoft recommends enterprises choose their primary antivirus solution and use it exclusively.
+**Microsoft does not recommend using this feature in enterprise environments. This is a feature primarily intended for consumers.** This feature only uses a very limited subset of the Windows Defender Antivirus capabilities to detect malware, and will not be able to detect most malware and potentially unwanted software. Also, management and reporting capabilities will be limited. Microsoft recommends enterprises choose their primary antivirus solution and use it exclusively.
## How to enable limited periodic scanning
-By default, Windows Defender AV will enable itself on a Windows 10 device if there is no other antivirus product installed, or if the other AV product is out-of-date, expired, or not working correctly.
+By default, Windows Defender Antivirus will enable itself on a Windows 10 device if there is no other antivirus product installed, or if the other product is out-of-date, expired, or not working correctly.
-If Windows Defender AV is enabled, the usual options will appear to configure Windows Defender AV on that device:
+If Windows Defender Antivirus is enabled, the usual options will appear to configure it on that device:
-
-If another AV product is installed and working correctly, Windows Defender AV will disable itself. The Windows Defender Security Center app will change the **Virus & threat protection** section to show status about the AV product, and provide a link to the product's configuration options:
+If another antivirus product is installed and working correctly, Windows Defender Antivirus will disable itself. The Windows Defender Security Center app will change the **Virus & threat protection** section to show status about the AV product, and provide a link to the product's configuration options:
Underneath any 3rd party AV products, a new link will appear as **Windows Defender Antivirus options**. Clicking this link will expand to show the toggle that enables limited periodic scanning.
-
Sliding the swtich to **On** will show the standard Windows Defender AV options underneath the 3rd party AV product. The limited periodic scanning option will appear at the bottom of the page.
-
-
-
-
-
+
## Related topics
diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md
index a15ae25596..2209e57918 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md
@@ -1,6 +1,6 @@
---
-title: Apply Windows Defender AV updates after certain events
-description: Manage how Windows Defender Antivirus applies proteciton updates after startup or receiving cloud-delivered detection reports.
+title: Apply Windows Defender Antivirus updates after certain events
+description: Manage how Windows Defender Antivirus applies protection updates after startup or receiving cloud-delivered detection reports.
keywords: updates, protection, force updates, events, startup, check for latest, notifications
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
@@ -11,57 +11,44 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
# Manage event-based forced updates
-**Applies to**
-- Windows 10
+**Applies to:**
-**Audience**
-
-- Network administrators
-
-**Manageability available with**
-
-- Group Policy
-- System Center Configuration Manager
-- PowerShell cmdlets
-- Windows Management Instruction (WMI)
-
-
-Windows Defender AV allows you to determine if updates should (or should not) occur after certain events, such as at startup or after receiving specific reports from the cloud-delivered protection service.
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+Windows Defender Antivirus allows you to determine if updates should (or should not) occur after certain events, such as at startup or after receiving specific reports from the cloud-delivered protection service.
## Check for protection updates before running a scan
-You can use Group Policy, Configuration Manager, PowerShell cmdlets, and WMI to force Windows Defender AV to check and download protection updates before running a scheduled scan.
-
-
-**Use Group Policy to check for protection updates before running a scan:**
-
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Policies** then **Administrative templates**.
-
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Scan**.
-
-6. Double-click the **Check for the latest virus and spyware definitions before running a scheduled scan** setting and set the option to **Enabled**.
-
-7. Click **OK**.
+You can use System Center Configuration Manager, Group Policy, PowerShell cmdlets, and WMI to force Windows Defender Antivirus to check and download protection updates before running a scheduled scan.
**Use Configuration Manager to check for protection updates before running a scan:**
-1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**)
+1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**)
-2. Go to the **Scheduled scans** section and set **Check for the latest definition updates before running a scan** to **Yes**.
+2. Go to the **Scheduled scans** section and set **Check for the latest definition updates before running a scan** to **Yes**.
3. Click **OK**.
-4. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers).
+4.[Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers).
+
+**Use Group Policy to check for protection updates before running a scan:**
+
+1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+
+2. In the **Group Policy Management Editor** go to **Computer configuration**.
+
+3. Click **Policies** then **Administrative templates**.
+
+4. Expand the tree to **Windows components > Windows Defender Antivirus > Scan**.
+
+5. Double-click **Check for the latest virus and spyware definitions before running a scheduled scan** and set the option to **Enabled**.
+
+6. Click **OK**.
**Use PowerShell cmdlets to check for protection updates before running a scan:**
@@ -73,7 +60,6 @@ Set-MpPreference -CheckForSignaturesBeforeRunningScan
See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus.
-
**Use Windows Management Instruction (WMI) to check for protection updates before running a scan**
Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/en-us/library/dn455323(v=vs.85).aspx) class for the following properties:
@@ -85,46 +71,39 @@ CheckForSignaturesBeforeRunningScan
See the following for more information:
- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx)
-
-
-
-
-
## Check for protection updates on startup
-You can use Group Policy to force Windows Defender AV to check and download protection updates when the machine is started.
+You can use Group Policy to force Windows Defender Antivirus to check and download protection updates when the machine is started.
-**Use Group Policy to download protection updates at startup:**
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+2. In the **Group Policy Management Editor** go to **Computer configuration**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
+3. Click **Policies** then **Administrative templates**.
-4. Click **Policies** then **Administrative templates**.
+4. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates**.
+5. Double-click **Check for the latest virus and spyware definitions on startup** and set the option to **Enabled**.
-5. Double-click the **Check for the latest virus and spyware definitions on startup** setting and set the option to **Enabled**.
+6. Click **OK**.
-6. Click **OK**.
+You can also use Group Policy, PowerShell, or WMI to configure Windows Defender Antivirus to check for updates at startup even when it is not running.
-You can also use Group Policy, PowerShell, or WMI to configure Windows Defender AV to check for updates at startup even when it is not running.
+**Use Group Policy to download updates when Windows Defender Antivirus is not present:**
-**Use Group Policy to download updates when Windows Defender AV is not present:**
+1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+2. In the **Group Policy Management Editor** go to **Computer configuration**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
+3. Click **Policies** then **Administrative templates**.
-4. Click **Policies** then **Administrative templates**.
+4. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates**.
+5. Double-click **Initiate definition update on startup** and set the option to **Enabled**.
-6. Double-click the **Initiate definition update on startup** setting and set the option to **Enabled**.
+6. Click **OK**.
-7. Click **OK**.
-
-**Use PowerShell cmdlets to download updates when Windows Defender AV is not present:**
+**Use PowerShell cmdlets to download updates when Windows Defender Antivirus is not present:**
Use the following cmdlets:
@@ -132,10 +111,9 @@ Use the following cmdlets:
Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine
```
-See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus.
+See [Use PowerShell cmdlets to manage Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus.
-
-**Use Windows Management Instruction (WMI) to download updates when Windows Defender AV is not present:**
+**Use Windows Management Instruction (WMI) to download updates when Windows Defender Antivirus is not present:**
Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/en-us/library/dn455323(v=vs.85).aspx) class for the following properties:
@@ -146,11 +124,8 @@ SignatureDisableUpdateOnStartupWithoutEngine
See the following for more information:
- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx)
-
-
-
-
+
## Allow ad hoc changes to protection based on cloud-delivered protection
Windows Defender AV can make changes to its protection based on cloud-delivered protection. This can occur outside of normal or scheduled protection updates.
@@ -159,27 +134,21 @@ If you have enabled cloud-delivered protection, Windows Defender AV will send fi
**Use Group Policy to automatically download recent updates based on cloud-delivered protection:**
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Policies** then **Administrative templates**.
-
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates** and configure the following:
- 1. Double-click the **Allow real-time definition updates based on reports to Microsoft MAPS** setting and set the option to **Enabled**. Click **OK**.
- 2. Double-click the **Allow notifications to disable definitions based reports to Microsoft MAPS** setting and set the option to **Enabled**. Click **OK**.
+2. In the **Group Policy Management Editor** go to **Computer configuration**.
+3. Click **Policies** then **Administrative templates**.
+4. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates** and configure the following:
+ 1. Double-click **Allow real-time definition updates based on reports to Microsoft MAPS** and set the option to **Enabled**. Click **OK**.
+ 2. Double-click **Allow notifications to disable definitions based reports to Microsoft MAPS** and set the option to **Enabled**. Click **OK**.
## Related topics
-- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md)
+- [Deploy Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md)
- [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md)
-- [Manage Windows Defender Antivirus protection and definition updates](manage-protection-updates-windows-defender-antivirus.md)
- [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md)
- [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md)
- [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md)
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
-
-
-
diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md
index 00b1ed1c2f..210423199c 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md
@@ -11,50 +11,51 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
-# Manage updates and scans for endpoints that are out of date
+# Manage Windows Defender Antivirus updates and scans for endpoints that are out of date
-**Applies to**
-- Windows 10
+**Applies to:**
-**Audience**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-- Network administrators
-
-**Manageability available with**
-
-- Group Policy
-- System Center Configuration Manager
-- PowerShell cmdlets
-- Windows Management Instruction (WMI)
-
-
-
-Windows Defender AV lets you define how long an endpoint can avoid an update or how many scans it can miss before it is required to update and scan itself. This is especially useful in environments where devices are not often connected to a corporate or external network, or devices that are not used on a daily basis.
+Windows Defender Antivirus lets you define how long an endpoint can avoid an update or how many scans it can miss before it is required to update and scan itself. This is especially useful in environments where devices are not often connected to a corporate or external network, or devices that are not used on a daily basis.
For example, an employee that uses a particular PC is on break for three days and does not log on to their PC during that time.
-When the user returns to work and logs on to their PC, Windows Defender AV will immediately check and download the latest protection updates, and run a scan.
+When the user returns to work and logs on to their PC, Windows Defender Antivirus will immediately check and download the latest protection updates, and run a scan.
## Set up catch-up protection updates for endpoints that haven't updated for a while
-If Windows Defender AV did not download protection updates for a specified period, you can set it up to automatically check and download the latest update at the next log on. This is useful if you have [globally disabled automatic update downloads on startup](manage-event-based-updates-windows-defender-antivirus.md).
+If Windows Defender Antivirus did not download protection updates for a specified period, you can set it up to automatically check and download the latest update at the next log on. This is useful if you have [globally disabled automatic update downloads on startup](manage-event-based-updates-windows-defender-antivirus.md).
+
+**Use Configuration Manager to configure catch-up protection updates:**
+
+1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**)
+
+2. Go to the **Definition updates** section and configure the following settings:
+
+ 1. Set **Force a definition update if the client computer is offline for more than two consecutive scheduled updates** to **Yes**.
+ 2. For the **If Configuration Manager is used as a source for definition updates...**, specify the hours before which the protection updates delivered by Configuration Manager should be considered out-of-date. This will cause the next update location to be used, based on the defined [fallback source order](manage-protection-updates-windows-defender-antivirus.md#fallback-order).
+
+3. Click **OK**.
+
+4. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers).
**Use Group Policy to enable and configure the catch-up update feature:**
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
+2. In the **Group Policy Management Editor** go to **Computer configuration**.
-4. Click **Policies** then **Administrative templates**.
+3. Click **Policies** then **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates**.
+4. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates**.
-6. Double-click the **Define the number of days after which a catch-up definition update is required** setting and set the option to **Enabled**. Enter the number of days after which you want Windows Defender AV to check for and download the latest protection update.
+5. Double-click the **Define the number of days after which a catch-up definition update is required** setting and set the option to **Enabled**. Enter the number of days after which you want Windows Defender AV to check for and download the latest protection update.
-7. Click **OK**.
+6. Click **OK**.
**Use PowerShell cmdlets to configure catch-up protection updates:**
@@ -78,23 +79,11 @@ See the following for more information and allowed parameters:
- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx)
-**Use Configuration Manager to configure catch-up protection updates:**
-
-1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**)
-
-2. Go to the **Definition updates** section and configure the following settings:
-
- 1. Set **Force a definition update if the client computer is offline for more than two consecutive scheduled updates** to **Yes**.
- 2. For the **If Configuration Manager is used as a source for definition updates...**, specify the hours before which the protection updates delivered by Configuration Manager should be considered out-of-date. This will cause the next update location to be used, based on the defined [fallback source order](manage-protection-updates-windows-defender-antivirus.md#fallback-order).
-
-3. Click **OK**.
-
-4. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers).
## Set the number of days before protection is reported as out-of-date
-You can also specify the number of days after which Windows Defender AV protection is considered old or out-of-date. After the specified number of days, the client will report itself as out-of-date, and show an error to the user of the PC. It may also cause Windows Defender AV to attempt to download an update from other sources (based on the defined [fallback source order](manage-protection-updates-windows-defender-antivirus.md#fallback-order)), such as when using MMPC as a secondary source after setting WSUS or Microsoft Update as the first source.
+You can also specify the number of days after which Windows Defender Antivirus protection is considered old or out-of-date. After the specified number of days, the client will report itself as out-of-date, and show an error to the user of the PC. It may also cause Windows Defender Antivirus to attempt to download an update from other sources (based on the defined [fallback source order](manage-protection-updates-windows-defender-antivirus.md#fallback-order)), such as when using MMPC as a secondary source after setting WSUS or Microsoft Update as the first source.
**Use Group Policy to specify the number of days before protection is considered out-of-date:**
@@ -119,7 +108,7 @@ You can also specify the number of days after which Windows Defender AV protecti
## Set up catch-up scans for endpoints that have not been scanned for a while
-You can set the number of consecutive scheduled scans that can be missed before Windows Defender AV will force a scan.
+You can set the number of consecutive scheduled scans that can be missed before Windows Defender Antivirus will force a scan.
The process for enabling this feature is:
@@ -159,7 +148,7 @@ Set-MpPreference -DisableCatchupQuickScan
```
-See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus.
+See [Use PowerShell cmdlets to manage Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) for more information on how to use PowerShell with Windows Defender Antivirus.
**Use Windows Management Instruction (WMI) to configure catch-up scans:**
@@ -187,9 +176,8 @@ See the following for more information and allowed parameters:
## Related topics
-- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md)
+- [Deploy Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md)
- [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md)
-- [Manage Windows Defender Antivirus protection and definition updates](manage-protection-updates-windows-defender-antivirus.md)
- [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md)
- [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md)
- [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md
index 650a73dafb..efcd9e0cfc 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md
@@ -11,27 +11,16 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
# Manage the schedule for when protection updates should be downloaded and applied
-**Applies to**
-- Windows 10
+**Applies to:**
-**Audience**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-- Network administrators
-
-**Manageability available with**
-
-- Group Policy
-- System Center Configuration Manager
-- PowerShell cmdlets
-- Windows Management Instruction (WMI)
-
-
-Windows Defender AV lets you determine when it should look for and download updates.
+Windows Defender Antivirus lets you determine when it should look for and download updates.
You can schedule updates for your endpoints by:
@@ -41,24 +30,6 @@ You can schedule updates for your endpoints by:
You can also randomize the times when each endpoint checks and downloads protection updates. See the [Schedule scans](scheduled-catch-up-scans-windows-defender-antivirus.md) topic for more information.
-**Use Group Policy to schedule protection updates:**
-
-> [!IMPORTANT]
-> By default, Windows Defender AV will check for an update 15 minutes before the time of any scheduled scans. Enabling these settings will override that default.
-
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Policies** then **Administrative templates**.
-
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates** and configure the following settings:
-
- 1. Double-click the **Specify the interval to check for definition updates** setting and set the option to **Enabled**. Enter the number of hours between updates. Click **OK**.
- 2. Double-click the **Specify the day of the week to check for definition updates** setting and set the option to **Enabled**. Enter the day of the week to check for updates. Click **OK**.
- 3. Double-click the **Specify the time to check for definition updates** setting and set the option to **Enabled**. Enter the time when updates should be checked. The time is based on the local time of the endpoint. Click **OK**.
-
-
**Use Configuration Manager to schedule protection updates:**
1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**)
@@ -73,6 +44,24 @@ You can also randomize the times when each endpoint checks and downloads protect
5. [Deploy the updated policy as usual](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers).
+**Use Group Policy to schedule protection updates:**
+
+> [!IMPORTANT]
+> By default, Windows Defender Antivirus will check for an update 15 minutes before the time of any scheduled scans. Enabling these settings will override that default.
+
+1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+
+3. In the **Group Policy Management Editor** go to **Computer configuration**.
+
+4. Click **Policies** then **Administrative templates**.
+
+5. Expand the tree to **Windows components > Windows Defender Antivirus > Signature Updates** and configure the following settings:
+
+ 1. Double-click the **Specify the interval to check for definition updates** setting and set the option to **Enabled**. Enter the number of hours between updates. Click **OK**.
+ 2. Double-click the **Specify the day of the week to check for definition updates** setting and set the option to **Enabled**. Enter the day of the week to check for updates. Click **OK**.
+ 3. Double-click the **Specify the time to check for definition updates** setting and set the option to **Enabled**. Enter the time when updates should be checked. The time is based on the local time of the endpoint. Click **OK**.
+
+
**Use PowerShell cmdlets to schedule protection updates:**
@@ -102,9 +91,8 @@ See the following for more information and allowed parameters:
## Related topics
-- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md)
+- [Deploy Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md)
- [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md)
-- [Manage Windows Defender Antivirus protection and definition updates](manage-protection-updates-windows-defender-antivirus.md)
- [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md)
- [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md)
- [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md
index fe09121625..e550220a80 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md
@@ -11,34 +11,23 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
# Manage the sources for Windows Defender Antivirus protection updates
-**Applies to**
-- Windows 10
+**Applies to:**
-**Audience**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-- Enterprise security administrators
-
-**Manageability available with**
-
-- Group Policy
-- System Center Configuration Manager
-- PowerShell cmdlets
-- Windows Management Instruction (WMI)
-- Mobile Device Management (MDM)
-
-
+
There are two components to managing protection updates - where the updates are downloaded from, and when updates are downloaded and applied.
This topic describes where you can specify the updates should be downloaded from, also known as the fallback order.
-See the [Manage Windows Defender AV updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) topic for an overview on how updates work, and how to configure other aspects of updates (such as scheduling updates).
+See [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) topic for an overview on how updates work, and how to configure other aspects of updates (such as scheduling updates).
@@ -53,7 +42,7 @@ You can use the following sources:
- [Windows Server Update Service (WSUS)](https://technet.microsoft.com/windowsserver/bb332157.aspx)
- System Center Configuration Manager
- A network file share
-- The [Microsoft Malware Protection Center definitions page (MMPC)](http://www.microsoft.com/security/portal/definitions/adl.aspx)
+- The [Microsoft Malware Protection Center definitions page (MMPC)](https://www.microsoft.com/security/portal/definitions/adl.aspx)
When updates are published, some logic will be applied to minimize the size of the update. In most cases, only the "delta" (or the differences between the latest update and the update that is currently installed on the endpoint) will be downloaded and applied. However, the size of the delta depends on:
@@ -81,8 +70,8 @@ Microsoft Update | You want your endpoints to connect directly to Microsoft Upda
File share | You have non-Internet-connected devices (such as VMs). You can use your Internet-connected VM host to download the updates to a network share, from which the VMs can obtain the updates. See the [VDI deployment guide](deployment-vdi-windows-defender-antivirus.md) for how file shares can be used in virtual desktop infrastructure (VDI) environments.
Configuration Manager | You are using System Center Configuration Manager to update your endpoints.
MMPC | You need to download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-windows-defender-antivirus.md). This option should generally be used only as a final fallback source, and not the primary source. It will only be used if updates cannot be downloaded from WSUS or Microsoft Update for [a specified number of days](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).
-
-
+
+
You can manage the order in which update sources are used with Group Policy, System Center Configuration Manager, PowerShell cmdlets, and WMI.
> [!IMPORTANT]
@@ -101,16 +90,16 @@ The procedures in this article first describe how to set the order, and then how
4. Click **Policies** then **Administrative templates**.
5. Expand the tree to **Windows components > Windows Defender > Signature updates** and configure the following settings:
-
- 1. Double-click the **Define the order of sources for downloading definition updates** setting and set the option to **Enabled**.
- 2. Enter the order of sources, separated by a single pipe, for example: `InternalDefinitionUpdateServer|MicrosoftUpdateServer|MMPC`, as shown in the following screenshot.
+ 1. Double-click the **Define the order of sources for downloading definition updates** setting and set the option to **Enabled**.
+
+ 2. Enter the order of sources, separated by a single pipe, for example: `InternalDefinitionUpdateServer|MicrosoftUpdateServer|MMPC`, as shown in the following screenshot.
- 3. Click **OK**. This will set the order of protection update sources.
+ 3. Click **OK**. This will set the order of protection update sources.
- 1. Double-click the **Define file shares for downloading definition updates** setting and set the option to **Enabled**.
+ 1. Double-click the **Define file shares for downloading definition updates** setting and set the option to **Enabled**.
2. Enter the file share source. If you have multiple sources, enter each source in the order they should be used, separated by a single pipe. Use [standard UNC notation](https://msdn.microsoft.com/en-us/library/gg465305.aspx) for denoting the path, for example: `\\host-name1\share-name\object-name|\\host-name2\share-name\object-name`. If you do not enter any paths then this source will be skipped when the VM downloads updates.
@@ -134,7 +123,7 @@ See the following for more information:
- [Set-MpPreference -SignatureFallbackOrder](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/set-mppreference#-signaturefallbackorder)
- [Set-MpPreference -SignatureDefinitionUpdateFileSharesSouce](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/set-mppreference#-signaturedefinitionupdatefilesharessources)
- [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md)
-- [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx)
+- [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx)
**Use Windows Management Instruction (WMI) to manage the update location:**
@@ -161,11 +150,11 @@ See [Policy CSP - Defender/SignatureUpdateFallbackOrder](https://docs.microsoft.
## Related topics
-- [Deploy, manage updates, and report on Windows Defender AV](deploy-manage-report-windows-defender-antivirus.md)
-- [Manage Windows Defender AV updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md)
-- [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md)
+
+- [Deploy Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md)
+- [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md)
- [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md)
- [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md)
- [Manage updates for mobile devices and VMs](manage-updates-mobile-devices-vms-windows-defender-antivirus.md)
-- [Windows Defender AV in Windows 10](windows-defender-antivirus-in-windows-10.md)
+- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md
index 99051e2f5f..b3541abe11 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md
@@ -11,21 +11,16 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
# Manage Windows Defender Antivirus updates and apply baselines
-
**Applies to:**
-- Windows 10
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Network administrators
-
-There are two types of updates related to keeping Windows Defender Antivirus:
+There are two types of updates related to keeping Windows Defender Antivirus up to date:
1. Protection updates
2. Product updates
@@ -33,14 +28,14 @@ You can also apply [Windows security baselines](https://technet.microsoft.com/en
## Protection updates
-Windows Defender AV uses both [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloaded protection updates to provide protection. These protection updates are also known as "definitions" or "signature updates".
+Windows Defender Antivirus uses both [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloaded protection updates to provide protection. These protection updates are also known as "definitions" or "signature updates".
The cloud-delivered protection is always on and requires an active connection to the Internet to function, while the protection updates generally occur once a day (although this can be configured). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for more details about enabling and configuring cloud-provided protection.
## Product updates
-Windows Defender AV requires [monthly updates](https://support.microsoft.com/en-us/help/4052623/update-for-windows-defender-antimalware-platform) (known as "engine updates" and "platform updates"), and will receive major feature updates alongside Windows 10 releases.
+Windows Defender Antivirus requires [monthly updates](https://support.microsoft.com/en-us/help/4052623/update-for-windows-defender-antimalware-platform) (known as "engine updates" and "platform updates"), and will receive major feature updates alongside Windows 10 releases.
You can manage the distribution of updates through Windows Server Update Service (WSUS), with [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/sum/understand/software-updates-introduction), or in the normal manner that you deploy Microsoft and Windows updates to endpoints in your network.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md
index de30dd760f..ee85e54424 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md
@@ -11,24 +11,14 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
# Manage updates for mobile devices and virtual machines (VMs)
-**Applies to**
-- Windows 10
-
-**Audience**
-
-- Network administrators
-
-**Manageability available with**
-
-- Group Policy
-
-
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
Mobile devices and VMs may require additional configuration to ensure performance is not impacted by updates.
@@ -44,7 +34,7 @@ The following topics may also be useful in these situations:
## Opt-in to Microsoft Update on mobile computers without a WSUS connection
-You can use Microsoft Update to keep definitions on mobile devices running Windows Defender AV up to date when they are not connected to the corporate network or don't otherwise have a WSUS connection.
+You can use Microsoft Update to keep definitions on mobile devices running Windows Defender Antivirus up to date when they are not connected to the corporate network or don't otherwise have a WSUS connection.
This means that protection updates can be delivered to devices (via Microsoft Update) even if you have set WSUS to override Microsoft Update.
@@ -81,7 +71,7 @@ You can opt-in to Microsoft Update on the mobile device in one of the following
## Prevent definition updates when running on battery power
-You can configure Windows Defender AV to only download protection updates when the PC is connected to a wired power source.
+You can configure Windows Defender Antivirus to only download protection updates when the PC is connected to a wired power source.
**Use Group Policy to prevent definition updates on battery power:**
@@ -103,4 +93,4 @@ You can configure Windows Defender AV to only download protection updates when t
## Related topics
- [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md)
-- [Update and manage Windows Defender in Windows 10](deploy-manage-report-windows-defender-antivirus.md)
+- [Update and manage Windows Defender Antivirus in Windows 10](deploy-manage-report-windows-defender-antivirus.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/TOC.md b/windows/security/threat-protection/windows-defender-antivirus/oldTOC.md
similarity index 100%
rename from windows/security/threat-protection/windows-defender-antivirus/TOC.md
rename to windows/security/threat-protection/windows-defender-antivirus/oldTOC.md
diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md
index d0306388a6..73d8882279 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md
@@ -11,28 +11,20 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
-# Prevent users from seeing or interacting with the Windows Defender AV user interface
+# Prevent users from seeing or interacting with the Windows Defender Antivirus user interface
+
**Applies to:**
-- Windows 10
-
-**Audience**
-
-- Enterprise security administrators
-
-**Manageability available with**
-
-- Group Policy
-
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
You can use Group Policy to prevent users on endpoints from seeing the Windows Defender Antivirus interface. You can also prevent them from pausing scans.
## Hide the Windows Defender Antivirus interface
-In Windows 10, versions 1703, hiding the interface will hide Windows Defender AV notifications and prevent the Virus & threat protection tile from appearing in the Windows Defender Security Center app.
+In Windows 10, versions 1703, hiding the interface will hide Windows Defender Antivirus notifications and prevent the Virus & threat protection tile from appearing in the Windows Defender Security Center app.
With the setting set to **Enabled**:
@@ -43,7 +35,7 @@ With the setting set to **Disabled** or not configured:
>[!NOTE]
->Hiding the interface will also prevent Windows Defender AV notifications from appearing on the endpoint. Windows Defender Advanced Threat Protection notifications will still appear. You can also individually [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md)
+>Hiding the interface will also prevent Windows Defender Antivirus notifications from appearing on the endpoint. Windows Defender Advanced Threat Protection notifications will still appear. You can also individually [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md)
In earlier versions of Windows 10, the setting will hide the Windows Defender client interface. If the user attempts to open it, they will receive a warning "Your system administrator has restricted access to this app.":
@@ -87,5 +79,5 @@ You can prevent users from pausing scans. This can be helpful to ensure schedule
- [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md)
-- [Configure end-user interaction with Windows Defender AV](configure-end-user-interaction-windows-defender-antivirus.md)
+- [Configure end-user interaction with Windows Defender Antivirus](configure-end-user-interaction-windows-defender-antivirus.md)
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md
index 79696c63e9..938413082b 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md
@@ -11,26 +11,20 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/10/2018
+ms.date: 09/03/2018
---
-# Report on Windows Defender Antivirus protection
+# Report on Windows Defender Antivirus
**Applies to:**
-- Windows 10
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
+There are a number of ways you can review protection status and alerts, depending on the management tool you are using for Windows Defender Antivirus.
-- IT administrators
+You can use System Center Configuration Manager to [monitor Windows Defender Antivirus](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/monitor-endpoint-protection) or [create email alerts](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-configure-alerts), or you can also monitor protection using [Microsoft Intune](https://docs.microsoft.com/en-us/intune/introduction-intune).
-There are a number of ways you can review protection status and alerts, depending on the management tool you are using for Windows Defender AV.
-
-
-
-You can use System Center Configuration Manager to [monitor Windows Defender AV protection](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/monitor-endpoint-protection) or [create email alerts](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-configure-alerts), or you can also monitor protection using [Microsoft Intune](https://docs.microsoft.com/en-us/intune/introduction-intune).
-
-Microsoft Operations Management Suite has an [Update Compliance add-in](/windows/deployment/update/update-compliance-get-started) that reports on key Windows Defender AV issues, including protection updates and real-time protection settings.
+Microsoft Operations Management Suite has an [Update Compliance add-in](/windows/deployment/update/update-compliance-get-started) that reports on key Windows Defender Antivirus issues, including protection updates and real-time protection settings.
If you have a third-party security information and event management (SIEM) tool, you can also consume [Windows Defender client events](https://msdn.microsoft.com/en-us/library/windows/desktop/aa964766(v=vs.85).aspx).
@@ -46,4 +40,4 @@ For monitoring or determining status with PowerShell, WMI, or Microsoft Azure, s
## Related topics
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
-- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md)
+- [Deploy Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md
index db4d6528c0..37c8231fb3 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md
@@ -11,26 +11,16 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/23/2018
+ms.date: 09/03/2018
---
# Restore quarantined files in Windows Defender AV
-
**Applies to:**
-- Windows 10
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Enterprise security administrators
-
-**Manageability available with**
-
-- Windows Defender Security Center
-
-If Windows Defender Antivirus is configured to detect and remediate threats on your device, Windows Defender AV quarantines suspicious files. If you are certain these files do not present a threat, you can restore them.
+If Windows Defender Antivirus is configured to detect and remediate threats on your device, Windows Defender Antivirus quarantines suspicious files. If you are certain these files do not present a threat, you can restore them.
1. Open **Windows Defender Security Center**.
2. Click **Virus & threat protection** and then click **Scan history**.
@@ -43,5 +33,5 @@ If Windows Defender Antivirus is configured to detect and remediate threats on y
- [Review scan results](review-scan-results-windows-defender-antivirus.md)
- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md)
- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md)
-- [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md)
+- [Configure Windows Defender Antivirus exclusions on Windows Server](configure-server-exclusions-windows-defender-antivirus.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md
index 151f4e6a10..802c92f163 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md
@@ -11,38 +11,30 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/10/2018
+ms.date: 09/03/2018
---
-# Review Windows Defender AV scan results
-
+# Review Windows Defender Antivirus scan results
**Applies to:**
-- Windows 10
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Enterprise security administrators
-
-**Manageability available with**
-
-- PowerShell
-- Windows Management Instrumentation (WMI)
-- System Center Configuration Manager
-- Microsoft Intune
-- Windows Defender Security Center app
+After an Windows Defender Antivirus scan completes, whether it is an [on-demand](run-scan-windows-defender-antivirus.md) or [scheduled scan](scheduled-catch-up-scans-windows-defender-antivirus.md), the results are recorded and you can view the results.
-After Windows Defender Antivirus has completed a scan, whether it is an [on-demand](run-scan-windows-defender-antivirus.md) or [scheduled scan](scheduled-catch-up-scans-windows-defender-antivirus.md), the results are recorded and you can view the results.
+**Use Microsoft Intune to review scan results:**
+1. In Intune, go to **Devices > All Devices** and select the device you want to scan.
-**Use Configuration Manager to review Windows Defender AV scan results:**
+2. Click the scan results in **Device actions status**.
+
+**Use Configuration Manager to review scan results:**
See [How to monitor Endpoint Protection status](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/monitor-endpoint-protection).
-**Use the Windows Defender Security Center app to review Windows Defender AV scan results:**
+**Use the Windows Defender Security Center app to review scan results:**
1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**.
@@ -54,7 +46,7 @@ See [How to monitor Endpoint Protection status](https://docs.microsoft.com/en-us
-**Use PowerShell cmdlets to review Windows Defender AV scan results:**
+**Use PowerShell cmdlets to review scan results:**
The following cmdlet will return each detection on the endpoint. If there are multiple detections of the same threat, each detection will be listed separately, based on the time of each detection:
@@ -76,20 +68,15 @@ Get-MpThreat
See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus.
-**Use Windows Management Instruction (WMI) to review Windows Defender AV scan results:**
+**Use Windows Management Instruction (WMI) to review scan results:**
Use the [**Get** method of the **MSFT_MpThreat** and **MSFT_MpThreatDetection**](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) classes.
-**Use Microsoft Intune to review Windows Defender AV scan results:**
-
-1. In Intune, go to **Devices > All Devices** and select the device you want to scan.
-
-2. Click the scan results in **Device actions status**.
## Related topics
-- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
+- [Customize, initiate, and review the results of Windows Defender Antivirus scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md
index cfa4f029ba..9a93cd3335 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md
@@ -11,46 +11,32 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/10/2018
+ms.date: 09/03/2018
---
-
-
-
-
-# Configure and run on-demand Windows Defender AV scans
+# Configure and run on-demand Windows Defender Antivirus scans
**Applies to:**
-- Windows 10
-
-**Audience**
-
-- Enterprise security administrators
-
-**Manageability available with**
-
-- Windows Defender AV mpcmdrun utility
-- PowerShell
-- Windows Management Instrumentation (WMI)
-- System Center Configuration Manager
-- Microsoft Intune
-- Windows Defender Security Center app
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
You can run an on-demand scan on individual endpoints. These scans will start immediately, and you can define parameters for the scan, such as the location or type.
-## Quick scan versus full scan and custom scan
+## Quick scan versus full scan
Quick scan looks at all the locations where there could be malware registered to start with the system, such as registry keys and known Windows startup folders.
-Combined with [always-on real-time protection capability](configure-real-time-protection-windows-defender-antivirus.md), which reviews files when they are opened and closed, and whenever a user navigates to a folder, a quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware.
+Combined with [always-on real-time protection capability](configure-real-time-protection-windows-defender-antivirus.md)--which reviews files when they are opened and closed, and whenever a user navigates to a folder--a quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware.
In most instances, this means a quick scan is adequate to find malware that wasn't picked up by real-time protection.
-A full scan can be useful on endpoints that have encountered a malware threat to identify if there are any inactive components that require a more thorough clean-up, and can be ideal when running on-demand scans.
+A full scan can be useful on endpoints that have encountered a malware threat to identify if there are any inactive components that require a more thorough clean-up, and can be ideal when running on-demand scans.
-A custom scan allows you to specify files or folders to scan, such as a USB drive.
+
+**Use Configuration Manager to run a scan:**
+
+See [Antimalware and firewall tasks: How to perform an on-demand scan](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-firewall#how-to-perform-an-on-demand-scan-of-computers) for details on using System Center Configuration Manager (current branch) to run a scan.
**Use the mpcmdrum.exe command-line utility to run a scan:**
@@ -66,10 +52,11 @@ See [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defen
-**Use Configuration Manager to run a scan:**
+**Use Microsoft Intune to run a scan:**
-See [Antimalware and firewall tasks: How to perform an on-demand scan](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-firewall#how-to-perform-an-on-demand-scan-of-computers) for details on using System Center Configuration Manager (current branch) to run a scan.
+1. In Intune, go to **Devices > All Devices** and select the device you want to scan.
+2. Select **...More** and then select **Quick Scan** or **Full Scan**.
**Use the Windows Defender Security Center app to run a scan:**
@@ -97,16 +84,9 @@ See the following for more information and allowed parameters:
- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx)
-**Use Microsoft Intune to run a scan:**
-
-1. In Intune, go to **Devices > All Devices** and select the device you want to scan.
-
-2. Select **...More** and then select **Quick Scan** or **Full Scan**.
-
-
## Related topics
-- [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md)
-- [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md)
+- [Configure Windows Defender Antivirus scanning options](configure-advanced-scan-types-windows-defender-antivirus.md)
+- [Configure scheduled Windows Defender Antivirus scans](scheduled-catch-up-scans-windows-defender-antivirus.md)
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md
index 20c62b31b9..4bb34b0d77 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md
@@ -11,32 +11,17 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/26/2018
+ms.date: 09/03/2018
---
+# Configure scheduled quick or full Windows Defender Antivirus scans
-# Configure scheduled quick or full scans for Windows Defender AV
-
-
-
-**Applies to**
-- Windows 10
-
-**Audience**
-
-- Enterprise security administrators
-
-**Manageability available with**
-
-- Group Policy
-- System Center Configuration Manager
-- PowerShell cmdlets
-- Windows Management Instruction (WMI)
-
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
> [!NOTE]
-> By default, Windows Defender AV will check for an update 15 minutes before the time of any scheduled scans. You can [Manage the schedule for when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) to override this default.
+> By default, Windows Defender Antivirus checks for an update 15 minutes before the time of any scheduled scans. You can [Manage the schedule for when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) to override this default.
In addition to always-on real-time protection and [on-demand](run-scan-windows-defender-antivirus.md) scans, you can set up regular, scheduled scans.
@@ -86,7 +71,7 @@ Location | Setting | Description | Default setting (if not configured)
Scan | Specify the scan type to use for a scheduled scan | Quick scan
Scan | Specify the day of the week to run a scheduled scan | Specify the day (or never) to run a scan. | Never
Scan | Specify the time of day to run a scheduled scan | Specify the number of minutes after midnight (for example, enter **60** for 1 am). | 2 am
-Root | Randomize scheduled task times | Randomize the start time of the scan to any interval from 0 to 4 hours, or to any interval plus or minus 30 minutes for non-Windows Defender scans. This can be useful in VM or VDI deployments. | Enabled
+Root | Randomize scheduled task times | Randomize the start time of the scan to any interval from 0 to 4 hours, or to any interval plus or minus 30 minutes for non-Windows Defender Antivirus scans. This can be useful in VM or VDI deployments. | Enabled
**Use PowerShell cmdlets to schedule scans:**
@@ -241,8 +226,8 @@ Signature updates | Turn on scan after signature update | A scan will occur imme
- [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md)
-- [Configure and run on-demand Windows Defender AV scans](run-scan-windows-defender-antivirus.md)
-- [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md)
+- [Configure and run on-demand Windows Defender Antivirus scans](run-scan-windows-defender-antivirus.md)
+- [Configure Windows Defender Antivirus scanning options](configure-advanced-scan-types-windows-defender-antivirus.md)
- [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md)
- [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md)
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md
index b2b7a4640f..592aa7ffe9 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md
@@ -11,26 +11,14 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/19/2018
+ms.date: 09/03/2018
---
# Specify the cloud-delivered protection level
-
-
**Applies to:**
-- Windows 10, version 1703 and later
-
-**Audience**
-
-- Enterprise security administrators
-
-**Manageability available with**
-
-- Group Policy
-- System Center Configuration Manager (current branch)
-- Intune
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
You can specify the level of cloud-protection offered by Windows Defender Antivirus with Group Policy and System Center Configuration Manager.
@@ -39,27 +27,6 @@ You can specify the level of cloud-protection offered by Windows Defender Antivi
-**Use Group Policy to specify the level of cloud-delivered protection:**
-
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-
-3. In the **Group Policy Management Editor** go to **Computer configuration**.
-
-4. Click **Administrative templates**.
-
-5. Expand the tree to **Windows components > Windows Defender Antivirus > MpEngine**.
-
-1. Double-click the **Select cloud protection level** setting and set it to **Enabled**. Select the level of protection:
- 1. Setting to **Default Windows Defender Antivirus blocking level** will provide strong detection without increasing the risk of detecting legitimate files.
- 2. Setting to **High blocking level** will apply a strong level of detection. While unlikely, some legitimate files may be detected (although you will have the option to unblock or dispute that detection).
-
-1. Click **OK**.
-
-
-**Use Configuration Manager to specify the level of cloud-delivered protection:**
-
-1. See [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) for details on configuring System Center Configuration Manager (current branch).
-
**Use Intune to specify the level of cloud-delivered protection:**
1. Sign in to the [Azure portal](https://portal.azure.com).
@@ -80,6 +47,28 @@ You can specify the level of cloud-protection offered by Windows Defender Antivi
For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](https://docs.microsoft.com/en-us/intune/device-profiles)
+**Use Configuration Manager to specify the level of cloud-delivered protection:**
+
+1. See [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) for details on configuring System Center Configuration Manager (current branch).
+
+**Use Group Policy to specify the level of cloud-delivered protection:**
+
+1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+
+3. In the **Group Policy Management Editor** go to **Computer configuration**.
+
+4. Click **Administrative templates**.
+
+5. Expand the tree to **Windows components > Windows Defender Antivirus > MpEngine**.
+
+1. Double-click the **Select cloud protection level** setting and set it to **Enabled**. Select the level of protection:
+ 1. Setting to **Default Windows Defender Antivirus blocking level** will provide strong detection without increasing the risk of detecting legitimate files.
+ 2. Setting to **High blocking level** will apply a strong level of detection. While unlikely, some legitimate files may be detected (although you will have the option to unblock or dispute that detection).
+
+1. Click **OK**.
+
+
+
## Related topics
diff --git a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md
index 28d890360d..ae18d78a72 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md
@@ -11,18 +11,14 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
# Troubleshoot Windows Defender Antivirus reporting in Update Compliance
**Applies to:**
-- Windows 10
-
-**Audience**
-
-- IT administrators
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
When you use [Windows Analytics Update Compliance to obtain reporting into the protection status of machines or endpoints](/windows/deployment/update/update-compliance-using#wdav-assessment) in your network that are using Windows Defender Antivirus, you may encounter problems or issues.
@@ -31,7 +27,7 @@ Typically, the most common indicators of a problem are:
- You do not see any devices at all
- The reports and information you do see is outdated (older than a few days)
-For common error codes and event IDs related to the Windows Defender AV service that are not related to Update Compliance, see the [Windows Defender Antivirus events](troubleshoot-windows-defender-antivirus.md) topic.
+For common error codes and event IDs related to the Windows Defender Antivirus service that are not related to Update Compliance, see [Windows Defender Antivirus events](troubleshoot-windows-defender-antivirus.md).
There are three steps to troubleshooting these problems:
@@ -40,12 +36,12 @@ There are three steps to troubleshooting these problems:
3. Submit support logs
>[!IMPORTANT]
->It typically takes 3 days for devices to start appearing in Update Compliance
+>It typically takes 3 days for devices to start appearing in Update Compliance.
## Confirm pre-requisites
-In order for devices to properly show up in Update Compliance, you have to meet certain pre-requisites for both the Update Compliance service and for Windows Defender AV protection:
+In order for devices to properly show up in Update Compliance, you have to meet certain pre-requisites for both the Update Compliance service and for Windows Defender Antivirus:
>[!div class="checklist"]
>- Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](windows-defender-antivirus-compatibility.md) and the endpoint will not be reported in Update Compliance.
@@ -67,4 +63,4 @@ If the above pre-requisites have all been met, you may need to proceed to the ne
## Related topics
- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
-- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md)
+- [Deploy Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md
index c71d3ab6c0..7d53f93ac2 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md
@@ -11,45 +11,40 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/16/2018
+ms.date: 09/03/2018
---
-# Review event logs and error codes to troubleshoot issues with Windows Defender AV
+# Review event logs and error codes to troubleshoot issues with Windows Defender Antivirus
+**Applies to:**
-**Applies to**
-- Windows 10
-- Windows Server 2016
-
-**Audience**
-
-- Enterprise security administrators
-
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
If you encounter a problem with Windows Defender Antivirus, you can search the tables in this topic to find a matching issue and potential solution.
The tables list:
-- [Windows Defender AV event IDs](#windows-defender-av-ids) (these apply to both Windows 10 and Windows Server 2016)
-- [Windows Defender AV client error codes](#error-codes)
-- [Internal Windows Defender AV client error codes (used by Microsoft during development and testing)](#internal-error-codes)
+- [Windows Defender Antivirus event IDs](#windows-defender-av-ids) (these apply to both Windows 10 and Windows Server 2016)
+- [Windows Defender Antivirus client error codes](#error-codes)
+- [Internal Windows Defender Antivirus client error codes (used by Microsoft during development and testing)](#internal-error-codes)
>[!TIP]
->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working:
+>You can also visit the Windows Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working:
+
>- Cloud-delivered protection
>- Fast learning (including Block at first sight)
>- Potentially unwanted application blocking
-## Windows Defender AV event IDs
+## Windows Defender Antivirus event IDs
-Windows Defender AV records event IDs in the Windows event log.
+Windows Defender Antivirus records event IDs in the Windows event log.
-You can directly view the event log, or if you have a third-party security information and event management (SIEM) tool, you can also consume [Windows Defender client event IDs](troubleshoot-windows-defender-antivirus.md#windows-defender-av-ids) to review specific events and errors from your endpoints.
+You can directly view the event log, or if you have a third-party security information and event management (SIEM) tool, you can also consume [Windows Defender Antivirus client event IDs](troubleshoot-windows-defender-antivirus.md#windows-defender-av-ids) to review specific events and errors from your endpoints.
-The table in this section lists the main Windows Defender AV event IDs and, where possible, provides suggested solutions to fix or resolve the error.
+The table in this section lists the main Windows Defender Antivirus event IDs and, where possible, provides suggested solutions to fix or resolve the error.
-**To view a Windows Defender AV event**
+**To view a Windows Defender Antivirus event**
1. Open **Event Viewer**.
2. In the console tree, expand **Applications and Services Logs**, then **Microsoft**, then **Windows**, then **Windows Defender Antivirus**.
@@ -330,7 +325,7 @@ Description of the error.
User action:
-The Windows Defender client encountered an error, and the current scan has stopped. The scan might fail due to a client-side issue. This event record includes the scan ID, type of scan (antivirus, antispyware, antimalware), scan parameters, the user that started the scan, the error code, and a description of the error.
+The antivirus client encountered an error, and the current scan has stopped. The scan might fail due to a client-side issue. This event record includes the scan ID, type of scan (Windows Defender Antivirus, antispyware, antimalware), scan parameters, the user that started the scan, the error code, and a description of the error.
To troubleshoot this event:
Run the scan again.
@@ -438,7 +433,7 @@ Message:
Description:
-Windows Defender has taken action to protect this machine from malware or other potentially unwanted software. For more information please see the following:
+Windows Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software. For more information please see the following:
User: <Domain>\\<User>
Name: <Threat name>
@@ -490,7 +485,7 @@ Message:
Description:
-Windows Defender has encountered an error when taking action on malware or other potentially unwanted software. For more information please see the following:
+Windows Defender Antivirus has encountered an error when taking action on malware or other potentially unwanted software. For more information please see the following:
User: <Domain>\\<User>
Name: <Threat name>
@@ -549,7 +544,7 @@ Message:
Description:
-Windows Defender has restored an item from quarantine. For more information please see the following:
+Windows Defender Antivirus has restored an item from quarantine. For more information please see the following:
Name: <Threat name>
ID: <Threat ID>
@@ -593,7 +588,7 @@ Message:
Description:
-Windows Defender has encountered an error trying to restore an item from quarantine. For more information please see the following:
+Windows Defender Antivirus has encountered an error trying to restore an item from quarantine. For more information please see the following:
Name: <Threat name>
ID: <Threat ID>
@@ -640,7 +635,7 @@ Message:
Description:
-Windows Defender has deleted an item from quarantine.
+Windows Defender Antivirus has deleted an item from quarantine.
For more information please see the following:
Name: <Threat name>
@@ -684,7 +679,7 @@ Message:
Description:
-Windows Defender has encountered an error trying to delete an item from quarantine.
+Windows Defender Antivirus has encountered an error trying to delete an item from quarantine.
For more information please see the following:
Name: <Threat name>
@@ -732,7 +727,7 @@ Message:
Description:
-Windows Defender has removed history of malware and other potentially unwanted software.
+Windows Defender Antivirus has removed history of malware and other potentially unwanted software.
Time: The time when the event occurred, for example when the history is purged. Note that this parameter is not used in threat events so that there is no confusion regarding whether it is remediation time or infection time. For those, we specifically call them as Action Time or Detection Time.
User: <Domain>\\<User>
@@ -763,7 +758,7 @@ The antimalware platform could not delete history of malware and other potential
Description:
-Windows Defender has encountered an error trying to remove history of malware and other potentially unwanted software.
+Windows Defender Antivirus has encountered an error trying to remove history of malware and other potentially unwanted software.
Time: The time when the event occurred, for example when the history is purged. Note that this parameter is not used in threat events so that there is no confusion regarding whether it is remediation time or infection time. For those, we specifically call them as Action Time or Detection Time.
User: <Domain>\\<User>
@@ -798,7 +793,7 @@ Message:
Description:
-Windows Defender has detected a suspicious behavior.
+Windows Defender Antivirus has detected a suspicious behavior.
For more information please see the following:
Name: <Threat name>
@@ -876,7 +871,7 @@ Message:
Description:
-Windows Defender has detected malware or other potentially unwanted software.
+Windows Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
Name: <Threat name>
@@ -930,7 +925,7 @@ UAC
User action:
-No action is required. Windows Defender can suspend and take routine action on this threat. If you want to remove the threat manually, in the Windows Defender interface, click Clean Computer.
+No action is required. Windows Defender Antivirus can suspend and take routine action on this threat. If you want to remove the threat manually, in the Windows Defender Antivirus interface, click Clean Computer.
@@ -958,7 +953,7 @@ Message:
Description:
-Windows Defender has taken action to protect this machine from malware or other potentially unwanted software.
+Windows Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software.
For more information please see the following:
Name: <Threat name>
@@ -1020,7 +1015,7 @@ Description of the error.
Signature Version: <Definition version>
Engine Version: <Antimalware Engine version>
NOTE:
-Whenever Windows Defender, Microsoft Security Essentials, Malicious Software Removal Tool, or System Center Endpoint Protection detects a malware, it will restore the following system settings and services which the malware might have changed:
+Whenever Windows Defender Antivirus, Microsoft Security Essentials, Malicious Software Removal Tool, or System Center Endpoint Protection detects a malware, it will restore the following system settings and services which the malware might have changed:
Default Internet Explorer or Microsoft Edge setting
User Access Control settings
Chrome settings
@@ -1059,7 +1054,7 @@ Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Se
User action:
-No action is necessary. Windows Defender removed or quarantined a threat.
+No action is necessary. Windows Defender Antivirus removed or quarantined a threat.
@@ -1086,7 +1081,7 @@ Message:
Description:
-Windows Defender has encountered a non-critical error when taking action on malware or other potentially unwanted software.
+Windows Defender Antivirus has encountered a non-critical error when taking action on malware or other potentially unwanted software.
For more information please see the following:
Name: <Threat name>
@@ -1155,7 +1150,7 @@ Description of the error.
User action:
-No action is necessary. Windows Defender failed to complete a task related to the malware remediation. This is not a critical failure.
+No action is necessary. Windows Defender Antivirus failed to complete a task related to the malware remediation. This is not a critical failure.
@@ -1182,7 +1177,7 @@ Message:
Description:
-Windows Defender has encountered a critical error when taking action on malware or other potentially unwanted software.
+Windows Defender Antivirus has encountered a critical error when taking action on malware or other potentially unwanted software.
For more information please see the following:
Name: <Threat name>
@@ -1251,7 +1246,7 @@ Description of the error.
User action:
-The Windows Defender client encountered this error due to critical issues. The endpoint might not be protected. Review the error description then follow the relevant User action steps below.
+The Windows Defender Antivirus client encountered this error due to critical issues. The endpoint might not be protected. Review the error description then follow the relevant User action steps below.
Action
@@ -1314,7 +1309,7 @@ Symbolic name:
Message:
-Windows Defender has deduced the hashes for a threat resource.
+Windows Defender Antivirus has deduced the hashes for a threat resource.
@@ -1322,7 +1317,7 @@ Message:
Description:
-Windows Defender client is up and running in a healthy state.
+Windows Defender Antivirus client is up and running in a healthy state.
Current Platform Version: <Current platform version>
Threat Resource Path: <Path>
@@ -1361,7 +1356,7 @@ Message:
Description:
-Windows Defender client is up and running in a healthy state.
+Windows Defender Antivirus client is up and running in a healthy state.
Platform Version: <Current platform version>
Signature Version: <Definition version>
@@ -1402,7 +1397,7 @@ Message:
Description:
-Windows Defender client health report.
+Antivirus client health report.
Platform Version: <Current platform version>
Engine Version: <Antimalware Engine version>
@@ -1456,7 +1451,7 @@ Message:
Description:
-Windows Defender signature version has been updated.
+Antivirus signature version has been updated.
Current Signature Version: <Current signature version>
@@ -1479,7 +1474,7 @@ Windows Defender signature version has been updated.
User action:
-No action is necessary. The Windows Defender client is in a healthy state. This event is reported when signatures are successfully updated.
+No action is necessary. The Windows Defender Antivirus client is in a healthy state. This event is reported when signatures are successfully updated.
@@ -1506,7 +1501,7 @@ Message:
Description:
-Windows Defender has encountered an error trying to update signatures.
+Windows Defender Antivirus has encountered an error trying to update signatures.
@@ -1598,7 +1593,7 @@ Windows Defender engine version has been updated.
User action:
-No action is necessary. The Windows Defender client is in a healthy state. This event is reported when the antimalware engine is successfully updated.
+No action is necessary. The Windows Defender Antivirus client is in a healthy state. This event is reported when the antimalware engine is successfully updated.
@@ -1625,7 +1620,7 @@ Message:
Description:
-Windows Defender has encountered an error trying to update the engine.
+Windows Defender Antivirus has encountered an error trying to update the engine.
@@ -1643,7 +1638,7 @@ Description of the error.
User action:
-The Windows Defender client update failed. This event occurs when the client fails to update itself. This event is usually due to an interruption in network connectivity during an update.
+The Windows Defender Antivirus client update failed. This event occurs when the client fails to update itself. This event is usually due to an interruption in network connectivity during an update.
To troubleshoot this event:
[Update definitions](manage-updates-baselines-windows-defender-antivirus.md) and force a rescan directly on the endpoint.
@@ -1675,7 +1670,7 @@ Message:
Description:
-Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
+Windows Defender Antivirus has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
Signatures Attempted:
Error Code: <Error code>
@@ -1692,7 +1687,7 @@ Description of the error.
User action:
-The Windows Defender client attempted to download and install the latest definitions file and failed. This error can occur when the client encounters an error while trying to load the definitions, or if the file is corrupt. Windows Defender will attempt to revert back to a known-good set of definitions.
+The Windows Defender Antivirus client attempted to download and install the latest definitions file and failed. This error can occur when the client encounters an error while trying to load the definitions, or if the file is corrupt. Windows Defender Antivirus will attempt to revert back to a known-good set of definitions.
To troubleshoot this event:
Restart the computer and try again.
@@ -1727,7 +1722,7 @@ Message:
Description:
-Windows Defender could not load antimalware engine because current platform version is not supported. Windows Defender will revert back to the last known-good engine and a platform update will be attempted.
+Windows Defender Antivirus could not load antimalware engine because current platform version is not supported. Windows Defender Antivirus will revert back to the last known-good engine and a platform update will be attempted.
Current Platform Version: <Current platform version>
@@ -1758,7 +1753,7 @@ Message:
Description:
-Windows Defender has encountered an error trying to update the platform.
+Windows Defender Antivirus has encountered an error trying to update the platform.
Current Platform Version: <Current platform version>
-Windows Defender will soon require a newer platform version to support future versions of the antimalware engine. Download the latest Windows Defender platform to maintain the best level of protection available.
+Windows Defender Antivirus will soon require a newer platform version to support future versions of the antimalware engine. Download the latest Windows Defender Antivirus platform to maintain the best level of protection available.
Current Platform Version: <Current platform version>
@@ -1822,7 +1817,7 @@ Message:
Description:
-Windows Defender used Dynamic Signature Service to retrieve additional signatures to help protect your machine.
+Windows Defender Antivirus used Dynamic Signature Service to retrieve additional signatures to help protect your machine.
Current Signature Version: <Current signature version>
Signature Type: <Signature type>, for example:
@@ -1880,7 +1875,7 @@ Message:
Description:
-Windows Defender used Dynamic Signature Service to discard obsolete signatures.
+Windows Defender Antivirus used Dynamic Signature Service to discard obsolete signatures.
Current Signature Version: <Current signature version>
Signature Type: <Signature type>, for example:
@@ -1919,7 +1914,7 @@ Windows Defender used Dynamic Signature Service to discard obsolete signa
User action:
-No action is necessary. The Windows Defender client is in a healthy state. This event is reported when the Dynamic Signature Service successfully deletes out-of-date dynamic definitions.
+No action is necessary. The Windows Defender Antivirus client is in a healthy state. This event is reported when the Dynamic Signature Service successfully deletes out-of-date dynamic definitions.
@@ -1947,7 +1942,7 @@ Message:
Description:
-Windows Defender has encountered an error trying to use Dynamic Signature Service.
+Windows Defender Antivirus has encountered an error trying to use Dynamic Signature Service.
Current Signature Version: <Current signature version>
Signature Type: <Signature type>, for example:
@@ -2017,7 +2012,7 @@ Message:
Description:
-Windows Defender discarded all Dynamic Signature Service signatures.
+Windows Defender Antivirus discarded all Dynamic Signature Service signatures.
Current Signature Version: <Current signature version>
@@ -2048,7 +2043,7 @@ Message:
Description:
-Windows Defender downloaded a clean file.
+Windows Defender Antivirus downloaded a clean file.
Filename: <File name>
Name of the file.
@@ -2081,7 +2076,7 @@ Message:
Description:
-Windows Defender has encountered an error trying to download a clean file.
+Windows Defender Antivirus has encountered an error trying to download a clean file.
Filename: <File name>
Name of the file.
@@ -2100,7 +2095,7 @@ User action:
Check your Internet connectivity settings.
-The Windows Defender client encountered an error when using the Dynamic Signature Service to download the latest definitions to a specific threat. This error is likely caused by a network connectivity issue.
+The Windows Defender Antivirus client encountered an error when using the Dynamic Signature Service to download the latest definitions to a specific threat. This error is likely caused by a network connectivity issue.
@@ -2126,7 +2121,7 @@ Message:
Description:
-Windows Defender downloaded and configured Windows Defender Offline to run on the next reboot.
+Windows Defender Antivirus downloaded and configured offline antivirus to run on the next reboot.
@@ -2153,7 +2148,7 @@ Message:
Description:
-Windows Defender has encountered an error trying to download and configure Windows Defender Offline.
+Windows Defender Antivirus has encountered an error trying to download and configure offline antivirus.
Error Code: <Error code>
Result code associated with threat status. Standard HRESULT values.
@@ -2187,7 +2182,7 @@ Message:
Description:
-The support for your operating system will expire shortly. Running Windows Defender on an out of support operating system is not an adequate solution to protect against threats.
+The support for your operating system will expire shortly. Running Windows Defender Antivirus on an out of support operating system is not an adequate solution to protect against threats.
@@ -2215,7 +2210,7 @@ Message:
Description:
-The support for your operating system has expired. Running Windows Defender on an out of support operating system is not an adequate solution to protect against threats.
+The support for your operating system has expired. Running Windows Defender Antivirus on an out of support operating system is not an adequate solution to protect against threats.
@@ -2243,7 +2238,7 @@ Message:
Description:
-The support for your operating system has expired. Windows Defender is no longer supported on your operating system, has stopped functioning, and is not protecting against malware threats.
+The support for your operating system has expired. Windows Defender Antivirus is no longer supported on your operating system, has stopped functioning, and is not protecting against malware threats.
@@ -2270,7 +2265,7 @@ Message:
Description:
-Windows Defender Real-Time Protection feature has encountered an error and failed.
+Windows Defender Antivirus Real-Time Protection feature has encountered an error and failed.
Feature: <Feature>, for example:
@@ -2284,7 +2279,7 @@ Windows Defender Real-Time Protection feature has encountered an error and faile
Result code associated with threat status. Standard HRESULT values.
Error Description: <Error description>
Description of the error.
-
Reason: The reason Windows Defender real-time protection has restarted a feature.
+
Reason: The reason Windows Defender Antivirus real-time protection has restarted a feature.
@@ -2294,7 +2289,7 @@ User action:
You should restart the system then run a full scan because it's possible the system was not protected for some time.
-The Windows Defender client's real-time protection feature encountered an error because one of the services failed to start.
+The Windows Defender Antivirus client's real-time protection feature encountered an error because one of the services failed to start.
If it is followed by a 3007 event ID, the failure was temporary and the antimalware client recovered from the failure.
@@ -2322,7 +2317,7 @@ Message:
Description:
-Windows Defender Real-time Protection has restarted a feature. It is recommended that you run a full system scan to detect any items that may have been missed while this agent was down.
+Windows Defender Antivirus Real-time Protection has restarted a feature. It is recommended that you run a full system scan to detect any items that may have been missed while this agent was down.
Feature: <Feature>, for example:
@@ -2332,7 +2327,7 @@ Windows Defender Real-time Protection has restarted a feature. It is recommended
Network Inspection System
-
Reason: The reason Windows Defender real-time protection has restarted a feature.
+
Reason: The reason Windows Defender Antivirus real-time protection has restarted a feature.
@@ -2369,7 +2364,7 @@ Message:
Description:
-Windows Defender Real-time Protection scanning for malware and other potentially unwanted software was enabled.
+Windows Defender Antivirus real-time protection scanning for malware and other potentially unwanted software was enabled.
@@ -2396,7 +2391,7 @@ Message:
Description:
-Windows Defender Real-time Protection scanning for malware and other potentially unwanted software was disabled.
+Windows Defender Antivirus real-time protection scanning for malware and other potentially unwanted software was disabled.
@@ -2424,7 +2419,7 @@ Message:
Description:
-Windows Defender Real-time Protection feature configuration has changed.
+Windows Defender Antivirus real-time protection feature configuration has changed.
Feature: <Feature>, for example:
@@ -2462,12 +2457,12 @@ Message:
Description:
-Windows Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
+Windows Defender Antivirus configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
Old value: <Old value number>
-Old Windows Defender configuration value.
+Old antivirus configuration value.
New value: <New value number>
-New Windows Defender configuration value.
+New antivirus configuration value.
@@ -2494,7 +2489,7 @@ Message:
Description:
-Windows Defender engine has been terminated due to an unexpected error.
+Windows Defender Antivirus engine has been terminated due to an unexpected error.
Failure Type: <Failure type>, for example:
Crash
@@ -2525,7 +2520,7 @@ To troubleshoot this event:
User action:
-The Windows Defender client engine stopped due to an unexpected error.
+The Windows Defender Antivirus client engine stopped due to an unexpected error.
To troubleshoot this event:
Run the scan again.
@@ -2560,7 +2555,7 @@ Message:
Description:
-Windows Defender scanning for malware and other potentially unwanted software has been enabled.
+Windows Defender Antivirus scanning for malware and other potentially unwanted software has been enabled.
@@ -2587,7 +2582,7 @@ Message:
Description:
-Windows Defender scanning for malware and other potentially unwanted software is disabled.
+Windows Defender Antivirus scanning for malware and other potentially unwanted software is disabled.
@@ -2613,7 +2608,7 @@ Message:
Description:
-Windows Defender scanning for viruses has been enabled.
+Windows Defender Antivirus scanning for viruses has been enabled.
@@ -2641,7 +2636,7 @@ Message:
Description:
-Windows Defender scanning for viruses is disabled.
+Windows Defender Antivirus scanning for viruses is disabled.
@@ -2669,10 +2664,10 @@ Message:
Description:
-Windows Defender has entered a grace period and will soon expire. After expiration, this program will disable protection against viruses, spyware, and other potentially unwanted software.
+Windows Defender Antivirus has entered a grace period and will soon expire. After expiration, this program will disable protection against viruses, spyware, and other potentially unwanted software.
-
Expiration Reason: The reason Windows Defender will expire.
-
Expiration Date: The date Windows Defender will expire.
+
Expiration Reason: The reason Windows Defender Antivirus will expire.
+
Expiration Date: The date Windows Defender Antivirus will expire.
@@ -2701,7 +2696,7 @@ Message:
Description:
-Windows Defender grace period has expired. Protection against viruses, spyware, and other potentially unwanted software is disabled.
+Windows Defender Antivirus grace period has expired. Protection against viruses, spyware, and other potentially unwanted software is disabled.
Expiration Reason:
Expiration Date:
@@ -2715,7 +2710,7 @@ Description of the error.
-## Windows Defender client error codes
+## Windows Defender Antivirus client error codes
If Windows Defender Antivirus experiences any issues it will usually give you an error code to help you troubleshoot the issue. Most often an error means there was a problem installing an update.
This section provides the following information about Windows Defender Antivirus client errors.
- The error code
@@ -2765,7 +2760,7 @@ This error indicates that there might be a problem with your security product.
Resolution
Update the definitions. Either:
-
Click the Update definitions button on the Update tab in Windows Defender. Or,
+
Click the Update definitions button on the Update tab in Windows Defender Antivirus. Or,
Download the latest definitions from the Windows Defender Security Intelligence site.
Note: The size of the definitions file downloaded from the site can exceed 60 MB and should not be used as a long-term solution for updating definitions.
@@ -2797,7 +2792,7 @@ data that does not allow the engine to function properly.
Possible reason
-This error indicates that Windows Defender failed to quarantine a threat.
+This error indicates that Windows Defender Antivirus failed to quarantine a threat.
-This error indicates that Windows Defender does not support the current version of the platform and requires a new version of the platform.
+This error indicates that Windows Defender Antivirus does not support the current version of the platform and requires a new version of the platform.
Resolution
-You can only use Windows Defender in Windows 10. For Windows 8, Windows 7 and Windows Vista, you can use System Center Endpoint Protection.
+You can only use Windows Defender Antivirus in Windows 10. For Windows 8, Windows 7 and Windows Vista, you can use System Center Endpoint Protection.
-The following error codes are used during internal testing of Windows Defender AV.
+The following error codes are used during internal testing of Windows Defender Antivirus.
If you see these errors, you can try to [update definitions](manage-updates-baselines-windows-defender-antivirus.md) and force a rescan directly on the endpoint.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md
index f13977e93c..d4fbc2f0c0 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md
@@ -1,6 +1,6 @@
---
-title: Configure Windows Defender AV with Group Policy
-description: Configure Windows Defender AV settings with Group Policy
+title: Configure Windows Defender Antivirus with Group Policy
+description: Configure Windows Defender Antivirus settings with Group Policy
keywords: group policy, GPO, configuration, settings
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
@@ -11,18 +11,18 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
-# Use Group Policy settings to configure and manage Windows Defender AV
+# Use Group Policy settings to configure and manage Windows Defender Antivirus
**Applies to:**
-- Windows 10, version 1703
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
You can use [Group Policy](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx) to configure and manage Windows Defender Antivirus on your endpoints.
-In general, you can use the following procedure to configure or change Windows Defender AV group policy settings:
+In general, you can use the following procedure to configure or change Windows Defender Antivirus group policy settings:
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object (GPO) you want to configure and click **Edit**.
@@ -41,15 +41,15 @@ The following table in this topic lists the Group Policy settings available in W
Location | Setting | Documented in topic
---|---|---
-Client interface | Enable headless UI mode | [Prevent users from seeing or interacting with the Windows Defender AV user interface](prevent-end-user-interaction-windows-defender-antivirus.md)
+Client interface | Enable headless UI mode | [Prevent users from seeing or interacting with the Windows Defender Antivirus user interface](prevent-end-user-interaction-windows-defender-antivirus.md)
Client interface | Display additional text to clients when they need to perform an action | [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md)
Client interface | Suppress all notifications | [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md)
Client interface | Suppresses reboot notifications | [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md)
-Exclusions | Extension Exclusions | [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md)
-Exclusions | Path Exclusions | [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md)
-Exclusions | Process Exclusions | [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md)
-Exclusions | Turn off Auto Exclusions | [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md)
-MAPS | Configure the 'Block at First Sight' feature | [Enable the Block at First Sight feature](configure-block-at-first-sight-windows-defender-antivirus.md)
+Exclusions | Extension Exclusions | [Configure and validate exclusions in Windows Defender Antivirus scans](configure-exclusions-windows-defender-antivirus.md)
+Exclusions | Path Exclusions | [Configure and validate exclusions in Windows Defender Antivirus scans](configure-exclusions-windows-defender-antivirus.md)
+Exclusions | Process Exclusions | [Configure and validate exclusions in Windows Defender Antivirus scans](configure-exclusions-windows-defender-antivirus.md)
+Exclusions | Turn off Auto Exclusions | [Configure and validate exclusions in Windows Defender Antivirus scans](configure-exclusions-windows-defender-antivirus.md)
+MAPS | Configure the 'Block at First Sight' feature | [Enable block at first sight](configure-block-at-first-sight-windows-defender-antivirus.md)
MAPS | Join Microsoft MAPS | [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md)
MAPS | Send file samples when further analysis is required | [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md)
MAPS | Configure local setting override for reporting to Microsoft MAPS | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md)
@@ -59,23 +59,23 @@ Network inspection system | Specify additional definition sets for network traff
Network inspection system | Turn on definition retirement | Not used
Network inspection system | Turn on protocol recognition | Not used
Quarantine | Configure local setting override for the removal of items from Quarantine folder | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md)
-Quarantine | Configure removal of items from Quarantine folder | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md)
+Quarantine | Configure removal of items from Quarantine folder | [Configure remediation for Windows Defender Antivirus scans](configure-remediation-windows-defender-antivirus.md)
Real-time protection | Configure local setting override for monitoring file and program activity on your computer | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md)
Real-time protection | Configure local setting override for monitoring for incoming and outgoing file activity | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md)
Real-time protection | Configure local setting override for scanning all downloaded files and attachments | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md)
Real-time protection | Configure local setting override for turn on behavior monitoring | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md)
Real-time protection | Configure local setting override to turn on real-time protection | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md)
-Real-time protection | Define the maximum size of downloaded files and attachments to be scanned | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
-Real-time protection | Monitor file and program activity on your computer | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
-Real-time protection | Scan all downloaded files and attachments | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
-Real-time protection | Turn off real-time protection | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
-Real-time protection | Turn on behavior monitoring | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
-Real-time protection | Turn on process scanning whenever real-time protection is enabled | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
-Real-time protection | Turn on raw volume write notifications | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
-Real-time protection | Configure monitoring for incoming and outgoing file and program activity | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
+Real-time protection | Define the maximum size of downloaded files and attachments to be scanned | [Enable and configure Windows Defender Antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
+Real-time protection | Monitor file and program activity on your computer | [Enable and configure Windows Defender Antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
+Real-time protection | Scan all downloaded files and attachments | [Enable and configure Windows Defender Antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
+Real-time protection | Turn off real-time protection | [Enable and configure Windows Defender Antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
+Real-time protection | Turn on behavior monitoring | [Enable and configure Windows Defender Antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
+Real-time protection | Turn on process scanning whenever real-time protection is enabled | [Enable and configure Windows Defender Antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
+Real-time protection | Turn on raw volume write notifications | [Enable and configure Windows Defender Antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
+Real-time protection | Configure monitoring for incoming and outgoing file and program activity | [Enable and configure Windows Defender Antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
Remediation | Configure local setting override for the time of day to run a scheduled full scan to complete remediation | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md)
-Remediation | Specify the day of the week to run a scheduled full scan to complete remediation | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md)
-Remediation | Specify the time of day to run a scheduled full scan to complete remediation | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md)
+Remediation | Specify the day of the week to run a scheduled full scan to complete remediation | [Configure scheduled Windows Defender Antivirus scans](scheduled-catch-up-scans-windows-defender-antivirus.md)
+Remediation | Specify the time of day to run a scheduled full scan to complete remediation | [Configure scheduled Windows Defender Antivirus scans](scheduled-catch-up-scans-windows-defender-antivirus.md)
Reporting | Configure Watson events | Not used
Reporting | Configure Windows software trace preprocessor components | Not used
Reporting | Configure WPP tracing level | Not used
@@ -89,11 +89,11 @@ Root | Define addresses to bypass proxy server | Not used
Root | Define proxy auto-config (.pac) for connecting to the network | Not used
Root | Define proxy server for connecting to the network | Not used
Root | Configure local administrator merge behavior for lists | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md)
-Root | Allow antimalware service to startup with normal priority | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md)
-Root | Allow antimalware service to remain running always | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md)
-Root | Turn off routine remediation | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md)
-Root | Randomize scheduled task times | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md)
-Scan | Allow users to pause scan | [Prevent users from seeing or interacting with the Windows Defender AV user interface](prevent-end-user-interaction-windows-defender-antivirus.md)
+Root | Allow antimalware service to startup with normal priority | [Configure remediation for Windows Defender Antivirus scans](configure-remediation-windows-defender-antivirus.md)
+Root | Allow antimalware service to remain running always | [Configure remediation for Windows Defender Antivirus scans](configure-remediation-windows-defender-antivirus.md)
+Root | Turn off routine remediation | [Configure remediation for Windows Defender Antivirus scans](configure-remediation-windows-defender-antivirus.md)
+Root | Randomize scheduled task times | [Configure scheduled scans for Windows Defender Antivirus](scheduled-catch-up-scans-windows-defender-antivirus.md)
+Scan | Allow users to pause scan | [Prevent users from seeing or interacting with the Windows Defender Antivirus user interface](prevent-end-user-interaction-windows-defender-antivirus.md)
Scan | Check for the latest virus and spyware definitions before running a scheduled scan | [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md)
Scan | Define the number of days after which a catch-up scan is forced | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md)
Scan | Turn on catch up full scan | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md)
@@ -103,25 +103,25 @@ Scan | Configure local setting override for schedule scan day | [Prevent or allo
Scan | Configure local setting override for scheduled quick scan time | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md)
Scan | Configure local setting override for scheduled scan time | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md)
Scan | Configure local setting override for the scan type to use for a scheduled scan | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md)
-Scan | Create a system restore point | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md)
-Scan | Turn on removal of items from scan history folder | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md)
-Scan | Turn on heuristics | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
-Scan | Turn on e-mail scanning | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md)
-Scan | Turn on reparse point scanning | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md)
-Scan | Run full scan on mapped network drives | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md)
-Scan | Scan archive files | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md)
-Scan | Scan network files | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md)
-Scan | Scan packed executables | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md)
-Scan | Scan removable drives | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md)
-Scan | Specify the maximum depth to scan archive files | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md)
-Scan | Specify the maximum percentage of CPU utilization during a scan | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md)
-Scan | Specify the maximum size of archive files to be scanned | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md)
-Scan | Specify the day of the week to run a scheduled scan | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md)
-Scan | Specify the interval to run quick scans per day | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md)
-Scan | Specify the scan type to use for a scheduled scan | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md)
-Scan | Specify the time for a daily quick scan | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md)
-Scan | Specify the time of day to run a scheduled scan | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md)
-Scan | Start the scheduled scan only when computer is on but not in use | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md)
+Scan | Create a system restore point | [Configure remediation for Windows Defender Antivirus scans](configure-remediation-windows-defender-antivirus.md)
+Scan | Turn on removal of items from scan history folder | [Configure remediation for Windows Defender Antivirus scans](configure-remediation-windows-defender-antivirus.md)
+Scan | Turn on heuristics | [Enable and configure Windows Defender Antivirus always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md)
+Scan | Turn on e-mail scanning | [Configure scanning options in Windows Defender Antivirus](configure-advanced-scan-types-windows-defender-antivirus.md)
+Scan | Turn on reparse point scanning | [Configure scanning options in Windows Defender Antivirus](configure-advanced-scan-types-windows-defender-antivirus.md)
+Scan | Run full scan on mapped network drives | [Configure scanning options in Windows Defender Antivirus](configure-advanced-scan-types-windows-defender-antivirus.md)
+Scan | Scan archive files | [Configure scanning options in Windows Defender Antivirus](configure-advanced-scan-types-windows-defender-antivirus.md)
+Scan | Scan network files | [Configure scanning options in Windows Defender Antivirus](configure-advanced-scan-types-windows-defender-antivirus.md)
+Scan | Scan packed executables | [Configure scanning options in Windows Defender Antivirus](configure-advanced-scan-types-windows-defender-antivirus.md)
+Scan | Scan removable drives | [Configure scanning options in Windows Defender Antivirus](configure-advanced-scan-types-windows-defender-antivirus.md)
+Scan | Specify the maximum depth to scan archive files | [Configure scanning options in Windows Defender Antivirus](configure-advanced-scan-types-windows-defender-antivirus.md)
+Scan | Specify the maximum percentage of CPU utilization during a scan | [Configure scanning options in Windows Defender Antivirus](configure-advanced-scan-types-windows-defender-antivirus.md)
+Scan | Specify the maximum size of archive files to be scanned | [Configure scanning options in Windows Defender Antivirus](configure-advanced-scan-types-windows-defender-antivirus.md)
+Scan | Specify the day of the week to run a scheduled scan | [Configure scheduled scans for Windows Defender Antivirus](scheduled-catch-up-scans-windows-defender-antivirus.md)
+Scan | Specify the interval to run quick scans per day | [Configure scheduled scans for Windows Defender Antivirus](scheduled-catch-up-scans-windows-defender-antivirus.md)
+Scan | Specify the scan type to use for a scheduled scan | [Configure scheduled scans for Windows Defender Antivirus](scheduled-catch-up-scans-windows-defender-antivirus.md)
+Scan | Specify the time for a daily quick scan | [Configure scheduled scans for Windows Defender Antivirus](scheduled-catch-up-scans-windows-defender-antivirus.md)
+Scan | Specify the time of day to run a scheduled scan | [Configure scheduled scans for Windows Defender Antivirus](scheduled-catch-up-scans-windows-defender-antivirus.md)
+Scan | Start the scheduled scan only when computer is on but not in use | [Configure scheduled scans for Windows Defender Antivirus](scheduled-catch-up-scans-windows-defender-antivirus.md)
Signature updates | Allow definition updates from Microsoft Update | [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md)
Signature updates | Allow definition updates when running on battery power | [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md)
Signature updates | Allow notifications to disable definitions based repots to Microsoft MAPS | [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md)
@@ -136,9 +136,9 @@ Signature updates | Initiate definition update on startup | [Manage event-based
Signature updates | Specify the day of the week to check for definition updates | [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md)
Signature updates | Specify the interval to check for definition updates | [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md)
Signature updates | Specify the time to check for definition updates | [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md)
-Signature updates | Turn on scan after signature update | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md)
-Threats | Specify threat alert levels at which default action should not be taken when detected | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md)
-Threats | Specify threats upon which default action should not be taken when detected | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md)
+Signature updates | Turn on scan after signature update | [Configure scheduled scans for Windows Defender Antivirus](scheduled-catch-up-scans-windows-defender-antivirus.md)
+Threats | Specify threat alert levels at which default action should not be taken when detected | [Configure remediation for Windows Defender Antivirus scans](configure-remediation-windows-defender-antivirus.md)
+Threats | Specify threats upon which default action should not be taken when detected | [Configure remediation for Windows Defender Antivirus scans](configure-remediation-windows-defender-antivirus.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md
index 403cf6a2e3..618ef1fa2f 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md
@@ -1,5 +1,5 @@
---
-title: Configure Windows Defender AV with Configuration Manager and Intune
+title: Configure Windows Defender Antivirus with Configuration Manager and Intune
description: Use System Center Configuration Manager and Microsoft Intune to configure Windows Defender AV and Endpoint Protection
keywords: scep, intune, endpoint protection, configuration
search.product: eADQiWindows 10XVcnh
@@ -11,14 +11,18 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/19/2018
+ms.date: 09/03/2018
---
-# Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV
+# Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender Antivirus
-If you are using System Center Configuration Manager or Microsoft Intune to manage the endpoints on your network, you can also use them to manage Windows Defender AV.
+**Applies to:**
-In some cases, the protection will be labeled as Endpoint Protection, although the engine is the same as that used by Windows Defender AV.
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+If you are using System Center Configuration Manager or Microsoft Intune to manage the endpoints on your network, you can also use them to manage Windows Defender Antivirus scans.
+
+In some cases, the protection will be labeled as Endpoint Protection, although the engine is the same as that used by Windows Defender Antivirus.
See the [Endpoint Protection](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-protection) library on docs.microsoft.com for information on using Configuration Manager.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md
index 8a77b98ed5..65ac1a5a70 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md
@@ -11,14 +11,14 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 12/12/2017
+ms.date: 09/03/2018
---
-# Use PowerShell cmdlets to configure and manage Windows Defender AV
+# Use PowerShell cmdlets to configure and manage Windows Defender Antivirus
**Applies to:**
-- Windows 10
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
You can use PowerShell to perform various functions in Windows Defender. Similar to the command prompt or command line, PowerShell is a task-based command-line shell and scripting language designed especially for system administration, and you can read more about it at the [PowerShell hub on MSDN](https://msdn.microsoft.com/en-us/powershell/mt173057.aspx).
@@ -27,7 +27,7 @@ For a list of the cmdlets and their functions and available parameters, see the
PowerShell cmdlets are most useful in Windows Server environments that don't rely on a graphical user interface (GUI) to configure software.
> [!NOTE]
-> PowerShell cmdlets should not be used as a replacement for a full network policy management infrastructure, such as [System Center Configuration Manager](https://technet.microsoft.com/en-us/library/gg682129.aspx), [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx), or [Windows Defender Group Policy ADMX templates](https://support.microsoft.com/en-us/kb/927367).
+> PowerShell cmdlets should not be used as a replacement for a full network policy management infrastructure, such as [System Center Configuration Manager](https://technet.microsoft.com/en-us/library/gg682129.aspx), [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx), or [Windows Defender Antivirus Group Policy ADMX templates](https://support.microsoft.com/en-us/kb/927367).
Changes made with PowerShell will affect local settings on the endpoint where the changes are deployed or made. This means that deployments of policy with Group Policy, System Center Configuration Manager, or Microsoft Intune can overwrite changes made with PowerShell.
@@ -36,7 +36,7 @@ You can [configure which settings can be overridden locally with local policy ov
PowerShell is typically installed under the folder _%SystemRoot%\system32\WindowsPowerShell_.
-**Use Windows Defender AV PowerShell cmdlets:**
+**Use Windows Defender Antivirus PowerShell cmdlets:**
1. Click **Start**, type **powershell**, and press **Enter**.
2. Click **Windows PowerShell** to open the interface.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md
index f8c35eb6c8..4d68937d13 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md
@@ -1,5 +1,5 @@
---
-title: Configure Windows Defender AV with WMI
+title: Configure Windows Defender Antivirus with WMI
description: Use WMI scripts to configure Windows Defender AV.
keywords: wmi, scripts, windows management instrumentation, configuration
search.product: eADQiWindows 10XVcnh
@@ -11,22 +11,22 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 08/26/2017
+ms.date: 09/03/2018
---
-# Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV
+# Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender Antivirus
**Applies to:**
-- Windows 10
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
Windows Management Instrumentation (WMI) is a scripting interface that allows you to retrieve, modify, and update settings.
Read more about WMI at the [Microsoft Developer Network System Administration library](https://msdn.microsoft.com/en-us/library/aa394582(v=vs.85).aspx).
-Windows Defender AV has a number of specific WMI classes that can be used to perform most of the same functions as Group Policy and other management tools. Many of the classes are analogous to [Defender PowerShell cmdlets](use-powershell-cmdlets-windows-defender-antivirus.md).
+Windows Defender Antivirus has a number of specific WMI classes that can be used to perform most of the same functions as Group Policy and other management tools. Many of the classes are analogous to [Defender PowerShell cmdlets](use-powershell-cmdlets-windows-defender-antivirus.md).
-The [MSDN Windows Defender WMIv2 Provider reference library](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) lists the available WMI classes for Windows Defender AV, and includes example scripts.
+The [MSDN Windows Defender WMIv2 Provider reference library](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) lists the available WMI classes for Windows Defender Antivirus, and includes example scripts.
Changes made with WMI will affect local settings on the endpoint where the changes are deployed or made. This means that deployments of policy with Group Policy, System Center Configuration Manager, or Microsoft Intune can overwrite changes made with WMI.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md
index fc5487d680..3c436236fe 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md
@@ -11,18 +11,14 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/21/2018
+ms.date: 09/03/2018
---
# Use next-gen technologies in Windows Defender Antivirus through cloud-delivered protection
**Applies to:**
-- Windows 10, version 1703 and later
-
-**Audience**
-
-- Enterprise security administrators
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
Microsoft next-gen technologies in Windows Defender Antivirus provide near-instant, automated protection against new and emerging threats. To dynamically identify new threats, these technologies work with large sets of interconnected data in the Microsoft Intelligent Security Graph and powerful artificial intelligence (AI) systems driven by advanced machine learning models.
@@ -79,5 +75,5 @@ You can also [configure Windows Defender AV to automatically receive new protect
[Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) | You can enable cloud-delivered protection with System Center Configuration Manager, Group Policy, Microsoft Intune, and PowerShell cmdlets.
[Specify the cloud-delivered protection level](specify-cloud-protection-level-windows-defender-antivirus.md) | You can specify the level of protection offered by the cloud with Group Policy and System Center Configuration Manager. The protection level will affect the amount of information shared with the cloud and how aggressively new files are blocked.
[Configure and validate network connections for Windows Defender Antivirus](configure-network-connections-windows-defender-antivirus.md) | There are certain Microsoft URLs that your network and endpoints must be able to connect to for cloud-delivered protection to work effectively. This topic lists the URLs that should be allowed via firewall or network filtering rules, and instructions for confirming your network is properly enrolled in cloud-delivered protection.
-[Configure the Block at First Sight feature](configure-block-at-first-sight-windows-defender-antivirus.md) | The Block at First Sight feature can block new malware within seconds, without having to wait hours for a traditional signature. You can enable and configure it with System Center Configuration Manager and Group Policy.
+[Configure the block at first sight feature](configure-block-at-first-sight-windows-defender-antivirus.md) | The Block at First Sight feature can block new malware within seconds, without having to wait hours for a traditional signature. You can enable and configure it with System Center Configuration Manager and Group Policy.
[Configure the cloud block timeout period](configure-cloud-block-timeout-period-windows-defender-antivirus.md) | Windows Defender Antivirus can block suspicious files from running while it queries our cloud-delivered protection service. You can configure the amount of time the file will be prevented from running with System Center Configuration Manager and Group Policy.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md
index db9fd10f0d..2aa61cadf2 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md
@@ -11,26 +11,18 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/04/2018
+ms.date: 09/03/2018
---
-
# Windows Defender Antivirus compatibility
-
**Applies to:**
-- Windows 10
-- Windows Server 2016
-
-**Audience**
-
-- Enterprise security administrators
-
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
Windows Defender Antivirus is automatically enabled and installed on endpoints and devices that are running Windows 10.
-However, on endpoints and devices that are protected with a non-Microsoft antivirus or antimalware app, Windows Defender AV will automatically disable itself. You can then choose to enable an optional, limited protection feature, called [limited periodic scanning](limited-periodic-scanning-windows-defender-antivirus.md).
+However, on endpoints and devices that are protected with a non-Microsoft antivirus or antimalware app, Windows Defender Antivirus will automatically disable itself. You can then choose to enable an optional, limited protection feature, called [limited periodic scanning](limited-periodic-scanning-windows-defender-antivirus.md).
If you are also using Windows Defender Advanced Threat Protection, then Windows Defender AV will enter a passive mode.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md
index ae39992504..c0484875ec 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md
@@ -11,60 +11,51 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
# Windows Defender Antivirus in Windows 10 and Windows Server 2016
-**Applies to**
-- Windows 10
-- Windows Server 2016
+**Applies to:**
-Windows Defender Antivirus is a built-in antimalware solution that provides security and antimalware management for desktops, portable computers, and servers.
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-This library of documentation is for enterprise security administrators who are either considering deployment, or have already deployed and are wanting to manage and configure Windows Defender AV on PC endpoints in their network.
+Windows Defender Antivirus is a built-in antimalware solution that provides next generation protection for desktops, portable computers, and servers.
-For more important information about running Windows Defender on a server platform, see [Windows Defender Antivirus on Windows Server 2016](windows-defender-antivirus-on-windows-server-2016.md).
+Windows Defender Antivirus includes:
+- [Cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) for near-instant detection and blocking of new and emerging threats. Along with machine learning and the Intelligent Security Graph, cloud-delivered protection is part of the next-gen technologies that power Windows Defender Antivirus.
+- [Always-on scanning](configure-real-time-protection-windows-defender-antivirus.md), using advanced file and process behavior monitoring and other heuristics (also known as "real-time protection")
+- [Dedicated protection updates](manage-updates-baselines-windows-defender-antivirus.md) based on machine-learning, human and automated big-data analysis, and in-depth threat resistance research
-Windows Defender AV can be managed with:
-- System Center Configuration Manager (as System Center Endpoint Protection, or SCEP)
-- Microsoft Intune
-
-It can be configured with:
+You can configure and manage Windows Defender Antivirus with:
- System Center Configuration Manager (as System Center Endpoint Protection, or SCEP)
- Microsoft Intune
- PowerShell
- Windows Management Instrumentation (WMI)
- Group Policy
-Some of the highlights of Windows Defender AV include:
-- [Cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) for near-instant detection and blocking of new and emerging threats. Along with machine learning and the Intelligent Security Graph, cloud-delivered protection is part of the next-gen technologies that power Windows Defender Antivirus.
-- [Always-on scanning](configure-real-time-protection-windows-defender-antivirus.md), using advanced file and process behavior monitoring and other heuristics (also known as "real-time protection")
-- [Dedicated protection updates](manage-updates-baselines-windows-defender-antivirus.md) based on machine-learning, human and automated big-data analysis, and in-depth threat resistance research
-
-
>[!TIP]
->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work:
+>You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work:
>- Cloud-delivered protection
>- Fast learning (including Block at first sight)
>- Potentially unwanted application blocking
## What's new in Windows 10, version 1803
-- The [Block at First Sight feature](configure-block-at-first-sight-windows-defender-antivirus.md) can now block non-portable executable files (such as JS, VBS, or macros) as well as executable files.
-- The [Virus & threat protection area in the Windows Defender Security Center](windows-defender-security-center-antivirus.md) now includes a section for Ransomware protection. It includes Controlled folder access settings and Ransomware recovery settings.
+- The [block at first sight feature](configure-block-at-first-sight-windows-defender-antivirus.md) can now block non-portable executable files (such as JS, VBS, or macros) as well as executable files.
+- The [Virus & threat protection area in the Windows Defender Security Center](windows-defender-security-center-antivirus.md) now includes a section for ransomware protection. It includes controlled folder access settings and ransomware recovery settings.
## What's new in Windows 10, version 1703
-New features for Windows Defender AV in Windows 10, version 1703 include:
-- [Updates to how the Block at First Sight feature can be configured](configure-block-at-first-sight-windows-defender-antivirus.md)
+New features for Windows Defender Antivirus in Windows 10, version 1703 include:
+- [Updates to how the block at first sight feature can be configured](configure-block-at-first-sight-windows-defender-antivirus.md)
- [The ability to specify the level of cloud-protection](specify-cloud-protection-level-windows-defender-antivirus.md)
- [Windows Defender Antivirus protection in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md)
-We've expanded this documentation library to cover end-to-end deployment, management, and configuration for Windows Defender AV, and we've added some new guides that can help with evaluating and deploying Windows Defender AV in certain scenarios:
-- [Evaluation guide for Windows Defender AV](evaluate-windows-defender-antivirus.md)
-- [Deployment guide for Windows Defender AV in a virtual desktop infrastructure environment](deployment-vdi-windows-defender-antivirus.md)
+We've expanded this documentation library to cover end-to-end deployment, management, and configuration for Windows Defender Antivirus, and we've added some new guides that can help with evaluating and deploying Windows Defender AV in certain scenarios:
+- [Evaluation guide for Windows Defender Antivirus](evaluate-windows-defender-antivirus.md)
+- [Deployment guide for Windows Defender Antivirus in a virtual desktop infrastructure environment](deployment-vdi-windows-defender-antivirus.md)
@@ -74,25 +65,17 @@ Windows Defender AV has the same hardware requirements as Windows 10. For more i
- [Minimum hardware requirements](https://msdn.microsoft.com/library/windows/hardware/dn915086.aspx)
- [Hardware component guidelines](https://msdn.microsoft.com/library/windows/hardware/dn915049.aspx)
+Functionality, configuration, and management is largely the same when using Windows Defender AV on Windows Server 2016; however, [there are some differences](windows-defender-antivirus-on-windows-server-2016.md).
-Some features require a certain version of Windows 10 - the minimum version required is specified at the top of each topic.
+## Related topics
-Functionality, configuration, and management is largely the same when using Windows Defender AV on Windows Server 2016, however [there are some differences](windows-defender-antivirus-on-windows-server-2016.md).
-
-
-
-
-## In this library
-
-Topic | Description
-:---|:---
-[Windows Defender AV in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md) | The Windows Defender Security Center combines the settings and notifications from the previous Windows Defender AV app and Windows Settings in one easy-to-manage place
-[Windows Defender AV on Windows Server 2016](windows-defender-antivirus-on-windows-server-2016.md) | Windows Defender AV can be used on Windows Server 2016, and features the same configuration and management capabilities as the Windows 10 version - with some added features for automatic exclusions
-[Windows Defender AV compatibility](windows-defender-antivirus-compatibility.md) | Windows Defender AV operates in different modes depending on whether it detects other AV products or if you are using Windows Defender Advanced Threat Protection
-[Evaluate Windows Defender AV protection](evaluate-windows-defender-antivirus.md) | Evaluate the protection capabilities of Windows Defender Antivirus with a specialized evaluation guide and PowerShell script
-[Deploy, manage updates, and report on Windows Defender AV](deploy-manage-report-windows-defender-antivirus.md) | While traditional client deployment is not required for Windows Defender AV, you will need to enable the service. You can also manage how protection and product updates are applies, and receive reports from Configuration Manager, Intune, and with some security information and event monitoring (SIEM) tools
-[Configure Windows Defender AV features](configure-windows-defender-antivirus-features.md) | Windows Defender AV has a large set of configurable features and options. You can configure options such as cloud-delivered protection, always-on monitoring and scanning, and how end-users can interact or override global policy settings
-[Customize, initiate, and review the results of scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) | You can set up scheduled scans, run on-demand scans, and configure how remediation works when threats are detected
-[Review event logs and error codes to troubleshoot issues](troubleshoot-windows-defender-antivirus.md)|Review event IDs and error codes in Windows Defender Antivirus to determine causes of problems and troubleshoot issues
-[Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md)|The management and configuration tools that you can use with Windows Defender AV are listed and described here
+[Windows Defender AV in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md)
+[Windows Defender AV on Windows Server 2016](windows-defender-antivirus-on-windows-server-2016.md)
+[Windows Defender AV compatibility](windows-defender-antivirus-compatibility.md)
+[Evaluate Windows Defender AV protection](evaluate-windows-defender-antivirus.md)
+[Deploy, manage updates, and report on Windows Defender AV](deploy-manage-report-windows-defender-antivirus.md)
+[Configure Windows Defender AV features](configure-windows-defender-antivirus-features.md)
+[Customize, initiate, and review the results of scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
+[Review event logs and error codes to troubleshoot issues](troubleshoot-windows-defender-antivirus.md)
+[Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md)
diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md
index f8fb6d41ba..2c18d5b068 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md
@@ -11,30 +11,14 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/11/2018
+ms.date: 09/03/2018
---
-
# Windows Defender Antivirus on Windows Server 2016
-
**Applies to:**
-- Windows Server 2016
-
-**Audience**
-
-- Enterprise security administrators
-- Network administrators
-
-
-**Manageability available with**
-
-- Group Policy
-- System Center Configuration Manager
-- PowerShell
-- Windows Management Instrumentation (WMI)
-
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
Windows Defender Antivirus is available on Windows Server 2016. In some instances it is referred to as Endpoint Protection - however, the protection engine is the same.
diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md
index c58ed524ef..4f28c692b5 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md
@@ -11,25 +11,14 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
# Run and review the results of a Windows Defender Offline scan
-
**Applies to:**
-- Windows 10, version 1607 and later
-
-**Audience**
-
-- Enterprise security administrators
-
-**Manageability available with**
-
-- Group Policy
-- PowerShell cmdlets
-- Windows Management Instruction (WMI)
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
Windows Defender Offline is an antimalware scanning tool that lets you boot and run a scan from a trusted environment. The scan runs from outside the normal Windows kernel so it can target malware that attempts to bypass the Windows shell, such as viruses and rootkits that infect or overwrite the master boot record (MBR).
@@ -147,4 +136,4 @@ Windows Defender Offline scan results will be listed in the [Scan history sectio
## Related topics
- [Customize, initiate, and review the results of scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md)
-- [Windows Defender Antivirus](windows-defender-antivirus-in-windows-10.md)
\ No newline at end of file
+- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md
index e7349b1a3f..ae068a7b88 100644
--- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md
+++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md
@@ -11,23 +11,14 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 09/03/2018
---
# Windows Defender Antivirus in the Windows Defender Security Center app
-**Applies to**
-
-- Windows 10, version 1703 and later
-
-**Audience**
-
-- End-users
-
-**Manageability available with**
-
-- Windows Defender Security Center app
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
In Windows 10, version 1703 and later, the Windows Defender app is part of the Windows Defender Security Center.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md b/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md
index cf8105dc69..f876e2a21b 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker-using-mdm.md b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker-using-mdm.md
index ac9277f3b2..19441d1b3a 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker-using-mdm.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker-using-mdm.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 03/01/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md
index e6c1d39bd4..689be7ba29 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
@@ -13,7 +14,7 @@ ms.date: 09/21/2017
# Administer AppLocker
**Applies to**
- - Windows 10
+ - Windows 10
- Windows Server
This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies.
@@ -65,6 +66,6 @@ You must have Edit Setting permission to edit a GPO. By default, members of the
## Using Windows PowerShell to administer AppLocker
-For how-to info about administering AppLocker with Windows PowerShell, see [Use the AppLocker Windows PowerShell Cmdlets](use-the-applocker-windows-powershell-cmdlets.md). For reference info and examples how to administer AppLocker with Windows PowerShell, see the [AppLocker cmdlets](http://technet.microsoft.com/library/hh847210.aspx).
+For how-to info about administering AppLocker with Windows PowerShell, see [Use the AppLocker Windows PowerShell Cmdlets](use-the-applocker-windows-powershell-cmdlets.md). For reference info and examples how to administer AppLocker with Windows PowerShell, see the [AppLocker cmdlets](https://technet.microsoft.com/library/hh847210.aspx).
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md
index 3544866752..8b526e85fa 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md
index 9210e50905..e1d9bba88b 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md
index ec754cf12c..c939e91051 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md
index 26b4d23de4..b6c2c868d6 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md
index 09a77338da..36e0ac5981 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md
index 3089c59df8..c4b962b01a 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md
index 5ba8623822..ee4c5fe937 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md
index dcc657973f..054ee9ef62 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md
index 3330eda208..44b08ac93f 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 06/08/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md
index 66187c838a..953ead6f1e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md
index a72ff3932a..dbc018a25b 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md
index 16266b4bae..f5511d3cc8 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md
index eace7b9b57..c756426699 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/02/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md
index e40454320d..a97aa2c7cd 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md
index 699a7c233a..b21e2e2528 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md
index 30344b2d69..ec420bcac6 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md
index 77e783422f..9eec93864f 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md
index 55249cd6d8..76e4917930 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md
index 58f90360cf..7f38968703 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md
index 51965b4116..1848f8085f 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md
index b86eb4c12e..1e07df2d5b 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md b/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md
index 5ee0ccdb96..7c12e10af2 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/02/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md
index 0e6056ffe2..3457f579f9 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md
index 2df842862c..c3be5b8cd7 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md
index 34d351396b..6acc47d3c4 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md
index 65cb27bc2f..e81f42d528 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
@@ -13,7 +14,7 @@ ms.date: 09/21/2017
# Determine which apps are digitally signed on a reference device
**Applies to**
- - Windows 10
+ - Windows 10
- Windows Server
This topic for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed.
@@ -29,7 +30,7 @@ Membership in the local **Administrators** group, or equivalent, is the minimum
2. Analyze the publisher's name and digital signature status from the output of the command.
-For command parameters, syntax, and examples, see [Get-AppLockerFileInformation](http://technet.microsoft.com/library/ee460961.aspx).
+For command parameters, syntax, and examples, see [Get-AppLockerFileInformation](https://technet.microsoft.com/library/ee460961.aspx).
## Related topics
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md
index a73fc8b1cd..bca3d32254 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md b/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md
index 3e7efbb672..393294a921 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md
@@ -6,6 +6,7 @@ ms.pagetype: security
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md
index be67db5038..cea7ab6ca2 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md
index b14ec68862..01f5f91d5d 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md
@@ -5,6 +5,7 @@ ms.assetid: 389ffa8e-11fc-49ff-b0b1-89553e6fb6e5
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
+ms.localizationpriority: medium
author: brianlic-msft
ms.pagetype: security
ms.date: 09/21/2017
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md
index faeb7da296..7b6244b2eb 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md
index da3b193ffe..8f9183d2d5 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md
index 01886f6af8..c03fb9d05e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md
index 5ade426b41..b620e305a4 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md b/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md
index 5593a53034..a915311c12 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md
index 4fba782a8d..6ef53ce437 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md
index bac088407a..1ac1c9ce81 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md
index b442b268b0..000441d121 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md
index d4fdf2d40e..71956ee4d9 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md b/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md
index da6e9d1a9c..536d75e6ad 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md
index 2ffbc23507..b880da4f7e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md
index f3bef329a4..0785d8c4b0 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md
index 7a8937b222..dfb5a0b633 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md
index 3522e95463..6f54125e98 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
@@ -13,14 +14,14 @@ ms.date: 09/21/2017
# Manage packaged apps with AppLocker
**Applies to**
- - Windows 10
+ - Windows 10
- Windows Server
This topic for IT professionals describes concepts and lists procedures to help you manage Packaged apps with AppLocker as part of your overall application control strategy.
## Understanding Packaged apps and Packaged app installers for AppLocker
-Packaged apps, also known as Universal Windows apps, are based on a model that ensures all the files within an app package share the same identity. With classic Windows apps, each file within the app could have a unique identity.
+Packaged apps, also known as Universal Windows apps, are based on a model that ensures all the files within an app package share the same identity. With classic Windows apps, each file within the app could have a unique identity.
With packaged apps, it is possible to control the entire app by using a single AppLocker rule.
>**Note:** AppLocker supports only publisher rules for packaged apps. All packaged apps must be signed by the software publisher because Windows does not support unsigned packaged apps.
@@ -29,7 +30,7 @@ Typically, an app consists of multiple components: the installer that is used to
### Comparing classic Windows apps and packaged apps
-AppLocker policies for packaged apps can only be applied to apps installed on computers running at least Windows Server 2012 or Windows 8, but classic Windows apps can be controlled on devices running at least Windows Server
+AppLocker policies for packaged apps can only be applied to apps installed on computers running at least Windows Server 2012 or Windows 8, but classic Windows apps can be controlled on devices running at least Windows Server
2008 R2 or Windows 7. The rules for classic Windows apps and packaged apps can be enforced in tandem. The differences between packaged apps and classic Windows apps that you should consider include:
- **Installing the apps** All packaged apps can be installed by a standard user, whereas a number of classic Windows apps require administrative privileges to install. In an environment where most of the users are standard users, you might not have numerous exe rules (because classic Windows apps require administrative privileges to install), but you might want to have more explicit policies for packaged apps.
@@ -48,7 +49,7 @@ You can use two methods to create an inventory of packaged apps on a computer: t
>**Note:** Not all packaged apps are listed in AppLocker’s application inventory wizard. Certain app packages are framework packages that are leveraged by other apps. By themselves, these packages cannot do anything, but blocking such packages can inadvertently cause failure for apps that you want to allow. Instead, you can create Allow or Deny rules for the packaged apps that use these framework packages. The AppLocker user interface deliberately filters out all the packages that are registered as framework packages. For info about how to create an inventory list, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md).
-For info about how to use the **Get-AppxPackage** Windows PowerShell cmdlet, see the [AppLocker PowerShell Command Reference](http://technet.microsoft.com/library/hh847210.aspx).
+For info about how to use the **Get-AppxPackage** Windows PowerShell cmdlet, see the [AppLocker PowerShell Command Reference](https://technet.microsoft.com/library/hh847210.aspx).
For info about creating rules for Packaged apps, see [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md).
@@ -56,7 +57,7 @@ Consider the following info when you are designing and deploying apps:
- Because AppLocker supports only publisher rules for packaged apps, collecting the installation path information for packaged apps is not necessary.
- You cannot create hash- or path-based rules for packaged apps because all packaged apps and packaged app installers are signed by the software publisher of the package. Classic Windows apps were not always consistently signed; therefore, AppLocker has to support hash- or path-based rules.
-- By default, if there are no rules in a particular rule collection, AppLocker allows every file that is included in that rule collection. For example, if there are no Windows Installer rules, AppLocker allows all .msi, .msp, and .mst files to run. An existing AppLocker policy that was targeted at computers running Windows Server 2008 R2 and Windows 7 would not have rules for Packaged apps. Therefore, when a computer running at least Windows Server 2012 or
+- By default, if there are no rules in a particular rule collection, AppLocker allows every file that is included in that rule collection. For example, if there are no Windows Installer rules, AppLocker allows all .msi, .msp, and .mst files to run. An existing AppLocker policy that was targeted at computers running Windows Server 2008 R2 and Windows 7 would not have rules for Packaged apps. Therefore, when a computer running at least Windows Server 2012 or
Windows 8 joins a domain where an AppLocker policy is already configured, users would be allowed to run any packaged app. This might be contrary to your design.
To prevent all packaged apps from running on a newly domain-joined computer, by default AppLocker blocks all packaged apps on a computer running at least Windows Server 2012 or Windows 8 if the existing domain policy has rules configured in the exe rule collection. You must take explicit action to allow packaged apps in your enterprise. You can allow only a select set of packaged apps. Or if you want to allow all packaged apps, you can create a default rule for the packaged apps collection.
@@ -67,7 +68,7 @@ Just as there are differences in managing each rule collection, you need to mana
1. Gather information about which Packaged apps are running in your environment. For information about how to do this, see [Create list of apps deployed to each business group](create-list-of-applications-deployed-to-each-business-group.md).
-2. Create AppLocker rules for specific packaged apps based on your policy strategies. For more information, see [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md) and [Packaged Apps Default Rules in AppLocker](http://technet.microsoft.com/library/ee460941(WS.10).aspx).
+2. Create AppLocker rules for specific packaged apps based on your policy strategies. For more information, see [Create a rule for packaged apps](create-a-rule-for-packaged-apps.md) and [Packaged Apps Default Rules in AppLocker](https://technet.microsoft.com/library/ee460941(WS.10).aspx).
3. Continue to update the AppLocker policies as new package apps are introduced into your environment. To do this, see [Add rules for packaged apps to existing AppLocker rule-set](add-rules-for-packaged-apps-to-existing-applocker-rule-set.md).
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md
index 62d120be4b..5de1967090 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
@@ -13,14 +14,14 @@ ms.date: 09/21/2017
# Merge AppLocker policies by using Set-ApplockerPolicy
**Applies to**
- - Windows 10
+ - Windows 10
- Windows Server
This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell.
The **Set-AppLockerPolicy** cmdlet sets the specified Group Policy Object (GPO) to contain the specified AppLocker policy. If no Lightweight Directory Access Protocol (LDAP) is specified, the local GPO is the default. When the Merge parameter is used, rules in the specified AppLocker policy will be merged with the AppLocker rules in the target GPO specified in the LDAP path. The merging of policies will remove rules with duplicate rule IDs, and the enforcement setting specified by the AppLocker policy in the target GPO will be preserved. If the Merge parameter is not specified, then the new policy will overwrite the existing policy.
-For info about using **Set-AppLockerPolicy**, including syntax descriptions and parameters, see [Set-AppLockerPolicy](http://technet.microsoft.com/library/hh847212.aspx).
+For info about using **Set-AppLockerPolicy**, including syntax descriptions and parameters, see [Set-AppLockerPolicy](https://technet.microsoft.com/library/hh847212.aspx).
For info about using Windows PowerShell for AppLocker, including how to import the AppLocker cmdlets into Windows PowerShell, see [Use the AppLocker Windows PowerShell cmdlets](use-the-applocker-windows-powershell-cmdlets.md).
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md
index 9becb2ec65..d77a10fb74 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md
index 08cd3572ad..d7dec8dac9 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md b/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md
index a9c80b2eac..cda020c5b7 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md
index 685667b11c..8911d1bf9e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 10/13/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md
index 995eb8fedc..f4d78c2168 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md
index 6812987ac1..5eb4f002d8 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md
index 7d0bc2af2c..df08c99d15 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md
index 70eb43cab4..d816c2e3df 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md
@@ -14,7 +14,7 @@ ms.date: 09/21/2017
# Requirements to use AppLocker
**Applies to**
- - Windows 10
+ - Windows 10
- Windows Server
This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems.
@@ -35,21 +35,21 @@ The following table show the on which operating systems AppLocker features are s
| Version | Can be configured | Can be enforced | Available rules | Notes |
| - | - | - | - | - |
-| Windows 10| Yes| Yes| Packaged apps Executable Windows Installer Script DLL| You can use the [AppLocker CSP](http://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) to configure AppLocker policies on any edition of Windows 10 supported by Mobile Device Management (MDM). You can only manage AppLocker with Group Policy on devices running Windows 10 Enterprise, Windows 10 Education, and Windows Server 2016. |
-| Windows Server 2016 Windows Server 2012 R2 Windows Server 2012| Yes| Yes| Packaged apps Executable Windows Installer Script DLL| |
+| Windows 10| Yes| Yes| Packaged apps Executable Windows Installer Script DLL| You can use the [AppLocker CSP](https://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) to configure AppLocker policies on any edition of Windows 10 supported by Mobile Device Management (MDM). You can only manage AppLocker with Group Policy on devices running Windows 10 Enterprise, Windows 10 Education, and Windows Server 2016. |
+| Windows Server 2016 Windows Server 2012 R2 Windows Server 2012| Yes| Yes| Packaged apps Executable Windows Installer Script DLL| |
| Windows 8.1 Pro| Yes| No| N/A||
-| Windows 8.1 Enterprise| Yes| Yes| Packaged apps Executable Windows Installer Script DLL| |
-| Windows RT 8.1| No| No| N/A||
+| Windows 8.1 Enterprise| Yes| Yes| Packaged apps Executable Windows Installer Script DLL| |
+| Windows RT 8.1| No| No| N/A||
| Windows 8 Pro| Yes| No| N/A||
-| Windows 8 Enterprise| Yes| Yes| Packaged apps Executable Windows Installer Script DLL||
-| Windows RT| No| No| N/A| |
+| Windows 8 Enterprise| Yes| Yes| Packaged apps Executable Windows Installer Script DLL||
+| Windows RT| No| No| N/A| |
| Windows Server 2008 R2 Standard| Yes| Yes| Executable Windows Installer Script DLL| Packaged app rules will not be enforced.|
| Windows Server 2008 R2 Enterprise|Yes| Yes| Executable Windows Installer Script DLL| Packaged app rules will not be enforced.|
-| Windows Server 2008 R2 Datacenter| Yes| Yes| Executable Windows Installer Script DLL| Packaged app rules will not be enforced.|
-| Windows Server 2008 R2 for Itanium-Based Systems| Yes| Yes| Executable Windows Installer Script DLL| Packaged app rules will not be enforced.|
+| Windows Server 2008 R2 Datacenter| Yes| Yes| Executable Windows Installer Script DLL| Packaged app rules will not be enforced.|
+| Windows Server 2008 R2 for Itanium-Based Systems| Yes| Yes| Executable Windows Installer Script DLL| Packaged app rules will not be enforced.|
| Windows 7 Ultimate| Yes| Yes| Executable Windows Installer Script DLL| Packaged app rules will not be enforced.|
-| Windows 7 Enterprise| Yes| Yes| Executable Windows Installer Script DLL| Packaged app rules will not be enforced.|
-| Windows 7 Professional| Yes| No| Executable Windows Installer Script DLL| No AppLocker rules are enforced.|
+| Windows 7 Enterprise| Yes| Yes| Executable Windows Installer Script DLL| Packaged app rules will not be enforced.|
+| Windows 7 Professional| Yes| No| Executable Windows Installer Script DLL| No AppLocker rules are enforced.|
AppLocker is not supported on versions of the Windows operating system not listed above. Software Restriction Policies can be used with those versions. However, the SRP Basic User feature is not supported on the above operating systems.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md b/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md
index 39ac2f8cc8..174b721e32 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md
index d31c811eb4..6fab819f0e 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md
index a1189105f5..a6b7813076 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
@@ -13,19 +14,19 @@ ms.date: 09/21/2017
# Security considerations for AppLocker
**Applies to**
- - Windows 10
+ - Windows 10
- Windows Server
This topic for the IT professional describes the security considerations you need to address when implementing AppLocker.
-The purpose of AppLocker is to restrict the access to software, and therefore, the data accessed by the software, to a specific group of users or within a defined business group. The following are security considerations for
+The purpose of AppLocker is to restrict the access to software, and therefore, the data accessed by the software, to a specific group of users or within a defined business group. The following are security considerations for
AppLocker:
AppLocker is deployed within an enterprise and administered centrally by those in IT with trusted credentials. This makes its policy creation and deployment conform to similar policy deployment processes and security restrictions.
AppLocker policies are distributed through known processes and by known means within the domain through Group Policy. But AppLocker policies can also be set on individual computers if the person has administrator privileges, and those policies might be contrary to the organization's written security policy. The enforcement settings for local policies are overridden by the same AppLocker policies in a Group Policy Object (GPO). However, because AppLocker rules are additive, a local policy that is not in a GPO will still be evaluated for that computer.
-Microsoft does not provide a way to develop any extensions to AppLocker. The interfaces are not public. A user with administrator credentials can automate some AppLocker processes by using Windows PowerShell cmdlets. For info about the Windows PowerShell cmdlets for AppLocker, see the [AppLocker Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/ee460962.aspx).
+Microsoft does not provide a way to develop any extensions to AppLocker. The interfaces are not public. A user with administrator credentials can automate some AppLocker processes by using Windows PowerShell cmdlets. For info about the Windows PowerShell cmdlets for AppLocker, see the [AppLocker Cmdlets in Windows PowerShell](https://technet.microsoft.com/library/ee460962.aspx).
AppLocker runs in the context of Administrator or LocalSystem, which is the highest privilege set. This security context has the potential of misuse. If a user with administrative credentials makes changes to an AppLocker policy on a local device that is joined to a domain, those changes could be overwritten or disallowed by the GPO that contains the AppLocker rule for the same file (or path) that was changed on the local device. However, because AppLocker rules are additive, a local policy that is not in a GPO will still be evaluated for that computer. If the local computer is not joined to a domain and is not administered by Group Policy, a person with administrative credentials can alter the AppLocker policy.
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md
index 0590a63b72..6d3979d91f 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md
index 6c210aa053..453ab0eb53 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md
index ec71166da6..27c90949d6 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md
index fe25d088f2..b78412c268 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md
index 009f8a35ab..5e696490b6 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md
index 4e1b579be2..66ac0616c3 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 10/13/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md
index 8c9da9bfcd..c85924b254 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md
index 07a4161fda..35b9675e4c 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md
index b216fa6fa5..b8dff87c25 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md
index 7b9bbb1637..fdba7959a0 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md
index 4ec88b21fc..a7077bd6b7 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md
index 7e6d3a3a64..cf5e0d7301 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md
index e2a66c497c..93e36b568f 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md
index c7817633da..56ef43a232 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md
index 31ac2a2881..bf60367a08 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md
index 1b711c83d1..46a0ba3967 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md
index b584cf1375..612e3824d2 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md
index 0f8cc64fbc..45529acef2 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
@@ -14,7 +15,7 @@ ms.date: 09/21/2017
# Use a reference device to create and maintain AppLocker policies
**Applies to**
- - Windows 10
+ - Windows 10
- Windows Server
This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer.
@@ -58,8 +59,8 @@ If AppLocker policies are currently running in your production environment, expo
You should test each set of rules to ensure that they perform as intended. The **Test-AppLockerPolicy** Windows PowerShell cmdlet can be used to determine whether any of the rules in your rule collection will be blocked on your reference device. Perform the steps on each reference device that you used to define the AppLocker policy. Ensure that the reference device is joined to the domain and that it is receiving the AppLocker policy from the appropriate GPO. Because AppLocker rules are inherited from linked GPOs, you should deploy all of the rules to simultaneously test all of your test GPOs. Use the following procedures to complete this step:
-- [Test an AppLocker Policy with Test-AppLockerPolicy](http://technet.microsoft.com/library/ee791772(WS.10).aspx)
-- [Discover the Effect of an AppLocker Policy](http://technet.microsoft.com/library/ee791823(WS.10).aspx)
+- [Test an AppLocker Policy with Test-AppLockerPolicy](https://technet.microsoft.com/library/ee791772(WS.10).aspx)
+- [Discover the Effect of an AppLocker Policy](https://technet.microsoft.com/library/ee791823(WS.10).aspx)
>**Caution:** If you have set the enforcement setting on the rule collection to **Enforce rules** or you have not configured the rule collection, the policy will be implemented when the GPO is updated in the next step. If you have set the enforcement setting on the rule collection to **Audit only**, application access events are written to the AppLocker log, and the policy will not take effect.
@@ -69,7 +70,7 @@ When the AppLocker policy has been tested successfully, it can be imported into
- [Export an AppLocker policy to an XML file](export-an-applocker-policy-to-an-xml-file.md)
- [Import an AppLocker policy into a GPO](import-an-applocker-policy-into-a-gpo.md) or
-- [Discover the Effect of an AppLocker Policy](http://technet.microsoft.com/library/ee791823(WS.10).aspx)
+- [Discover the Effect of an AppLocker Policy](https://technet.microsoft.com/library/ee791823(WS.10).aspx)
If the AppLocker policy enforcement setting is **Audit only** and you are satisfied that the policy is fulfilling your intent, you can change it to **Enforce rules**. For info about how to change the enforcement setting, see [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md).
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md
index 71bfcb91e5..e5cd39f92c 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md
index 30a919b546..686d4be09d 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
@@ -13,41 +14,41 @@ ms.date: 09/21/2017
# Use the AppLocker Windows PowerShell cmdlets
**Applies to**
- - Windows 10
+ - Windows 10
- Windows Server
This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies.
## AppLocker Windows PowerShell cmdlets
-The five AppLocker cmdlets are designed to streamline the administration of an AppLocker policy. They can be used to help create, test, maintain, and troubleshoot an AppLocker policy. The cmdlets are intended to be used in conjunction with the AppLocker user interface that is accessed through the
+The five AppLocker cmdlets are designed to streamline the administration of an AppLocker policy. They can be used to help create, test, maintain, and troubleshoot an AppLocker policy. The cmdlets are intended to be used in conjunction with the AppLocker user interface that is accessed through the
Microsoft Management Console (MMC) snap-in extension to the Local Security Policy snap-in and Group Policy Management Console.
-To edit or update a Group Policy Object (GPO) by using the AppLocker cmdlets, you must have Edit Setting permission. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. To perform tasks by using the
+To edit or update a Group Policy Object (GPO) by using the AppLocker cmdlets, you must have Edit Setting permission. By default, members of the **Domain Admins** group, the **Enterprise Admins** group, and the **Group Policy Creator Owners** group have this permission. To perform tasks by using the
Local Security policy snap-in, you must be a member of the local **Administrators** group, or equivalent, on the computer.
### Retrieve application information
-The [Get-AppLockerFileInformation](http://technet.microsoft.com/library/hh847209.aspx) cmdlet retrieves the AppLocker file information from a list of files or from an event log. File information that is retrieved can include publisher information, file hash information, and file path information.
+The [Get-AppLockerFileInformation](https://technet.microsoft.com/library/hh847209.aspx) cmdlet retrieves the AppLocker file information from a list of files or from an event log. File information that is retrieved can include publisher information, file hash information, and file path information.
File information from an event log may not contain all of these fields. Files that are not signed do not have any publisher information.
### Set AppLocker policy
-The [Set-AppLockerPolicy](http://technet.microsoft.com/library/hh847212.aspx) cmdlet sets the specified GPO to contain the specified AppLocker policy. If no Lightweight Directory Access Protocol (LDAP) is specified, the local GPO is the default.
+The [Set-AppLockerPolicy](https://technet.microsoft.com/library/hh847212.aspx) cmdlet sets the specified GPO to contain the specified AppLocker policy. If no Lightweight Directory Access Protocol (LDAP) is specified, the local GPO is the default.
### Retrieve an AppLocker policy
-The [Get-AppLockerPolicy](http://technet.microsoft.com/library/hh847214.aspx) cmdlet gets the AppLocker policy from the local GPO, from a specified GPO, or from the effective AppLocker policy on the device. The output of the AppLocker policy is an AppLockerPolicy object or an XML-formatted string.
+The [Get-AppLockerPolicy](https://technet.microsoft.com/library/hh847214.aspx) cmdlet gets the AppLocker policy from the local GPO, from a specified GPO, or from the effective AppLocker policy on the device. The output of the AppLocker policy is an AppLockerPolicy object or an XML-formatted string.
### Generate rules for a given user or group
-The [New-AppLockerPolicy](http://technet.microsoft.com/library/hh847211.aspx) cmdlet uses a list of file information to automatically generate rules for a given user or group. It can generate rules based on publisher, hash, or path information. Use **Get-AppLockerFileInformation** to create the
+The [New-AppLockerPolicy](https://technet.microsoft.com/library/hh847211.aspx) cmdlet uses a list of file information to automatically generate rules for a given user or group. It can generate rules based on publisher, hash, or path information. Use **Get-AppLockerFileInformation** to create the
list of file information.
### Test the AppLocker Policy against a file set
-The [Test-AppLockerPolicy](http://technet.microsoft.com/library/hh847213.aspx) cmdlet uses the specified AppLocker policy to test whether a specified list of files are allowed to run or not on the local device for a specific user.
+The [Test-AppLockerPolicy](https://technet.microsoft.com/library/hh847213.aspx) cmdlet uses the specified AppLocker policy to test whether a specified list of files are allowed to run or not on the local device for a specific user.
## Additional resources
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md
index 19b0fe1159..36b1d0017d 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md
index 09a6f698ed..6d7fb0b8d9 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md
index 3f65a1e334..292c50818f 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md
index 544b30162f..47b6d2df84 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md
index 2c487d8854..9926340d47 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md
index 8400f6cb17..9da9555294 100644
--- a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md
@@ -7,6 +7,7 @@ ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: andreabichsel
+ms.localizationpriority: medium
msauthor: v-anbic
ms.date: 08/27/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md
index f2d785d66a..740a8eab56 100644
--- a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md
+++ b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md
@@ -18,7 +18,7 @@ ms.date: 05/03/2018
- Windows 10
- Windows Server 2016
-When WDAC policies are run in audit mode, it allows administrators to discover any applications that were missed during an initial policy scan and to identify any new applications that have been installed and run since the original policy was created. While a WDAC policy is running in audit mode, any binary that runs and would have been denied had the policy been enforced is logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log. When these logged binaries have been validated, they can easily be added to a new WDAC policy. When the new exception policy is created, you can merge it with your existing WDAC policies.
+Running Appication Control in audit mode allows administrators to discover any applications that were missed during an initial policy scan and to identify any new applications that have been installed and run since the original policy was created. While a WDAC policy is running in audit mode, any binary that runs and would have been denied had the policy been enforced is logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log. When these logged binaries have been validated, they can easily be added to a new WDAC policy. When the new exception policy is created, you can merge it with your existing WDAC policies.
Before you begin this process, you need to create a WDAC policy binary file. If you have not already done so, see [Create an initial Windows Defender Application Control policy from a reference computer](#create-initial-default-policy).
diff --git a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md
index 7303a1371c..54c89364d5 100644
--- a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: jsuther1974
ms.date: 02/28/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md b/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md
index c91ecd2bc3..e49dcb1440 100644
--- a/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md
+++ b/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md
index c2ea74a274..b6683d45c4 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: jsuther1974
ms.date: 02/28/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md
index a8c0e32665..46f8a8a3c8 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: jsuther1974
ms.date: 02/28/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md
index 2012791205..857ab2ea09 100644
--- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md
+++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: justinha
ms.date: 05/17/2018
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md b/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md
index 41f09c0b09..68bc862fd3 100644
--- a/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md
+++ b/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 09/21/2017
---
diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
index b5fdd41d57..26155f371a 100644
--- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
@@ -6,7 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.localizationpriority: medium
author: jsuther1974
-ms.date: 08/16/2018
+ms.date: 08/31/2018
---
# Microsoft recommended block rules
@@ -137,6 +137,7 @@ Microsoft recommends that you block the following Microsoft-signed applications
+
@@ -705,7 +706,7 @@ Microsoft recommends that you block the following Microsoft-signed applications
-
+
-
You can also download the entire list in CSV format using the **Export to CSV** feature. For more information on filters, see [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md).
You can filter the health state list by the following status:
@@ -61,7 +46,7 @@ You can view the machine details when you click on a misconfigured or inactive m
-In the **Machines list**, you can download a full list of all the machines in your organization in a CSV format. To download, click the **Manage Alert** menu icon on the top corner of the page.
+In the **Machines list**, you can download a full list of all the machines in your organization in a CSV format.
>[!NOTE]
>Export the list in CSV format to display the unfiltered data. The CSV file will include all machines in the organization, regardless of any filtering applied in the view itself and can take a significant amount of time to download, depending on how large your organization is.
diff --git a/windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md
index 432cfcfa13..3ff19840f0 100644
--- a/windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md
@@ -16,11 +16,6 @@ ms.date: 04/24/2018
# Enable conditional access to better protect users, devices, and data
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
@@ -69,89 +64,9 @@ The following example sequence of events explains conditional access in action:
4. The manual or automated investigation and remediation is completed and the threat is removed. Windows Defender ATP sees that there is no risk on the device and Intune assesses the device to be in a compliant state. Azure AD applies the policy which allows access to applications.
5. Users can now access applications.
-
-
- ## Configure conditional access
-This section guides you through all the steps you need to take to properly implement conditional access.
-
-### Before you begin
->[!WARNING]
->It's important to note that Azure AD registered devices is not supported in this scenario.
->Only Intune enrolled devices are supported.
-
-You need to make sure that all your devices are enrolled in Intune. You can use any of the following options to enroll devices in Intune:
-
-
-- IT Admin: For more information on how to enabling auto-enrollment, see [Windows Enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment)
-- End-user: For more information on how to enroll your Windows 10 device in Intune, see [Enroll your Windows 10 device in Intune](https://docs.microsoft.com/intune-user-help/enroll-your-w10-device-access-work-or-school)
-- End-user alternative: For more information on joining an Azure AD domain, see [Set up Azure Active Directory joined devices](https://docs.microsoft.com/en-us/azure/active-directory/device-management-azuread-joined-devices-setup).
-
-
-
-There are steps you'll need to take in Windows Defender Security Center, the Intune portal, and Azure AD portal.
-
-> [!NOTE]
-> You'll need a Microsoft Intune environment, with Intune managed and Azure AD joined Windows 10 devices.
-
-Take the following steps to enable conditional access:
-- Step 1: Turn on the Microsoft Intune connection from Windows Defender Security Center
-- Step 2: Turn on the Windows Defender ATP integration in Intune
-- Step 3: Create the compliance policy in Intune
-- Step 4: Assign the policy
-- Step 5: Create an Azure AD conditional access policy
-
-
-### Step 1: Turn on the Microsoft Intune connection
-1. In the navigation pane, select **Settings** > **Advanced features** > **Microsoft Intune connection**.
-2. Toggle the Microsoft Intune setting to **On**.
-3. Click **Save preferences**.
-
-
-### Step 2: Turn on the Windows Defender ATP integration in Intune
-1. Sign in to the [Azure portal](https://portal.azure.com).
-2. Select **Device compliance** > **Windows Defender ATP**.
-3. Set **Connect Windows 10.0.15063+ devices to Windows Defender Advanced Threat Protection** to **On**.
-4. Click **Save**.
-
-
-### Step 3: Create the compliance policy in Intune
-1. In the [Azure portal](https://portal.azure.com), select **All services**, filter on **Intune**, and select **Microsoft Intune**.
-2. Select **Device compliance** > **Policies** > **Create policy**.
-3. Enter a **Name** and **Description**.
-4. In **Platform**, select **Windows 10 and later**.
-5. In the **Device Health** settings, set **Require the device to be at or under the Device Threat Level** to your preferred level:
-
- - **Secured**: This level is the most secure. The device cannot have any existing threats and still access company resources. If any threats are found, the device is evaluated as noncompliant.
- - **Low**: The device is compliant if only low-level threats exist. Devices with medium or high threat levels are not compliant.
- - **Medium**: The device is compliant if the threats found on the device are low or medium. If high-level threats are detected, the device is determined as noncompliant.
- - **High**: This level is the least secure, and allows all threat levels. So devices that with high, medium or low threat levels are considered compliant.
-
-6. Select **OK**, and **Create** to save your changes (and create the policy).
-
-### Step 4: Assign the policy
-1. In the [Azure portal](https://portal.azure.com), select **All services**, filter on **Intune**, and select **Microsoft Intune**.
-2. Select **Device compliance** > **Policies**> select your Windows Defender ATP compliance policy.
-3. Select **Assignments**.
-4. Include or exclude your Azure AD groups to assign them the policy.
-5. To deploy the policy to the groups, select **Save**. The user devices targeted by the policy are evaluated for compliance.
-
-### Step 5: Create an Azure AD conditional access policy
-1. In the [Azure portal](https://portal.azure.com), open **Azure Active Directory** > **Conditional access** > **New policy**.
-2. Enter a policy **Name**, and select **Users and groups**. Use the Include or Exclude options to add your groups for the policy, and select **Done**.
-3. Select **Cloud apps**, and choose which apps to protect. For example, choose **Select apps**, and select **Office 365 SharePoint Online** and **Office 365 Exchange Online**. Select **Done** to save your changes.
-
-4. Select **Conditions** > **Client apps** to apply the policy to apps and browsers. For example, select **Yes**, and then enable **Browser** and **Mobile apps and desktop clients**. Select **Done** to save your changes.
-
-5. Select **Grant** to apply conditional access based on device compliance. For example, select **Grant access** > **Require device to be marked as compliant**. Choose **Select** to save your changes.
-
-6. Select **Enable policy**, and then **Create** to save your changes.
-
-For more information, see [Enable Windows Defender ATP with conditional access in Intune](https://docs.microsoft.com/intune/advanced-threat-protection).
-
->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-conditionalaccess-belowfoldlink)
-
+
## Related topic
-- [Configure advanced features in Windows Defender ATP](advanced-features-windows-defender-advanced-threat-protection.md)
+- [Configure conditional access in Windows Defender ATP](configure-conditional-access-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md
index c4633c09c3..922143b7f4 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 10/16/2017
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-attack-surface-reduction.md b/windows/security/threat-protection/windows-defender-atp/configure-attack-surface-reduction.md
new file mode 100644
index 0000000000..f48dd12b3e
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/configure-attack-surface-reduction.md
@@ -0,0 +1,38 @@
+---
+title:
+description:
+keywords:
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 07/01/2018
+---
+
+# Configure attack surface reduction
+
+You can configure attack surface reduction with a number of tools, including:
+
+- Microsoft Intune
+- System Center Configuration Manager
+- Group Policy
+- PowerShell cmdlets
+
+
+The topics in this section describe how to configure attack surface reduction. Each topic includes instructions for the applicable configuration tool (or tools).
+
+## In this section
+Topic | Description
+:---|:---
+[Enable hardware-based isolation for Microsoft Edge](../windows-defender-application-guard/install-wd-app-guard.md) | How to preprare for and install Application Guard, including hardware and softeware requirements
+[Enable application control](../windows-defender-application-control/windows-defender-application-control.md)|How to control applications run by users and potect kernel mode processes
+[Exploit protection](../windows-defender-exploit-guard/enable-exploit-protection.md)|How to automatically apply exploit mitigation techniques on both operating system processes and on individual apps
+[Network protection](../windows-defender-exploit-guard/enable-network-protection.md)|How to prevent users from using any apps to acces dangerous domains
+[Controlled folder access](../windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md)|How to protect valuable data from malicious apps
+[Attack surface reduction](../windows-defender-exploit-guard/enable-attack-surface-reduction.md)|How to prevent actions and aopps that are typically used for by exploit-seeking malware
+[Network firewall](../windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md)|How to protect devices and data across a network
+
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-conditional-access-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-conditional-access-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..7e52942346
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/configure-conditional-access-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,96 @@
+---
+title: Configure conditional access in Windows Defender ATP
+description:
+keywords:
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+# Configure conditional access in Windows Defender ATP
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+This section guides you through all the steps you need to take to properly implement conditional access.
+
+### Before you begin
+>[!WARNING]
+>It's important to note that Azure AD registered devices is not supported in this scenario.
+>Only Intune enrolled devices are supported.
+
+You need to make sure that all your devices are enrolled in Intune. You can use any of the following options to enroll devices in Intune:
+
+
+- IT Admin: For more information on how to enabling auto-enrollment, see [Windows Enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment)
+- End-user: For more information on how to enroll your Windows 10 device in Intune, see [Enroll your Windows 10 device in Intune](https://docs.microsoft.com/intune-user-help/enroll-your-w10-device-access-work-or-school)
+- End-user alternative: For more information on joining an Azure AD domain, see [Set up Azure Active Directory joined devices](https://docs.microsoft.com/en-us/azure/active-directory/device-management-azuread-joined-devices-setup).
+
+
+
+There are steps you'll need to take in Windows Defender Security Center, the Intune portal, and Azure AD portal.
+
+> [!NOTE]
+> You'll need a Microsoft Intune environment, with Intune managed and Azure AD joined Windows 10 devices.
+
+Take the following steps to enable conditional access:
+- Step 1: Turn on the Microsoft Intune connection from Windows Defender Security Center
+- Step 2: Turn on the Windows Defender ATP integration in Intune
+- Step 3: Create the compliance policy in Intune
+- Step 4: Assign the policy
+- Step 5: Create an Azure AD conditional access policy
+
+
+### Step 1: Turn on the Microsoft Intune connection
+1. In the navigation pane, select **Settings** > **Advanced features** > **Microsoft Intune connection**.
+2. Toggle the Microsoft Intune setting to **On**.
+3. Click **Save preferences**.
+
+
+### Step 2: Turn on the Windows Defender ATP integration in Intune
+1. Sign in to the [Azure portal](https://portal.azure.com).
+2. Select **Device compliance** > **Windows Defender ATP**.
+3. Set **Connect Windows 10.0.15063+ devices to Windows Defender Advanced Threat Protection** to **On**.
+4. Click **Save**.
+
+
+### Step 3: Create the compliance policy in Intune
+1. In the [Azure portal](https://portal.azure.com), select **All services**, filter on **Intune**, and select **Microsoft Intune**.
+2. Select **Device compliance** > **Policies** > **Create policy**.
+3. Enter a **Name** and **Description**.
+4. In **Platform**, select **Windows 10 and later**.
+5. In the **Device Health** settings, set **Require the device to be at or under the Device Threat Level** to your preferred level:
+
+ - **Secured**: This level is the most secure. The device cannot have any existing threats and still access company resources. If any threats are found, the device is evaluated as noncompliant.
+ - **Low**: The device is compliant if only low-level threats exist. Devices with medium or high threat levels are not compliant.
+ - **Medium**: The device is compliant if the threats found on the device are low or medium. If high-level threats are detected, the device is determined as noncompliant.
+ - **High**: This level is the least secure, and allows all threat levels. So devices that with high, medium or low threat levels are considered compliant.
+
+6. Select **OK**, and **Create** to save your changes (and create the policy).
+
+### Step 4: Assign the policy
+1. In the [Azure portal](https://portal.azure.com), select **All services**, filter on **Intune**, and select **Microsoft Intune**.
+2. Select **Device compliance** > **Policies**> select your Windows Defender ATP compliance policy.
+3. Select **Assignments**.
+4. Include or exclude your Azure AD groups to assign them the policy.
+5. To deploy the policy to the groups, select **Save**. The user devices targeted by the policy are evaluated for compliance.
+
+### Step 5: Create an Azure AD conditional access policy
+1. In the [Azure portal](https://portal.azure.com), open **Azure Active Directory** > **Conditional access** > **New policy**.
+2. Enter a policy **Name**, and select **Users and groups**. Use the Include or Exclude options to add your groups for the policy, and select **Done**.
+3. Select **Cloud apps**, and choose which apps to protect. For example, choose **Select apps**, and select **Office 365 SharePoint Online** and **Office 365 Exchange Online**. Select **Done** to save your changes.
+
+4. Select **Conditions** > **Client apps** to apply the policy to apps and browsers. For example, select **Yes**, and then enable **Browser** and **Mobile apps and desktop clients**. Select **Done** to save your changes.
+
+5. Select **Grant** to apply conditional access based on device compliance. For example, select **Grant access** > **Require device to be marked as compliant**. Choose **Select** to save your changes.
+
+6. Select **Enable policy**, and then **Create** to save your changes.
+
+For more information, see [Enable Windows Defender ATP with conditional access in Intune](https://docs.microsoft.com/intune/advanced-threat-protection).
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-conditionalaccess-belowfoldlink)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md
index 24160d9cd2..1d3703c9be 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 07/16/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md
index 980252189b..ba9cdde442 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md
@@ -18,10 +18,7 @@ ms.date: 04/24/2018
**Applies to:**
- Group Policy
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md
index 83f63e9c62..4d35506749 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsmdm-abovefoldlink)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md
index cbc1b85dda..d0bf0a6cbd 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
- System Center 2012 Configuration Manager or later versions
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md
index 8236a40cf4..ea54c42092 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md
index c0ae298a7a..8b93f17477 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 07/12/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-mssp-support-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-mssp-support-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..82a78124e7
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/configure-mssp-support-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,283 @@
+---
+title: Configure managed security service provider support
+description: Take the necessary steps to configure the MSSP integration with Windows Defender ATP
+keywords: managed security service provider, mssp, configure, integration
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+# Configure managed security service provider integration
+
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-mssp-support-abovefoldlink)
+
+[!include[Prereleaseinformation](prerelease.md)]
+
+You'll need to take the following configuration steps to enable the managed security service provider (MSSP) integration.
+
+>[!NOTE]
+>The following terms are used in this article to distinguish between the service provider and service consumer:
+> - MSSPs: Security organizations that offer to monitor and manage security devices for an organization.
+> - MSSP customers: Organizations that engage the services of MSSPs.
+
+The integration will allow MSSPs to take the following actions:
+- Get access to MSSP customer's Windows Defender Security Center portal
+- Get email notifications, and
+- Fetch alerts through security information and event management (SIEM) tools
+
+Before MSSPs can take these actions, the MSSP customer will need to grant access to their Windows Defender ATP tenant so that the MSSP can access the portal.
+
+Typically, MSSP customers take the initial configuration steps to grant MSSPs access to their Windows Defender Security Central tenant. After access is granted, other configuration steps can be done by either the MSSP customer or the MSSP.
+
+
+In general, the following configuration steps need to be taken:
+
+- **Grant the MSSP access to Windows Defender Security Center**
+This action needs to be done by the MSSP customer. It grants the MSSP access to the MSSP customer's Windows Defender ATP tenant.
+
+- **Configure alert notifications sent to MSSPs**
+This action can be taken by either the MSSP customer or MSSP. This lets the MSSPs know what alerts they need to address for the MSSP customer.
+
+- **Fetch alerts from MSSP customer's tenant into SIEM system**
+This action is taken by the MSSP. It allows MSSPs to fetch alerts in SIEM tools.
+
+- **Fetch alerts from MSSP customer's tenant using APIs**
+This action is taken by the MSSP. It allows MSSPs to fetch alerts using APIs.
+
+
+## Grant the MSSP access to the portal
+
+>[!NOTE]
+> These set of steps are directed towards the MSSP customer.
+> Access to the portal can can only be done by the MSSP customer.
+
+As a MSSP customer, you'll need to take the following configuration steps to grant the MSSP access to Windows Defender Security Center.
+
+Authentication and authorization of the MSSP user is built on top of Azure Active Directory (Azure AD) B2B functionality.
+
+You'll need to take the following 2 steps:
+- Add MSSP user to your tenant as a guest user
+- Grant MSSP user access to Windows Defender Security Center
+
+### Add MSSP user to your tenant as a guest user
+Add a user who is a member of the MSSP tenant to your tenant as a guest user.
+
+To grant portal access to the MSSP, you must add the MSSP user to your Azure AD as a guest user. For more information, see [Add Azure Active Directory B2B collaboration users in the Azure portal](https://docs.microsoft.com/azure/active-directory/b2b/add-users-administrator).
+
+### Grant MSSP user access to Windows Defender Security Center
+Grant the guest user access and permissions to your Windows Defender Security Center tenant.
+
+Granting access to guest user is done the same way as granting access to a user who is a member of your tenant.
+
+If you're using basic permissions to access the portal, the guest user must be assigned a Security Administrator role in **your** tenant. For more information, see [Use basic permissions to access the portal](basic-permissions-windows-defender-advanced-threat-protection.md).
+
+If you're using role-based access control (RBAC), the guest user must be to added to the appropriate group or groups in **your** tenant. Fore more information on RBAC in Windows Defender ATP, see [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md).
+
+>[!NOTE]
+>There is no difference between the Member user and Guest user roles from RBAC perspective.
+
+It is recommended that groups are created for MSSPs to make authorization access more manageable.
+
+As a MSSP customer, you can always remove or modify the permissions granted to the MSSP by updating the Azure AD user groups.
+
+## Access the Windows Defender Security Center MSSP customer portal
+
+>[!NOTE]
+>These set of steps are directed towards the MSSP.
+
+By default, MSSP customers access their Windows Defender Security Center tenant through the following URL: `https://securitycenter.windows.com`.
+
+MSSPs however, will need to use a tenant-specific URL in the following format: `https://securitycenter.windows.com?tid=customer_tenant_id` to access the MSSP customer portal.
+
+In general, MSSPs will need to be added to each of the MSSP customer's Azure AD that they intend to manage.
+
+
+Use the following steps to obtain the MSSP customer tenant ID and then use the ID to access the tenant-specific URL:
+
+1. As an MSSP, login to Azure AD with your credentials.
+
+2. Switch directory to the MSSP customer's tenant.
+
+3. Select **Azure Active Directory > Properties**. You'll find the tenant ID in the Directory ID field.
+
+4. Access the MSSP customer portal by replacing the `customer_tenant_id` value in the following URL: `https://securitycenter.windows.com?tid=customer_tenant_id`.
+
+## Configure alert notifications that are sent to MSSPs
+
+>[!NOTE]
+>This step can be done by either the MSSP customer or MSSP. MSSPs must be granted the appropriate permissions to configure this on behalf of the MSSP customer.
+
+After access the portal is granted, alert notification rules can to be created so that emails are sent to MSSPs when alerts associated with the tenant are created and set conditions are met.
+
+For more information, see [Create rules for alert notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md#create-rules-for-alert-notifications).
+
+These check boxes must be checked:
+ - **Include organization name** - The customer name will be added to email notifications
+ - **Include tenant-specific portal link** - Alert link URL will have tenant specific parameter (tid=target_tenant_id) that allows direct access to target tenant portal
+
+
+## Fetch alerts from MSSP customer's tenant into the SIEM system
+
+>[!NOTE]
+>This action is taken by the MSSP.
+
+
+To fetch alerts into your SIEM system you'll need to take the following steps:
+
+Step 1: Create a third-party application
+
+Step 2: Get access and refresh tokens from your customer's tenant
+
+Step 3: Whitelist your application on Windows Defender Security Center
+
+
+
+### Step 1: Create an application in Azure Active Directory (Azure AD)
+You'll need to create an application and grant it permissions to fetch alerts from your customer's Windows Defender ATP tenant.
+
+1. Sign in to the [Azure AD portal](https://aad.portal.azure.com/).
+
+2. Select **Azure Active Directory** > **App registrations**.
+
+3. Click **New application registration**.
+
+4. Specify the following values:
+
+ - Name: \ SIEM MSSP Connector (replace Tenant_name with the tenant display name)
+ - Application type: Web app / API
+ - Sign-on URL: `https://SiemMsspConnector`
+
+5. Click **Create**. The application is displayed in the list of applications you own.
+
+6. Select the application, then click **Settings** > **Properties**.
+
+7. Copy the value from the **Application ID** field.
+
+8. Change the value in the **App ID URI** to: `https:///SiemMsspConnector` (replace \ with the tenant name.
+
+9. Ensure that the **Multi-tenanted** field is set to **Yes**.
+
+10. In the **Settings** panel, select **Reply URLs** and add the following URL: `https://localhost:44300/wdatpconnector`.
+
+11. Click **Save**.
+
+12. Select **Keys** and specify the following values:
+
+ - Description: Enter a description for the key.
+ - Expires: Select **In 1 year**
+
+13. Click **Save**. Save the value is a safe place, you'll need this
+
+### Step 2: Get access and refresh tokens from your customer's tenant
+This section guides you on how to use a PowerShell script to get the tokens from your customer's tenant. This script uses the application from the previous step to get the access and refresh tokens using the OAuth Authorization Code Flow.
+
+After providing your credentials, you'll need to grant consent to the application so that the application is provisioned in the customer's tenant.
+
+
+1. Create a new folder and name it: `MsspTokensAcquisition`.
+
+2. Download the [LoginBrowser.psm1 module](https://github.com/shawntabrizi/Microsoft-Authentication-with-PowerShell-and-MSAL/blob/master/Authorization%20Code%20Grant%20Flow/LoginBrowser.psm1) and save it in the `MsspTokensAcquisition` folder.
+
+ >[!NOTE]
+ >In line 30, replace `authorzationUrl` with `authorizationUrl`.
+
+3. Create a file with the following content and save it with the name `MsspTokensAcquisition.ps1` in the folder:
+ ```
+ param (
+ [Parameter(Mandatory=$true)][string]$clientId,
+ [Parameter(Mandatory=$true)][string]$secret,
+ [Parameter(Mandatory=$true)][string]$tenantId
+ )
+ [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+ # Load our Login Browser Function
+ Import-Module .\LoginBrowser.psm1
+
+ # Configuration parameters
+ $login = "https://login.microsoftonline.com"
+ $redirectUri = "https://SiemMsspConnector"
+ $resourceId = "https://graph.windows.net"
+
+ Write-Host 'Prompt the user for his credentials, to get an authorization code'
+ $authorizationUrl = ("{0}/{1}/oauth2/authorize?prompt=select_account&response_type=code&client_id={2}&redirect_uri={3}&resource={4}" -f
+ $login, $tenantId, $clientId, $redirectUri, $resourceId)
+ Write-Host "authorzationUrl: $authorizationUrl"
+
+ # Fake a proper endpoint for the Redirect URI
+ $code = LoginBrowser $authorizationUrl $redirectUri
+
+ # Acquire token using the authorization code
+
+ $Body = @{
+ grant_type = 'authorization_code'
+ client_id = $clientId
+ code = $code
+ redirect_uri = $redirectUri
+ resource = $resourceId
+ client_secret = $secret
+ }
+
+ $tokenEndpoint = "$login/$tenantId/oauth2/token?"
+ $Response = Invoke-RestMethod -Method Post -Uri $tokenEndpoint -Body $Body
+ $token = $Response.access_token
+ $refreshToken= $Response.refresh_token
+
+ Write-Host " ----------------------------------- TOKEN ---------------------------------- "
+ Write-Host $token
+
+ Write-Host " ----------------------------------- REFRESH TOKEN ---------------------------------- "
+ Write-Host $refreshToken
+ ```
+4. Open an elevated PowerShell command prompt in the `MsspTokensAcquisition` folder.
+
+5. Run the following command:
+ `Set-ExecutionPolicy -ExecutionPolicy Bypass`
+
+6. Enter the following commands: `.\MsspTokensAcquisition.ps1 -clientId -secret -tenantId `
+
+ - Replace \ with the Application ID you got from the previous step.
+ - Replace \ with the application key you created from the previous step.
+ - Replace \ with your customer's tenant ID.
+
+7. You'll be asked to provide your credentials and consent. Ignore the page redirect.
+
+8. In the PowerShell window, you'll receive an access token and a refresh token. Save the refresh token to configure your SIEM connector.
+
+### Step 3: Whitelist your application on Windows Defender Security Center
+You'll need to whitelist the application you created in Windows Defender Security Center.
+
+You'll need to have **Manage portal system settings** permission to whitelist the application. Otherwise, you'll need to request your customer to whitelist the application for you.
+
+1. Go to `https://securitycenter.windows.com?tid=` (replace \ with the customer's tenant ID.
+
+2. Click **Settings** > **SIEM**.
+
+3. Select the **MSSP** tab.
+
+4. Enter the **Application ID** from the first step and your **Tenant ID**.
+
+5. Click **Authorize application**.
+
+You can now download the relevant configuration file for your SIEM and connect to the Windows Defender ATP API. For more information see, [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md).
+
+- In the ArcSight configuration file / Splunk Authentication Properties file you will have to write your application key manually by settings the secret value.
+- Instead of acquiring a refresh token in the portal, use the script from the previous step to acquire a refresh token (or acquire it by other means).
+
+## Fetch alerts from MSSP customer's tenant using APIs
+For information on how to fetch alerts using REST API, see [Pull alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md).
+
+## Related topics
+- [Use basic permissions to access the portal](basic-permissions-windows-defender-advanced-threat-protection.md)
+- [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md)
+- [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md)
+- [Pull alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
+
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md
index 23f06ea316..d9a8498c73 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md
@@ -18,10 +18,7 @@ ms.date: 05/29/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md
index cf4dafd48d..d31a895006 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md
@@ -1,15 +1,15 @@
---
title: Onboard servers to the Windows Defender ATP service
description: Onboard servers so that they can send sensor data to the Windows Defender ATP sensor.
-keywords: onboard server, server, server onboarding, machine management, configure Windows ATP servers, onboard Windows Defender Advanced Threat Protection servers
+keywords: onboard server, server, 2012r2, 2016, 2019, server onboarding, machine management, configure Windows ATP servers, onboard Windows Defender Advanced Threat Protection servers
search.product: eADQiWindows 10XVcnh
ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
author: mjcaparas
-ms.localizationpriority: high
-ms.date: 08/08/2018
+ms.localizationpriority: medium
+ms.date: 09/06/2018
---
# Onboard servers to the Windows Defender ATP service
@@ -19,25 +19,28 @@ ms.date: 08/08/2018
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server, version 1803
+- Windows Server, 2019
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configserver-abovefoldlink)
+
Windows Defender ATP extends support to also include the Windows Server operating system, providing advanced attack detection and investigation capabilities, seamlessly through the Windows Defender Security Center console.
The service supports the onboarding of the following servers:
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server, version 1803
+- Windows Server 2019
-## Onboard Windows Server 2012 R2 and Windows Server 2016
+## Windows Server 2012 R2 and Windows Server 2016
-To onboard your servers to Windows Defender ATP, you’ll need to:
+To onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP, you’ll need to:
- For Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients.
-- Turn on server monitoring from the Windows Defender Security Center portal.
+- Turn on server monitoring from Windows Defender Security Center.
- If you're already leveraging System Center Operations Manager (SCOM) or Operations Management Suite (OMS), simply attach the Microsoft Monitoring Agent (MMA) to report to your Windows Defender ATP workspace through [Multi Homing support](https://blogs.technet.microsoft.com/msoms/2016/05/26/oms-log-analytics-agent-multi-homing-support/). Otherwise, install and configure MMA to report sensor data to Windows Defender ATP as instructed below.
>[!TIP]
@@ -97,8 +100,8 @@ Agent Resource | Ports
| winatp-gw-aus.microsoft.com | 443|
| winatp-gw-aue.microsoft.com |443 |
-## Onboard Windows Server, version 1803
-You’ll be able to onboard in the same method available for Windows 10 client machines. For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). Support for Windows Server, version 1803 provides deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
+## Windows Server, version 1803 and Windows Server 2019
+To onboard Windows Server, version 1803 or Windows Server 2019, use the same method used when onboarding Windows 10 machines. For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). Support for Windows Server, version 1803 and Windows 2019 provides deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
1. Configure Windows Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
@@ -134,7 +137,7 @@ The following capabilities are included in this integration:
> Automated onboarding is only applicable for Windows Server 2012 R2 and Windows Server 2016.
- Servers monitored by Azure Security Center will also be available in Windows Defender ATP - Azure Security Center seamlessly connects to the Windows Defender ATP tenant, providing a single view across clients and servers. In addition, Windows Defender ATP alerts will be available in the Azure Security Center console.
-- Server investigation - Azure Security Center customers can access the Windows Defender ATP portal to perform detailed investigation to uncover the scope of a potential breach
+- Server investigation - Azure Security Center customers can access Windows Defender Security Center to perform detailed investigation to uncover the scope of a potential breach
>[!IMPORTANT]
>- When you use Azure Security Center to monitor servers, a Windows Defender ATP tenant is automatically created. The Windows Defender ATP data is stored in Europe by default.
@@ -143,7 +146,7 @@ The following capabilities are included in this integration:
## Offboard servers
-You can offboard Windows Server, version 1803 in the same method available for Windows 10 client machines.
+You can offboard Windows Server, version 1803 and Windows 2019 in the same method available for Windows 10 client machines.
For other server versions, you have two options to offboard servers from the service:
- Uninstall the MMA agent
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md
index f499b17917..5c36c805e4 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 10/16/2017
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)
diff --git a/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md
index ed37cdaedb..03f3013863 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 10/16/2017
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/custom-detection-rules.md b/windows/security/threat-protection/windows-defender-atp/custom-detection-rules.md
new file mode 100644
index 0000000000..e9d21b6f95
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/custom-detection-rules.md
@@ -0,0 +1,63 @@
+---
+title: Create custom detection rules in Windows Defender ATP
+description: Learn how to create custom detections rules based on advanced hunting queries
+keywords: create custom detections, detections, advanced hunting, hunt, detect, query
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+
+# Create custom detections rules
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prereleaseinformation](prerelease.md)]
+
+1. In the navigation pane, select **Advanced hunting**.
+
+2. Select an existing query that you'd like to base the monitor on or create a new query.
+
+3. Select **Create detection rule**.
+
+4. Specify the alert details:
+
+ - Alert title
+ - Severity
+ - Category
+ - Description
+ - Recommended actions
+
+5. Click **Create**.
+
+> [!TIP]
+> TIP #1: Running the query for the first time before saving it can help you find any mistakes or errors and give you a preview of the data you can expect to be returned.
+> When a new detection rule is created, it will run for the first time (it might take a few minutes) and raise any alerts created by this rule. After that, the rule will automatically run every 24 hours.
+> TIP #2: Since the detection automatically runs every 24 hours, it's best to query data in the last 24 hours.
+
+## Manage existing custom detection rules
+View existing rules in your network, see the last results of each rule, navigate to view all alerts that were created by each rule. You can also modify existing rules.
+
+1. In the navigation pane, select **Settings** > **Custom detections**. You'll see all the detections created in the system.
+
+2. Select one of the rules to take any of the following actions:
+ - Open related alerts - See all the alerts that were raised based to this rule
+ - Run - Run the selected detection immediately.
+
+ > [!NOTE]
+ > The next run for the query will be in 24 hours after the last run.
+
+ - Edit - Modify the settings of the rule.
+ - Modify query - View and edit the query itself.
+ - Turn off - Stop the query from running.
+ - Delete
+
+
+## Related topic
+- [Custom detections overview](overview-custom-detections.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md
index 43933756ec..229300b01e 100644
--- a/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md
index 2e13780e25..b98dc92230 100644
--- a/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md
@@ -16,10 +16,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md
index b4de052320..1efa791236 100644
--- a/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md
@@ -10,13 +10,12 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: medium
-ms.date: 07/05/2018
+ms.date: 09/07/2018
---
# Windows Defender ATP data storage and privacy
**Applies to:**
-
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md
index 26e859fb08..80d84f08c0 100644
--- a/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md
index 1d1154af3b..4896e983e7 100644
--- a/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md
index bddab1a14d..1afddb33b9 100644
--- a/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
@@ -32,8 +29,6 @@ Set the baselines for calculating the score of Windows Defender security control
1. In the navigation pane, select **Settings** > **Secure Score**.
- 
-
2. Select the security control, then toggle the setting between **On** and **Off**.
3. Click **Save preferences**.
diff --git a/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md
index 44e55b2b9b..123c537dc8 100644
--- a/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/evaluate-atp.md b/windows/security/threat-protection/windows-defender-atp/evaluate-atp.md
new file mode 100644
index 0000000000..760908772b
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/evaluate-atp.md
@@ -0,0 +1,38 @@
+---
+title: Evaluate Windows Defender Advanced Threat Protection
+description:
+keywords:
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 08/10/2018
+---
+
+# Evaluate Windows Defender ATP
+Windows Defender Advanced Threat Protection (Windows Defender ATP) is a unified platform for preventative protection, post-breach detection, automated investigation, and response.
+
+You can evaluate Windows Defender Advanced Threat Protection in your organization by [starting your free trial](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp).
+
+You can also evaluate the different security capabilities in Windows Defender ATP by using the following instructions.
+
+## Evaluate attack surface reduction
+These capabilities help prevent attacks and exploitations from infecting your organization.
+- [Evaluate attack surface reduction](../windows-defender-exploit-guard/evaluate-attack-surface-reduction.md)
+- [Evaluate exploit protection](../windows-defender-exploit-guard/evaluate-exploit-protection.md)
+- [Evaluate network protection](../windows-defender-exploit-guard/evaluate-exploit-protection.md)
+- [Evaluate controlled folder access](../windows-defender-exploit-guard/evaluate-controlled-folder-access.md)
+- [Evaluate application guard](../windows-defender-application-guard/test-scenarios-wd-app-guard.md)
+- [Evaluate network firewall](../windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md)
+
+## Evaluate next generation protection
+Next gen protections help detect and block the latest threats.
+- [Evaluate antivirus](../windows-defender-antivirus/evaluate-windows-defender-antivirus.md)
+
+
+## See Also
+[Get started with Windows Defender Advanced Threat Protection](get-started.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md
index 9fe88c8887..03354b9f6a 100644
--- a/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md
@@ -19,10 +19,7 @@ ms.date: 05/21/2018
**Applies to:**
- Event Viewer
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md
index 137a1b8070..68a5bbfdf5 100644
--- a/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 11/09/2017
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md
index 8864102a57..860ff1eee2 100644
--- a/windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 10/23/2017
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md
index 8d04e19940..1de9e6fc6b 100644
--- a/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 10/23/2017
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
@@ -60,7 +57,7 @@ The following suggested actions can help fix issues related to a misconfigured m
- [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls)
Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Windows Defender ATP service URLs.
-If you took corrective actions and the machine status is still misconfigured, [open a support ticket](http://go.microsoft.com/fwlink/?LinkID=761093&clcid=0x409).
+If you took corrective actions and the machine status is still misconfigured, [open a support ticket](https://go.microsoft.com/fwlink/?LinkID=761093&clcid=0x409).
### No sensor data
A misconfigured machine with status ‘No sensor data’ has communication with the service but can only report partial sensor data.
@@ -78,7 +75,7 @@ If the machines aren't reporting correctly, you might need to check that the Win
- [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)
If your machines are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Antivirus Early Launch Antimalware (ELAM) driver to be enabled.
-If you took corrective actions and the machine status is still misconfigured, [open a support ticket](http://go.microsoft.com/fwlink/?LinkID=761093&clcid=0x409).
+If you took corrective actions and the machine status is still misconfigured, [open a support ticket](https://go.microsoft.com/fwlink/?LinkID=761093&clcid=0x409).
## Related topic
- [Check sensor health state in Windows Defender ATP](check-sensor-status-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/get-started.md b/windows/security/threat-protection/windows-defender-atp/get-started.md
new file mode 100644
index 0000000000..ea37ae0629
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/get-started.md
@@ -0,0 +1,54 @@
+---
+title: Get started with Windows Defender Advanced Threat Protection
+description: Learn about the minimum requirements and initial steps you need to take to get started with Windows Defender ATP.
+keywords: get started, minimum requirements, setup, subscription, features, data storage, privacy, user access
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+# Get started with Windows Defender Advanced Threat Protection
+Learn about the minimum requirements and initial steps you need to take to get started with Windows Defender ATP.
+
+The following capabilities are available across multiple products that make up the Windows Defender ATP platform.
+
+**Attack surface reduction**
+The attack surface reduction set of capabilities provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations.
+
+**Next generation protection**
+To further reinforce the security perimeter of your network, Windows Defender ATP uses next generation protection designed to catch all types of emerging threats.
+
+**Endpoint detection and response**
+Endpoint detection and response capabilities are put in place to detect, investigate, and respond to advanced threats that may have made it past the first two security pillars.
+
+**Auto investigation and remediation**
+In conjunction with being able to quickly respond to advanced attacks, Windows Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale.
+
+**Secure score**
+Windows Defender ATP provides a security posture capability to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security state of your network.
+
+**Advanced hunting**
+Advanced hunting allows you to hunt for possible threats across your organization using a powerful search and query tool. You can also create custom detection rules based on the queries you created and surface alerts in Windows Defender Security Center.
+
+**Management and APIs**
+Integrate Windows Defender Advanced Threat Protection into your existing workflows.
+
+**Microsoft threat protection**
+Bring the power of Microsoft threat protection to your organization.
+
+## In this section
+Topic | Description
+:---|:---
+[Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) | Learn about the requirements for onboarding machines to the platform.
+[Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) | Get guidance on how to check that licenses have been provisioned to your organization and how to access the portal for the first time.
+[Preview features](preview-windows-defender-advanced-threat-protection.md) | Learn about new features in the Windows Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience.
+[Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) | Explains the data storage and privacy details related to Windows Defender ATP.
+[Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) | Set permissions to manage who can access the portal. You can set basic permissions or set granular permissions using role-based access control (RBAC).
+[Evaluate Windows Defender ATP](evaluate-atp.md) | Evaluate the various capabilities in Windows Defender ATP and test features out.
+[Access the Windows Defender Security Center Community Center](community-windows-defender-advanced-threat-protection.md) | The Windows Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product.
\ No newline at end of file
diff --git a/windows/security/identity-protection/how-hardware-based-containers-help-protect-windows.md b/windows/security/threat-protection/windows-defender-atp/how-hardware-based-containers-help-protect-windows.md
similarity index 98%
rename from windows/security/identity-protection/how-hardware-based-containers-help-protect-windows.md
rename to windows/security/threat-protection/windows-defender-atp/how-hardware-based-containers-help-protect-windows.md
index 04430822f3..199ece9336 100644
--- a/windows/security/identity-protection/how-hardware-based-containers-help-protect-windows.md
+++ b/windows/security/threat-protection/windows-defender-atp/how-hardware-based-containers-help-protect-windows.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: justinha
ms.date: 08/01/2018
---
diff --git a/windows/security/threat-protection/windows-defender-atp/images/active-alerts-tile.png b/windows/security/threat-protection/windows-defender-atp/images/active-alerts-tile.png
new file mode 100644
index 0000000000..19428a4156
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/active-alerts-tile.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/advanced-features.png b/windows/security/threat-protection/windows-defender-atp/images/advanced-features.png
new file mode 100644
index 0000000000..614b37509d
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/advanced-features.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/alerts-q-bulk.png b/windows/security/threat-protection/windows-defender-atp/images/alerts-q-bulk.png
index bafa469657..4a894f8c27 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/alerts-q-bulk.png and b/windows/security/threat-protection/windows-defender-atp/images/alerts-q-bulk.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/alerts-queue-list.png b/windows/security/threat-protection/windows-defender-atp/images/alerts-queue-list.png
new file mode 100644
index 0000000000..b62bd16313
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/alerts-queue-list.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-active-investigations-tile.png b/windows/security/threat-protection/windows-defender-atp/images/atp-active-investigations-tile.png
index 6950882187..9d46d16055 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-active-investigations-tile.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-active-investigations-tile.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting.png b/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting.png
index f43355e6e2..e023ffdfd6 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-advanced-hunting.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-view.png b/windows/security/threat-protection/windows-defender-atp/images/atp-alert-view.png
index 1b6c2dfa10..1d9c37de33 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-alert-view.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-alert-view.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-related-to-machine.PNG b/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-related-to-machine.PNG
index dcaa87034d..680603087c 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-related-to-machine.PNG and b/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-related-to-machine.PNG differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-selected.png b/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-selected.png
index 4fcc40c32c..ec05ebcd1f 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-selected.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-selected.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-tile.png b/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-tile.png
index 7a975960a1..40a8d079a4 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-tile.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-alerts-tile.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-auto-investigations-list.png b/windows/security/threat-protection/windows-defender-atp/images/atp-auto-investigations-list.png
index b2cdc68a24..2ac2a20e91 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-auto-investigations-list.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-auto-investigations-list.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-automated-investigations-statistics.png b/windows/security/threat-protection/windows-defender-atp/images/atp-automated-investigations-statistics.png
index 82565d784f..deefc7b684 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-automated-investigations-statistics.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-automated-investigations-statistics.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine-user.png b/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine-user.png
index c2c13fe289..80ee13a00e 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine-user.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine-user.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine.png b/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine.png
index 62e88527b3..c92c48edf0 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-azure-atp-machine.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-cloud-discovery-dashboard-menu.png b/windows/security/threat-protection/windows-defender-atp/images/atp-cloud-discovery-dashboard-menu.png
new file mode 100644
index 0000000000..df043c168e
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-cloud-discovery-dashboard-menu.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-daily-machines-reporting.png b/windows/security/threat-protection/windows-defender-atp/images/atp-daily-machines-reporting.png
index e46f058e86..2d4b4fc334 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-daily-machines-reporting.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-daily-machines-reporting.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-file-action.png b/windows/security/threat-protection/windows-defender-atp/images/atp-file-action.png
index 6d0e7a9d55..ffff95d0b6 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-file-action.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-file-action.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-details-page.png b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-details-page.png
new file mode 100644
index 0000000000..043255312e
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-details-page.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-details.png b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-details.png
new file mode 100644
index 0000000000..0135cd0a3f
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-details.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-evidence-tab.png b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-evidence-tab.png
new file mode 100644
index 0000000000..0b52a39faa
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-evidence-tab.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-graph-details.png b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-graph-details.png
new file mode 100644
index 0000000000..5875c6fdb3
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-graph-details.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-graph-tab.png b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-graph-tab.png
new file mode 100644
index 0000000000..7944809cde
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-graph-tab.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-investigations-tab.png b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-investigations-tab.png
new file mode 100644
index 0000000000..ffac35fc9b
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-investigations-tab.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-machine-tab.png b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-machine-tab.png
new file mode 100644
index 0000000000..1e4d52ff8d
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-machine-tab.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incident-queue.png b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-queue.png
new file mode 100644
index 0000000000..a2a61cb49b
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-incident-queue.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-incidents-mgt-pane.png b/windows/security/threat-protection/windows-defender-atp/images/atp-incidents-mgt-pane.png
new file mode 100644
index 0000000000..7d02d3d6ed
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-incidents-mgt-pane.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png b/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png
index e2e3ae3944..4aa7b0b33b 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machines-at-risk.png b/windows/security/threat-protection/windows-defender-atp/images/atp-machines-at-risk.png
index 9347d09c04..2a637f7560 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-machines-at-risk.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-machines-at-risk.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-machines-timeline.png b/windows/security/threat-protection/windows-defender-atp/images/atp-machines-timeline.png
index eccd6e9aec..1b65743d36 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-machines-timeline.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-machines-timeline.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mcas-settings.png b/windows/security/threat-protection/windows-defender-atp/images/atp-mcas-settings.png
new file mode 100644
index 0000000000..11e12c2890
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-mcas-settings.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png b/windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png
index ee2cf3dc71..94b1da42ea 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-WDATP-portal.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-list.png b/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-list.png
index 55113991e6..8da2532df7 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-list.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-list.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-notification.png b/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-notification.png
index af05f88e0b..415835330e 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-notification.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-pending-actions-notification.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-rename-incident.png b/windows/security/threat-protection/windows-defender-atp/images/atp-rename-incident.png
new file mode 100644
index 0000000000..3df94c2e4d
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-rename-incident.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-sec-ops-dashboard.png b/windows/security/threat-protection/windows-defender-atp/images/atp-sec-ops-dashboard.png
index 5a4816bf80..56a204ca39 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-sec-ops-dashboard.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-sec-ops-dashboard.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-suspicious-activities-tile.png b/windows/security/threat-protection/windows-defender-atp/images/atp-suspicious-activities-tile.png
index 0989362804..3be42e4c9d 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-suspicious-activities-tile.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-suspicious-activities-tile.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-tile-sensor-health.png b/windows/security/threat-protection/windows-defender-atp/images/atp-tile-sensor-health.png
index dce4ee3f5e..e39ee3c1ed 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-tile-sensor-health.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-tile-sensor-health.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-user-details-view-azureatp.png b/windows/security/threat-protection/windows-defender-atp/images/atp-user-details-view-azureatp.png
index 2fcb58e44f..e3f37f7626 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-user-details-view-azureatp.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-user-details-view-azureatp.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-users-at-risk.png b/windows/security/threat-protection/windows-defender-atp/images/atp-users-at-risk.png
index c2b81ca99a..dc9414f4cf 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/atp-users-at-risk.png and b/windows/security/threat-protection/windows-defender-atp/images/atp-users-at-risk.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/cloud-apps.png b/windows/security/threat-protection/windows-defender-atp/images/cloud-apps.png
new file mode 100644
index 0000000000..0c1aa96a37
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/cloud-apps.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/cloud-discovery.png b/windows/security/threat-protection/windows-defender-atp/images/cloud-discovery.png
new file mode 100644
index 0000000000..f4ff016260
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/cloud-discovery.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/dashboard.png b/windows/security/threat-protection/windows-defender-atp/images/dashboard.png
index 974708504f..a91410b6a2 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/dashboard.png and b/windows/security/threat-protection/windows-defender-atp/images/dashboard.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/io.png b/windows/security/threat-protection/windows-defender-atp/images/io.png
index a03e5fb917..4f2babfee6 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/io.png and b/windows/security/threat-protection/windows-defender-atp/images/io.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/machines-at-risk-tile.png b/windows/security/threat-protection/windows-defender-atp/images/machines-at-risk-tile.png
new file mode 100644
index 0000000000..04480e2b04
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/machines-at-risk-tile.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/machines-list.png b/windows/security/threat-protection/windows-defender-atp/images/machines-list.png
new file mode 100644
index 0000000000..8ffba20f49
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/machines-list.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/mss.png b/windows/security/threat-protection/windows-defender-atp/images/mss.png
index 63a22c2e50..2935e70089 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/mss.png and b/windows/security/threat-protection/windows-defender-atp/images/mss.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/new-secure-score-dashboard.png b/windows/security/threat-protection/windows-defender-atp/images/new-secure-score-dashboard.png
new file mode 100644
index 0000000000..b302d30f54
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/new-secure-score-dashboard.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/new-ssot.png b/windows/security/threat-protection/windows-defender-atp/images/new-ssot.png
new file mode 100644
index 0000000000..2dc4cba2f2
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/new-ssot.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/sec-ops-dashboard.png b/windows/security/threat-protection/windows-defender-atp/images/sec-ops-dashboard.png
new file mode 100644
index 0000000000..f858a4664a
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/sec-ops-dashboard.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/status-tile.png b/windows/security/threat-protection/windows-defender-atp/images/status-tile.png
index 452918b63f..bdc4ec022d 100644
Binary files a/windows/security/threat-protection/windows-defender-atp/images/status-tile.png and b/windows/security/threat-protection/windows-defender-atp/images/status-tile.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/ta.png b/windows/security/threat-protection/windows-defender-atp/images/ta.png
new file mode 100644
index 0000000000..db89f750a7
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/ta.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/threat-analytics-report.png b/windows/security/threat-protection/windows-defender-atp/images/threat-analytics-report.png
new file mode 100644
index 0000000000..374a1e58b2
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/threat-analytics-report.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/top-recommendations.png b/windows/security/threat-protection/windows-defender-atp/images/top-recommendations.png
new file mode 100644
index 0000000000..2b08ddae2e
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/top-recommendations.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/win10-endpoint-users.png b/windows/security/threat-protection/windows-defender-atp/images/win10-endpoint-users.png
new file mode 100644
index 0000000000..04eaa248a9
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/win10-endpoint-users.png differ
diff --git a/windows/security/identity-protection/images/windows-defender-system-guard-boot-time-integrity.png b/windows/security/threat-protection/windows-defender-atp/images/windows-defender-system-guard-boot-time-integrity.png
similarity index 100%
rename from windows/security/identity-protection/images/windows-defender-system-guard-boot-time-integrity.png
rename to windows/security/threat-protection/windows-defender-atp/images/windows-defender-system-guard-boot-time-integrity.png
diff --git a/windows/security/identity-protection/images/windows-defender-system-guard-validate-system-integrity.png b/windows/security/threat-protection/windows-defender-atp/images/windows-defender-system-guard-validate-system-integrity.png
similarity index 100%
rename from windows/security/identity-protection/images/windows-defender-system-guard-validate-system-integrity.png
rename to windows/security/threat-protection/windows-defender-atp/images/windows-defender-system-guard-validate-system-integrity.png
diff --git a/windows/security/identity-protection/images/windows-defender-system-guard.png b/windows/security/threat-protection/windows-defender-atp/images/windows-defender-system-guard.png
similarity index 100%
rename from windows/security/identity-protection/images/windows-defender-system-guard.png
rename to windows/security/threat-protection/windows-defender-atp/images/windows-defender-system-guard.png
diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md
index 5f1f375b3f..6e47b6ddea 100644
--- a/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md
@@ -16,10 +16,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md
index f57e046676..6640bb6e9f 100644
--- a/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md
@@ -16,10 +16,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md
index 8a0c91b597..29592bd0f8 100644
--- a/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md
@@ -16,10 +16,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md
index c6beecee0e..c88e3f9b5e 100644
--- a/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md
@@ -10,13 +10,12 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: medium
-ms.date: 08/01/2018
+ms.date: 09/03/2018
---
# Investigate machines in the Windows Defender ATP Machines list
**Applies to:**
-
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatemachines-abovefoldlink)
@@ -148,76 +147,13 @@ From the list of events that are displayed in the timeline, you can examine the
-You can also use the [Alerts spotlight](investigate-alerts-windows-defender-advanced-threat-protection.md#artifact-timeline) feature to see the correlation between alerts and events on a specific machine.
+You can also use the [Artifact timeline](investigate-alerts-windows-defender-advanced-threat-protection.md#artifact-timeline) feature to see the correlation between alerts and events on a specific machine.
Expand an event to view associated processes related to the event. Click on the circle next to any process or IP address in the process tree to investigate additional details of the identified processes. This action brings up the **Details pane** which includes execution context of processes, network communications and a summary of meta data on the file or IP address.
The details pane enriches the ‘in-context’ information across investigation and exploration activities, reducing the need to switch between contexts. It lets you focus on the task of tracing associations between attributes without leaving the current context.
-## Add machine tags
-You can add tags on machines during an investigation. Machine tags support proper mapping of the network, enabling you to attach different tags to capture context and to enable dynamic list creation as part of an incident.
-You can add tags on machines using the following ways:
-- By setting a registry key value
-- By using the portal
-
-### Add machine tags by setting a registry key value
-Add tags on machines which can be used as a filter in Machines list view. You can limit the machines in the list by selecting the Tag filter on the Machines list.
-
->[!NOTE]
-> Applicable only on the following machines:
->- Windows 10, version 1709 or later
->- Windows Server, version 1803 or later
->- Windows Server 2016
->- Windows Server 2012 R2
-
-Machines with similar tags can be handy when you need to apply contextual action on a specific list of machines.
-
-Use the following registry key entry to add a tag on a machine:
-
-- Registry key: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\DeviceTagging\`
-- Registry key value (string): Group
-
->[!NOTE]
->The device tag is part of the machine information report that’s generated once a day. As an alternative, you may choose to restart the endpoint that would transfer a new machine information report.
-
-
-### Add machine tags using the portal
-Dynamic context capturing is achieved using tags. By tagging machines, you can keep track of individual machines in your organization. After adding tags on machines, you can apply the Tags filter on the Machines list to get a narrowed list of machines with the tag.
-
-1. Select the machine that you want to manage tags on. You can select or search for a machine from any of the following views:
-
- - **Security operations dashboard** - Select the machine name from the Top machines with active alerts section.
- - **Alerts queue** - Select the machine name beside the machine icon from the alerts queue.
- - **Machines list** - Select the machine name from the list of machines.
- - **Search box** - Select Machine from the drop-down menu and enter the machine name.
-
- You can also get to the alert page through the file and IP views.
-
-2. Open the **Actions** menu and select **Manage tags**.
-
- 
-
-3. Enter tags on the machine. To add more tags, click the + icon.
-4. Click **Save and close**.
-
- 
-
- Tags are added to the machine view and will also be reflected on the **Machines list** view. You can then use the **Tags** filter to see the relevant list of machines.
-
-### Manage machine tags
-You can manage tags from the Actions button or by selecting a machine from the Machines list and opening the machine details panel.
-
-
-
-## Use machine groups in an investigation
-Machine group affiliation can represent geographic location, specific activity, importance level and others.
-
-You can create machine groups in the context of role-based access (RBAC) to control who can take specific action or who can see information on a specific machine group or groups by assigning the machine group to a user group. For more information, see [Manage portal access using role-based access control](rbac-windows-defender-advanced-threat-protection.md).
-
-You can also use machine groups to assign specific remediation levels to apply during automated investigations. For more information, see [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md).
-
-In an investigation, you can filter the Machines list to just specific machine groups by using the Groups filter.
## Related topics
diff --git a/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md
index 778f8d48b4..c2460df138 100644
--- a/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md
@@ -16,10 +16,7 @@ ms.date: 10/16/2017
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
@@ -112,7 +109,7 @@ When accessing [Windows Defender Security Center](https://SecurityCenter.Windows
-9. A dedicated cloud instance of Windows Defender Security Center portal is being created at this time. This step will take an average of 5 minutes to complete.
+9. A dedicated cloud instance of Windows Defender Security Center is being created at this time. This step will take an average of 5 minutes to complete.
diff --git a/windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md
index eade1924be..2969a1b1a1 100644
--- a/windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md
@@ -16,10 +16,7 @@ ms.date: 05/08/2018
# Create and manage machine groups in Windows Defender ATP
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Azure Active Directory
- Office 365
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
@@ -42,7 +39,7 @@ As part of the process of creating a machine group, you'll:
>A machine group is accessible to all users if you don’t assign any Azure AD groups to it.
-## Add a machine group
+## Create a machine group
1. In the navigation pane, select **Settings** > **Machine groups**.
diff --git a/windows/security/threat-protection/windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..eb5a096cf1
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,81 @@
+---
+title: Create and manage machine tags
+description: Use machine tags to group machines to capture context and enable dynamic list creation as part of an incident
+keywords: tags, machine tags, machine groups, groups, remediation, level, rules, aad group, role, assign, rank
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/13/2018
+---
+
+# Create and manage machine tags
+Add tags on machines to create a logical group affiliation. Machine group affiliation can represent geographic location, specific activity, importance level and others.
+
+You can create machine groups in the context of role-based access (RBAC) to control who can take specific action or who can see information on a specific machine group or groups by assigning the machine group to a user group. For more information, see [Manage portal access using role-based access control](rbac-windows-defender-advanced-threat-protection.md).
+
+You can also use machine groups to assign specific remediation levels to apply during automated investigations. For more information, see [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md).
+
+In an investigation, you can filter the Machines list to just specific machine groups by using the Groups filter.
+
+
+Machine tags support proper mapping of the network, enabling you to attach different tags to capture context and to enable dynamic list creation as part of an incident.
+
+You can add tags on machines using the following ways:
+- By setting a registry key value
+- By using the portal
+
+## Add machine tagsby setting a registry key value
+Add tags on machines which can be used as a filter in Machines list view. You can limit the machines in the list by selecting the Tag filter on the Machines list.
+
+>[!NOTE]
+> Applicable only on the following machines:
+>- Windows 10, version 1709 or later
+>- Windows Server, version 1803 or later
+>- Windows Server 2016
+>- Windows Server 2012 R2
+
+Machines with similar tags can be handy when you need to apply contextual action on a specific list of machines.
+
+Use the following registry key entry to add a tag on a machine:
+
+- Registry key: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\DeviceTagging\`
+- Registry key value (string): Group
+
+>[!NOTE]
+>The device tag is part of the machine information report thats generated once a day. As an alternative, you may choose to restart the endpoint that would transfer a new machine information report.
+
+
+## Add machine tags using the portal
+Dynamic context capturing is achieved using tags. By tagging machines, you can keep track of individual machines in your organization. After adding tags on machines, you can apply the Tags filter on the Machines list to get a narrowed list of machines with the tag.
+
+1. Select the machine that you want to manage tags on. You can select or search for a machine from any of the following views:
+
+ - **Security operations dashboard** - Select the machine name from the Top machines with active alerts section.
+ - **Alerts queue** - Select the machine name beside the machine icon from the alerts queue.
+ - **Machines list** - Select the machine name from the list of machines.
+ - **Search box** - Select Machine from the drop-down menu and enter the machine name.
+
+ You can also get to the alert page through the file and IP views.
+
+2. Open the **Actions** menu and select **Manage tags**.
+
+ 
+
+3. Enter tags on the machine. To add more tags, click the + icon.
+4. Click **Save and close**.
+
+ 
+
+ Tags are added to the machine view and will also be reflected on the **Machines list** view. You can then use the **Tags** filter to see the relevant list of machines.
+
+### Manage machine tags
+You can manage tags from the Actions button or by selecting a machine from the Machines list and opening the machine details panel.
+
+
+
+
diff --git a/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md
index 3906ca3861..d75eefe80b 100644
--- a/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md
@@ -10,63 +10,62 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: medium
-ms.date: 04/24/2018
+ms.date: 09/03/2018
---
# View and organize the Windows Defender ATP Machines list
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-machinesview-abovefoldlink)
-The **Machines list** shows a list of the machines in your network, the domain of each machine, when it last reported and the local IP Address it reported on, its **Health state**, the number of active alerts on each machine categorized by alert severity level, and the number of active malware detections. This view allows viewing machines ranked by risk or sensor health state, and keeping track of all machines that are reporting sensor data in your network.
+The **Machines list** shows a list of the machines in your network where alerts were generated. By default, the queue displays machines with alerts seen in the last 30 days.
-Use the Machines list in these main scenarios:
+At a glance you'll see information such as domain, risk level, OS platform, and other details.
+
+
+There are several options you can choose from to customize the machines list view.
+On the top navigation you can:
+- Customize columns to add or remove columns
+- Export the entire list in CSV format
+- Select the items to show per page
+- Navigate between pages
+- Apply filters
+
+
+Use the machine list in these main scenarios:
- **During onboarding**
During the onboarding process, the **Machines list** is gradually populated with machines as they begin to report sensor data. Use this view to track your onboarded endpoints as they come online. Sort and filter by time of last report, **Active malware category**, or **Sensor health state**, or download the complete endpoint list as a CSV file for offline analysis.
+
+ >[NOTE]
+ > Exporting the list depends on the number of machines in your organization. It might take a significant amount of time to download, depending on how large your organization is.
+Exporting the list in CSV format displays the data in an unfiltered manner. The CSV file will include all machines in the organization, regardless of any filtering applied in the view itself.
+
- **Day-to-day work**
- The **Machines list** enables easy identification of machines most at risk in a glance. High-risk machines have the greatest number and highest-severity alerts; **Sensor health state** provides another dimension to rank machines. Sorting machines by **Active alerts**, and then by **Sensor health state** helps identify the most vulnerable machines and take action on them.
+ The list enables easy identification of machines most at risk in a glance. High-risk machines have the greatest number and highest-severity alerts. Sorting machines by **Active alerts**, helps identify the most vulnerable machines and take action on them.
-## Sort, filter, and download the list of machines from the Machines list
-You can sort the **Machines list** by clicking on any column header to sort the view in ascending or descending order.
-Filter the **Machines list** by **Time**, **OS Platform**, **Health**, **Security state**, **Malware category alerts**, **Groups**, or **Tags** to focus on certain sets of machines, according to the desired criteria.
+
-You can also download the entire list in CSV format using the **Export to CSV** feature.
+## Sort and filter the machine list
+You can apply the following filters to limit the list of alerts and get a more focused view.
-
-You can use the following filters to limit the list of machines displayed during an investigation:
-
-**Time period**
-- 1 day
-- 3 days
-- 7 days
-- 30 days
-- 6 months
-
-**Risk level**
+### Risk level
Machine risk levels are indicators of the active threats that machines could be exposed to. A machine's risk level is determined using the number of active alerts and their severity levels. You can influence a machine's risk level by resolving associated alerts manually or automatically and also by suppressing an alert.
-**OS Platform**
-- Windows 10
-- Windows Server 2012 R2
-- Windows Server 2016
-- Other
+### OS Platform
+Limit the alerts queue view by selecting the OS platform that you're interested in investigating.
-
-**Sensor health state**
+### Health state
Filter the list to view specific machines grouped together by the following machine health states:
- **Active** – Machines that are actively reporting sensor data to the service.
-- **Misconfigured** – Machines that have impaired communications with service or are unable to send sensor data. Misconfigured machines can further be classified to:
+- **Misconfigured** – Machines that have impaired communications with service or are unable to send sensor data. Misconfigured machines can further be classified to:
- No sensor data
- Impaired communications
@@ -74,7 +73,7 @@ Filter the list to view specific machines grouped together by the following mach
- **Inactive** – Machines that have completely stopped sending signals for more than 7 days.
-**Security state**
+### Security state
Filter the list to view specific machines that are well configured or require attention based on the Windows Defender security controls that are enabled in your organization.
@@ -83,39 +82,9 @@ Filter the list to view specific machines that are well configured or require at
For more information, see [View the Secure Score dashboard](secure-score-dashboard-windows-defender-advanced-threat-protection.md).
-**Malware category alerts**
-Filter the list to view specific machines grouped together by the following malware categories:
- - **Ransomware** – Ransomware use common methods to encrypt files using keys that are known only to attackers. As a result, victims are unable to access the contents of the encrypted files. Most ransomware display or drop a ransom note—an image or an HTML file that contains information about how to obtain the attacker-supplied decryption tool for a fee.
- - **Credential theft** – Spying tools, whether commercially available or solely used for unauthorized purposes, include general purpose spyware, monitoring software, hacking programs, and password stealers.
- These tools collect credentials and other information from browser records, key presses, email and instant messages, voice and video conversations, and screenshots. They are used in cyberattacks to establish control and steal information.
- - **Exploit** – Exploits take advantage of unsecure code in operating system components and applications. Exploits allow attackers to run arbitrary code, elevate privileges, and perform other actions that increase their ability to compromise a targeted machine. Exploits are found in both commodity malware and malware used in targeted attacks.
- - **Backdoor** - Backdoors are malicious remote access tools that allow attackers to access and control infected machines. Backdoors can also be used to exfiltrate data.
- - **General malware** – Malware are malicious programs that perform unwanted actions, including actions that can disrupt, cause direct damage, and facilitate intrusion and data theft. Some malware can replicate and spread from one machine to another. Others are able to receive commands from remote attackers and perform activities associated with cyberattacks.
- - **PUA** – Unwanted software is a category of applications that install and perform undesirable activity without adequate user consent. These applications are not necessarily malicious, but their behaviors often negatively impact the computing experience, even appearing to invade user privacy. Many of these applications display advertising, modify browser settings, and install bundled software.
-
-**Groups and tags**
+### Tags
You can filter the list based on the grouping and tagging that you've added to individual machines.
-## Export machine list to CSV
-You can download a full list of all the machines in your organization, in CSV format. Click the **Export to CSV** button to download the entire list as a CSV file.
-
->[NOTE]
-> Exporting the list depends on the number of machines in your organization. It might take a significant amount of time to download, depending on how large your organization is.
-Exporting the list in CSV format displays the data in an unfiltered manner. The CSV file will include all machines in the organization, regardless of any filtering applied in the view itself.
-
-## Sort the Machines list
-You can sort the **Machines list** by the following columns:
-
-- **Machine name** - Name or GUID of the machine
-- **Health State** – Indicates if the machine is misconfigured or is not sending sensor data
-- **Last seen** - Date and time when the machine last reported sensor data
-- **Internal IP** - Local internal Internet Protocol (IP) address of the machine
-- **Active Alerts** - Number of alerts reported by the machine by severity
-- **Active malware alerts** - Number of active malware detections reported by the machine
-
-> [!NOTE]
-> The **Active malware detections** filter column will only appear if your machines are using [Windows Defender Antivirus](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) as the active real-time protection antimalware product.
-
## Related topics
- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md
index 4860f91956..00142f3502 100644
--- a/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md
@@ -10,51 +10,30 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: medium
-ms.date: 04/24/2018
+ms.date: 09/03/2018
---
# Manage Windows Defender Advanced Threat Protection alerts
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-managealerts-abovefoldlink)
-Windows Defender ATP notifies you of possible malicious events, attributes, and contextual information through alerts. A summary of new alerts is displayed in the **Security operations dashboard**, and you can access all alerts in the **Alerts queue** menu.
+Windows Defender ATP notifies you of possible malicious events, attributes, and contextual information through alerts. A summary of new alerts is displayed in the **Security operations dashboard**, and you can access all alerts in the **Alerts queue**.
You can manage alerts by selecting an alert in the **Alerts queue** or the **Alerts related to this machine** section of the machine details view.
Selecting an alert in either of those places brings up the **Alert management pane**.
-
+
-## Change the status of an alert
-
-You can categorize alerts (as **New**, **In Progress**, or **Resolved**) by changing their status as your investigation progresses. This helps you organize and manage how your team can respond to alerts.
-
-For example, a team leader can review all **New** alerts, and decide to assign them to the **In Progress** queue for further analysis.
-
-Alternatively, the team leader might assign the alert to the **Resolved** queue if they know the alert is benign, coming from a machine that is irrelevant (such as one belonging to a security administrator), or is being dealt with through an earlier alert.
-
-## Alert classification
-You can specify if an alert is a true alert or a false alert.
+## Link to another incident
+You can create a new incident from the alert or link to an existing incident.
## Assign alerts
If an alert is no yet assigned, you can select **Assign to me** to assign the alert to yourself.
-## Add comments and view the history of an alert
-You can add comments and view historical events about an alert to see previous changes made to the alert.
-
-Whenever a change or comment is made to an alert, it is recorded in the **Comments and history** section.
-
-Added comments instantly appear on the pane.
## Suppress alerts
There might be scenarios where you need to suppress alerts from appearing in Windows Defender Security Center. Windows Defender ATP lets you create suppression rules for specific alerts that are known to be innocuous such as known tools or processes in your organization.
@@ -83,32 +62,18 @@ Create custom rules to control when alerts are suppressed, or resolved. You can
1. Select the alert you'd like to suppress. This brings up the **Alert management** pane.
-2. Scroll down to the **Create a supression rule** section.
+2. Select **Create a supression rule**.
- 
-
-3. Enter an alert title then select an indicator of compromise from the drop-down list.
-
- 
-
- > [!NOTE]
- > You cannot create a custom or blank suppression rule. You must start from an existing alert.
-
-4. Specify the suppression conditions by entering values for any of the following:
- - Sha1
- - File name
- - Folder path
-
- > [!NOTE]
- > The SHA1 of the alert cannot be modified, however you can clear the SHA1 to remove it from the suppression conditions by removing the deselecting the checkbox.
+3. Select the **Trigerring IOC**.
-5. Specify the action and scope on the alert.
- You can automatically resolve an alert or hide it from the portal. Alerts that are automatically resolved will appear in the resolved section of the alerts queue. Alerts that are marked as hidden will be suppressed from the entire system, both on the machine's associated alerts and from the dashboard. You can also specify to suppress the alert on the machine only or the whole organization.
+4. Specify the action and scope on the alert.
+ You can automatically resolve an alert or hide it from the portal. Alerts that are automatically resolved will appear in the resolved section of the alerts queue. Alerts that are marked as hidden will be suppressed from the entire system, both on the machine's associated alerts and from the dashboard. You can also specify to suppress the alert on a specific machine group.
-6. Click **Save and close**.
+5. Enter a rule name and a comment.
+6. Click **Save**.
-### View the list of suppression rules
+#### View the list of suppression rules
1. In the navigation pane, select **Settings** > **Alert suppression**.
@@ -116,6 +81,28 @@ Create custom rules to control when alerts are suppressed, or resolved. You can
For more information on managing suppression rules, see [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md)
+## Change the status of an alert
+
+You can categorize alerts (as **New**, **In Progress**, or **Resolved**) by changing their status as your investigation progresses. This helps you organize and manage how your team can respond to alerts.
+
+For example, a team leader can review all **New** alerts, and decide to assign them to the **In Progress** queue for further analysis.
+
+Alternatively, the team leader might assign the alert to the **Resolved** queue if they know the alert is benign, coming from a machine that is irrelevant (such as one belonging to a security administrator), or is being dealt with through an earlier alert.
+
+
+
+## Alert classification
+You can choose not to set a classification, or specify if an alert is a true alert or a false alert.
+
+
+## Add comments and view the history of an alert
+You can add comments and view historical events about an alert to see previous changes made to the alert.
+
+Whenever a change or comment is made to an alert, it is recorded in the **Comments and history** section.
+
+Added comments instantly appear on the pane.
+
+
## Related topics
- [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md)
- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..a5df326a4d
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,194 @@
+---
+title: Learn about the automated investigations dashboard in Windows Defender Security Center
+description: View the list of automated investigations, its status, detection source and other details.
+keywords: autoir, automated, investigation, detection, dashboard, source, threat types, id, tags, machines, duration, filter export
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+# Learn about the automated investigations dashboard
+By default, the Automated investigations list displays investigations initiated in the last week. You can also choose to select other time ranges from the drop-down menu or specify a custom range.
+
+>[!NOTE]
+>If your organization has implemented role-based access to manage portal access, only authorized users or user groups who have permission to view the machine or machine group will be able to view the entire investigation.
+
+Use the **Customize columns** drop-down menu to select columns that you'd like to show or hide.
+
+From this view, you can also download the entire list in CSV format using the **Export** button, specify the number of items to show per page, and navigate between pages. You also have the flexibility to filter the list based on your preferred criteria.
+
+
+
+
+**Filters**
+You can use the following operations to customize the list of Automated investigations displayed:
+
+
+**Triggering alert**
+The alert the initiated the Automated investigation.
+
+**Status**
+An Automated investigation can be in one of the following status:
+
+Status | Description
+:---|:---
+| No threats found | No malicious entities found during the investigation.
+| Failed | A problem has interrupted the investigation, preventing it from completing. |
+| Partially remediated | A problem prevented the remediation of some malicious entities. |
+| Pending action | Remediation actions require review and approval. |
+| Waiting for machine | Investigation paused. The investigation will resume as soon as the machine is available. |
+| Queued | Investigation has been queued and will resume as soon as other remediation activities are completed. |
+| Running | Investigation ongoing. Malicious entities found will be remediated. |
+| Remediated | Malicious entities found were successfully remediated. |
+| Terminated by system | Investigation was stopped by the system. |
+| Terminated by user | A user stopped the investigation before it could complete.
+| Partially investigated | Entities directly related to the alert have been investigated. However, a problem stopped the investigation of collateral entities. |
+
+
+
+**Detection source**
+Source of the alert that initiated the Automated investigation.
+
+**Threat**
+The category of threat detected during the Automated investigation.
+
+
+**Tags**
+Filter using manually added tags that capture the context of an Automated investigation.
+
+**Machines**
+You can filter the Automated investigations list to zone in a specific machine to see other investigations related to the machine.
+
+**Machine groups**
+Apply this filter to see specific machine groups that you might have created.
+
+**Comments**
+Select between filtering the list between Automated investigations that have comments and those that don't.
+
+## Analyze Automated investigations
+You can view the details of an Automated investigation to see information such as the investigation graph, alerts associated with the investigation, the machine that was investigated, and other information.
+
+In this view, you'll see the name of the investigation, when it started and ended.
+
+
+
+The progress ring shows two status indicators:
+- Orange ring - shows the pending portion of the investigation
+- Green ring - shows the running time portion of the investigation
+
+
+
+In the example image, the automated investigation started on 10:26:59 AM and ended on 10:56:26 AM. Therefore, the entire investigation was running for 29 minutes and 27 seconds.
+
+The pending time of 16 minutes and 51 seconds reflects two possible pending states: pending for asset (for example, the device might have disconnected from the network) or pending for approval.
+
+From this view, you can also view and add comments and tags about the investigation.
+
+### Investigation page
+The investigation page gives you a quick summary on the status, alert severity, category, and detection source.
+
+You'll also have access to the following sections that help you see details of the investigation with finer granularity:
+
+- Investigation graph
+- Alerts
+- Machines
+- Threats
+- Entities
+- Log
+- Pending actions
+
+ >[!NOTE]
+ >The Pending actions tab is only displayed if there are actual pending actions.
+
+- Pending actions history
+
+ >[!NOTE]
+ >The Pending actions history tab is only displayed when an investigation is complete.
+
+In any of the sections, you can customize columns to further expand to limit the details you see in a section.
+
+### Investigation graph
+The investigation graph provides a graphical representation of an Automated investigation. All investigation related information is simplified and arranged in specific sections. Clicking on any of the icons brings you the relevant section where you can view more information.
+
+### Alerts
+Shows details such as a short description of the alert that initiated the Automated investigation, severity, category, the machine associated with the alert, user, time in queue, status, investigation state, and who the investigation is assigned to.
+
+Additional alerts seen on a machine can be added to an Automated investigation as long as the investigation is ongoing.
+
+Selecting an alert using the check box brings up the alerts details pane where you have the option of opening the alert page, manage the alert by changing its status, see alert details, Automated investigation details, related machine, logged-on users, and comments and history.
+
+Clicking on an alert title brings you the alert page.
+
+### Machines
+Shows details the machine name, IP address, group, users, operating system, remediation level, investigation count, and when it was last investigated.
+
+Machines that show the same threat can be added to an ongoing investigation and will be displayed in this tab. If 10 or more machines are found during this expansion process from the same entity, then that expansion action will require an approval and will be seen in the **Pending actions** view.
+
+Selecting a machine using the checkbox brings up the machine details pane where you can see more information such as machine details and logged-on users.
+
+Clicking on an machine name brings you the machine page.
+
+### Threats
+Shows details related to threats associated with this investigation.
+
+### Entities
+Shows details about entities such as files, process, services, drives, and IP addresses. The table details such as the number of entities that were analyzed. You'll gain insight into details such as how many are remediated, suspicious, or determined to be clean.
+
+### Log
+Gives a chronological detailed view of all the investigation actions taken on the alert. You'll see the action type, action, status, machine name, description of the action, comments entered by analysts who may have worked on the investigation, execution start time, duration, pending duration.
+
+As with other sections, you can customize columns, select the number of items to show per page, and filter the log.
+
+Available filters include action type, action, status, machine name, and description.
+
+You can also click on an action to bring up the details pane where you'll see information such as the summary of the action and input data.
+
+### Pending actions history
+This tab is only displayed when an investigation is complete and shows all pending actions taken during the investigation.
+
+
+## Pending actions
+If there are pending actions on an Automated investigation, you'll see a pop up similar to the following image.
+
+
+
+When you click on the pending actions link, you'll be taken to the pending actions page. You can also navigate to the page from the navigation page by going to **Automated investigation** > **Pending actions**.
+
+
+The pending actions view aggregates all investigations that require an action for an investigation to proceed or be completed.
+
+
+
+Use the Customize columns drop-down menu to select columns that you'd like to show or hide.
+
+From this view, you can also download the entire list in CSV format using the **Export** feature, specify the number of items to show per page, and navigate between pages.
+
+Pending actions are grouped together in the following tabs:
+- Quarantine file
+- Remove persistence
+- Stop process
+- Expand pivot
+- Quarantine service
+
+>[!NOTE]
+>The tab will only appear if there are pending actions for that category.
+
+### Approve or reject an action
+You'll need to manually approve or reject pending actions on each of these categories for the automated actions to proceed.
+
+Selecting an investigation from any of the categories opens a panel where you can approve or reject the remediation. Other details such as file or service details, investigation details, and alert details are displayed.
+
+
+
+From the panel, you can click on the Open investigation page link to see the investigation details.
+
+You also have the option of selecting multiple investigations to approve or reject actions on multiple investigations.
+
+## Related topic
+- [Investigate Windows Defender ATP alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md
index c090006878..46adcfac19 100644
--- a/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 06/14/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md
index 89eeee2c0e..9a359aaabc 100644
--- a/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md
index bae5b989f8..d3ed61a295 100644
--- a/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/manage-edr.md b/windows/security/threat-protection/windows-defender-atp/manage-edr.md
new file mode 100644
index 0000000000..97ff8bd046
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/manage-edr.md
@@ -0,0 +1,27 @@
+---
+title: Manage endpoint detection and response capabilities
+description:
+keywords:
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 07/01/2018
+---
+
+# Manage endpoint detection and response capabilities
+
+Manage the alerts queue, investigate machines in the machines list, take response actions, and hunt for possible threats in your organization using advanced hunting.
+
+
+## In this section
+Topic | Description
+:---|:---
+[Alerts queue](alerts-queue-endpoint-detection-response.md)| View the alerts surfaced in Windows Defender Security Center.
+[Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) | Learn how you can view and manage the machines list, manage machine groups, and investigate machine related alerts.
+[Take response actions](response-actions-windows-defender-advanced-threat-protection.md)| Take response actions on machines and files to quickly respond to detected attacks and contain threats.
+[Query data using advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md)| Proactively hunt for possible threats across your organization using a powerful search and query tool.
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md
index 6db6e02136..1fa0357ade 100644
--- a/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/management-apis.md b/windows/security/threat-protection/windows-defender-atp/management-apis.md
new file mode 100644
index 0000000000..2e0966140c
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/management-apis.md
@@ -0,0 +1,53 @@
+---
+title: Overview of management and APIs
+description:
+keywords:
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+# Overview of management and APIs
+
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-mgt-apis-abovefoldlink)
+
+Windows Defender ATP supports a wide variety of options to ensure that customers can easily adopt the platform.
+
+Acknowledging that customer environments and structures can vary, Windows Defender ATP was created with flexibility and granular control to fit varying customer requirements.
+
+Machine onboarding is fully integrated into System Center Configuration Manager and Microsoft Intune for client machines and Azure Security Center for server machines, providing complete end-to-end experience of configuration, deployment, and monitoring. In addition, Windows Defender ATP supports Group Policy and other third-party tools used for machines management.
+
+Windows Defender ATP provides fine-grained control over what users with access to the portal can see and do through the flexibility of role-based access control (RBAC). The RBAC model supports all flavors of security teams structure:
+- Globally distributed organizations and security teams
+- Tiered model security operations teams
+- Fully segregated devisions with single centralized global security operations teams
+
+The Windows Defender ATP solution is built on top of an integration-ready platform:
+- It supports integration with a number of security information and event management (SIEM) solutions and also exposes APIs to fully support pulling all the alerts and detection information into any SIEM solution.
+- It supports a rich set of application programming interface (APIs) providing flexibility for those who are already heavily invested in data enrichment and automation:
+ - Enriching events coming from other security systems with foot print or prevalence information
+ - Triggering file or machine level response actions through APIs
+ - Keeping systems in-sync such as importing machine tags from asset management systems into Windows Defender ATP, synchronize alerts and incidents status cross ticketing systems with Windows Defender ATP.
+
+An important aspect of machine management is the ability to analyze the environment from varying and broad perspectives. This often helps drive new insights and proper priority identification:
+- The Secure score dashboard provides metrics based method of prioritizing the most important proactive security measures.
+- Windows Defender ATP includes a built-in PowerBI based reporting solution to quickly review trends and details related to Windows Defender ATP alerts and secure score of machines. The platform also supports full customization of the reports, including mashing of Windows Defender ATP data with your own data stream to produce business specific reports.
+
+## Related topics
+- [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md)
+- [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md)
+- [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md)
+- [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md)
+- [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
+- [Role-based access control](rbac-windows-defender-advanced-threat-protection.md)
+
+
diff --git a/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md b/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md
new file mode 100644
index 0000000000..77af2ccba3
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md
@@ -0,0 +1,60 @@
+---
+title: Configure Microsoft Cloud App Security integration
+description: Learn how to turn on the settings to enable the Windows Defender ATP integration with Microsoft Cloud App Security.
+keywords: cloud, app, security, settings, integration, discovery, report
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+
+---
+
+# Configure Microsoft Cloud App Security integration
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prereleaseinformation](prerelease.md)]
+
+
+To benefit from Windows Defender Advanced Threat Protection (ATP) cloud app discovery signals, turn on Microsoft Cloud App Security integration.
+
+1. In the navigation pane, select **Preferences setup** > **Advanced features**.
+2. Select **Microsoft Cloud App Security** and switch the toggle to **On**.
+3. Click **Save preferences**.
+
+
+
+
+
+Once activated, Windows Defender ATP will immediately start forwarding discovery signals to Cloud App Security.
+
+## View the data collected
+
+1. Browse to the [Cloud App Security portal](https://portal.cloudappsecurity.com).
+
+2. Navigate to the Cloud Discovery dashboard.
+
+ 
+
+3. Select **Win10 Endpoint Users report**, which contains the data coming from Windows Defender ATP.
+
+ 
+
+This report is similar to the existing discovery report with one major difference: you can now benefit from visibility to the machine context.
+
+Notice the new **Machines** tab that allows you to view the data split to the device dimensions. This is available in the main report page or any subpage (for example, when drilling down to a specific cloud app).
+
+
+
+
+For more information about cloud discovery, see [Working with discovered apps](https://docs.microsoft.com/en-us/cloud-app-security/discovered-apps).
+
+If you are interested in trying Microsoft Cloud App Security, see [Microsoft Cloud App Security Trial](https://signup.microsoft.com/Signup?OfferId=757c4c34-d589-46e4-9579-120bba5c92ed&ali=1).
+
+## Related topic
+- [Microsoft Cloud App Security integration](microsoft-cloud-app-security-integration.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration.md b/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration.md
new file mode 100644
index 0000000000..4b4962140d
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration.md
@@ -0,0 +1,40 @@
+---
+title: Microsoft Cloud App Security integration overview
+description:
+keywords:
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+# Microsoft Cloud App Security integration overview
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prereleaseinformation](prerelease.md)]
+
+Microsoft Cloud App Security (Cloud App Security) is a comprehensive solution that gives visibility into cloud apps and services by allowing you to control and limit access to cloud apps, while enforcing compliance requirements on data stored in the cloud. For more information, see [Cloud App Security](https://docs.microsoft.com/cloud-app-security/what-is-cloud-app-security).
+
+## Windows Defender ATP and Cloud App Security integration
+
+Cloud App Security discovery relies on cloud traffic logs being forwarded to it from enterprise firewall and proxy servers. Windows Defender ATP integrates with Cloud App Security by collecting and forwarding all cloud app networking activities, providing unparalleled visibility to cloud app usage. The monitoring functionality is built into the device, providing complete coverage of network activity.
+
+The integration provides the following major improvements to the existing Cloud App Security discovery:
+
+- Available everywhere - Since the network activity is collected directly from the endpoint, it's available wherever the device is, on or off corporate network, as it's no longer depended on traffic routed through the enterprise firewall or proxy servers.
+
+- Works out of the box, no configuration required - Forwarding cloud traffic logs to Cloud App Security requires firewall and proxy server configuration. With the Windows Defender ATP and Cloud App Security integration, there's no configuration required. Just switch it on in Windows Defender Security Center settings and you're good to go.
+
+- Device context - Cloud traffic logs lack device context. Windows Defender ATP network activity is reported with the device context (which device accessed the cloud app), so you are able to understand exactly where (device) the network activity took place, in addition to who (user) performed it.
+
+For more information about cloud discovery, see [Working with discovered apps](https://docs.microsoft.com/en-us/cloud-app-security/discovered-apps).
+
+## Related topic
+
+- [Configure Microsoft Cloud App Security integration](microsoft-cloud-app-security-config.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md
index aee31bf368..84f62905aa 100644
--- a/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md
@@ -16,11 +16,6 @@ ms.date: 07/01/2018
# Minimum requirements for Windows Defender ATP
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
There are some minimum requirements for onboarding machines to the service.
diff --git a/windows/security/threat-protection/windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..0ec05caa9c
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,44 @@
+---
+title: Managed security service provider (MSSP) support
+description: Understand how Windows Defender ATP integrates with managed security service providers (MSSP)
+keywords: mssp, integration, managed, security, service, provider
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+# Managed security service provider support
+
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-mssp-support-abovefoldlink)
+
+[!include[Prereleaseinformation](prerelease.md)]
+
+Security is recognized as a key component in running an enterprise, however some organizations might not have the capacity or expertise to have a dedicated security operations team to manage the security of their endpoints and network, others may want to have a second set of eyes to review alerts in their network.
+
+
+To address this demand, managed security service providers (MSSP) offer to deliver managed detection and response (MDR) services on top of Windows Defender ATP.
+
+
+Windows Defender ATP adds support for this scenario and to allow MSSPs to take the following actions:
+
+- Get access to MSSP customer's Windows Defender Security Center portal
+- Get email notifications, and
+- Fetch alerts through security information and event management (SIEM) tools
+
+
+## Related topic
+- [Configure managed security service provider integration](configure-mssp-support-windows-defender-advanced-threat-protection.md)
+
+
+
+
+
diff --git a/windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md
index 0b481a47f3..af9a42584f 100644
--- a/windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md
@@ -16,11 +16,6 @@ ms.date: 04/24/2018
# Offboard machines from the Windows Defender ATP service
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- macOS
- Linux
- Windows Server 2012 R2
diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md
index 5f44382d18..34c07f0734 100644
--- a/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md
@@ -18,7 +18,7 @@ ms.date: 07/01/2018
**Applies to:**
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-You need to onboard machines to Windows Defender ATP before you can use the service.
+You need to turn on the sensor to give visibility within Windows Defender ATP.
For more information, see [Onboard your Windows 10 machines to Windows Defender ATP](https://www.youtube.com/watch?v=JT7VGYfeRlA&feature=youtu.be).
diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md
index 46f931e363..1428a1b310 100644
--- a/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md
@@ -23,7 +23,7 @@ ms.date: 06/18/2018
- Windows 8.1 Enterprise
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-[!include[Prerelease information](prerelease.md)]
+[!include[Prerelease information](prerelease.md)]
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-downlevel-abovefoldlink)
diff --git a/windows/security/threat-protection/windows-defender-atp/onboard.md b/windows/security/threat-protection/windows-defender-atp/onboard.md
new file mode 100644
index 0000000000..39ee66db3c
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/onboard.md
@@ -0,0 +1,32 @@
+---
+title: Configure and manage Windows Defender ATP capabilities
+description: Configure and manage Windows Defender ATP capabilities such as attack surface reduction, next generation protection, and security controls
+keywords: configure, manage, capabilities, attack surface reduction, next generation protection, security controls, endpoint detection and response, auto investigation and remediation, security controls, controls
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+# Configure and manage Windows Defender ATP capabilities
+
+Configure and manage all the Windows Defender ATP capabilities to get the best security protection for your organization.
+
+
+## In this section
+Topic | Description
+:---|:---
+[Configure attack surface reduction capabilities](configure-attack-surface-reduction.md) | By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations.
+[Configure next generation protection](../windows-defender-antivirus/configure-windows-defender-antivirus-features.md) | Configure next generation protection to catch all types of emerging threats.
+[Configure Secure score dashboard security controls](secure-score-dashboard-windows-defender-advanced-threat-protection.md) | Configure the security controls in Secure score to increase the security posture of your organization.
+Configure Microsoft threat protection integration| Configure other solutions that integrate with Windows Defender ATP.
+Management and API support| Pull alerts to your SIEM or use APIs to create custom alerts. Create and build Power BI reports.
+[Configure Windows Defender Security Center settings](preferences-setup-windows-defender-advanced-threat-protection.md) | Configure portal related settings such as general settings, advanced features, enable the preview experience and others.
+
+
+
diff --git a/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction.md b/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction.md
new file mode 100644
index 0000000000..98d08c46d6
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction.md
@@ -0,0 +1,32 @@
+---
+title: Overview of attack surface reduction
+description: Learn about the attack surface reduction capability in Windows Defender ATP
+keywords:
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 07/01/2018
+---
+
+# Overview of attack surface reduction
+
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+Attack surface reduction capabilities in Windows Defender ATP helps protect the devices and applications in your organization from new and emerging threats.
+
+| Capability | Description |
+|------------|-------------|
+| [Hardware-based isolation](../windows-defender-application-guard/wd-app-guard-overview.md) | Protects and maintains the integrity of the system as it starts and while it's running, and validates system integrity through local and remote attestation. In addition, container isolation for Microsoft Edge helps protect host operating system from malicious wbsites. |
+| [Application control](../windows-defender-application-control/windows-defender-application-control.md) | Moves away from the traditional application trust model where all applications are assumed trustworthy by default to one where applications must earn trust in order to run. |
+| [Exploit protection](../windows-defender-exploit-guard/exploit-protection-exploit-guard.md) | Applies exploit mitigation techniques to apps your organization uses, both individually and to all apps. Works with third-party antivirus solutions and Windows Defender Antivirus (Windows Defender AV) |
+| [Network protection](../windows-defender-exploit-guard/network-protection-exploit-guard.md) | Extends the malware and social engineering protection offered by Windows Defender SmartScreen in Microsoft Edge to cover network traffic and connectivity on your organization's devices. Requires Windows Defender AV. |
+| [Controlled folder access](../windows-defender-exploit-guard/controlled-folders-exploit-guard.md) | Helps protect files in key system folders from changes made by malicious and suspicious apps, including file-encrypting ransomware malware. Requires Windows Defender AV. |
+| [Attack surface reduction](../windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md) | reduce the attack surface of your applications with intelligent rules that stop the vectors used by Office-, script- and mail-based malware. Requires Windows Defender AV. |
+| [Network firewall](../windows-firewall/windows-firewall-with-advanced-security.md) | Host-based, two-way network traffic filtering that blocks unauthorized network traffic flowing into or out of the local device. |
+
diff --git a/windows/security/threat-protection/windows-defender-atp/overview-custom-detections.md b/windows/security/threat-protection/windows-defender-atp/overview-custom-detections.md
new file mode 100644
index 0000000000..9b2912076d
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/overview-custom-detections.md
@@ -0,0 +1,33 @@
+---
+title: Custom detections overview
+description: Understand how how you can leverage the power of advanced hunting to create custom detections
+keywords: custom detections, detections, advanced hunting, hunt, detect, query
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+
+# Custom detections overview
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prereleaseinformation](prerelease.md)]
+
+Alerts in Windows Defender ATP are surfaced through the system based on signals gathered from endpoints. With custom detections, you can create custom queries to monitor events for any kind of behavior such as suspicious or emerging threats.
+
+This can be done by leveraging the power of Advanced hunting through the creation of custom detection rules.
+Custom detections are queries that run periodically every 24 hours and can be configured so that when the query meets the criteria you set, alerts are created and are surfaced in Windows Defender Security Center. These alerts will be treated like any other alert in the system.
+
+This capability is particularly useful for scenarios when you want to pro-actively prevent threats and be notified quickly of emerging threats.
+
+## Related topic
+- [Create custom detection rules](custom-detection-rules.md)
+
+
diff --git a/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md b/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md
new file mode 100644
index 0000000000..31b65ba716
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md
@@ -0,0 +1,44 @@
+---
+title: Overview of endpoint detection and response capabilities
+description: Learn about the endpoint detection and response capabilities in Windows Defender ATP
+keywords:
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+# Overview of endpoint detection and response
+
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+
+The Widows Defender ATP endpoint detection and response capabilities provides near real-time actionable advance attacks detections, enables security analysts to effectively prioritize alerts, unfold the full scope of a breach and take response actions to remediate the threat.
+
+
+When a threat is detected, alerts are be created in the system for an analyst to investigate. Alerts with the same attack techniques or attributed to the same attacker are aggregated into an entity called _incident_. Aggregating alerts in this manner makes it easy for analysts to collectively investigate and respond to threats.
+
+Inspired by the "assume breach" mindset, Windows Defender ATP continuously collects behavioral cyber telemetry. This includes process information, network activities, deep optics into the kernel and memory manager, user login activities, registry and file system changes and others. This information is stored for six months, enabling an analyst to travel back in time to the starting point of an attack and pivot in various views and approach an investigation through multiple possible vectors.
+
+The response capabilities give you the power to promptly remediate threats by acting on the affected entities.
+
+## In this section
+
+Topic | Description
+:---|:---
+Security operations dashboard | This is where the endpoint detection and response capabilities are surfaced. It provides a high level overview of where detections were seen and highlights where response actions are needed.
+Alerts queue | This dashboard shows all the alerts that were seen on machines. Learn how you can view and organize the queue, or how to manage and investigate alerts.
+Machines list | Shows a list of machines where alerts have been generated. Learn how you can investigate machines, or how to search for specific events in a timeline, and others.
+Take response actions | Learn about the available response actions and how to apply them on machines and files.
+
+
+
+
+
+
diff --git a/windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md b/windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md
new file mode 100644
index 0000000000..9d8cdabaae
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md
@@ -0,0 +1,27 @@
+---
+title: Hardware-based isolation (Windows 10)
+description: Learn about how hardware-based isolation in Windows 10 helps to combat malware.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+author: justinha
+ms.localizationpriority: medium
+ms.author: justinha
+ms.date: 09/07/2018
+---
+
+# Hardware-based isolation in Windows 10
+
+**Applies to:** Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+Hardware-based isolation helps protect system integrity in Windows 10 and is integrated with Windows Defender ATP.
+
+| Feature | Description |
+|------------|-------------|
+| [Windows Defender Application Guard](../windows-defender-application-guard/wd-app-guard-overview.md) | Application Guard protects your device from advanced attacks while keeping you productive. Using a unique hardware-based isolation approach, the goal is to isolate untrusted websites and PDF documents inside a lightweight container that is separated from the operating system via the native Windows Hypervisor. If an untrusted site or PDF document turns out to be malicious, it still remains contained within Application Guard’s secure container, keeping the desktop PC protected and the attacker away from your enterprise data. |
+| [Windows Defender System Guard](how-hardware-based-containers-help-protect-windows.md) | System Guard protects and maintains the integrity of the system as it starts and after it's running, and validates system integrity by using attestation. |
+
+
+
+
diff --git a/windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..598138a8ef
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,35 @@
+---
+title: Overview of advanced hunting capabilities
+description: Hunt for possible threats accross your organization using a powerful search and query tool
+keywords: advanced hunting, hunting, search, query, tool, intellisense, telemetry
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/12/2018
+---
+
+# Overview of advanced hunting
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+Advanced hunting allows you to hunt for possible threats across your organization using a powerful search and query tool. You can also create custom detection rules based on the queries you created and surface alerts in Windows Defender Security Center.
+
+With advanced hunting, you can take advantage of the following capabilities:
+
+- **Powerful query language with IntelliSense** - Built on top of a query language that gives you the flexibility you need to take hunting to the next level.
+- **Query the stored telemetry** - The telemetry data is accessible in tables for you to query. For example, you can query process creation, network communication, and many other event types.
+- **Links to portal** - Certain query results, such as machine names and file names are actually direct links to the portal, consolidating the Advanced hunting query experience and the existing portal investigation experience.
+- **Query examples** - A welcome page provides examples designed to get you started and get you familiar with the tables and the query language.
+
+## In this section
+Topic | Description
+:---|:---
+[Query data using Advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md) | Learn how to use the basic or advanced query examples to search for possible emerging threats in your organization.
+
+
+
diff --git a/windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..222e5cfffa
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,76 @@
+---
+title: Overview of Secure score in Windows Defender Security Center
+description: Expand your visibility into the overall security posture of your organization
+keywords: secure score, security controls, improvement opportunities, security score over time, score, posture, baseline
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+# Overview of Secure score in Windows Defender Security Center
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+The Secure score dashboard expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. From there you can take action based on the recommended configuration baselines.
+
+>[!IMPORTANT]
+> This feature is available for machines on Windows 10, version 1703 or later.
+
+
+The **Secure score dashboard** displays a snapshot of:
+- Microsoft secure score
+- Secure score over time
+- Top recommendations
+- Improvement opportunities
+
+
+
+
+## Microsoft secure score
+The Microsoft secure score tile is reflective of the sum of all the Windows Defender security controls that are configured according to the recommended baseline and Office 365 controls. It allows you to drill down into each portal for further analysis. You can also improve this score by taking the steps in configuring each of the security controls in the optimal settings.
+
+
+
+Each Windows Defender security control contributes 100 points to the score. The total number is reflective of the score potential and calculated by multiplying the number of supported security controls (Windows Defender security controls pillars) by the maximum points that each pillar contributes (maximum of 100 points for each pillar).
+
+The Office 365 Secure Score looks at your settings and activities and compares them to a baseline established by Microsoft. For more information, see [Introducing the Office 365 Secure Score](https://support.office.com/en-us/article/introducing-the-office-365-secure-score-c9e7160f-2c34-4bd0-a548-5ddcc862eaef#howtoaccess).
+
+In the example image, the total points for the Windows security controls and Office 365 add up to 602 points.
+
+You can set the baselines for calculating the score of Windows Defender security controls on the Secure score dashboard through the **Settings**. For more information, see [Enable Secure score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md).
+
+## Secure score over time
+You can track the progression of your organizational security posture over time using this tile. It displays the overall score in a historical trend line enabling you to see how taking the recommended actions increase your overall security posture.
+
+
+
+You can mouse over specific date points to see the total score for that security control is on a specific date.
+
+
+## Top recommendations
+Reflects specific actions you can take to significantly increase the security stance of your organization and how many points will be added to the secure score if you take the recommended action.
+
+
+
+## Improvement opportunities
+Improve your score by taking the recommended improvement actions listed on this tile. The goal is to reduce the gap between the perfect score and the current score for each control.
+
+Clicking on the affected machines link at the top of the table takes you to the Machines list. The list is filtered to reflect the list of machines where improvements can be made.
+
+
+
+
+
+
+Within the tile, you can click on each control to see the recommended optimizations.
+
+Clicking the link under the Misconfigured machines column opens up the **Machines list** with filters applied to show only the list of machines where the recommendation is applicable. You can export the list in Excel to create a target collection and apply relevant policies using a management solution of your choice.
+
+## Related topic
+- [Threat analytics](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/overview.md b/windows/security/threat-protection/windows-defender-atp/overview.md
new file mode 100644
index 0000000000..1277a549bf
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/overview.md
@@ -0,0 +1,36 @@
+---
+title: Overview of Windows Defender ATP
+description:
+keywords:
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+# Overview of Windows Defender ATP capabilities
+
+Understand the concepts behind the capabilities in Windows Defender ATP so you take full advantage of the complete threat protection platform.
+
+## In this section
+
+Topic | Description
+:---|:---
+[Attack surface reduction](overview-attack-surface-reduction.md) | Leverage the attack surface reduction capabilities to protect the perimeter of your organization.
+[Next generation protection](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) | Learn about the antivirus capabilities in Windows Defender ATP so you can protect desktops, portable computers, and servers.
+[Endpoint detection and response](overview-endpoint-detection-response.md) | Understand how Windows Defender ATP continuously monitors your organization for possible attacks against systems, networks, or users in your organization and the features you can use to mitigate and remediate threats.
+[Automated investigation and investigation](automated-investigations-windows-defender-advanced-threat-protection.md) | In conjunction with being able to quickly respond to advanced attacks, Windows Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale.
+[Secure score](overview-secure-score-windows-defender-advanced-threat-protection.md) | Quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to better protect your organization - all in one place.
+[Advanced hunting](overview-hunting-windows-defender-advanced-threat-protection.md) | Use a powerful search and query language to create custom queries and detection rules.
+[Management and APIs](management-apis.md) | Windows Defender ATP supports a wide variety of tools to help you manage and interact with the platform so that you can integrate the service into your existing workflows.
+[Microsoft threat protection](threat-protection-integration.md) | Microsoft security products work better together. Learn about other security capabilities in the Microsoft threat protection stack.
+[Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) |Learn to navigate your way around Windows Defender Security Center.
+
+
+
+
diff --git a/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
index bbee7b2a62..aa1c10660e 100644
--- a/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
@@ -16,11 +16,6 @@ ms.date: 04/24/2018
# Windows Defender Advanced Threat Protection portal overview
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
@@ -52,14 +47,15 @@ Area | Description
:---|:---
(1) Navigation pane | Use the navigation pane to move between the **Dashboards**, **Alerts queue**, **Automated investigations**, **Machines list**, **Service health**, **Advanced hunting**, and **Settings**.
**Dashboards** | Access the Security operations, the Secure Score, or Threat analytics dashboard.
-**Alerts** | View separate queues of new, in progress, resolved alerts, alerts assigned to you.
+**Incidents** | View alerts that have been aggregated as incidents.
+**Alerts** | View alerts generated from machines in your organizations.
**Automated investigations** | Displays a list of automated investigations that's been conducted in the network, the status of each investigation and other details such as when the investigation started and the duration of the investigation.
+**Advanced hunting** | Advanced hunting allows you to proactively hunt and investigate across your organization using a powerful search and query tool.
**Machines list** | Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts.
**Service health** | Provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues.
-**Advanced hunting** | Advanced hunting allows you to proactively hunt and investigate across your organization using a powerful search and query tool.
**Settings** | Shows the settings you selected during onboarding and lets you update your industry preferences and retention policy period. You can also set other configuration settings such as email notifications, activate the preview experience, enable or turn off advanced features, SIEM integration, threat intel API, build Power BI reports, and set baselines for the Secure Score dashboard.
**(2) Main portal** | Main area where you will see the different views such as the Dashboards, Alerts queue, and Machines list.
-**(3) Search, Community center, Time settings, Help and support, Feedback** | **Search** - Provides access to the search bar where you can search for file, IP, machine, URL, and user. Displays the Search box: the drop-down list allows you to select the entity type and then enter the search query text. **Community center** -Access the Community center to learn, collaborate, and share experiences about the product. **Time settings** - Gives you access to the configuration settings where you can set time zones and view license information. **Help and support** - Gives you access to the Windows Defender ATP guide, Microsoft support, and Premier support. **Feedback** - Access the feedback button to provide comments about the portal.
+**(3) Community center, Time settings, Help and support, Feedback** | **Community center** -Access the Community center to learn, collaborate, and share experiences about the product. **Time settings** - Gives you access to the configuration settings where you can set time zones and view license information. **Help and support** - Gives you access to the Windows Defender ATP guide, Microsoft support, and Premier support. **Feedback** - Access the feedback button to provide comments about the portal.
## Windows Defender ATP icons
The following table provides information on the icons used all throughout the portal:
diff --git a/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md
index ee949dfc75..269e894610 100644
--- a/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md
@@ -14,11 +14,6 @@ ms.date: 04/24/2018
# Create and build Power BI reports using Windows Defender ATP data
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md
index cc40a22908..538450ea18 100644
--- a/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md
@@ -16,11 +16,6 @@ ms.date: 04/24/2018
# PowerShell code examples for the custom threat intelligence API
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md
index 769e84dfb8..76c28f6e1f 100644
--- a/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md
@@ -15,15 +15,8 @@ ms.date: 04/24/2018
# Configure Windows Defender Security Center settings
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-prefsettings-abovefoldlink)
Use the **Settings** menu to modify general settings, advanced features, enable the preview experience, email notifications, and the custom threat intelligence feature.
@@ -32,7 +25,7 @@ Use the **Settings** menu to modify general settings, advanced features, enable
Topic | Description
:---|:---
-[Update general settings](data-retention-settings-windows-defender-advanced-threat-protection.md) | Modify your general settings that were previously defined as part of the onboarding process.
+General settings | Modify your general settings that were previously defined as part of the onboarding process.
Permissions | Manage portal access using RBAC as well as machine groups.
APIs | Enable the threat intel and SIEM integration.
Rules | Configure suppressions rules and automation settings.
diff --git a/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md
index 244a09bc78..a295925903 100644
--- a/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md
@@ -15,11 +15,6 @@ ms.date: 04/24/2018
# Turn on the preview experience in Windows Defender ATP
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md
index 8675655043..3eab3eda81 100644
--- a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md
@@ -10,17 +10,12 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: medium
-ms.date: 07/30/2018
+ms.date: 09/03/2018
---
# Windows Defender ATP preview features
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
@@ -42,6 +37,29 @@ Turn on the preview experience setting to be among the first to try upcoming fea
## Preview features
The following features are included in the preview release:
+
+- [Threat analytics](threat-analytics.md)
+Threat Analytics is a set of interactive reports published by the Windows Defender ATP research team as soon as emerging threats and outbreaks are identified. The reports help security operations teams assess impact on their environment and provides recommended actions to contain, increase organizational resilience, and prevent specific threats.
+
+- [Custom detection](overview-custom-detections.md)
+ With custom detections, you can create custom queries to monitor events for any kind of behavior such as suspicious or emerging threats. This can be done by leveraging the power of Advanced hunting through the creation of custom detection rules.
+
+
+- [Managed security service provider (MSSP) support](mssp-support-windows-defender-advanced-threat-protection.md)
+Windows Defender ATP adds support for this scenario by providing MSSP integration.
+The integration will allow MSSPs to take the following actions:
+Get access to MSSP customer's Windows Defender Security Center portal, fet email notifications, and fetch alerts through security information and event management (SIEM) tools.
+
+- [Integration with Azure Security Center](configure-server-endpoints-windows-defender-advanced-threat-protection.md#integration-with-azure-security-center)
+Windows Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Windows Defender ATP to provide improved threat detection for Windows Servers.
+
+- [Integration with Microsoft Cloud App Security](microsoft-cloud-app-security-integration.md)
+Microsoft Cloud App Security leverages Windows Defender ATP endpoint signals to allow direct visibility into cloud application usage including the use of unsupported cloud services (shadow IT) from all Windows Defender ATP monitored machines.
+
+
+- [Onboard Windows Server 2019](configure-server-endpoints-windows-defender-advanced-threat-protection.md#windows-server-version-1803-and-windows-server-2019)
+Windows Defender ATP now adds support for Windows Server 2019. You'll be able to onboard Windows Server 2019 in the same method available for Windows 10 client machines.
+
- [Onboard previous versions of Windows](onboard-downlevel-windows-defender-advanced-threat-protection.md)
Onboard supported versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor
- Windows 7 SP1 Enterprise
@@ -49,11 +67,6 @@ Onboard supported versions of Windows machines so that they can send sensor data
- Windows 8.1 Enterprise
- Windows 8.1 Pro
-- [Integration with Azure Security Center](configure-server-endpoints-windows-defender-advanced-threat-protection.md#integration-with-azure-security-center)
-Windows Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Windows Defender ATP to provide improved threat detection for Windows Servers.
-
-
-
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-preview-belowfoldlink)
diff --git a/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md
index aab70fb694..58f784e646 100644
--- a/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md
@@ -16,11 +16,6 @@ ms.date: 04/24/2018
# Pull Windows Defender ATP alerts using REST API
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md
index ec4e631bbb..f84794a823 100644
--- a/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 04/24/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md
index 6c6e1ced73..20e2299d14 100644
--- a/windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md
@@ -15,17 +15,10 @@ ms.date: 05/08/2018
# Manage portal access using role-based access control
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Azure Active Directory
- Office 365
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-rbac-abovefoldlink)
@@ -45,9 +38,9 @@ Windows Defender ATP RBAC is designed to support your tier- or role-based model
- Create custom roles and control what Windows Defender ATP capabilities they can access with granularity.
- **Control who can see information on specific machine group or groups**
- - [Create machine groups](machine-groups-windows-defender-advanced-threat-protection.md) by specific criteria such as names, tags, domains, and others, then grant role access to them using a specific Azure AD user group.
+ - [Create machine groups](machine-groups-windows-defender-advanced-threat-protection.md) by specific criteria such as names, tags, domains, and others, then grant role access to them using a specific Azure Active Directory (Azure AD) user group.
-To implement role-based access, you'll need to define admin roles, assign corresponding permissions, and assign Azure Active Directory (Azure AD) user groups assigned to the roles.
+To implement role-based access, you'll need to define admin roles, assign corresponding permissions, and assign Azure AD user groups assigned to the roles.
### Before you begin
@@ -70,48 +63,7 @@ Someone with a Windows Defender ATP Global administrator role has unrestricted a
>
> After opting in to use RBAC, you cannot revert to the initial roles as when you first logged into the portal.
-## Create roles and assign the role to a group
-1. In the navigation pane, select **Settings > Role based access control > Roles**.
-
-2. Click **Add role**.
-
-3. Enter the role name, description, and permissions you’d like to assign to the role.
-
- - **Role name**
-
- - **Description**
-
- - **Permissions**
- - **View data** - Users can view information in the portal.
- - **Investigate alerts** - Users can manage alerts, initiate automated investigations, collect investigation packages, manage machine tags, and export machine timeline.
- - **Approve or take action** - Users can take response actions and approve or dismiss pending remediation actions.
- - **Manage system settings** - Users can configure settings, SIEM and threat intel API settings, advanced settings, preview features, and automated file uploads.
- - **Manage security settings** - Users can configure alert suppression settings, manage allowed/blocked lists for automation, manage folder exclusions for automation, onboard and offboard machines, and manage email notifications.
-
-4. Click **Next** to assign the role to an Azure AD group.
-
-5. Use the filter to select the Azure AD group that you’d like to add to this role.
-
-6. Click **Save and close**.
-
-7. Apply the configuration settings.
-
-## Edit roles
-
-1. Select the role you'd like to edit.
-
-2. Click **Edit**.
-
-3. Modify the details or the groups that are assigned to the role.
-
-4. Click **Save and close**.
-
-## Delete roles
-
-1. Select the role you'd like to delete.
-
-2. Click the drop-down button and select **Delete role**.
## Related topic
- [Create and manage machine groups in Windows Defender ATP](machine-groups-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md
index c2dc292025..148d0a9793 100644
--- a/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md
@@ -16,11 +16,6 @@ ms.date: 04/24/2018
# Take response actions on a file
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md
index c43c430a57..064fb37360 100644
--- a/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md
@@ -16,11 +16,6 @@ ms.date: 12/12/2017
# Take response actions on a machine
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md
index 8858ac7366..5feacd51aa 100644
--- a/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md
@@ -16,11 +16,6 @@ ms.date: 11/12/2017
# Take response actions in Windows Defender ATP
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md
index b7b33d60ef..985a82d123 100644
--- a/windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md
@@ -16,7 +16,6 @@ ms.date: 12/08/2017
# Restrict app execution API
**Applies to:**
-
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md
index c6803604a8..9132144898 100644
--- a/windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md
@@ -16,7 +16,6 @@ ms.date: 12/08/2017
# Run antivirus scan API
**Applies to:**
-
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md
index 87fe1b0b5c..ad774f962c 100644
--- a/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md
@@ -10,23 +10,24 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: medium
-ms.date: 11/06/2017
+ms.date: 09/07/2018
---
# Run a detection test on a newly onboarded Windows Defender ATP machine
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+- Supported Windows 10 versions
+- Windows Server 2012 R2
+- Windows Server 2016
+- Windows Server, version 1803
+- Windows Server, 2019
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
Run the following PowerShell script on a newly onboarded machine to verify that it is properly reporting to the Windows Defender ATP service.
-1. Open an elevated command-line prompt on the machine and run the script:
+1. Create a folder: 'C:\test-WDATP-test'.
+2. Open an elevated command-line prompt on the machine and run the script:
a. Go to **Start** and type **cmd**.
@@ -34,7 +35,7 @@ Run the following PowerShell script on a newly onboarded machine to verify that
-2. At the prompt, copy and run the following command:
+3. At the prompt, copy and run the following command:
```
powershell.exe -NoExit -ExecutionPolicy Bypass -WindowStyle Hidden (New-Object System.Net.WebClient).DownloadFile('http://127.0.0.1/1.exe', 'C:\test-WDATP-test\invoice.exe');Start-Process 'C:\test-WDATP-test\invoice.exe'
diff --git a/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md
index 47815df570..48a0fcb12c 100644
--- a/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md
@@ -1,6 +1,6 @@
---
-title: View the Secure Score dashboard in Windows Defender ATP
-description: Use the Secure Score dashboard to assess and improve the security state of your organization by analyzing various security control tiles.
+title: Configure the security controls in Secure score
+description: Configure the security controls in Secure score
keywords: secure score, dashboard, security recommendations, security control state, security score, score improvement, microsoft secure score, security controls, security control, improvement opportunities, edr, antivirus, av, os security updates
search.product: eADQiWindows 10XVcnh
ms.prod: w10
@@ -12,80 +12,10 @@ ms.localizationpriority: medium
ms.date: 04/24/2018
---
-# View the Windows Defender Advanced Threat Protection Secure score dashboard
-
+# Configure the security controls in Secure score
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-
->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-sadashboard-abovefoldlink)
-
-
-The Secure score dashboard expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. From there you can take action based on the recommended configuration baselines.
-
->[!IMPORTANT]
-> This feature is available for machines on Windows 10, version 1703 or later.
-
-
-The **Secure score dashboard** displays a snapshot of:
-- Microsoft Secure score
-- Windows Defender security controls
-- Improvement opportunities
-- Security score over time
-
-
-
-## Microsoft secure score
-The Microsoft secure score tile is reflective of the sum of all the Windows Defender security controls that are configured according to the recommended baseline and Office 365 controls. It allows you to drill down into each portal for further analysis. You can also improve this score by taking the steps in configuring each of the security controls in the optimal settings.
-
-
-
-Each Windows Defender security control contributes 100 points to the score. The total number is reflective of the score potential and calculated by multiplying the number of supported security controls (Windows Defender security controls pillars) by the maximum points that each pillar contributes (maximum of 100 points for each pillar).
-
-The Office 365 Secure Score looks at your settings and activities and compares them to a baseline established by Microsoft. For more information, see [Introducing the Office 365 Secure Score](https://support.office.com/en-us/article/introducing-the-office-365-secure-score-c9e7160f-2c34-4bd0-a548-5ddcc862eaef#howtoaccess).
-
-In the example image, the total points for the Windows security controls and Office 365 add up to 718 points.
-
-You can set the baselines for calculating the score of Windows Defender security controls on the Secure score dashboard through the **Settings**. For more information, see [Enable Secure score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md).
-
-## Windows Defender security controls
-The security controls tile shows a bar graph where each bar represents a Windows Defender security control. Each bar reflects the number of machines that are well configured and those that require **any kind of attention** for each security control. Hovering on top of the individual bars will show exact numbers for each category. Machines that are green are well configured, while machines that are orange require some level of attention.
-
-
-
-
-## Improvement opportunities
-Improve your score by taking the recommended improvement actions listed on this tile. The goal is to reduce the gap between the perfect score and the current score for each control.
-
-Click on each control to see the recommended optimizations.
-
-
-
-The numbers beside the green triangle icon on each recommended action represents the number of points you can gain by taking the action. When added together, the total number makes up the numerator in the fraction for each segment in the Improvement opportunities tile.
-
->[!IMPORTANT]
->Recommendations that do not display a green triangle icon are informational only and no action is required.
-
-Clicking **View machines** in a specific recommendation opens up the **Machines list** with filters applied to show only the list of machines where the recommendation is applicable. You can export the list in Excel to create a target collection and apply relevant policies using a management solution of your choice.
-
-The following image shows an example list of machines where the EDR sensor is not turned on.
-
-
-
-## Security score over time
-You can track the progression of your organizational security posture over time using this tile. It displays the overall and individual control scores in a historical trend line enabling you to see how taking the recommended actions increase your overall security posture.
-
-
-
-You can click on specific date points to see the total score for that security control is on a particular date.
-
-## Improve your secure score by applying improvement recommendations
Each security control lists recommendations that you can take to increase the security posture of your organization.
### Endpoint detection and response (EDR) optimization
@@ -342,10 +272,7 @@ For more information, see [Manage Windows Defender Credential Guard](https://doc
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-sadashboard-belowfoldlink)
## Related topics
-- [Understand the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md)
-- [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md)
-- [View the Security operations dashboard](security-operations-dashboard-windows-defender-advanced-threat-protection.md)
-- [View the Threat analytics dashboard and take recommended mitigation actions](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md)
+- [Overview of Secure score](overview-secure-score-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md
index 8e9f3634dc..0fdb2ab3d7 100644
--- a/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md
@@ -1,6 +1,6 @@
---
-title: Windows Defender Advanced Threat Protection Security operations dashboard
-description: Use the Dashboard to identify machines at risk, keep track of the status of the service, and see statistics and information about machines and alerts.
+title: Windows Defender Security Center Security operations dashboard
+description: Use the dashboard to identify machines at risk, keep track of the status of the service, and see statistics and information about machines and alerts.
keywords: dashboard, alerts, new, in progress, resolved, risk, machines at risk, infections, reporting, statistics, charts, graphs, health, active malware detections, threat category, categories, password stealer, ransomware, exploit, threat, low severity, active malware
search.product: eADQiWindows 10XVcnh
ms.prod: w10
@@ -10,37 +10,32 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: medium
-ms.date: 04/24/2018
+ms.date: 09/04/2018
---
-# View the Windows Defender Advanced Threat Protection Security operations dashboard
+# Windows Defender Security Center Security operations dashboard
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-secopsdashboard-abovefoldlink)
-The **Security operations dashboard** displays a snapshot of:
+The **Security operations dashboard** is where the endpoint detection and response capabilities are surfaced. It provides a high level overview of where detections were seen and highlights where response actions are needed.
-- The latest active alerts on your network
+The dashboard displays a snapshot of:
+
+- Active alerts
- Machines at risk
-- Machines with active malware alerts
+- Sensor health
+- Service health
- Daily machines reporting
- Active automated investigations
- Automated investigations statistics
- Users at risk
- Suspicious activities
-- Sensor health
-- Service health
-
+
+
You can explore and investigate alerts and machines to quickly determine if, where, and when suspicious activities occurred in your network to help you understand the context they appeared in.
@@ -49,51 +44,45 @@ From the **Security operations dashboard** you will see aggregated events to fac
It also has clickable tiles that give visual cues on the overall health state of your organization. Each tile opens a detailed view of the corresponding overview.
## Active alerts
-You can view the overall number of active ATP alerts from the last 30 days in your network from the **ATP alerts** tile. Alerts are grouped into **New** and **In progress**.
+You can view the overall number of active alerts from the last 30 days in your network from the tile. Alerts are grouped into **New** and **In progress**.
-
+
Each group is further sub-categorized into their corresponding alert severity levels. Click the number of alerts inside each alert ring to see a sorted view of that category's queue (**New** or **In progress**).
For more information see, [Alerts overview](alerts-queue-windows-defender-advanced-threat-protection.md).
-The **Latest active alerts** section includes the latest active alerts in your network. Each row includes an alert severity category and a short description of the alert. Click an alert to see its detailed view, or **Alerts queue** at the top of the list to go directly to the Alerts queue. For more information see, [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) and [Alerts overview](alerts-queue-windows-defender-advanced-threat-protection.md).
+Each row includes an alert severity category and a short description of the alert. You can click an alert to see its detailed view. For more information see, [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) and [Alerts overview](alerts-queue-windows-defender-advanced-threat-protection.md).
## Machines at risk
This tile shows you a list of machines with the highest number of active alerts. The total number of alerts for each machine is shown in a circle next to the machine name, and then further categorized by severity levels at the far end of the tile (hover over each severity bar to see its label).
-
+
Click the name of the machine to see details about that machine. For more information see, [Investigate machines in the Windows Defender Advanced Threat Protection Machines list](investigate-machines-windows-defender-advanced-threat-protection.md).
You can also click **Machines list** at the top of the tile to go directly to the **Machines list**, sorted by the number of active alerts. For more information see, [Investigate machines in the Windows Defender Advanced Threat Protection Machines list](investigate-machines-windows-defender-advanced-threat-protection.md).
-## Machines with active malware detections
-The **Machines with active malware detections** tile will only appear if your machines are using Windows Defender Antivirus.
+## Sensor health
+The **Sensor health** tile provides information on the individual machine’s ability to provide sensor data to the Windows Defender ATP service. It reports how many machines require attention and helps you identify problematic machines.
-Active malware is defined as threats that were actively executing at the time of detection.
+
-Hover over each bar to see the number of active malware detections (as **Malware detections**) and the number of machines with at least one active detection (as **Machines**) over the past 30 days.
+There are two status indicators that provide information on the number of machines that are not reporting properly to the service:
+- **Misconfigured** – These machines might partially be reporting sensor data to the Windows Defender ATP service and might have configuration errors that need to be corrected.
+- **Inactive** - Machines that have stopped reporting to the Windows Defender ATP service for more than seven days in the past month.
-
-The chart is sorted into five categories:
+When you click any of the groups, you’ll be directed to machines list, filtered according to your choice. For more information, see [Check sensor state](check-sensor-status-windows-defender-advanced-threat-protection.md) and [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md).
-- **Ransomware** - threats that prevent user access to a machine or its files and demand payment to restore access.
-- **Credential theft** - threats that attempt to steal credentials.
-- **Exploit** - threats that use software vulnerabilities to infect machines.
-- **Backdoor** - threats that gives a malicious hacker access to and control of machines.
-- **General** - threats that perform unwanted actions, including actions that can disrupt, cause direct damage, and facilitate intrusion and data theft.
-- **PUA** - applications that install and perform undesirable activity without adequate user consent.
+## Service health
+The **Service health** tile informs you if the service is active or if there are issues.
-Threats are considered "active" if there is a very high probability that the malware was executing on your network, as opposed to statically located on-disk.
+
-Clicking on any of these categories will navigate to the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md), filtered by the appropriate category. This lets you see a detailed breakdown of which machines have active malware detections, and how many threats were detected per machine.
-
-> [!NOTE]
-> The **Machines with active malware detections** tile will only appear if your machines are using [Windows Defender Antivirus](https://technet.microsoft.com/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product.
+For more information on the service health, see [Check the Windows Defender ATP service health](service-status-windows-defender-advanced-threat-protection.md).
## Daily machines reporting
@@ -104,13 +93,13 @@ The **Daily machines reporting** tile shows a bar graph that represents the numb
## Active automated investigations
-You can view the overall number of automated investigations from the last 30 days in your network from the **Active automated investigations** tile. Investigations are grouped into **Waiting for machine**, **Running**, and **Pending approval**.
+You can view the overall number of automated investigations from the last 30 days in your network from the **Active automated investigations** tile. Investigations are grouped into **Pending action**, **Waiting for machine**, and **Running**.
## Automated investigations statistics
-This tile shows statistics related to automated investigations in the last 30 days. It shows the number of investigations completed, the number of successfully remediated investigations, the average pending time it takes for an investigaiton to be initiated, the average time it takes to remediate an alert, the number of alerts investigated, and the number of hours of automation saved from a typical manual investigation.
+This tile shows statistics related to automated investigations in the last 30 days. It shows the number of investigations completed, the number of successfully remediated investigations, the average pending time it takes for an investigation to be initiated, the average time it takes to remediate an alert, the number of alerts investigated, and the number of hours of automation saved from a typical manual investigation.
@@ -129,26 +118,6 @@ This tile shows audit events based on detections from various security component
-## Sensor health
-The **Sensor health** tile provides information on the individual machine’s ability to provide sensor data to the Windows Defender ATP service. It reports how many machines require attention and helps you identify problematic machines.
-
-
-
-There are two status indicators that provide information on the number of machines that are not reporting properly to the service:
-- **Inactive** - Machines that have stopped reporting to the Windows Defender ATP service for more than seven days in the past month.
-- **Misconfigured** – These machines might partially be reporting sensor data to the Windows Defender ATP service and might have configuration errors that need to be corrected.
-
-When you click any of the groups, you’ll be directed to machines list, filtered according to your choice. For more information, see [Check sensor state](check-sensor-status-windows-defender-advanced-threat-protection.md) and [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md).
-
-## Service health
-The **Service health** tile informs you if the service is active or if there are issues.
-
-
-
-For more information on the service health, see [Check the Windows Defender ATP service health](service-status-windows-defender-advanced-threat-protection.md).
-
-
-
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-secopsdashboard-belowfoldlink)
diff --git a/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md
index 656e809d15..20028f9555 100644
--- a/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md
@@ -16,11 +16,6 @@ ms.date: 04/24/2018
# Check the Windows Defender Advanced Threat Protection service health
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md
index 9540e46529..2e4f1e0fd1 100644
--- a/windows/security/threat-protection/windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md
@@ -16,7 +16,6 @@ ms.date: 12/08/2017
# Stop and quarantine file API
**Applies to:**
-
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md
index b8bc903b76..a6c64df7ff 100644
--- a/windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md
@@ -10,17 +10,12 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: medium
-ms.date: 04/24/2018
+ms.date: 09/03/2018
---
# Supported Windows Defender ATP query APIs
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
@@ -40,5 +35,3 @@ IP | Run API calls such as get IP related alerts, IP related machines, IP statis
Machines | Run API calls such as find machine information by IP, get machines, get machines by ID, information about logged on users, and alerts related to a given machine ID.
User | Run API calls such as get alert related user information, user information, user related alerts, and user related machines.
-## Related topic
-- [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md
index 2d05ed0158..2ee0df491f 100644
--- a/windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md
@@ -16,7 +16,6 @@ ms.date: 12/01/2017
# Supported Windows Defender ATP query APIs
**Applies to:**
-
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md
index 9b235fa9b0..affe0ea030 100644
--- a/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md
@@ -1,5 +1,5 @@
---
-title: Windows Defender Advanced Threat Protection Threat analytics
+title: Threat analytics for Spectre and Meltdown
description: Get a tailored organizational risk evaluation and actionable steps you can take to minimize risks in your organization.
keywords: threat analytics, risk evaluation, OS mitigation, microcode mitigation, mitigation status
search.product: eADQiWindows 10XVcnh
@@ -10,20 +10,14 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: medium
-ms.date: 03/06/2018
+ms.date: 09/03/2018
---
# Threat analytics for Spectre and Meltdown
-
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
+The **Threat analytics** dashboard provides insight on how emerging threats affect your organization. It provides information that's specific for your organization.
[Spectre and Meltdown](https://cloudblogs.microsoft.com/microsoftsecure/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/) is a new class of exploits that take advantage of critical vulnerabilities in the CPU processors, allowing attackers running user-level, non-admin code to steal data from kernel memory. These exploits can potentially allow arbitrary non-admin code running on a host machine to harvest sensitive data belonging to other apps or system processes, including apps on guest VMs.
@@ -51,9 +45,8 @@ To access Threat analytics, from the navigation pane select **Dashboards** > **T
Click a section of each chart to get a list of the machines in the corresponding mitigation status.
## Related topics
-- [Understand the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md)
-- [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md)
-- [View the Security operations dashboard](security-operations-dashboard-windows-defender-advanced-threat-protection.md)
-- [View the Secure Score dashboard and improve your secure score](secure-score-dashboard-windows-defender-advanced-threat-protection.md)
+- [Threat analtyics](threat-analytics-windows-defender-advanced-threat-protection.md)
+- [Overview of Secure Score in Windows Defender Security Center](overview-secure-score-windows-defender-advanced-threat-protection.md)
+- [Configure the security controls in Secure score](secure-score-dashboard-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/threat-analytics.md b/windows/security/threat-protection/windows-defender-atp/threat-analytics.md
new file mode 100644
index 0000000000..cb47452b3c
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/threat-analytics.md
@@ -0,0 +1,65 @@
+---
+title: Windows Defender Advanced Threat Protection Threat analytics
+description: Get a tailored organizational risk evaluation and actionable steps you can take to minimize risks in your organization.
+keywords: threat analytics, risk evaluation, OS mitigation, microcode mitigation, mitigation status
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+# Threat analytics
+**Applies to:**
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+[!include[Prereleaseinformation](prerelease.md)]
+
+Cyberthreats are emerging more frequently and prevalently. It is critical for organizations to be able to quickly assess their security posture, including impact, and organizational resilience in the context of specific emerging threats.
+
+Threat Analytics is a set of interactive reports published by the Windows Defender ATP research team as soon as emerging threats and outbreaks are identified. The reports help you the assess impact of threats in your environment and provides recommended actions to contain, increase organizational resilience, and prevent specific threats.
+
+
+>[!NOTE]
+>The number of resolved alerts indicates how quickly your organization responds to alerts associated with a threat. Ideally, the chart should be showing alerts being resolved within a few days.
+
+Each threat report provides a summary to describe details such as where the threat is coming from, where it's been seen, or techniques and tools that were used by the threat.
+
+The dashboard shows the impact in your organization through the following tiles:
+- Machines with alerts - shows the current distinct number of impacted machines in your organization
+- Machines with alerts over time - shows the distinct number of impacted over time
+- Mitigation recommendations - lists the measurable mitigations and the number of machines that do not have each of the mitigations in place
+- Mitigation status - shows the number of mitigated and unmitigated machines. Machines are considered mitigated if they have all the measurable mitigations in place.
+- Mitigation status over time - shows the distinct number of machines that have been mitigated, unmitigated, and unavailable over time
+
+
+
+## Organizational impact
+You can assess the organizational impact of a threat using the **Machines with alerts** and **Machines with alerts over time** tiles.
+
+A machine is categorized as **Active** if there is at least 1 alert associated with that threat and **Resolved** if *all* alerts associated with the threat on the machine are resolved.
+
+
+The **Machine with alerts over time**, shows the number of distinct machines with **Active** and **Resolved alerts over time**. The number of resolved alerts indicates how quickly your organization responds to alerts associated with a threat. Ideally, the chart should be showing alerts being resolved within a few days.
+## Organizational resilience
+The **Mitigation recommendations** section provides specific actionable recommendations to improve your visibility into this threat and increase your organizational resilience.
+
+The **Mitigation status** and **Mitigation status over time** shows the endpoint configuration status assessed based on the recommended mitigations.
+
+>[!IMPORTANT]
+>- The chart only reflects mitigations that are measurable and where an evaluation can be made on the machine state as being compliant or non-compliant. There can be additional mitigations or compliance actions that currently cannot be computed or measured that are not reflected in the charts and are covered in the threat description under **Mitigation recommendations** section.
+>- Even if all mitigations were measurable, there is no absolute guarantee of complete resilience but reflects the best possible actions that need to be taken to improve resiliency.
+
+
+
+>[!NOTE]
+>The Unavailable category indicates that there is no data available from the specific machine yet.
+
+
+## Related topics
+- [Threat analytics for Spectre and Meltdown](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md)
+
diff --git a/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md
index dc1b0cb21e..c189fa2336 100644
--- a/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md
@@ -10,17 +10,12 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: medium
-ms.date: 04/24/2018
+ms.date: 09/03/2018
---
# Understand threat intelligence concepts
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/threat-protection-integration.md b/windows/security/threat-protection/windows-defender-atp/threat-protection-integration.md
new file mode 100644
index 0000000000..b491a5a109
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/threat-protection-integration.md
@@ -0,0 +1,44 @@
+---
+title: Microsoft threat protection
+description:
+keywords:
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/12/2018
+---
+
+# Microsoft threat protection
+
+Microsoft's multiple layers of threat protection across data, applications, devices, and identities can help protect your organization from advanced cyber threats.
+
+Each layer in the threat protection stack plays a critical role in protecting customers. The deep integration between these layers results in better protected customers.
+
+## Conditional access
+Windows Defender ATP's dynamic machine risk score is integrated into the conditional access evaluation, ensuring that only secure devices have access to resources.
+
+## Office 365 Advanced Threat Protection (Office 365 ATP)
+The integration between Office 365 ATP and Windows Defender ATP enables security analysts to go upstream to investigate the entry point of an attack. Through threat intelligence sharing, attacks can be contained and blocked.
+
+## Azure Advanced Threat Protection (Azure ATP)
+ Suspicious activities are processes running under a user context. The integration between Windows Defender ATP and Azure ATP provides the flexibility of conducting cyber security investigation across activities and identities.
+
+## Skype for Business
+The Skype for Business integration provides s a way for analysts to communicate with a potentially compromised user or device owner through ao simple button from the portal.
+
+## Azure Security Center
+Windows Defender ATP provides a comprehensive server protection solution, including endpoint detection and response (EDR) capabilities on Windows Servers.
+
+## Microsoft Cloud App Security
+Microsoft Cloud App Security leverages Windows Defender ATP endpoint signals to allow direct visibility into cloud application usage including the use of unsupported cloud services (shadow IT) from all Windows Defender ATP monitored machines.
+
+## Related topic
+- [Protect users, data, and devices with conditional access](conditional-access-windows-defender-advanced-threat-protection.md)
+
+
+
diff --git a/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md
index e9cb11bc67..505296a18a 100644
--- a/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md
@@ -16,11 +16,6 @@ ms.date: 02/13/2018
# Windows Defender Security Center time zone settings
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md
index be766d8d46..d86deb3f28 100644
--- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 06/25/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md
index eee538a7aa..3310063e5a 100644
--- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md
@@ -17,10 +17,7 @@ ms.date: 08/01/2018
**Applies to:**
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
+
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md
index f9e7872493..e7c34f1bb9 100644
--- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md
@@ -10,17 +10,12 @@ ms.pagetype: security
ms.author: macapara
author: mjcaparas
ms.localizationpriority: medium
-ms.date: 04/24/2018
+ms.date: 09/07/2018
---
# Troubleshoot Windows Defender Advanced Threat Protection onboarding issues
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
- Windows Server 2012 R2
- Windows Server 2016
@@ -80,7 +75,7 @@ Event ID | Error Type | Resolution steps
## Troubleshoot onboarding issues using Microsoft Intune
You can use Microsoft Intune to check error codes and attempt to troubleshoot the cause of the issue.
-If you have configured policies in Intune and they are not propagated on machines, you might need to configure automatic MDM enrollment. For more information, see the [Configure automatic MDM enrollment](https://go.microsoft.com/fwlink/?linkid=829597) section.
+If you have configured policies in Intune and they are not propagated on machines, you might need to configure automatic MDM enrollment.
Use the following tables to understand the possible causes of issues while onboarding:
@@ -308,5 +303,6 @@ For more information, see [Windows 10 Licensing](https://www.microsoft.com/en-us
## Related topics
- [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-advanced-threat-protection.md)
-- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
+- [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md)
- [Configure machine proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
+
diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md
index 9a63f9dc8b..c90bb67da7 100644
--- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md
@@ -16,11 +16,6 @@ ms.date: 02/13/2018
# Troubleshoot SIEM tool integration issues
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-wdatp.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-wdatp.md
new file mode 100644
index 0000000000..12f36df3a9
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-wdatp.md
@@ -0,0 +1,27 @@
+---
+title: Troubleshoot Windows Defender Advanced Threat Protection capabilities
+description: Find solutions to issues on sensor state, service issues, or other Windows Defender ATP capabilities
+keywords: troubleshoot, sensor, state, service, issues, attack surface reduction, next generation protection
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+# Troubleshoot Windows Defender Advanced Threat Protection
+
+Troubleshoot issues that might arise as you use Windows Defender ATP capabilities.
+
+## In this section
+Topic | Description
+:---|:---
+Troubleshoot sensor state | Find solutions for issues related to the Windows Defender ATP sensor
+Troubleshoot service issues | Fix issues related to the Windows Defender Advanced Threat service
+Troubleshoot attack surface reduction | Fix issues related to network protection and attack surface reduction rules
+Troubleshoot next generation protection | If you encounter a problem with antivirus, you can search the tables in this topic to find a matching issue and potential solution
+
diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md
index c6e68b56e5..fc9f502186 100644
--- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md
@@ -1,5 +1,5 @@
---
-title: Troubleshoot Windows Defender Advanced Threat Protection service issues
+title: Troubleshoot Windows Defender Advanced Threat Protection service issues
description: Find solutions and work arounds to known issues such as server errors when trying to access the service.
keywords: troubleshoot Windows Defender Advanced Threat Protection, troubleshoot Windows ATP, server error, access denied, invalid credentials, no data, dashboard portal, whitelist, event viewer
search.product: eADQiWindows 10XVcnh
@@ -15,11 +15,6 @@ ms.date: 07/30/2018
# Troubleshoot service issues
-**Applies to:**
-- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-
-
This section addresses issues that might arise as you use the Windows Defender Advanced Threat service.
## Server error - Access is denied due to invalid credentials
@@ -72,14 +67,6 @@ When you use Azure Security Center to monitor servers, a Windows Defender ATP te
-
-
-
-
-
-
-
-
## Related topics
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
- [Review events and errors using Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md
index b8fed131a5..c45ead9ecd 100644
--- a/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md
@@ -16,11 +16,6 @@ ms.date: 04/24/2018
# Use the threat intelligence API to create custom alerts
**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
diff --git a/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md
index 07cec03da7..42e5a71b83 100644
--- a/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md
@@ -1,5 +1,5 @@
---
-title: Use the Windows Defender Advanced Threat Protection portal
+title: Overview of Windows Defender Security Center
description: Learn about the features on Windows Defender Security Center, including how alerts work, and suggestions on how to investigate possible breaches and attacks.
keywords: dashboard, alerts queue, manage alerts, investigation, investigate alerts, investigate machines, submit files, deep analysis, high, medium, low, severity, ioc, ioa
search.product: eADQiWindows 10XVcnh
@@ -13,21 +13,11 @@ ms.localizationpriority: medium
ms.date: 03/12/2018
---
-# Use the Windows Defender Advanced Threat Protection portal
-
-**Applies to:**
-
-- Windows 10 Enterprise
-- Windows 10 Education
-- Windows 10 Pro
-- Windows 10 Pro Education
-- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-
+# Overview of Windows Defender Security Center
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-usewdatp-abovefoldlink)
-You can use Windows Defender Security Center to carry out an end-to-end security breach investigation through the dashboards.
+Windows Defender Security Center is the portal where you can access Windows Defender Advanced Threat Protection capabilities.
Use the **Security operations** dashboard to gain insight on the various alerts on machines and users in your network.
diff --git a/windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md
new file mode 100644
index 0000000000..122fd23da5
--- /dev/null
+++ b/windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md
@@ -0,0 +1,75 @@
+---
+title: Create and manage roles for role-based access control
+description: Create roles and define the permissions assigned to the role as part of the role-based access control implimentation
+keywords: user roles, roles, access rbac
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+ms.date: 09/03/2018
+---
+
+# Create and manage roles for role-based access control
+**Applies to:**
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+
+>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-roles-abovefoldlink)
+
+## Create roles and assign the role to an Azure Active Directory group
+The following steps guide you on how to create roles in Windows Defender Security Center. It assumes that you have already created Azure Active Directory user groups.
+
+1. In the navigation pane, select **Settings > Role based access control > Roles**.
+
+2. Click **Add role**.
+
+3. Enter the role name, description, and permissions you'd like to assign to the role.
+
+ - **Role name**
+
+ - **Description**
+
+ - **Permissions**
+ - **View data** - Users can view information in the portal.
+ - **Investigate alerts** - Users can manage alerts, initiate automated investigations, collect investigation packages, manage machine tags, and export machine timeline.
+ - **Approve or take action** - Users can take response actions and approve or dismiss pending remediation actions.
+ - **Manage system settings** - Users can configure settings, SIEM and threat intel API settings, advanced settings, preview features, and automated file uploads.
+ - **Manage security settings** - Users can configure alert suppression settings, manage allowed/blocked lists for automation, manage folder exclusions for automation, onboard and offboard machines, and manage email notifications.
+
+4. Click **Next** to assign the role to an Azure AD group.
+
+5. Use the filter to select the Azure AD group that you'd like to add to this role.
+
+6. Click **Save and close**.
+
+7. Apply the configuration settings.
+
+
+After creating roles, you'll need to create a machine group and provide access to the machine group by assigning it to a role that you just created.
+
+
+## Edit roles
+
+1. Select the role you'd like to edit.
+
+2. Click **Edit**.
+
+3. Modify the details or the groups that are assigned to the role.
+
+4. Click **Save and close**.
+
+## Delete roles
+
+1. Select the role you'd like to delete.
+
+2. Click the drop-down button and select **Delete role**.
+
+
+##Related topic
+- [User basic permissions to access the portal](basic-permissions-windows-defender-advanced-threat-protection.md)
+- [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md
index 07eee21200..a67e865ccb 100644
--- a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md
@@ -9,17 +9,12 @@ ms.sitesec: library
ms.pagetype: security
ms.author: macapara
author: mjcaparas
-ms.localizationpriority: high
-ms.date: 07/12/2018
+ms.localizationpriority: medium
+ms.date: 09/03/2018
---
# Windows Defender Advanced Threat Protection
-**Applies to:**
-- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-
-
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-main-abovefoldlink)
>
>For more info about Windows 10 Enterprise Edition features and functionality, see [Windows 10 Enterprise edition](https://www.microsoft.com/WindowsForBusiness/buy).
@@ -34,13 +29,10 @@ The Windows Defender ATP platform is where all the capabilities that are availab
Topic | Description
:---|:---
-[Windows Defender Security Center](windows-defender-security-center-atp.md) | Windows Defender Security Center is the portal where you can access Windows Defender Advanced Threat Protection capabilities. It gives enterprise security operations teams a single pane of glass experience to help secure networks.
-[Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) | Windows Defender Antivirus is a built-in antimalware solution that provides security and antimalware management for desktops, portable computers, and servers.
-[Windows Defender Exploit Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard) | Windows Defender Exploit Guard (Windows Defender EG) is a new set of host intrusion prevention capabilities for Windows 10, allowing you to manage and reduce the attack surface of apps used by your employees.
-[Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control) | Windows Defender Application Control (WDAC) can help mitigate security threats by restricting the applications that users are allowed to run and the code that runs in the System Core (kernel).
-[Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) | Windows Defender Application Guard helps to isolate enterprise-defined untrusted sites, protecting your company while your employees browse the Internet.
-
-
+[Overview](overview.md) | Understand the concepts behind the capabilities in Windows Defender ATP so you take full advantage of the complete threat protection platform.
+[Get started](get-started.md) | Learn about the requirements of the platform and the initial steps you need to take to get started with Windows Defender ATP.
+[Cconfigure and manage capabilities](onboard.md)| Configure and manage the individual capabilities in Windows Defender ATP.
+[Troubleshoot Windows Defender ATP](troubleshoot-wdatp.md) | Learn how to address issues that you might encounter while using the platform.
## Related topic
[Windows Defender ATP helps detect sophisticated threats](https://www.microsoft.com/itshowcase/Article/Content/854/Windows-Defender-ATP-helps-detect-sophisticated-threats)
diff --git a/windows/security/threat-protection/windows-defender-atp/windows-defender-security-center-atp.md b/windows/security/threat-protection/windows-defender-atp/windows-defender-security-center-atp.md
index 244a14ea0d..ea7e9fd67b 100644
--- a/windows/security/threat-protection/windows-defender-atp/windows-defender-security-center-atp.md
+++ b/windows/security/threat-protection/windows-defender-atp/windows-defender-security-center-atp.md
@@ -9,16 +9,12 @@ ms.sitesec: library
ms.pagetype: security
ms.author: macapara
author: mjcaparas
-ms.localizationpriority: high
+ms.localizationpriority: medium
ms.date: 07/01/2018
---
# Windows Defender Security Center
-**Applies to:**
-
-- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
Windows Defender Security Center is the portal where you can access Windows Defender Advanced Threat Protection capabilities. It gives enterprise security operations teams a single pane of glass experience to help secure networks.
## In this section
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md
index 9f78476437..8e21f4933d 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md
@@ -11,87 +11,43 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/30/2018
+ms.date: 08/08/2018
---
-# Reduce attack surfaces with Windows Defender Exploit Guard
+# Reduce attack surfaces with Windows Defender Exploit Guard
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
-- Microsoft Office 365
-- Microsoft Office 2016
-- Microsoft Office 2013
-- Microsoft Office 2010
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+Attack surface reduction helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines.
+Attack surface reduction works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md), which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md).
-
-
-**Audience**
-
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Group Policy
-- PowerShell
-- Configuration service providers for mobile device management
-
-
-Supported in Windows 10 Enterprise E5, Attack surface reduction helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines.
-
-It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md).
-
->[!TIP]
->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
-
-Attack surface reduction works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md) - which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md).
-
-The feature is comprised of a number of rules, each of which target specific behaviors that are typically used by malware and malicious apps to infect machines, such as:
+Attack surface reduction has a number of [rules](#attack-surface-reduction-rules), each of which targets specific behaviors that are typically used by malware and malicious apps to infect machines, such as:
- Executable files and scripts used in Office apps or web mail that attempt to download or run files
- Scripts that are obfuscated or otherwise suspicious
- Behaviors that apps undertake that are not usually initiated during normal day-to-day work
-See the [Attack surface reduction rules](#attack-surface-reduction-rules) section in this topic for more information on each rule.
-
When a rule is triggered, a notification will be displayed from the Action Center. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors.
You can also use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Attack surface reduction would impact your organization if it were enabled.
## Requirements
-Attack surface reduction requires Windows 10 Enterprise E5 and Windows Defender AV real-time protection.
-
-Windows 10 version | Windows Defender Antivirus
-- | -
-Windows 10 version 1709 or later | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) must be enabled
+Attack surface reduction requires Windows 10 Enterprise E5 and [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md).
## Attack surface reduction rules
-Windows 10, version 1803 has five new Attack surface reduction rules:
-
-- Block executable files from running unless they meet a prevalence, age, or trusted list criteria
-- Use advanced protection against ransomware
-- Block credential stealing from the Windows local security authority subsystem (lsass.exe)
-- Block process creations originating from PSExec and WMI commands
-- Block untrusted and unsigned processes that run from USB
-
-In addition, the following rule is available for beta testing:
-
-- Block Office communication applications from creating child processes
-
The following sections describe what each rule does. Each rule is identified by a rule GUID, as in the following table:
Rule name | GUID
-|-
Block executable content from email client and webmail | BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550
-Block Office applications from creating child processes | D4F940AB-401B-4EFC-AADC-AD5F3C50688A
+Block all Office applications from creating child processes | D4F940AB-401B-4EFC-AADC-AD5F3C50688A
Block Office applications from creating executable content | 3B576869-A4EC-4529-8536-B80A7769E899
Block Office applications from injecting code into other processes | 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84
Block JavaScript or VBScript from launching downloaded executable content | D3E037E1-3EB8-44C8-A917-57927947596D
@@ -102,12 +58,11 @@ Use advanced protection against ransomware | c1db55ab-c21a-4637-bb3f-a12568109d3
Block credential stealing from the Windows local security authority subsystem (lsass.exe) | 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
Block process creations originating from PSExec and WMI commands | d1e49aac-8f56-4280-b9ba-993a6d77406c
Block untrusted and unsigned processes that run from USB | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4
-Block Office communication applications from creating child processes (available for beta testing) | 26190899-1602-49e8-8b27-eb1d0a1ce869
+Block only Office communication applications from creating child processes (available for beta testing) | 26190899-1602-49e8-8b27-eb1d0a1ce869
Block Adobe Reader from creating child processes (available for beta testing) | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
-The rules apply to the following Office apps running on Windows 10, version 1709. See the **Applies to** section at the start of this topic for a list of supported Office version.
+The rules apply to the following Office apps:
-Supported Office apps:
- Microsoft Word
- Microsoft Excel
- Microsoft PowerPoint
@@ -127,7 +82,7 @@ This rule blocks the following file types from being run or launched from an ema
>[!IMPORTANT]
>[Exclusions do not apply to this rule](customize-attack-surface-reduction.md#exclude-files-and-folders).
-### Rule: Block Office applications from creating child processes
+### Rule: Block all Office applications from creating child processes
Office apps will not be allowed to create child processes. This includes Word, Excel, PowerPoint, OneNote, and Access.
@@ -215,7 +170,7 @@ With this rule, admins can prevent unsigned or untrusted executable files from r
- Executable files (such as .exe, .dll, or .scr)
- Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file)
-### Rule: Block Office communication applications from creating child processes (available for beta testing)
+### Rule: Block only Office communication applications from creating child processes (available for beta testing)
Office communication apps will not be allowed to create child processes. This includes Outlook.
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md
index 989c432d1b..5e7831035b 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md
@@ -1,6 +1,6 @@
---
-title: Test how Windows Defender EG features work
-description: Audit mode lets you use the event log to see how Windows Defender Exploit Guard would protect your devices if it were enabled
+title: Test how Windows Defender ATP features work
+description: Audit mode lets you use the event log to see how Windows Defender ATP would protect your devices if it were enabled
keywords: exploit guard, audit, auditing, mode, enabled, disabled, test, demo, evaluate, lab
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
@@ -11,35 +11,32 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/08/2018
---
-# Use audit mode to evaluate Windows Defender Exploit Guard features
+# Use audit mode
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Enterprise security administrators
-You can enable each of the features of Windows Defender Exploit Guard in audit mode. This lets you see a record of what *would* have happened if you had enabled the feature.
-You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how many suspicious file modification attempts generally occur over a certain period.
+You can enable attack surface reduction, eploit protection, network protection, and controlled folder access in audit mode. This lets you see a record of what *would* have happened if you had enabled the feature.
+
+You might want to do this when testing how the features will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how many suspicious file modification attempts generally occur over a certain period.
While the features will not block or prevent apps, scripts, or files from being modified, the Windows Event Log will record events as if the features were fully enabled. This means you can enable audit mode and then review the event log to see what impact the feature would have had were it enabled.
-You can use Windows Defender Advanced Threat Protection to get greater granularity into each event, especially for investigating Attack surface reduction rules. Using the Windows Defender ATP console lets you [investigate issues as part of the alert timeline and investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md).
+You can use Windows Defender Advanced Threat Protection to get greater deatils for each event, especially for investigating Attack surface reduction rules. Using the Windows Defender ATP console lets you [investigate issues as part of the alert timeline and investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md).
This topic provides links that describe how to enable the audit functionality for each feature and how to view events in the Windows Event Viewer.
-You can use Group Policy, PowerShell, and configuration servicer providers (CSPs) to enable audit mode.
+You can use Group Policy, PowerShell, and configuration service providers (CSPs) to enable audit mode.
>[!TIP]
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work.
@@ -76,10 +73,10 @@ You can also use the a custom PowerShell script that enables the features in aud
## Related topics
-- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md)
-- [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md)
-- [Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md)
-- [Protect important folders with Controlled folder access](controlled-folders-exploit-guard.md)
+- [Protect devices from exploits](exploit-protection-exploit-guard.md)
+- [Reduce attack surfaces with](attack-surface-reduction-exploit-guard.md)
+- [Protect your network](network-protection-exploit-guard.md)
+- [Protect important folders](controlled-folders-exploit-guard.md)
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md b/windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md
index 21cec1e41c..72daf4a2bc 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md
@@ -1,5 +1,5 @@
---
-title: Submit cab files related to Windows Defender EG problems
+title: Submit cab files related to problems
description: Use the command-line tool to obtain .cab file that can be used to investigate ASR rule issues.
keywords: troubleshoot, error, fix, asr, windows defender eg, exploit guard, attack surface reduction
search.product: eADQiWindows 10XVcnh
@@ -11,17 +11,16 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/08/2018
---
-# Collect diagnostic data for Windows Defender Exploit Guard file submissions
+# Collect diagnostic data for file submissions
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
-**Audience**
- IT administrators
@@ -64,7 +63,7 @@ Before attempting this process, ensure you have met all required pre-requisites
## Related topics
-- [Troubleshoot Windows Defender Exploit Guard ASR rules](troubleshoot-asr.md)
-- [Troubleshoot Windows Defender Network protection](troubleshoot-np.md)
-- [Windows Defender Exploit Guard](windows-defender-exploit-guard.md)
+- [Troubleshoot ASR rules](troubleshoot-asr.md)
+- [Troubleshoot Network protection](troubleshoot-np.md)
+
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md
index 852398e010..a5c31c8baf 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md
@@ -1,6 +1,6 @@
---
title: Help prevent ransomware and threats from encrypting and changing files
-description: Files in default folders can be protected from being changed by malicious apps. This can help prevent ransomware encrypting your files.
+description: Files in default folders can be protected from being changed by malicious apps. This can help prevent ransomware from encrypting your files.
keywords: controlled folder access, windows 10, windows defender, ransomware, protect, files, folders
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
@@ -11,59 +11,36 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/08/2018
---
-# Protect important folders with Controlled folder access
+# Protect important folders with controlled folder access
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
-
-
-**Audience**
-
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Windows Defender Security Center app
-- Group Policy
-- PowerShell
-- Configuration service providers for mobile device management
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware.
-
-It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md).
-
->[!TIP]
->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
-
-Controlled folder access works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md) - which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md).
+Controlled folder access works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md), which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md).
All apps (any executable file, including .exe, .scr, .dll files and others) are assessed by Windows Defender Antivirus, which then determines if the app is malicious or safe. If the app is determined to be malicious or suspicious, then it will not be allowed to make changes to any files in any protected folder.
-This is especially useful in helping to protect your documents and information from [ransomware](https://www.microsoft.com/en-us/wdsi/threats/ransomware) that can attempt to encrypt your files and hold them hostage.
+This is especially useful in helping to protect your documents and information from [ransomware](https://www.microsoft.com/wdsi/threats/ransomware) that can attempt to encrypt your files and hold them hostage.
A notification will appear on the computer where the app attempted to make changes to a protected folder. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors.
The protected folders include common system folders, and you can [add additional folders](customize-controlled-folders-exploit-guard.md#protect-additional-folders). You can also [allow or whitelist apps](customize-controlled-folders-exploit-guard.md#allow-specific-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders.
-As with other features of Windows Defender Exploit Guard, you can use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Controlled folder access would impact your organization if it were enabled.
-
+You can use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Controlled folder access would impact your organization if it were enabled. You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
## Requirements
-Windows 10 version | Windows Defender Antivirus
--|-
-Windows 10 version 1709 or later | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) must be enabled
+Controlled folder access requires enabling [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md).
## Review Controlled folder access events in Windows Event Viewer
@@ -74,9 +51,9 @@ You can review the Windows event log to see events that are created when Control
2. Type **Event viewer** in the Start menu to open the Windows Event Viewer.
-3. On the left panel, under **Actions**, click **Import custom view...**
+3. On the left panel, under **Actions**, click **Import custom view...**.
- 
+ 
4. Navigate to where you extracted *cfa-events.xml* and select it. Alternatively, [copy the XML directly](event-views-exploit-guard.md).
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md b/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md
index d3fdfd801d..fcba05fbf6 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md
@@ -11,31 +11,17 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/30/2018
+ms.date: 08/08/2018
---
-# Customize Attack surface reduction
+# Customize attack surface reduction
**Applies to:**
-- Windows 10 Enterprise edition, version 1709 and later
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Windows Defender Security Center app
-- Group Policy
-- PowerShell
-- Configuration service providers for mobile device management
-
-
-Supported in Windows 10 Enterprise E5, Attack surface reduction is a feature that is part of Windows Defender Exploit Guard. It helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines.
+Attack surface reduction helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines.
This topic describes how to customize Attack surface reduction by [excluding files and folders](#exclude-files-and-folders) or [adding custom text to the notification](#customize-the-notification) alert that appears on a user's computer.
@@ -54,7 +40,7 @@ This could potentially allow unsafe files to run and infect your devices.
You can specify individual files or folders (using folder paths or fully qualified resource names) but you cannot specify if the exclusions should only be applied to individual rules: the exclusions will apply to all rules that are enabled (or placed in audit mode) and that allow exclusions.
-Windows 10, version 1803 supports environment variables and wildcards. For information about using wildcards in Windows Defender Exploit Guard, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists).
+Attack surface reduction supports environment variables and wildcards. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists).
Exclusions will only be applied to certain rules. Some rules will not honor the exclusion list. This means that even if you have added a file to the exclusion list, some rules will still evaluate and potentially block that file if the rule determines the file to be unsafe.
@@ -64,7 +50,7 @@ Exclusions will only be applied to certain rules. Some rules will not honor the
Rule description | Rule honors exclusions | GUID
-|:-:|-
-Block Office applications from creating child processes | [!include[Check mark yes](images/svg/check-yes.svg)] | D4F940AB-401B-4EFC-AADC-AD5F3C50688A
+Block all Office applications from creating child processes | [!include[Check mark yes](images/svg/check-yes.svg)] | D4F940AB-401B-4EFC-AADC-AD5F3C50688A
Block execution of potentially obfuscated scripts | [!include[Check mark yes](images/svg/check-yes.svg)] | 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC
Block Win32 API calls from Office macro | [!include[Check mark yes](images/svg/check-yes.svg)] | 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B
Block Office applications from creating executable content | [!include[Check mark yes](images/svg/check-yes.svg)] | 3B576869-A4EC-4529-8536-B80A7769E899
@@ -76,7 +62,7 @@ Use advanced protection against ransomware | [!include[Check mark yes](images/sv
Block credential stealing from the Windows local security authority subsystem (lsass.exe) | [!include[Check mark no](images/svg/check-no.svg)] | 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
Block process creations originating from PSExec and WMI commands | [!include[Check mark yes](images/svg/check-yes.svg)] | d1e49aac-8f56-4280-b9ba-993a6d77406c
Block untrusted and unsigned processes that run from USB | [!include[Check mark yes](images/svg/check-yes.svg)] | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4
-Block Office communication applications from creating child processes (available for beta testing) | [!include[Check mark yes](images/svg/check-yes.svg)] | 26190899-1602-49e8-8b27-eb1d0a1ce869
+Block only Office communication applications from creating child processes (available for beta testing) | [!include[Check mark yes](images/svg/check-yes.svg)] | 26190899-1602-49e8-8b27-eb1d0a1ce869
Block Adobe Reader from creating child processes (available for beta testing) | [!include[Check mark yes](images/svg/check-yes.svg)] | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
@@ -110,7 +96,7 @@ Continue to use `Add-MpPreference -AttackSurfaceReductionOnlyExclusions` to add
### Use MDM CSPs to exclude files and folders
-Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductiononlyexclusions) configuration service provider (CSP) to add exclusions.
+Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductiononlyexclusions) configuration service provider (CSP) to add exclusions.
@@ -122,7 +108,7 @@ See the [Windows Defender Security Center](../windows-defender-security-center/w
## Related topics
-- [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md)
+- [Reduce attack surfaces](attack-surface-reduction-exploit-guard.md)
- [Enable Attack surface reduction](enable-attack-surface-reduction.md)
- [Evaluate Attack surface reduction](evaluate-attack-surface-reduction.md)
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md
index 1c626d7c8f..aebfd7efca 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md
@@ -1,5 +1,5 @@
---
-title: Add additional folders and apps to be protected by Windows 10
+title: Add additional folders and apps to be protected
description: Add additional folders that should be protected by Controlled folder access, or whitelist apps that are incorrectly blocking changes to important files.
keywords: Controlled folder access, windows 10, windows defender, ransomware, protect, files, folders, customize, add folder, add app, whitelist, add executable
search.product: eADQiWindows 10XVcnh
@@ -11,34 +11,20 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/08/2018
---
-# Customize Controlled folder access
+# Customize controlled folder access
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Windows Defender Security Center app
-- Group Policy
-- PowerShell
-- Configuration service providers for mobile device management
-
-
-Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md).
+Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware.
This topic describes how to customize the following settings of the Controlled folder access feature with the Windows Defender Security Center app, Group Policy, PowerShell, and mobile device management (MDM) configuration service providers (CSPs):
@@ -59,7 +45,7 @@ You can add additional folders to be protected, but you cannot remove the defaul
Adding other folders to Controlled folder access can be useful, for example, if you don't store files in the default Windows libraries or you've changed the location of the libraries away from the defaults.
-You can also enter network shares and mapped drives. Windows 10, version 1803 supports environment variables and wildcards. For information about using wildcards in Windows Defender Exploit Guard, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10).
+You can also enter network shares and mapped drives. Environment variables and wildcards are supported. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10).
You can use the Windows Defender Security Center app or Group Policy to add and remove additional protected folders.
@@ -70,26 +56,22 @@ You can use the Windows Defender Security Center app or Group Policy to add and
2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then click **Ransomware protection**:
-3. Under the **Controlled folder access** section, click **Protected folders**
+3. Under the **Controlled folder access** section, click **Protected folders**
4. Click **Add a protected folder** and follow the prompts to add apps.
- 
+ 
### Use Group Policy to protect additional folders
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
-3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+3. In the **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Controlled folder access**.
-
-6. Double-click the **Configured protected folders** setting and set the option to **Enabled**. Click **Show** and enter each folder.
-
-> [!NOTE]
-> Windows 10, version 1803 supports environment variables and wildcards. For information about using wildcards in Windows Defender Exploit Guard, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10).
+5. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Controlled folder access**.
+6. Double-click **Configured protected folders** and set the option to **Enabled**. Click **Show** and enter each folder.
### Use PowerShell to protect additional folders
@@ -112,7 +94,7 @@ Continue to use `Add-MpPreference -ControlledFolderAccessProtectedFolders` to ad
### Use MDM CSPs to protect additional folders
-Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersList](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-guardedfolderslist) configuration service provider (CSP) to allow apps to make changes to protected folders.
+Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-guardedfolderslist) configuration service provider (CSP) to allow apps to make changes to protected folders.
@@ -147,7 +129,7 @@ When you add an app, you have to specify the app's location. Only the app in tha
3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Controlled folder access**.
+5. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Controlled folder access**.
6. Double-click the **Configure allowed applications** setting and set the option to **Enabled**. Click **Show** and enter each app.
@@ -162,7 +144,7 @@ When you add an app, you have to specify the app's location. Only the app in tha
Add-MpPreference -ControlledFolderAccessAllowedApplications ""
```
- For example, to add the executable *test.exe*, located in the folder *C:\apps*, the cmdlet would be as follows:
+ For example, to add the executable *test.exe* located in the folder *C:\apps*, the cmdlet would be as follows:
```PowerShell
Add-MpPreference -ControlledFolderAccessAllowedApplications "c:\apps\test.exe"
@@ -181,7 +163,7 @@ Continue to use `Add-MpPreference -ControlledFolderAccessAllowedApplications` to
### Use MDM CSPs to allow specific apps
-Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersAllowedApplications](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-guardedfoldersallowedapplications) configuration service provider (CSP) to allow apps to make changes to protected folders.
+Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersAllowedApplications](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-guardedfoldersallowedapplications) configuration service provider (CSP) to allow apps to make changes to protected folders.
## Customize the notification
@@ -190,4 +172,4 @@ See the [Windows Defender Security Center](../windows-defender-security-center/w
## Related topics
- [Protect important folders with Controlled folder access](controlled-folders-exploit-guard.md)
- [Enable Controlled folder access](enable-controlled-folders-exploit-guard.md)
-- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md)
\ No newline at end of file
+- [Evaluate attack surface reduction](evaluate-windows-defender-exploit-guard.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md
index d26e9872e6..59513ac8ec 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md
@@ -11,33 +11,30 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/08/2018
---
# Customize Exploit protection
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+
+
+
+
+
-**Audience**
-
-- Enterprise security administrators
-**Manageability available with**
-- Windows Defender Security Center app
-- Group Policy
-- PowerShell
Exploit protection automatically applies a number of exploit mitigation techniques on both the operating system processes and on individual apps.
- It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md).
You configure these settings using the Windows Defender Security Center on an individual machine, and then export the configuration as an XML file that you can deploy to other machines. You can use Group Policy to distribute the XML file to multiple devices at once. You can also configure the mitigations with PowerShell.
@@ -46,7 +43,7 @@ You configure these settings using the Windows Defender Security Center on an in
It also describes how to enable or configure the mitigations using Windows Defender Security Center, PowerShell, and MDM CSPs. This is the first step in creating a configuration that you can deploy across your network. The next step involves [generating or exporting, importing, and deploying the configuration to multiple devices](import-export-exploit-protection-emet-xml.md).
>[!WARNING]
->Some security mitigation technologies may have compatibility issues with some applications. You should test Exploit protection in all target use scenarios by using [audit mode](audit-windows-defender-exploit-guard.md) before deploying the configuration across a production environment or the rest of your network.
+>Some security mitigation technologies may have compatibility issues with some applications. You should test exploit protection in all target use scenarios by using [audit mode](evaluate-exploit-protection.md) before deploying the configuration across a production environment or the rest of your network.
## Exploit protection mitigations
@@ -299,7 +296,7 @@ See the [Windows Defender Security Center](../windows-defender-security-center/w
## Related topics
-- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md)
+- [Protect devices from exploits](exploit-protection-exploit-guard.md)
- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md)
- [Evaluate Exploit protection](evaluate-exploit-protection.md)
- [Enable Exploit protection](enable-exploit-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md
index bb57a23872..f37c7b6665 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 08/08/2018
---
@@ -21,35 +21,25 @@ ms.date: 04/30/2018
**Applies to:**
-- Windows 10, version 1709 and later
-- Enhanced Mitigation Experience Toolkit version 5.5 (latest version)
-
-
-
-**Audience**
-
-- Enterprise security administrators
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
>[!IMPORTANT]
->If you are currently using EMET you should be aware that [EMET will reach end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with Exploit protection in Windows 10.
+>If you are currently using EMET, you should be aware that [EMET reached end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with Exploit protection in Windows Defender ATP.
>
>You can [convert an existing EMET configuration file into Exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings.
-This topic describes the differences between the Enhance Mitigation Experience Toolkit (EMET) and its replacement in Windows 10: Windows Defender Exploit Guard.
-
- In Windows 10, version 1709 (also known as the Fall Creators Update) we released [Windows Defender Exploit Guard](windows-defender-exploit-guard.md), which provides unparalleled mitigation of known and unknown threat attack vectors, including exploits.
+This topic describes the differences between the Enhance Mitigation Experience Toolkit (EMET) and Exploit protection in Windows Defender ATP.
- Windows Defender Exploit Guard is our successor to EMET and provides stronger protection, more customization, an easier user interface, and better configuration and management options.
+Exploit protection in Windows Defender ATP is our successor to EMET and provides stronger protection, more customization, an easier user interface, and better configuration and management options.
- EMET is a stand-alone product that is available on earlier versions of Windows and provides some mitigation against older, known exploit techniques.
+EMET is a standalone product for earlier versions of Windows and provides some mitigation against older, known exploit techniques.
- After July 31, 2018, it will reach its end of life, which means it will not be supported and no additional development will be made on it.
+After July 31, 2018, it will not be supported.
- For more information about the individual features and mitigations available in Windows Defender Exploit Guard, as well as how to enable, configure, and deploy them to better protect your network, see the following topics:
+For more information about the individual features and mitigations available in Windows Defender ATP, as well as how to enable, configure, and deploy them to better protect your network, see the following topics:
-- [Windows Defender Exploit Guard](windows-defender-exploit-guard.md)
-- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md)
+- [Protect devices from exploits](exploit-protection-exploit-guard.md)
- [Configure and audit Exploit protection mitigations](customize-exploit-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md
index 59f434e325..4f7e747a4b 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 07/30/2018
+ms.date: 08/08/2018
---
@@ -20,23 +20,22 @@ ms.date: 07/30/2018
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Enterprise security administrators
-**Manageability available with**
-
-- Group Policy
-- PowerShell
-- Configuration service providers for mobile device management
-Supported in Windows 10 Enterprise E5, Attack surface reduction is a feature that is part of Windows Defender Exploit Guard. It helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines.
+
+
+
+
+
+
+
+
+Attack surface reduction is a feature that helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines.
@@ -53,7 +52,7 @@ You can manually add the rules by using the GUIDs in the following table:
Rule description | GUID
-|-
Block executable content from email client and webmail | BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550
-Block Office applications from creating child processes | D4F940AB-401B-4EFC-AADC-AD5F3C50688A
+Block all Office applications from creating child processes | D4F940AB-401B-4EFC-AADC-AD5F3C50688A
Block Office applications from creating executable content | 3B576869-A4EC-4529-8536-B80A7769E899
Block Office applications from injecting code into other processes | 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84
Block JavaScript or VBScript from launching downloaded executable content | D3E037E1-3EB8-44C8-A917-57927947596D
@@ -64,7 +63,7 @@ Use advanced protection against ransomware | c1db55ab-c21a-4637-bb3f-a12568109d3
Block credential stealing from the Windows local security authority subsystem (lsass.exe) | 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
Block process creations originating from PSExec and WMI commands | d1e49aac-8f56-4280-b9ba-993a6d77406c
Block untrusted and unsigned processes that run from USB | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4
-Block Office communication applications from creating child processes (available for beta testing) | 26190899-1602-49e8-8b27-eb1d0a1ce869
+Block only Office communication applications from creating child processes (available for beta testing) | 26190899-1602-49e8-8b27-eb1d0a1ce869
Block Adobe Reader from creating child processes (available for beta testing) | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
See the [Attack surface reduction](attack-surface-reduction-exploit-guard.md) topic for details on each rule.
@@ -76,7 +75,7 @@ See the [Attack surface reduction](attack-surface-reduction-exploit-guard.md) to
3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack surface reduction**.
+5. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Attack surface reduction**.
6. Double-click the **Configure Attack surface reduction rules** setting and set the option to **Enabled**. You can then set the individual state for each rule in the options section:
- Click **Show...** and enter the rule ID in the **Value name** column and your desired state in the **Value** column as follows:
@@ -134,6 +133,6 @@ Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules](https
## Related topics
-- [Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md)
+- [Reduce attack surfaces](attack-surface-reduction-exploit-guard.md)
- [Customize Attack surface reduction](customize-attack-surface-reduction.md)
- [Evaluate Attack surface reduction](evaluate-attack-surface-reduction.md)
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md
index 67697f589e..62f8359359 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md
@@ -11,31 +11,17 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/08/2018
---
-# Enable Controlled folder access
+# Enable controlled folder access
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
-
-
-**Audience**
-
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Windows Defender Security Center app
-- Group Policy
-- PowerShell
-- Configuration service providers for mobile device management
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md).
@@ -43,11 +29,10 @@ Controlled folder access helps you protect valuable data from malicious apps and
This topic describes how to enable Controlled folder access with the Windows Defender Security Center app, Group Policy, PowerShell, and mobile device management (MDM) configuration service providers (CSPs).
-## Enable and audit Controlled folder access
+## Enable and audit controlled folder access
-You can enable Controlled folder access with the Windows Defender Security Center app, Group Policy, PowerShell, or MDM CSPs. You can also set the feature to audit mode. Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine.
+You can enable controlled folder access with the Security Center app, Group Policy, PowerShell, or MDM CSPs. You can also set the feature to audit mode. Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine.
-For further details on how audit mode works, and when you might want to use it, see the [audit Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md).
>[!NOTE]
>The Controlled folder access feature will display the state in the Windows Defender Security Center app under **Virus & threat protection settings**.
@@ -58,7 +43,7 @@ For further details on how audit mode works, and when you might want to use it,
>Group Policy settings that disable local administrator list merging will override Controlled folder access settings. They also override protected folders and allowed apps set by the local administrator through Controlled folder access. These policies include:
>- Windows Defender Antivirus **Configure local administrator merge behavior for lists**
>- System Center Endpoint Protection **Allow users to add exclusions and overrides**
->For more information about disabling local list merging, see [Prevent or allow users to locally modify Windows Defender AV policy settings](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged).
+>For more information about disabling local list merging, see [Prevent or allow users to locally modify Windows Defender AV policy settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged).
### Use the Windows Defender Security app to enable Controlled folder access
@@ -102,11 +87,11 @@ Use `Disabled` to turn the feature off.
### Use MDM CSPs to enable Controlled folder access
-Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersList](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-guardedfolderslist) configuration service provider (CSP) to allow apps to make changes to protected folders.
+Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-guardedfolderslist) configuration service provider (CSP) to allow apps to make changes to protected folders.
## Related topics
- [Protect important folders with Controlled folder access](controlled-folders-exploit-guard.md)
- [Customize Controlled folder access](customize-controlled-folders-exploit-guard.md)
-- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md)
+- [Evaluate Windows Defender ATP](evaluate-windows-defender-exploit-guard.md)
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md
index 584b3b2e8a..c9c10f4b93 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md
@@ -11,57 +11,36 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/08/2018
---
-# Enable Exploit protection
+# Enable exploit protection
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
-
-
-**Audience**
-
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Windows Defender Security Center app
-- Group Policy
-- PowerShell
-
-
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
Exploit protection applies helps protect devices from malware that use exploits to spread and infect. It consists of a number of mitigations that can be applied at either the operating system level, or at the individual app level.
-Many of the features that are part of the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/en-us/security/jj653751) are included in Exploit protection.
+Many of the features that were part of the Enhanced Mitigation Experience Toolkit (EMET) are included in exploit protection.
-It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md).
+## Enable and audit exploit protection
+You enable and configure each exploit protection mitigation separately. Some mitigations apply to the entire operating system, while others can be targeted towards specific apps.
+The mitigations available in exploit protection are enabled or configured to their default values automatically in Windows 10. However, you can customize the configuration to suit your organization and then deploy that configuration across your network.
-## Enable and audit Exploit protection
-
-You enable and configure each Exploit protection mitigation separately. Some mitigations apply to the entire operating system, while others can be targeted towards specific apps.
-
-The mitigations available in Exploit protection are enabled or configured to their default values automatically in Windows 10. However, you can customize the configuration to suit your organization and then deploy that configuration across your network.
-
-You can also set mitigations to audit mode. Audit mode allows you to test how the mitigations would work (and review events) without impacting the normal use of the machine.
-
-For background information on how audit mode works, and when you might want to use it, see the [audit Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md).
+You can also set mitigations to [audit mode](audit-windows-defender-exploit-guard.md). Audit mode allows you to test how the mitigations would work (and review events) without impacting the normal use of the machine.
>[!WARNING]
->Some security mitigation technologies may have compatibility issues with some applications. You should test Exploit protection in all target use scenarios by using [audit mode](audit-windows-defender-exploit-guard.md) before deploying the configuration across a production environment or the rest of your network.
+>Some security mitigation technologies may have compatibility issues with some applications. You should test exploit protection in all target use scenarios by using audit mode before deploying in production.
-You can also convert an existing EMET configuration file (in XML format) and import it into Exploit protection. This is useful if you have been using EMET and have a customized series of policies and mitigations that you want to keep using.
+You can also convert an existing EMET configuration file (in XML format) and import it into exploit protection. This is useful if you have been using EMET and have a customized series of policies and mitigations that you want to keep using.
-See the following topics for instructions on configuring Exploit protection mitigations and importing, exporting, and converting configurations:
+See the following topics for instructions on configuring exploit protection mitigations and importing, exporting, and converting configurations:
1. [Configure the mitigations you want to enable or audit](customize-exploit-protection.md)
2. [Export the configuration to an XML file that you can use to deploy the configuration to multiple machines](import-export-exploit-protection-emet-xml.md).
@@ -69,11 +48,10 @@ See the following topics for instructions on configuring Exploit protection miti
## Related topics
-- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md)
- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md)
-- [Evaluate Exploit protection](evaluate-exploit-protection.md)
-- [Configure and audit Exploit protection mitigations](customize-exploit-protection.md)
-- [Import, export, and deploy Exploit protection configurations](import-export-exploit-protection-emet-xml.md)
+- [Evaluate exploit protection](evaluate-exploit-protection.md)
+- [Configure and audit exploit protection mitigations](customize-exploit-protection.md)
+- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md)
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md
index 2d33ef5980..93d25b4d0b 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md
@@ -20,23 +20,22 @@ ms.date: 05/30/2018
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Enterprise security administrators
-**Manageability available with**
-
-- Group Policy
-- PowerShell
-- Configuration service providers for mobile device management
-Supported in Windows 10 Enterprise, Network protection is a feature that is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). It helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet.
+
+
+
+
+
+
+
+
+Network protection is a feature that helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet.
This topic describes how to enable Network protection with Group Policy, PowerShell cmdlets, and configuration service providers (CSPs) for mobile device management (MDM).
@@ -55,9 +54,9 @@ For background information on how audit mode works, and when you might want to u
3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Network protection**.
+5. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Network protection**.
-6. Double-click the **Prevent users and apps from accessing dangerous websites** setting and set the option to **Enabled**. In the options section you must specify one of the following:
+6. Double-click the **Prevent users and apps from accessing dangerous websites** setting and set the option to **Enabled**. In the options section, you must specify one of the following:
- **Block** - Users will not be able to access malicious IP addresses and domains
- **Disable (Default)** - The Network protection feature will not work. Users will not be blocked from accessing malicious domains
- **Audit Mode** - If a user visits a malicious IP address or domain, an event will be recorded in the Windows event log but the user will not be blocked from visiting the address.
@@ -89,10 +88,10 @@ Use `Disabled` insead of `AuditMode` or `Enabled` to turn the feature off.
### Use MDM CSPs to enable or audit Network protection
-Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable and configure Network protection.
+Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable and configure Network protection.
## Related topics
-- [Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md)
+- [Protect your network](network-protection-exploit-guard.md)
- [Evaluate Network protection](evaluate-network-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md
index 24a17e6b60..cb3e681ae8 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md
@@ -6,15 +6,14 @@ ms.mktglfcycl: deploy
ms.localizationpriority: medium
ms.author: justinha
author: brianlic-msft
-ms.date: 04/19/2018
+ms.date: 08/08/2018
---
# Enable virtualization-based protection of code integrity
**Applies to**
-- Windows 10
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
This topic covers different ways to enable Hypervisor-protected code integrity (HVCI) on Windows 10.
Some applications, including device drivers, may be incompatible with HVCI.
@@ -61,7 +60,7 @@ Set the following registry keys to enable HVCI. This provides exactly the same s
> - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations, we recommend that you choose **Secure Boot**. This option provides Secure Boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have Secure Boot with DMA protection. A computer without IOMMUs will simply have Secure Boot enabled. In contrast, with **Secure Boot with DMA**, the setting will enable Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS or HVCI protection, although it can still have WDAC enabled.
> - All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable these features on a group of test computers before you enable them on users' computers.
-#### For Windows 1607 and above
+#### For Windows 10 version 1607 and later
Recommended settings (to enable virtualization-based protection of Code Integrity policies, without UEFI Lock):
@@ -115,7 +114,7 @@ reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorE
> To enable **virtualization-based protection of Code Integrity policies with UEFI lock (value 1)**, in the preceding command, change **/d 0** to **/d 1**.
-#### For Windows 1511 and below
+#### For Windows 10 version 1511 and earlier
Recommended settings (to enable virtualization-based protection of Code Integrity policies, without UEFI Lock):
@@ -182,8 +181,6 @@ This field helps to enumerate and report state on the relevant security properti
| **5.** | If present, NX protections are available. |
| **6.** | If present, SMM mitigations are available. |
-> [!NOTE]
-> 4, 5, and 6 were added as of Windows 10, version 1607.
#### InstanceIdentifier
@@ -203,9 +200,6 @@ This field describes the required security properties to enable virtualization-b
| **5.** | If present, NX protections are needed. |
| **6.** | If present, SMM mitigations are needed. |
-> [!NOTE]
-> 4, 5, and 6 were added as of Windows 10, version 1607.
-
#### SecurityServicesConfigured
This field indicates whether the Windows Defender Credential Guard or HVCI service has been configured.
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md
index 3785af890d..d641593a68 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/08/2018
---
@@ -19,25 +19,24 @@ ms.date: 05/30/2018
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
-
-
-**Audience**
-
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Windows Defender Security Center app
-- Group Policy
-- PowerShell
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-Supported in Windows 10 Enterprise E5, Attack surface reduction is a feature that is part of Windows Defender Exploit Guard [that helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines](attack-surface-reduction-exploit-guard.md).
+
+
+
+
+
+
+
+
+
+
+
+
+Attack surface reduction is a feature that helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines.
This topic helps you evaluate Attack surface reduction. It explains how to demo the feature using a specialized tool, and how to enable audit mode so you can test the feature directly in your organization.
@@ -179,14 +178,14 @@ Malware and other threats can attempt to obfuscate or hide their malicious code
- Random
- A scenario will be randomly chosen from this list
- AntiMalwareScanInterface
- - This scenario uses the [AntiMalwareScanInterface (AMSI)](https://msdn.microsoft.com/en-us/library/windows/desktop/dn889587(v=vs.85).aspx) to determine if a script is potentially obfuscated, and then blocks such a script
+ - This scenario uses the [AntiMalwareScanInterface (AMSI)](https://msdn.microsoft.com/library/windows/desktop/dn889587(v=vs.85).aspx) to determine if a script is potentially obfuscated, and then blocks such a script
- OnAccess
- Potentially obfuscated scripts will be blocked when an attempt is made to access them
## Review Attack surface reduction events in Windows Event Viewer
-You can also review the Windows event log to see the events there were created when using the tool. You can use the custom view below or [locate them manually](event-views-exploit-guard.md#list-of-all-windows-defender-exploit-guard-events).
+You can also review the Windows event log to see the events there were created when using the tool. You can use the custom view below or [locate them manually](event-views-exploit-guard.md#list-of-attack-surface-reduction-events).
1. Type **Event viewer** in the Start menu to open the Windows Event Viewer.
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md
index 56695c3814..db37592aa5 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/08/2018
---
@@ -19,24 +19,22 @@ ms.date: 05/30/2018
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-
-- Enterprise security administrators
-**Manageability available with**
-- Windows Defender Security Center app
-- Group Policy
-- PowerShell
-Controlled folder access is a feature that is part of Windows Defender Exploit Guard [that helps protect your documents and files from modification by suspicious or malicious apps](controlled-folders-exploit-guard.md).
-It is especially useful in helping to protect your documents and information from [ransomware](https://www.microsoft.com/en-us/wdsi/threats/ransomware) that can attempt to encrypt your files and hold them hostage.
+
+
+
+
+
+[Controlled folder access](controlled-folders-exploit-guard.md) is a feature that helps protect your documents and files from modification by suspicious or malicious apps.
+
+It is especially useful in helping to protect your documents and information from [ransomware](https://www.microsoft.com/wdsi/threats/ransomware) that can attempt to encrypt your files and hold them hostage.
This topic helps you evaluate Controlled folder access. It explains how to demo the feature using a specialized tool, and how to enable audit mode so you can test the feature directly in your organization.
@@ -54,7 +52,7 @@ Use the **ExploitGuard CFA File Creator** tool to see how Controlled folder acce
The tool is part of the Windows Defender Exploit Guard evaluation package:
- [Download the Exploit Guard Evaluation Package](https://aka.ms/mp7z2w)
-This tool can be run locally on an individual machine to see the typical behavior of Controlled folder access. The tool is considered by Windows Defender Exploit Guard to be suspicious and will be blocked from creating new files or making changes to existing files in any of your protected folders.
+This tool can be run locally on an individual machine to see the typical behavior of Controlled folder access. The tool is considered by Windows Defender ATP to be suspicious and will be blocked from creating new files or making changes to existing files in any of your protected folders.
You can enable Controlled folder access, run the tool, and see what the experience is like when a suspicious app is prevented from accessing or modifying files in protected folders.
@@ -83,7 +81,7 @@ You can enable Controlled folder access, run the tool, and see what the experien
## Review Controlled folder access events in Windows Event Viewer
-You can also review the Windows event log to see the events there were created when using the tool. You can use the custom view below or [locate them manually](event-views-exploit-guard.md#list-of-all-windows-defender-exploit-guard-events).
+You can also review the Windows event log to see the events there were created when using the tool. You can use the custom view below or [locate them manually](event-views-exploit-guard.md#list-of-attack-surface-reduction-events).
1. Type **Event viewer** in the Start menu to open the Windows Event Viewer.
@@ -133,5 +131,5 @@ See the main [Protect important folders with Controlled folder access](controlle
## Related topics
- [Protect important folders with Controlled folder access](controlled-folders-exploit-guard.md)
-- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md)
-- [Use audit mode to evaluate Windows Defender Exploit Guard](audit-windows-defender-exploit-guard.md)
\ No newline at end of file
+- [Evaluate Windows Defender ATP](evaluate-windows-defender-exploit-guard.md)
+- [Use audit mode](audit-windows-defender-exploit-guard.md)
\ No newline at end of file
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md
index 499c186d35..d4d3705b4a 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md
@@ -1,6 +1,6 @@
---
-title: See how Exploit protection works in a demo
-description: See how Exploit protection can prevent suspicious behaviors from occurring on specific apps.
+title: See how exploit protection works in a demo
+description: See how exploit protection can prevent suspicious behaviors from occurring on specific apps.
keywords: Exploit protection, exploits, kernel, events, evaluate, demo, try, mitigiation
search.product: eADQiWindows 10XVcnh
ms.pagetype: security
@@ -16,40 +16,27 @@ ms.date: 05/30/2018
-# Evaluate Exploit protection
+# Evaluate exploit protection
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
-
-
-**Audience**
-
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Windows Defender Security Center app
-- Group Policy
-- PowerShell
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
Exploit protection applies helps protect devices from malware that use exploits to spread and infect. It consists of a number of mitigations that can be applied at either the operating system level, or at the individual app level.
-Many of the features that are part of the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/en-us/security/jj653751) are included in Exploit protection.
+Many of the features that are part of the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/en-us/security/jj653751) are included in exploit protection.
-This topcs helps you evaluate Exploit protection. See the [Exploit protection topic](exploit-protection-exploit-guard.md) for more information on what Exploit protection does and how to configure it for real-world deployment.
+This topic helps you evaluate exploit protection. For more information about what exploit protection does and how to configure it for real-world deployment, see [Exploit protection](exploit-protection-exploit-guard.md) .
>[!NOTE]
>This topic uses PowerShell cmdlets to make it easy to enable the feature and test it.
->For instructions on how to use Group Policy and Mobile Device Management (MDM to deploy these settings across your network, see the main [Exploit protection topic](exploit-protection-exploit-guard.md) .
+>For instructions about how to use Group Policy and Mobile Device Management (MDM to deploy these settings across your network, see [Exploit protection](exploit-protection-exploit-guard.md).
>[!TIP]
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
-## Enable and validate an Exploit protection mitigation
+## Enable and validate an exploit protection mitigation
For this demo you will enable the mitigation that prevents child processes from being created. You'll use Internet Explorer as the parent app.
@@ -63,11 +50,11 @@ First, enable the mitigation using PowerShell, and then confirm that it has been
Set-ProcessMitigation -Name iexplore.exe -Enable DisallowChildProcessCreation
```
-1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**.
+1. Open Windows Security by clicking the shield icon in the task bar or searching the Start menu for **Defender**.
2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then **Exploit protection settings** at the bottom of the screen.
-3. Go to the **Program settings** section, scroll down, click **iexplore.exe**, and then **Edit**.
+3. Go to the **Program settings** section, scroll down, click **iexplore.exe**, and then **Edit**.
4. Find the **Do not allow child processes** setting and make sure that **Override System settings** is enabled and the switch is set to **On**.
@@ -81,20 +68,20 @@ Now that you know the mitigation has been enabled, you can test to see if it wor
Lastly, we can disable the mitigation so that Internet Explorer works properly again:
-1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**.
+1. Open Windows Security by clicking the shield icon in the task bar or searching the Start menu for **Defender**.
2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then **Exploit protection settings** at the bottom of the screen.
-3. Go to the **Program settings** section, scroll down, click **iexplore.exe**, and then **Edit**.
+3. Go to the **Program settings** section, scroll down, click **iexplore.exe**, and then **Edit**.
4. Find the **Do not allow child processes** setting and set the switch to **Off**. Click **Apply**
5. Validate that Internet Explorer runs by running it from the run dialog box again. It should open as expected.
-## Review Exploit protection events in Windows Event Viewer
+## Review exploit protection events in Windows Event Viewer
-You can now review the events that Exploit protection sent to the Windows Event log to confirm what happened. You can use the custom view below or [locate them manually](event-views-exploit-guard.md#list-of-all-windows-defender-exploit-guard-events).
+You can now review the events that exploit protection sent to the Windows Event Viewer to confirm what happened. You can use the custom view below or [locate them manually](event-views-exploit-guard.md#list-of-attack-surface-reduction-events).
1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the file *ep-events.xml* to an easily accessible location on the machine.
@@ -106,7 +93,7 @@ You can now review the events that Exploit protection sent to the Windows Event
4. Click **OK**.
-5. This will create a custom view that filters to only show the following events related to Exploit protection, which are all listed in the [Exploit protection](exploit-protection-exploit-guard.md) topic.
+5. This will create a custom view that filters to only show the events related to exploit protection.
6. The specific event to look for in this demo is event ID 4, which should have the following or similar information:
@@ -115,21 +102,24 @@ You can now review the events that Exploit protection sent to the Windows Event
## Use audit mode to measure impact
-As with other Windows Defender EG features, you can enable Exploit protection in audit mode. You can enable audit mode for individual mitigations.
+You can enable exploit protection in audit mode. You can enable audit mode for individual mitigations.
This lets you see a record of what *would* have happened if you had enabled the mitigation.
You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how many suspicious or malicious events generally occur over a certain period.
-See the [**PowerShell reference** section in the Customize Exploit protection topic](customize-exploit-protection.md#powershell-reference) for a list of which mitigations can be audited and instructions on enabling the mode.
+See the [**PowerShell reference** section in customize exploit protection](customize-exploit-protection.md#powershell-reference) for a list of which mitigations can be audited and instructions on enabling the mode.
-For further details on how audit mode works, and when you might want to use it, see the [audit Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md).
+For further details on how audit mode works, and when you might want to use it, see [audit Windows Defender Exploit Guard](audit-windows-defender-exploit-guard.md).
## Related topics
-- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md)
- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md)
-- [Enable Exploit protection](enable-exploit-protection.md)
-- [Configure and audit Exploit protection mitigations](customize-exploit-protection.md)
-- [Import, export, and deploy Exploit protection configurations](import-export-exploit-protection-emet-xml.md)
+- [Enable exploit protection](enable-exploit-protection.md)
+- [Configure and audit exploit protection mitigations](customize-exploit-protection.md)
+- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md)
+- [Enable network protection](enable-network-protection.md)
+- [Enable controlled folder access](enable-controlled-folders-exploit-guard.md)
+- [Enable attack surface reduction](enable-attack-surface-reduction.md)
+
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md
index 1f004b79b7..dc6546e9a9 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/09/2018
---
# Evaluate Network protection
@@ -20,19 +20,18 @@ ms.date: 05/30/2018
**Applies to:**
-- Windows 10 Enterprise edition, version 1709 or later
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+
+
+
+
+
-**Audience**
-
-- Enterprise security administrators
-**Manageability available with**
-- Group Policy
-- PowerShell
@@ -72,7 +71,7 @@ You will get a 403 Forbidden response in the browser, and you will see a notific
## Review Network protection events in Windows Event Viewer
-You can also review the Windows event log to see the events there were created when performing the demo. You can use the custom view below or [locate them manually](event-views-exploit-guard.md#list-of-all-windows-defender-exploit-guard-events).
+You can also review the Windows event log to see the events there were created when performing the demo. You can use the custom view below or [locate them manually](event-views-exploit-guard.md#list-of-attack-surface-reduction-events).
1. Type **Event viewer** in the Start menu to open the Windows Event Viewer.
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md
index 958158f7f6..e7852096d0 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md
@@ -25,9 +25,9 @@ ms.date: 05/30/2018
- Windows Server 2016
-**Audience**
-- Enterprise security administrators
+
+
Windows Defender Exploit Guard is a new collection of tools and features that help you keep your network safe from exploits. Exploits are infection vectors for malware that rely on vulnerabilities in software.
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md
index f070b8407e..ceb60ddeb8 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md
@@ -1,5 +1,5 @@
---
-title: Import custom views to see Windows Defender Exploit Guard events
+title: Import custom views to see attack surface reduction events
description: Use Windows Event Viewer to import individual views for each of the features.
keywords: event view, exploit guard, audit, review, events
search.product: eADQiWindows 10XVcnh
@@ -12,38 +12,37 @@ ms.date: 04/16/2018
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/08/2018
---
-# View Windows Defender Exploit Guard events
+# View attack surface reduction events
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-**Audience**
-- Enterprise security administrators
-Each of the four features in Windows Defender Exploit Guard allow you to review events in the Windows Event log. This is useful so you can monitor what rules or settings are working, and determine if any settings are too "noisy" or impacting your day to day workflow.
+
+
+You can review attack surface reduction events in Event Viewer. This is useful so you can monitor what rules or settings are working, and determine if any settings are too "noisy" or impacting your day to day workflow.
Reviewing the events is also handy when you are evaluating the features, as you can enable audit mode for the features or settings, and then review what would have happened if they were fully enabled.
This topic lists all the events, their associated feature or setting, and describes how to create custom views to filter to specific events.
-You can also get detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md) in the Windows Defender Security Center console, which you gain access to if you have an E5 subscription and use [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md).
+You can also get detailed reporting into events and blocks as part of Windows Defender Security Center, which you gain access to if you have an E5 subscription and use [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md).
-## Use custom views to review Windows Defender Exploit Guard features
+## Use custom views to review attack surface reduction capabilities
-You can create custom views in the Windows Event Viewer to only see events for specific features and settings.
+You can create custom views in the Windows Event Viewer to only see events for specific capabilities and settings.
The easiest way to do this is to import a custom view as an XML file. You can obtain XML files for each of the features in the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w), or you can copy the XML directly from this page.
-You can also manually navigate to the event area that corresponds to the Windows Defender EG feature, see the [list of all Windows Defender Exploit Guard events](#list-of-all-windows-defender-exploit-guard-events) section at the end of this topic for more details.
+You can also manually navigate to the event area that corresponds to the Windows Defender EG feature, see the [list of attack surface reduction events](#list-of-attack-surface-reduction-events) section at the end of this topic for more details.
### Import an existing XML custom view
@@ -143,10 +142,10 @@ You can also manually navigate to the event area that corresponds to the Windows
-## List of all Windows Defender Exploit Guard events
+## List of attack surface reduction events
-All Windows Defender Exploit Guard events are located under **Applications and Services Logs > Microsoft > Windows** and then the folder or provider as listed in the following table.
+All attack surface reductiond events are located under **Applications and Services Logs > Microsoft > Windows** and then the folder or provider as listed in the following table.
You can access these events in Windows Event viewer:
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md
index 64d6627554..3fa5e1d678 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md
@@ -11,32 +11,17 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/09/2018
---
-# Protect devices from exploits with Windows Defender Exploit Guard
+# Protect devices from exploits with with Windows Defender Exploit Guard
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
-
-
-**Audience**
-
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Windows Defender Security Center app
-- Group Policy
-- PowerShell
-
-
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
Exploit protection automatically applies a number of exploit mitigation techniques on both the operating system processes and on individual apps.
@@ -115,13 +100,109 @@ Security-Mitigations | 24 | ROP SimExec enforce
WER-Diagnostics | 5 | CFG Block
Win32K | 260 | Untrusted Font
+## Comparison between Enhanced Mitigation Experience Toolkit and Windows Defender Exploit Guard
+
+>[!IMPORTANT]
+>If you are currently using EMET, you should be aware that [EMET reached end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with Exploit protection in Windows Defender ATP.
+>
+>You can [convert an existing EMET configuration file into Exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings.
+
+This topic describes the differences between the Enhance Mitigation Experience Toolkit (EMET) and Exploit protection in Windows Defender ATP.
+
+Exploit protection in Windows Defender ATP is our successor to EMET and provides stronger protection, more customization, an easier user interface, and better configuration and management options.
+
+EMET is a standalone product for earlier versions of Windows and provides some mitigation against older, known exploit techniques.
+
+After July 31, 2018, it will not be supported.
+
+For more information about the individual features and mitigations available in Windows Defender ATP, as well as how to enable, configure, and deploy them to better protect your network, see the following topics:
+
+- [Protect devices from exploits](exploit-protection-exploit-guard.md)
+- [Configure and audit Exploit protection mitigations](customize-exploit-protection.md)
+
+
+
+
+ ## Feature comparison
+
+ The table in this section illustrates the differences between EMET and Windows Defender Exploit Guard.
+
+ | Windows Defender Exploit Guard | EMET
+ -|:-:|:-:
+Windows versions | [!include[Check mark yes](images/svg/check-yes.svg)] All versions of Windows 10 starting with version 1709 | [!include[Check mark yes](images/svg/check-yes.svg)] Windows 8.1; Windows 8; Windows 7 Cannot be installed on Windows 10, version 1709 and later
+Installation requirements | [Windows Defender Security Center in Windows 10](../windows-defender-security-center/windows-defender-security-center.md) (no additional installation required) Windows Defender Exploit Guard is built into Windows - it doesn't require a separate tool or package for management, configuration, or deployment. | Available only as an additional download and must be installed onto a management device
+User interface | Modern interface integrated with the [Windows Defender Security Center](../windows-defender-security-center/windows-defender-security-center.md) | Older, complex interface that requires considerable ramp-up training
+Supportability | [!include[Check mark yes](images/svg/check-yes.svg)] [Dedicated submission-based support channel](https://www.microsoft.com/en-us/wdsi/filesubmission)[[1](#fn1)] [Part of the Windows 10 support lifecycle](https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet) | [!include[Check mark no](images/svg/check-no.svg)] Ends after July 31, 2018
+Updates | [!include[Check mark yes](images/svg/check-yes.svg)] Ongoing updates and development of new features, released twice yearly as part of the [Windows 10 semi-annual update channel](https://blogs.technet.microsoft.com/windowsitpro/2017/07/27/waas-simplified-and-aligned/) | [!include[Check mark no](images/svg/check-no.svg)] No planned updates or development
+Exploit protection | [!include[Check mark yes](images/svg/check-yes.svg)] All EMET mitigations plus new, specific mitigations ([see table](#mitigation-comparison)) [Can convert and import existing EMET configurations](import-export-exploit-protection-emet-xml.md) | [!include[Check mark yes](images/svg/check-yes.svg)] Limited set of mitigations
+Attack surface reduction[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)] [Helps block known infection vectors](attack-surface-reduction-exploit-guard.md) [Can configure individual rules](enable-attack-surface-reduction.md) | [!include[Check mark yes](images/svg/check-yes.svg)] Limited ruleset configuration only for modules (no processes)
+Network protection[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)] [Helps block malicious network connections](network-protection-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)] Not available
+Controlled folder access[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)] [Helps protect important folders](controlled-folders-exploit-guard.md) [Configurable for apps and folders](customize-controlled-folders-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)] Not available
+Configuration with GUI (user interface) | [!include[Check mark yes](images/svg/check-yes.svg)] [Use Windows Defender Security Center app to customize and manage configurations](customize-exploit-protection.md) | [!include[Check mark yes](images/svg/check-yes.svg)] Requires installation and use of EMET tool
+Configuration with Group Policy | [!include[Check mark yes](images/svg/check-yes.svg)] [Use Group Policy to deploy and manage configurations](import-export-exploit-protection-emet-xml.md#manage-or-deploy-a-configuration) | [!include[Check mark yes](images/svg/check-yes.svg)] Available
+Configuration with shell tools | [!include[Check mark yes](images/svg/check-yes.svg)] [Use PowerShell to customize and manage configurations](customize-exploit-protection.md#powershell-reference) | [!include[Check mark yes](images/svg/check-yes.svg)] Requires use of EMET tool (EMET_CONF)
+System Center Configuration Manager | [!include[Check mark yes](images/svg/check-yes.svg)] [Use Configuration Manager to customize, deploy, and manage configurations](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/create-deploy-exploit-guard-policy) | [!include[Check mark no](images/svg/check-no.svg)] Not available
+Microsoft Intune | [!include[Check mark yes](images/svg/check-yes.svg)] [Use Intune to customize, deploy, and manage configurations](https://docs.microsoft.com/en-us/intune/whats-new#window-defender-exploit-guard-is-a-new-set-of-intrusion-prevention-capabilities-for-windows-10----1063615---) | [!include[Check mark no](images/svg/check-no.svg)] Not available
+Reporting | [!include[Check mark yes](images/svg/check-yes.svg)] With [Windows event logs](event-views-exploit-guard.md) and [full audit mode reporting](audit-windows-defender-exploit-guard.md) [Full integration with Windows Defender Advanced Threat Protection](../windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md) | [!include[Check mark yes](images/svg/check-yes.svg)] Limited Windows event log monitoring
+Audit mode | [!include[Check mark yes](images/svg/check-yes.svg)] [Full audit mode with Windows event reporting](audit-windows-defender-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)] Limited to EAF, EAF+, and anti-ROP mitigations
+
+
+
+([1](#ref1)) Requires an enterprise subscription with Azure Active Directory or a [Software Assurance ID](https://www.microsoft.com/en-us/licensing/licensing-programs/software-assurance-default.aspx).
+
+([2](#ref2-1)) Additional requirements may apply (such as use of Windows Defender Antivirus). See [Windows Defender Exploit Guard requirements](windows-defender-exploit-guard.md#requirements) for more details. Customizable mitigation options that are configured with [Exploit protection](exploit-protection-exploit-guard.md) do not require Windows Defender Antivirus.
+
+
+
+## Mitigation comparison
+
+The mitigations available in EMET are included in Windows Defender Exploit Guard, under the [Exploit protection feature](exploit-protection-exploit-guard.md).
+
+The table in this section indicates the availability and support of native mitigations between EMET and Exploit protection.
+
+Mitigation | Available in Windows Defender Exploit Guard | Available in EMET
+-|:-:|:-:
+Arbitrary code guard (ACG) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] As "Memory Protection Check"
+Block remote images | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] As "Load Library Check"
+Block untrusted fonts | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Data Execution Prevention (DEP) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Export address filtering (EAF) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Force randomization for images (Mandatory ASLR) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+NullPage Security Mitigation | [!include[Check mark yes](images/svg/check-yes.svg)] Included natively in Windows 10 See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](images/svg/check-yes.svg)]
+Randomize memory allocations (Bottom-Up ASLR) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Simulate execution (SimExec) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Validate API invocation (CallerCheck) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Validate exception chains (SEHOP) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Validate stack integrity (StackPivot) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
+Certificate trust (configurable certificate pinning) | Windows 10 provides enterprise certificate pinning | [!include[Check mark yes](images/svg/check-yes.svg)]
+Heap spray allocation | Ineffective against newer browser-based exploits; newer mitigations provide better protection See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](images/svg/check-yes.svg)]
+Block low integrity images | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Code integrity guard | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Disable extension points | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Disable Win32k system calls | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Do not allow child processes | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Import address filtering (IAF) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Validate handle usage | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Validate heap integrity | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+Validate image dependency integrity | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)]
+
+
+
+
+
+
+>[!NOTE]
+>The Advanced ROP mitigations that are available in EMET are superseded by ACG in Windows 10, which other EMET advanced settings are enabled by default in Windows Defender Exploit Guard as part of enabling the anti-ROP mitigations for a process.
+>
+>See the [Mitigation threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information on how Windows 10 employs existing EMET technology.
+
+
+## Related topics
+
+- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md)
+- [Evaluate Exploit protection](evaluate-exploit-protection.md)
+- [Enable Exploit protection](enable-exploit-protection.md)
+- [Configure and audit Exploit protection mitigations](customize-exploit-protection.md)
+- [Import, export, and deploy Exploit protection configurations](import-export-exploit-protection-emet-xml.md)
- ## In this section
-Topic | Description
----|---
-[Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) | Many of the features in the EMET are now included in Exploit protection. This topic identifies those features and explains how the features have changed or evolved.
-[Evaluate Exploit protection](evaluate-exploit-protection.md) | Undertake a demo scenario to see how Exploit protection mitigations can protect your network from malicious and suspicious behavior.
-[Enable Exploit protection](enable-exploit-protection.md) | Use Group Policy or PowerShell to enable and manage Exploit protection in your network.
-[Customize and configure Exploit protection](customize-exploit-protection.md) | Configure mitigations for the operating system and for individual apps.
-[Import, export, and deploy Exploit protection configurations](import-export-exploit-protection-emet-xml.md) | Export, import, and deploy the settings across your organization. You can also convert an existing EMET configuration profile and import it into Exploit protection.
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md b/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md
index 77b9114470..2da48a5d94 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md
@@ -21,20 +21,21 @@ ms.date: 04/30/2018
**Applies to:**
-- Windows 10, version 1709 and later
+
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+
+
+
+
+
+
-**Audience**
-
-- Enterprise security administrators
-**Manageability available with**
-- Windows Defender Security Center app
-- Group Policy
-- PowerShell
@@ -166,7 +167,7 @@ You can use Group Policy to deploy the configuration you've created to multiple
3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
-5. Expand the tree to **Windows components > Windows Defender Exploit Guard > Exploit protection**.
+5. Expand the tree to **Windows components** > **Windows Defender Exploit Guard** > **Exploit protection**.
@@ -182,7 +183,7 @@ You can use Group Policy to deploy the configuration you've created to multiple
## Related topics
-- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md)
+- [Protect devices from exploits](exploit-protection-exploit-guard.md)
- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md)
- [Evaluate Exploit protection](evaluate-exploit-protection.md)
- [Enable Exploit protection](enable-exploit-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md b/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md
index 7ac4ae1438..a24d063a73 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: iaanw
ms.author: iawilt
-ms.date: 02/20/2018
+ms.date: 08/09/2018
---
@@ -21,8 +21,9 @@ ms.date: 02/20/2018
**Applies to:**
-- Windows 10, version 1709
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
Memory integrity is a powerful system mitigation that leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code. Code integrity validation is performed in a secure environment that is resistant to attack from malicious software, and page permissions for kernel mode are set and maintained by the Hyper-V hypervisor. Memory integrity helps block many types of malware from running on computers that run Windows 10 and Windows Server 2016.
+
+
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md
index df6a6b9037..65be3c2ceb 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/09/2018
---
@@ -20,23 +20,9 @@ ms.date: 05/30/2018
**Applies to:**
-- Windows 10, version 1709 or higher
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-
-**Audience**
-
-- Enterprise security administrators
-
-
-**Manageability available with**
-
-- Group Policy
-- PowerShell
-- Configuration service providers for mobile device management
-
-
-Supported in Windows 10 Enterprise, Network protection helps reduce the attack surface of your devices from Internet-based events. It prevents employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet.
+Network protection helps reduce the attack surface of your devices from Internet-based events. It prevents employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet.
It expands the scope of [Windows Defender SmartScreen](../windows-defender-smartscreen/windows-defender-smartscreen-overview.md) to block all outbound HTTP(s) traffic that attempts to connect to low-reputation sources (based on the domain or hostname).
@@ -46,14 +32,12 @@ It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
-Network protection works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md) - which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md).
+Network protection works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md), which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md).
When Network protection blocks a connection, a notification will be displayed from the Action Center. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors.
You can also use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Network protection would impact your organization if it were enabled.
-
-
## Requirements
Network protection requires Windows 10 Enterprise E3 and Windows Defender AV real-time protection.
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/TOC.md b/windows/security/threat-protection/windows-defender-exploit-guard/oldTOC.md
similarity index 100%
rename from windows/security/threat-protection/windows-defender-exploit-guard/TOC.md
rename to windows/security/threat-protection/windows-defender-exploit-guard/oldTOC.md
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md
index 71dea75d8e..dc50235f04 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md
@@ -1,6 +1,6 @@
---
title: Requirements and deployment planning guidelines for irtualization-based protection of code integrity (Windows 10)
-description: To help you plan a deployment of Microsoft Windows Defender Device Guard, this article describes hardware requirements for Windows Defender Device Guard, outlines deployment approaches, and describes methods for code signing and the deployment of code integrity policies.
+description: To help you plan a deployment of Microsoft Windows Defender Device Guard, this article describes hardware requirements for Windows Defender Device Guard, outlines deployment approaches, and describes methods for code signing and the deployment of code integrity policies.
keywords: virtualization, security, malware
ms.prod: w10
ms.mktglfcycl: deploy
@@ -9,15 +9,15 @@ author: brianlic-msft
ms.date: 10/20/2017
---
-# Requirements and deployment planning guidelines for virtualization-based protection of code integrity
+# Baseline protections and additional qualifications for virtualization-based protection of code integrity
**Applies to**
-- Windows 10
-- Windows Server 2016
-Computers must meet certain hardware, firmware, and software requirements in order to take adavantage of all of the virtualization-based security (VBS) features in Windows Defender Device Guard. Computers lacking these requirements can still be protected by Windows Defender Application Control (WDAC) policies—the difference is that those computers will not be as hardened against certain threats.
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
-For example, hardware that includes CPU virtualization extensions and SLAT will be hardened against malware that attempts to gain access to the kernel, but without protected BIOS options such as “Boot only from internal hard drive,” the computer could be booted (by a malicious person who has physical access) into an operating system on bootable media.
+Computers must meet certain hardware, firmware, and software requirements in order to take adavantage of all of the virtualization-based security (VBS) features in [Windows Defender Device Guard](../device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md). Computers lacking these requirements can still be protected by Windows Defender Application Control (WDAC) policies—the difference is that those computers will not be as hardened against certain threats.
+
+For example, hardware that includes CPU virtualization extensions and SLAT will be hardened against malware that attempts to gain access to the kernel, but without protected BIOS options such as “Boot only from internal hard drive,” the computer could be booted (by a malicious person who has physical access) into an operating system on bootable media.
> [!WARNING]
> Virtualization-based protection of code integrity may be incompatible with some devices and applications. We strongly recommend testing this configuration in your lab before enabling virtualization-based protection of code integrity on production systems. Failure to do so may result in unexpected failures up to and including data loss or a blue screen error (also called a stop error).
@@ -25,13 +25,13 @@ For example, hardware that includes CPU virtualization extensions and SLAT will
The following tables provide more information about the hardware, firmware, and software required for deployment of various Windows Defender Device Guard features. The tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017.
> [!NOTE]
-> Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new computers.
+> Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new computers.
## Baseline protections
|Baseline Protections | Description | Security benefits |
|--------------------------------|----------------------------------------------------|-------------------|
-| Hardware: **64-bit CPU** | A 64-bit computer is required for the Windows hypervisor to provide VBS. | |
+| Hardware: **64-bit CPU** | A 64-bit computer is required for the Windows hypervisor to provide VBS. | |
| Hardware: **CPU virtualization extensions**, plus **extended page tables** | These hardware features are required for VBS: One of the following virtualization extensions: • VT-x (Intel) or • AMD-V And: • Extended page tables, also called Second Level Address Translation (SLAT). | VBS provides isolation of the secure kernel from the normal operating system. Vulnerabilities and zero-days in the normal operating system cannot be exploited because of this isolation. |
| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://docs.microsoft.com/windows-hardware/design/compatibility/systems#systemfundamentalsfirmwareuefisecureboot) | UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. |
| Firmware: **Secure firmware update process** | UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://docs.microsoft.com/windows-hardware/design/compatibility/systems#systemfundamentalsfirmwareuefisecureboot) | UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. |
@@ -64,11 +64,11 @@ The following tables describe additional hardware and firmware qualifications, a
-### Additional security qualifications starting with Windows 10, version 1703
+### Additional security qualifications starting with Windows 10, version 1703
| Protections for Improved Security | Description | Security benefits |
|---------------------------------------------|----------------------------------------------------|------|
| Firmware: **VBS enablement of NX protection for UEFI runtime services** | • VBS will enable No-Execute (NX) protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be exceutable. • UEFI runtime service must meet these requirements: • Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table. • PE sections need to be page-aligned in memory (not required for in non-volitile storage). • The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS: • All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both • No entries may be left with neither of the above attributes, indicating memory that is both exceutable and writable. Memory must be either readable and executable or writeable and non-executable.
Notes: • This only applies to UEFI runtime service memory, and not UEFI boot service memory. • This protection is applied by VBS on OS page tables.
Please also note the following: • Do not use sections that are both writeable and exceutable • Do not attempt to directly modify executable system memory • Do not use dynamic code | • Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable) • Reduces the attack surface to VBS from system firmware. |
-| Firmware: **Firmware support for SMM protection** | The [Windows SMM Security Mitigations Table (WSMT) specification](http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.| • Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable) • Reduces the attack surface to VBS from system firmware. • Blocks additional security attacks against SMM. |
+| Firmware: **Firmware support for SMM protection** | The [Windows SMM Security Mitigations Table (WSMT) specification](https://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.| • Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable) • Reduces the attack surface to VBS from system firmware. • Blocks additional security attacks against SMM. |
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md
index 412c817281..a2e9bc9fb3 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md
@@ -18,10 +18,9 @@ ms.date: 05/17/2018
**Applies to:**
-- Windows 10, version 1709 or higher
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
-**Audience**
- IT administrators
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md
index 8410be06b9..28b500c5c9 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/09/2018
---
@@ -21,19 +21,18 @@ ms.date: 05/30/2018
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+
+
+
+
+
-**Audience**
-
-- Enterprise security administrators
-**Manageability available with**
-- Windows Defender Security Center app
-- PowerShell
When you create a set of Exploit protection mitigations (known as a configuration), you might find that the configuration export and import process does not remove all unwanted mitigations.
@@ -205,7 +204,7 @@ You can manually remove unwanted mitigations in Windows Defender Security Center
```
-If you haven’t already, it's a good idea to download and use the [Windows Security Baselines](https://docs.microsoft.com/en-us/windows/device-security/windows-security-baselines) to complete your Exploit protection customization.
+If you haven’t already, it's a good idea to download and use the [Windows Security Baselines](https://docs.microsoft.com/windows/device-security/windows-security-baselines) to complete your Exploit protection customization.
## Related topics
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md
index 2b7764fdb5..3019dd13f6 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md
@@ -11,16 +11,16 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/17/2018
+ms.date: 08/09/2018
---
# Troubleshoot Network protection
**Applies to:**
-- Windows 10, version 1709 or higher
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
-**Audience**
- IT administrators
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md
index 96ed1733a8..1613918bd9 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/09/2018
---
@@ -21,13 +21,12 @@ ms.date: 05/30/2018
**Applies to:**
-- Windows 10, version 1709 and later
-- Windows Server 2016
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+
-**Audience**
-- Enterprise security administrators
Windows Defender Exploit Guard (Windows Defender EG) is a new set of host intrusion prevention capabilities for Windows 10, allowing you to manage and reduce the attack surface of apps used by your employees.
@@ -52,13 +51,9 @@ You can also [enable audit mode](audit-windows-defender-exploit-guard.md) for th
>[!TIP]
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how each of them work.
-Windows Defender EG can be managed and reported on in the Windows Defender Security Center as part of the Windows Defender Advanced Threat Protection suite of threat mitigation, preventing, protection, and analysis technologies, which also includes:
-- [Windows Defender Security Center](../windows-defender-atp/windows-defender-security-center-atp.md)
-- [Windows Defender Antivirus in Windows 10](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)
-- [Windows Defender Application Control](../windows-defender-application-control/windows-defender-application-control.md)
-- [Windows Defender Application Guard](../windows-defender-application-guard/wd-app-guard-overview.md)
+Windows Defender EG can be managed and reported on in the Windows Defender Security Center as part of the Windows Defender Advanced Threat Protection suite of threat mitigation, preventing, protection, and analysis technologies.
-You can use the Windows Defender ATP console to obtain detailed reporting into events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md). You can [sign up for a free trial of Windows Defender ATP](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=cx-docs-msa4053440) to see how it works.
+You can use the Windows Defender Security Center to obtain detailed reporting into events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md). You can [sign up for a free trial of Windows Defender ATP](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=cx-docs-msa4053440) to see how it works.
## Requirements
@@ -68,14 +63,13 @@ This section covers requirements for each feature in Windows Defender EG.
|--------|---------|
|  | Not supported |
|  | Supported |
-|  | Includes advanced exploit protection for the kernel mode via [HVCI](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity) |
-|  | Includes automated reporting into the Windows Defender ATP console|
+|  | Recommended. Includes full, automated reporting into the Windows Defender ATP console. Provides additional cloud-powered capabilities, including the Network protection ability to block apps from accessing low-reputation websites and an Attack surface reduction rule that blocks executable files that meet age or prevalence criteria.|
| Feature | Windows 10 Home | Windows 10 Professional | Windows 10 E3 | Windows 10 E5 |
| ----------------- | :------------------------------------: | :---------------------------: | :-------------------------: | :--------------------------------------: |
-| Exploit protection |  |  |  |  |
-| Attack surface reduction |  |  |  |  |
+| Exploit protection |  |  |  |  |
+| Attack surface reduction |  |  |  |  |
| Network protection |  |  |  |  |
| Controlled folder access |  |  |  |  |
@@ -92,9 +86,9 @@ The following table lists which features in Windows Defender EG require enabling
Topic | Description
---|---
-[Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md) | Exploit protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once.
-[Reduce attack surfaces with Windows Defender Exploit Guard](attack-surface-reduction-exploit-guard.md) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as Office-based malicious macro code and PowerShell, VBScript, and JavaScript scripts.
-[Protect your network with Windows Defender Exploit Guard](network-protection-exploit-guard.md) | Minimize the exposure of your devices from network and web-based infection vectors.
+[Protect devices from exploits](exploit-protection-exploit-guard.md) | Exploit protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once.
+[Reduce attack surfaces](attack-surface-reduction-exploit-guard.md) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as Office-based malicious macro code and PowerShell, VBScript, and JavaScript scripts.
+[Protect your network](network-protection-exploit-guard.md) | Minimize the exposure of your devices from network and web-based infection vectors.
[Protect important folders with Controlled folder access](controlled-folders-exploit-guard.md) | Prevent unknown or unauthorized apps (including ransomware encryption malware) from writing to sensitive folders, such as folders containing sensitive or business-critical data.
diff --git a/windows/security/threat-protection/windows-defender-security-center/TOC.md b/windows/security/threat-protection/windows-defender-security-center/oldTOC.md
similarity index 100%
rename from windows/security/threat-protection/windows-defender-security-center/TOC.md
rename to windows/security/threat-protection/windows-defender-security-center/oldTOC.md
diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md
index 4986db4e3e..06fbec6d1e 100644
--- a/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md
+++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md
@@ -22,7 +22,7 @@ ms.date: 04/30/2018
- Windows 10, version 1703 and later
-The **Firewall & network protection** section contains information about the firewalls and network connections used by the machine, including the status of Windows Defender Firewall and any other third-party firewalls. IT administrators and IT pros can get configuration guidance from the [Windows Defender Firewall with Advanced Security documentation library](https://docs.microsoft.com/en-us/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security).
+The **Firewall & network protection** section contains information about the firewalls and network connections used by the machine, including the status of Windows Defender Firewall and any other third-party firewalls. IT administrators and IT pros can get configuration guidance from the [Windows Defender Firewall with Advanced Security documentation library](../windows-firewall/windows-firewall-with-advanced-security.md).
In Windows 10, version 1709 and later, the section can be hidden from users of the machine. This can be useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section.
@@ -38,7 +38,7 @@ This can only be done in Group Policy.
>
>You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings.
-1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+1. On your Group Policy management machine, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and click **Edit**.
3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
@@ -46,7 +46,7 @@ This can only be done in Group Policy.
6. Open the **Hide the Firewall and network protection area** setting and set it to **Enabled**. Click **OK**.
-7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx).
+7. Deploy the updated GPO as you normally do.
>[!NOTE]
>If you hide all sections then the app will show a restricted interface, as in the following screenshot:
diff --git a/windows/security/threat-protection/windows-firewall/TOC.md b/windows/security/threat-protection/windows-firewall/TOC.md
new file mode 100644
index 0000000000..19f2d4873f
--- /dev/null
+++ b/windows/security/threat-protection/windows-firewall/TOC.md
@@ -0,0 +1,109 @@
+# [Windows Firewall with Advanced Security](windows-firewall-with-advanced-security.md)
+## [Isolating Microsoft Store Apps on Your Network](isolating-apps-on-your-network.md)
+## [Securing IPsec](securing-end-to-end-ipsec-connections-by-using-ikev2.md)
+## [PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md)
+## [Design Guide](windows-firewall-with-advanced-security-design-guide.md)
+### [Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md)
+### [Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
+#### [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md)
+#### [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)
+#### [Require Encryption](require-encryption-when-accessing-sensitive-network-resources.md)
+#### [Restrict Access](restrict-access-to-only-specified-users-or-devices.md)
+### [Mapping Goals to a Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md)
+#### [Basic Design](basic-firewall-policy-design.md)
+#### [Domain Isolation Design](domain-isolation-policy-design.md)
+#### [Server Isolation Design](server-isolation-policy-design.md)
+#### [Certificate-based Isolation Design](certificate-based-isolation-policy-design.md)
+### [Evaluating Design Examples](evaluating-windows-firewall-with-advanced-security-design-examples.md)
+#### [Basic Design Example](firewall-policy-design-example.md)
+#### [Domain Isolation Design Example](domain-isolation-policy-design-example.md)
+#### [Server Isolation Design Example](server-isolation-policy-design-example.md)
+#### [Certificate-based Isolation Design Example](certificate-based-isolation-policy-design-example.md)
+### [Designing a Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md)
+#### [Gathering the Info You Need](gathering-the-information-you-need.md)
+##### [Network](gathering-information-about-your-current-network-infrastructure.md)
+##### [Active Directory](gathering-information-about-your-active-directory-deployment.md)
+##### [Computers](gathering-information-about-your-devices.md)
+##### [Other Relevant Information](gathering-other-relevant-information.md)
+#### [Determining the Trusted State of Your Computers](determining-the-trusted-state-of-your-devices.md)
+### [Planning Your Design](planning-your-windows-firewall-with-advanced-security-design.md)
+#### [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md)
+#### [Planning Domain Isolation Zones](planning-domain-isolation-zones.md)
+##### [Exemption List](exemption-list.md)
+##### [Isolated Domain](isolated-domain.md)
+##### [Boundary Zone](boundary-zone.md)
+##### [Encryption Zone](encryption-zone.md)
+#### [Planning Server Isolation Zones](planning-server-isolation-zones.md)
+#### [Planning Certificate-based Authentication](planning-certificate-based-authentication.md)
+##### [Documenting the Zones](documenting-the-zones.md)
+##### [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md)
+###### [Planning Isolation Groups for the Zones](planning-isolation-groups-for-the-zones.md)
+###### [Planning Network Access Groups](planning-network-access-groups.md)
+###### [Planning the GPOs](planning-the-gpos.md)
+####### [Firewall GPOs](firewall-gpos.md)
+######## [GPO_DOMISO_Firewall](gpo-domiso-firewall.md)
+####### [Isolated Domain GPOs](isolated-domain-gpos.md)
+######## [GPO_DOMISO_IsolatedDomain_Clients](gpo-domiso-isolateddomain-clients.md)
+######## [GPO_DOMISO_IsolatedDomain_Servers](gpo-domiso-isolateddomain-servers.md)
+####### [Boundary Zone GPOs](boundary-zone-gpos.md)
+######## [GPO_DOMISO_Boundary](gpo-domiso-boundary.md)
+####### [Encryption Zone GPOs](encryption-zone-gpos.md)
+######## [GPO_DOMISO_Encryption](gpo-domiso-encryption.md)
+####### [Server Isolation GPOs](server-isolation-gpos.md)
+###### [Planning GPO Deployment](planning-gpo-deployment.md)
+### [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md)
+## [Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md)
+### [Planning to Deploy](planning-to-deploy-windows-firewall-with-advanced-security.md)
+### [Implementing Your Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md)
+### [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
+### [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md)
+### [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md)
+### [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md)
+### [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md)
+### [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md)
+#### [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md)
+#### [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md)
+#### [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md)
+#### [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md)
+### [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md)
+#### [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md)
+#### [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md)
+### [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md)
+### [Procedures Used in This Guide](procedures-used-in-this-guide.md)
+#### [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md)
+#### [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)
+#### [Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md)
+#### [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md)
+#### [Configure Authentication Methods](configure-authentication-methods.md)
+#### [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)
+#### [Configure Group Policy to Autoenroll and Deploy Certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md)
+#### [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)
+#### [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md)
+#### [Configure the Windows Firewall Log](configure-the-windows-firewall-log.md)
+#### [Configure the Workstation Authentication Certificate Template](configure-the-workstation-authentication-certificate-template.md)
+#### [Configure Windows Firewall to Suppress Notifications When a Program Is Blocked](configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md)
+#### [Confirm That Certificates Are Deployed Correctly](confirm-that-certificates-are-deployed-correctly.md)
+#### [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)
+#### [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md)
+#### [Create a Group Policy Object](create-a-group-policy-object.md)
+#### [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md)
+#### [Create an Authentication Request Rule](create-an-authentication-request-rule.md)
+#### [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md)
+#### [Create an Inbound Port Rule](create-an-inbound-port-rule.md)
+#### [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md)
+#### [Create an Outbound Port Rule](create-an-outbound-port-rule.md)
+#### [Create an Outbound Program or Service Rule](create-an-outbound-program-or-service-rule.md)
+#### [Create Inbound Rules to Support RPC](create-inbound-rules-to-support-rpc.md)
+#### [Create WMI Filters for the GPO](create-wmi-filters-for-the-gpo.md)
+#### [Enable Predefined Inbound Rules](enable-predefined-inbound-rules.md)
+#### [Enable Predefined Outbound Rules](enable-predefined-outbound-rules.md)
+#### [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)
+#### [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)
+#### [Modify GPO Filters](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)
+#### [Open IP Security Policies](open-the-group-policy-management-console-to-ip-security-policies.md)
+#### [Open Group Policy](open-the-group-policy-management-console-to-windows-firewall.md)
+#### [Open Group Policy](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md)
+#### [Open Windows Firewall](open-windows-firewall-with-advanced-security.md)
+#### [Restrict Server Access](restrict-server-access-to-members-of-a-group-only.md)
+#### [Enable Windows Firewall](turn-on-windows-firewall-and-configure-default-behavior.md)
+#### [Verify Network Traffic](verify-that-network-traffic-is-authenticated.md)
diff --git a/windows/security/identity-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md b/windows/security/threat-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md
rename to windows/security/threat-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md
index 8df6f869aa..98a41989a0 100644
--- a/windows/security/identity-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md
+++ b/windows/security/threat-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md b/windows/security/threat-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md
rename to windows/security/threat-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md
index 281ad6dac7..01300466cb 100644
--- a/windows/security/identity-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md
+++ b/windows/security/threat-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md b/windows/security/threat-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md
rename to windows/security/threat-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md
index 5cebf022c7..80be70956a 100644
--- a/windows/security/identity-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md
+++ b/windows/security/threat-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md b/windows/security/threat-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md
rename to windows/security/threat-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md
index 6b62911649..ca09cb0b1b 100644
--- a/windows/security/identity-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md
+++ b/windows/security/threat-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/basic-firewall-policy-design.md b/windows/security/threat-protection/windows-firewall/basic-firewall-policy-design.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/basic-firewall-policy-design.md
rename to windows/security/threat-protection/windows-firewall/basic-firewall-policy-design.md
index c42b348566..52a0ff1746 100644
--- a/windows/security/identity-protection/windows-firewall/basic-firewall-policy-design.md
+++ b/windows/security/threat-protection/windows-firewall/basic-firewall-policy-design.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/boundary-zone-gpos.md b/windows/security/threat-protection/windows-firewall/boundary-zone-gpos.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/boundary-zone-gpos.md
rename to windows/security/threat-protection/windows-firewall/boundary-zone-gpos.md
index 1cd6e00adf..c6efd1da85 100644
--- a/windows/security/identity-protection/windows-firewall/boundary-zone-gpos.md
+++ b/windows/security/threat-protection/windows-firewall/boundary-zone-gpos.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/boundary-zone.md b/windows/security/threat-protection/windows-firewall/boundary-zone.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/boundary-zone.md
rename to windows/security/threat-protection/windows-firewall/boundary-zone.md
index 8bbf2b4e08..4b8a3f82d9 100644
--- a/windows/security/identity-protection/windows-firewall/boundary-zone.md
+++ b/windows/security/threat-protection/windows-firewall/boundary-zone.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design-example.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design-example.md
rename to windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design-example.md
index 1b0eb72de4..a3077b6d8b 100644
--- a/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design-example.md
+++ b/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design-example.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design.md
rename to windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md
index bdd5a0c1de..5703ac0670 100644
--- a/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design.md
+++ b/windows/security/threat-protection/windows-firewall/certificate-based-isolation-policy-design.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/change-rules-from-request-to-require-mode.md b/windows/security/threat-protection/windows-firewall/change-rules-from-request-to-require-mode.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/change-rules-from-request-to-require-mode.md
rename to windows/security/threat-protection/windows-firewall/change-rules-from-request-to-require-mode.md
index 1b9c21d3ce..62420de298 100644
--- a/windows/security/identity-protection/windows-firewall/change-rules-from-request-to-require-mode.md
+++ b/windows/security/threat-protection/windows-firewall/change-rules-from-request-to-require-mode.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md
similarity index 97%
rename from windows/security/identity-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md
rename to windows/security/threat-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md
index 0a85219b4b..0494cf7b90 100644
--- a/windows/security/identity-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md
+++ b/windows/security/threat-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md
rename to windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md
index 8f72339a24..cc95a9fe0e 100644
--- a/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md
+++ b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md
rename to windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md
index 73e079e959..36a838b94a 100644
--- a/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md
+++ b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md
rename to windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md
index 23127bc7f3..c0097b7a82 100644
--- a/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md
+++ b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md
rename to windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md
index 8ee694fdd7..59459f5637 100644
--- a/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md
+++ b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md
rename to windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md
index 2d8c7601d4..12aff1bf77 100644
--- a/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md
+++ b/windows/security/threat-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/checklist-creating-group-policy-objects.md b/windows/security/threat-protection/windows-firewall/checklist-creating-group-policy-objects.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/checklist-creating-group-policy-objects.md
rename to windows/security/threat-protection/windows-firewall/checklist-creating-group-policy-objects.md
index f405e2bb9a..b42bfc69b3 100644
--- a/windows/security/identity-protection/windows-firewall/checklist-creating-group-policy-objects.md
+++ b/windows/security/threat-protection/windows-firewall/checklist-creating-group-policy-objects.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md b/windows/security/threat-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md
similarity index 97%
rename from windows/security/identity-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md
rename to windows/security/threat-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md
index 5df5d2c5b6..7b6bd39b54 100644
--- a/windows/security/identity-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md
+++ b/windows/security/threat-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md b/windows/security/threat-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md
rename to windows/security/threat-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md
index 483fe71c65..559291765a 100644
--- a/windows/security/identity-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md
+++ b/windows/security/threat-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md b/windows/security/threat-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md
rename to windows/security/threat-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md
index f072701a49..9a7e901ac8 100644
--- a/windows/security/identity-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md
+++ b/windows/security/threat-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md
rename to windows/security/threat-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md
index 99969245fc..d58d940b08 100644
--- a/windows/security/identity-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md
+++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md
rename to windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md
index dc40a91804..e482d00b69 100644
--- a/windows/security/identity-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md
+++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md
rename to windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md
index 8a58ee4cde..18e9197b4e 100644
--- a/windows/security/identity-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md
+++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md
rename to windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md
index 2b9b09d474..dcf7575556 100644
--- a/windows/security/identity-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md
+++ b/windows/security/threat-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/configure-authentication-methods.md b/windows/security/threat-protection/windows-firewall/configure-authentication-methods.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/configure-authentication-methods.md
rename to windows/security/threat-protection/windows-firewall/configure-authentication-methods.md
index d0a86b59f7..b23f0c7d01 100644
--- a/windows/security/identity-protection/windows-firewall/configure-authentication-methods.md
+++ b/windows/security/threat-protection/windows-firewall/configure-authentication-methods.md
@@ -6,7 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
-
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/configure-data-protection-quick-mode-settings.md b/windows/security/threat-protection/windows-firewall/configure-data-protection-quick-mode-settings.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/configure-data-protection-quick-mode-settings.md
rename to windows/security/threat-protection/windows-firewall/configure-data-protection-quick-mode-settings.md
index 95c923e55b..05db2ff779 100644
--- a/windows/security/identity-protection/windows-firewall/configure-data-protection-quick-mode-settings.md
+++ b/windows/security/threat-protection/windows-firewall/configure-data-protection-quick-mode-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md b/windows/security/threat-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md
rename to windows/security/threat-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md
index 8b65b64896..63802f55e1 100644
--- a/windows/security/identity-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md
+++ b/windows/security/threat-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/configure-key-exchange-main-mode-settings.md b/windows/security/threat-protection/windows-firewall/configure-key-exchange-main-mode-settings.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/configure-key-exchange-main-mode-settings.md
rename to windows/security/threat-protection/windows-firewall/configure-key-exchange-main-mode-settings.md
index 4ebecbd05c..4ec20e462c 100644
--- a/windows/security/identity-protection/windows-firewall/configure-key-exchange-main-mode-settings.md
+++ b/windows/security/threat-protection/windows-firewall/configure-key-exchange-main-mode-settings.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/configure-the-rules-to-require-encryption.md b/windows/security/threat-protection/windows-firewall/configure-the-rules-to-require-encryption.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/configure-the-rules-to-require-encryption.md
rename to windows/security/threat-protection/windows-firewall/configure-the-rules-to-require-encryption.md
index 011e37612c..b9cb9944ae 100644
--- a/windows/security/identity-protection/windows-firewall/configure-the-rules-to-require-encryption.md
+++ b/windows/security/threat-protection/windows-firewall/configure-the-rules-to-require-encryption.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/threat-protection/windows-firewall/configure-the-windows-firewall-log.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/configure-the-windows-firewall-log.md
rename to windows/security/threat-protection/windows-firewall/configure-the-windows-firewall-log.md
index d108f8e07b..ba32647e26 100644
--- a/windows/security/identity-protection/windows-firewall/configure-the-windows-firewall-log.md
+++ b/windows/security/threat-protection/windows-firewall/configure-the-windows-firewall-log.md
@@ -6,7 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
-
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md b/windows/security/threat-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md
rename to windows/security/threat-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md
index 840bf5b9b7..b3e437f93d 100644
--- a/windows/security/identity-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md
+++ b/windows/security/threat-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: Justinha
ms.date: 07/30/2018
---
diff --git a/windows/security/identity-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md b/windows/security/threat-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md
rename to windows/security/threat-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md
index 69fe26b5c4..b0f250ecfb 100644
--- a/windows/security/identity-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md
+++ b/windows/security/threat-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md b/windows/security/threat-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md
rename to windows/security/threat-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md
index c8b0f4c9f5..1895dc3017 100644
--- a/windows/security/identity-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md
+++ b/windows/security/threat-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: securit
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md b/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md
rename to windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md
index 6199641b1f..af70080d9b 100644
--- a/windows/security/identity-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md
+++ b/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/create-a-group-account-in-active-directory.md b/windows/security/threat-protection/windows-firewall/create-a-group-account-in-active-directory.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/create-a-group-account-in-active-directory.md
rename to windows/security/threat-protection/windows-firewall/create-a-group-account-in-active-directory.md
index acf2f55a73..9aefd85144 100644
--- a/windows/security/identity-protection/windows-firewall/create-a-group-account-in-active-directory.md
+++ b/windows/security/threat-protection/windows-firewall/create-a-group-account-in-active-directory.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/create-a-group-policy-object.md b/windows/security/threat-protection/windows-firewall/create-a-group-policy-object.md
similarity index 97%
rename from windows/security/identity-protection/windows-firewall/create-a-group-policy-object.md
rename to windows/security/threat-protection/windows-firewall/create-a-group-policy-object.md
index 4cbdd983d0..dd292b0bea 100644
--- a/windows/security/identity-protection/windows-firewall/create-a-group-policy-object.md
+++ b/windows/security/threat-protection/windows-firewall/create-a-group-policy-object.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/create-an-authentication-exemption-list-rule.md b/windows/security/threat-protection/windows-firewall/create-an-authentication-exemption-list-rule.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/create-an-authentication-exemption-list-rule.md
rename to windows/security/threat-protection/windows-firewall/create-an-authentication-exemption-list-rule.md
index 06f204cb58..f9d1765c2f 100644
--- a/windows/security/identity-protection/windows-firewall/create-an-authentication-exemption-list-rule.md
+++ b/windows/security/threat-protection/windows-firewall/create-an-authentication-exemption-list-rule.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/create-an-authentication-request-rule.md b/windows/security/threat-protection/windows-firewall/create-an-authentication-request-rule.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/create-an-authentication-request-rule.md
rename to windows/security/threat-protection/windows-firewall/create-an-authentication-request-rule.md
index edf9d7479c..efde773a84 100644
--- a/windows/security/identity-protection/windows-firewall/create-an-authentication-request-rule.md
+++ b/windows/security/threat-protection/windows-firewall/create-an-authentication-request-rule.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/create-an-inbound-icmp-rule.md b/windows/security/threat-protection/windows-firewall/create-an-inbound-icmp-rule.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/create-an-inbound-icmp-rule.md
rename to windows/security/threat-protection/windows-firewall/create-an-inbound-icmp-rule.md
index 4ddb3567bf..a4ecccf7e2 100644
--- a/windows/security/identity-protection/windows-firewall/create-an-inbound-icmp-rule.md
+++ b/windows/security/threat-protection/windows-firewall/create-an-inbound-icmp-rule.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/create-an-inbound-port-rule.md b/windows/security/threat-protection/windows-firewall/create-an-inbound-port-rule.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/create-an-inbound-port-rule.md
rename to windows/security/threat-protection/windows-firewall/create-an-inbound-port-rule.md
index 066e7e1ea1..d20966c5d7 100644
--- a/windows/security/identity-protection/windows-firewall/create-an-inbound-port-rule.md
+++ b/windows/security/threat-protection/windows-firewall/create-an-inbound-port-rule.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/create-an-inbound-program-or-service-rule.md b/windows/security/threat-protection/windows-firewall/create-an-inbound-program-or-service-rule.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/create-an-inbound-program-or-service-rule.md
rename to windows/security/threat-protection/windows-firewall/create-an-inbound-program-or-service-rule.md
index 301a6ed8f0..36d61e5346 100644
--- a/windows/security/identity-protection/windows-firewall/create-an-inbound-program-or-service-rule.md
+++ b/windows/security/threat-protection/windows-firewall/create-an-inbound-program-or-service-rule.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/create-an-outbound-port-rule.md b/windows/security/threat-protection/windows-firewall/create-an-outbound-port-rule.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/create-an-outbound-port-rule.md
rename to windows/security/threat-protection/windows-firewall/create-an-outbound-port-rule.md
index 9e07ad036f..4f3a998eee 100644
--- a/windows/security/identity-protection/windows-firewall/create-an-outbound-port-rule.md
+++ b/windows/security/threat-protection/windows-firewall/create-an-outbound-port-rule.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/create-an-outbound-program-or-service-rule.md b/windows/security/threat-protection/windows-firewall/create-an-outbound-program-or-service-rule.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/create-an-outbound-program-or-service-rule.md
rename to windows/security/threat-protection/windows-firewall/create-an-outbound-program-or-service-rule.md
index 293c0b91b8..f0d4c6761c 100644
--- a/windows/security/identity-protection/windows-firewall/create-an-outbound-program-or-service-rule.md
+++ b/windows/security/threat-protection/windows-firewall/create-an-outbound-program-or-service-rule.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/create-inbound-rules-to-support-rpc.md b/windows/security/threat-protection/windows-firewall/create-inbound-rules-to-support-rpc.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/create-inbound-rules-to-support-rpc.md
rename to windows/security/threat-protection/windows-firewall/create-inbound-rules-to-support-rpc.md
index a2be760876..aec0ec391f 100644
--- a/windows/security/identity-protection/windows-firewall/create-inbound-rules-to-support-rpc.md
+++ b/windows/security/threat-protection/windows-firewall/create-inbound-rules-to-support-rpc.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/create-wmi-filters-for-the-gpo.md b/windows/security/threat-protection/windows-firewall/create-wmi-filters-for-the-gpo.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/create-wmi-filters-for-the-gpo.md
rename to windows/security/threat-protection/windows-firewall/create-wmi-filters-for-the-gpo.md
index 8f0ee31021..7744378add 100644
--- a/windows/security/identity-protection/windows-firewall/create-wmi-filters-for-the-gpo.md
+++ b/windows/security/threat-protection/windows-firewall/create-wmi-filters-for-the-gpo.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 05/25/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md b/windows/security/threat-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md
rename to windows/security/threat-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md
index 2ed2c83937..48712e94eb 100644
--- a/windows/security/identity-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md
+++ b/windows/security/threat-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md b/windows/security/threat-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md
rename to windows/security/threat-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md
index 1169fd195d..5023cacc9c 100644
--- a/windows/security/identity-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md
+++ b/windows/security/threat-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/documenting-the-zones.md b/windows/security/threat-protection/windows-firewall/documenting-the-zones.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/documenting-the-zones.md
rename to windows/security/threat-protection/windows-firewall/documenting-the-zones.md
index 092e1b70c1..ee0a546b86 100644
--- a/windows/security/identity-protection/windows-firewall/documenting-the-zones.md
+++ b/windows/security/threat-protection/windows-firewall/documenting-the-zones.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/domain-isolation-policy-design-example.md
rename to windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md
index b6738968f0..cb91e6f3ab 100644
--- a/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design-example.md
+++ b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/domain-isolation-policy-design.md
rename to windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md
index 97c2561cf6..db21ce0ac9 100644
--- a/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design.md
+++ b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/enable-predefined-inbound-rules.md b/windows/security/threat-protection/windows-firewall/enable-predefined-inbound-rules.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/enable-predefined-inbound-rules.md
rename to windows/security/threat-protection/windows-firewall/enable-predefined-inbound-rules.md
index 7f83f9dc04..825edaca3a 100644
--- a/windows/security/identity-protection/windows-firewall/enable-predefined-inbound-rules.md
+++ b/windows/security/threat-protection/windows-firewall/enable-predefined-inbound-rules.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/enable-predefined-outbound-rules.md b/windows/security/threat-protection/windows-firewall/enable-predefined-outbound-rules.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/enable-predefined-outbound-rules.md
rename to windows/security/threat-protection/windows-firewall/enable-predefined-outbound-rules.md
index 21011137b7..df3c7329ae 100644
--- a/windows/security/identity-protection/windows-firewall/enable-predefined-outbound-rules.md
+++ b/windows/security/threat-protection/windows-firewall/enable-predefined-outbound-rules.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/encryption-zone-gpos.md b/windows/security/threat-protection/windows-firewall/encryption-zone-gpos.md
similarity index 97%
rename from windows/security/identity-protection/windows-firewall/encryption-zone-gpos.md
rename to windows/security/threat-protection/windows-firewall/encryption-zone-gpos.md
index a3169a163b..6ed1c4c636 100644
--- a/windows/security/identity-protection/windows-firewall/encryption-zone-gpos.md
+++ b/windows/security/threat-protection/windows-firewall/encryption-zone-gpos.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/encryption-zone.md b/windows/security/threat-protection/windows-firewall/encryption-zone.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/encryption-zone.md
rename to windows/security/threat-protection/windows-firewall/encryption-zone.md
index 29681be588..35aa4212f1 100644
--- a/windows/security/identity-protection/windows-firewall/encryption-zone.md
+++ b/windows/security/threat-protection/windows-firewall/encryption-zone.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md b/windows/security/threat-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md
similarity index 97%
rename from windows/security/identity-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md
rename to windows/security/threat-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md
index e0bcd65419..720c7272ac 100644
--- a/windows/security/identity-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md
+++ b/windows/security/threat-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/exempt-icmp-from-authentication.md b/windows/security/threat-protection/windows-firewall/exempt-icmp-from-authentication.md
similarity index 97%
rename from windows/security/identity-protection/windows-firewall/exempt-icmp-from-authentication.md
rename to windows/security/threat-protection/windows-firewall/exempt-icmp-from-authentication.md
index 5e47503c42..4cf8c409e1 100644
--- a/windows/security/identity-protection/windows-firewall/exempt-icmp-from-authentication.md
+++ b/windows/security/threat-protection/windows-firewall/exempt-icmp-from-authentication.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/exemption-list.md b/windows/security/threat-protection/windows-firewall/exemption-list.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/exemption-list.md
rename to windows/security/threat-protection/windows-firewall/exemption-list.md
index 7f06dcc4f1..21a3e2c957 100644
--- a/windows/security/identity-protection/windows-firewall/exemption-list.md
+++ b/windows/security/threat-protection/windows-firewall/exemption-list.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/firewall-gpos.md b/windows/security/threat-protection/windows-firewall/firewall-gpos.md
similarity index 95%
rename from windows/security/identity-protection/windows-firewall/firewall-gpos.md
rename to windows/security/threat-protection/windows-firewall/firewall-gpos.md
index 5c244fa5b6..ad1d17f139 100644
--- a/windows/security/identity-protection/windows-firewall/firewall-gpos.md
+++ b/windows/security/threat-protection/windows-firewall/firewall-gpos.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/firewall-policy-design-example.md b/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/firewall-policy-design-example.md
rename to windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md
index 76d4cb1d81..07ca7e7c61 100644
--- a/windows/security/identity-protection/windows-firewall/firewall-policy-design-example.md
+++ b/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md b/windows/security/threat-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md
rename to windows/security/threat-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md
index ab28af81ed..4c2a252889 100644
--- a/windows/security/identity-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md
+++ b/windows/security/threat-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md b/windows/security/threat-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md
rename to windows/security/threat-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md
index b6b0712078..c3a22d6df6 100644
--- a/windows/security/identity-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md
+++ b/windows/security/threat-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
@@ -61,7 +62,7 @@ Other examples of incompatibility include:
- Network monitoring tools might be unable to parse ESP packets that are not encrypted (ESP-Null).
- >**Note:** Microsoft Message Analyzer can help in troubleshooting of unencrypted IPsec packets. The latest version of Message Analyzer is available on the [Microsoft Download Center](http://www.microsoft.com/download/details.aspx?id=44226).
+ >**Note:** Microsoft Message Analyzer can help in troubleshooting of unencrypted IPsec packets. The latest version of Message Analyzer is available on the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=44226).
## Network address translation (NAT)
diff --git a/windows/security/identity-protection/windows-firewall/gathering-information-about-your-devices.md b/windows/security/threat-protection/windows-firewall/gathering-information-about-your-devices.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/gathering-information-about-your-devices.md
rename to windows/security/threat-protection/windows-firewall/gathering-information-about-your-devices.md
index 1d21b2750c..8c1b016757 100644
--- a/windows/security/identity-protection/windows-firewall/gathering-information-about-your-devices.md
+++ b/windows/security/threat-protection/windows-firewall/gathering-information-about-your-devices.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/gathering-other-relevant-information.md b/windows/security/threat-protection/windows-firewall/gathering-other-relevant-information.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/gathering-other-relevant-information.md
rename to windows/security/threat-protection/windows-firewall/gathering-other-relevant-information.md
index eaafe2cb9f..2ecc649ffb 100644
--- a/windows/security/identity-protection/windows-firewall/gathering-other-relevant-information.md
+++ b/windows/security/threat-protection/windows-firewall/gathering-other-relevant-information.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
@@ -22,7 +23,7 @@ This topic discusses several other things that you should examine to see whether
Because IPsec uses mathematically intensive cryptographic techniques, it can consume significant overhead on a device. Areas to watch:
-- **Encryption.** You might use 256-bit Advanced Encryption Standard (AES-256) and 384-bit Secure Hash Algorithm (SHA-384) to check integrity in situations that require the strongest available encryption and key exchange protection. If you have NICs that support IPsec Task Offload, you can reduce the effect that encryption has on network throughput. For more information, see [IPsec Task Offload](http://technet.microsoft.com/network/dd277647.aspx).
+- **Encryption.** You might use 256-bit Advanced Encryption Standard (AES-256) and 384-bit Secure Hash Algorithm (SHA-384) to check integrity in situations that require the strongest available encryption and key exchange protection. If you have NICs that support IPsec Task Offload, you can reduce the effect that encryption has on network throughput. For more information, see [IPsec Task Offload](https://technet.microsoft.com/network/dd277647.aspx).
- **Security association (SA) negotiation.** You can use a shorter lifetime for the main mode SA, such as three hours, but then you might need to make tradeoffs. Because each main mode SA occupies approximately 5 KB of RAM, situations in which a server brokers tens of thousands of concurrent connections can lead to overutilization.
diff --git a/windows/security/identity-protection/windows-firewall/gathering-the-information-you-need.md b/windows/security/threat-protection/windows-firewall/gathering-the-information-you-need.md
similarity index 97%
rename from windows/security/identity-protection/windows-firewall/gathering-the-information-you-need.md
rename to windows/security/threat-protection/windows-firewall/gathering-the-information-you-need.md
index 267025d913..b2c85e5dd0 100644
--- a/windows/security/identity-protection/windows-firewall/gathering-the-information-you-need.md
+++ b/windows/security/threat-protection/windows-firewall/gathering-the-information-you-need.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/gpo-domiso-boundary.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-boundary.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/gpo-domiso-boundary.md
rename to windows/security/threat-protection/windows-firewall/gpo-domiso-boundary.md
index ecac9fe271..38018ab8e2 100644
--- a/windows/security/identity-protection/windows-firewall/gpo-domiso-boundary.md
+++ b/windows/security/threat-protection/windows-firewall/gpo-domiso-boundary.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/gpo-domiso-encryption.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-encryption.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/gpo-domiso-encryption.md
rename to windows/security/threat-protection/windows-firewall/gpo-domiso-encryption.md
index 3d554f3a9e..99ff5ffcf6 100644
--- a/windows/security/identity-protection/windows-firewall/gpo-domiso-encryption.md
+++ b/windows/security/threat-protection/windows-firewall/gpo-domiso-encryption.md
@@ -7,6 +7,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/gpo-domiso-firewall.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-firewall.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/gpo-domiso-firewall.md
rename to windows/security/threat-protection/windows-firewall/gpo-domiso-firewall.md
index 2d72894c44..bed2d46cda 100644
--- a/windows/security/identity-protection/windows-firewall/gpo-domiso-firewall.md
+++ b/windows/security/threat-protection/windows-firewall/gpo-domiso-firewall.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md
rename to windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md
index 6ca14e5412..1f645f91c2 100644
--- a/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md
+++ b/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md b/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md
rename to windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md
index 31c28d7a4f..f13c70d1c7 100644
--- a/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md
+++ b/windows/security/threat-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md b/windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md
rename to windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md
index 78403c5c87..30a391a025 100644
--- a/windows/security/identity-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md
+++ b/windows/security/threat-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/images/corpnet.gif b/windows/security/threat-protection/windows-firewall/images/corpnet.gif
similarity index 100%
rename from windows/security/identity-protection/windows-firewall/images/corpnet.gif
rename to windows/security/threat-protection/windows-firewall/images/corpnet.gif
diff --git a/windows/security/identity-protection/windows-firewall/images/createipsecrule.gif b/windows/security/threat-protection/windows-firewall/images/createipsecrule.gif
similarity index 100%
rename from windows/security/identity-protection/windows-firewall/images/createipsecrule.gif
rename to windows/security/threat-protection/windows-firewall/images/createipsecrule.gif
diff --git a/windows/security/identity-protection/windows-firewall/images/powershelllogosmall.gif b/windows/security/threat-protection/windows-firewall/images/powershelllogosmall.gif
similarity index 100%
rename from windows/security/identity-protection/windows-firewall/images/powershelllogosmall.gif
rename to windows/security/threat-protection/windows-firewall/images/powershelllogosmall.gif
diff --git a/windows/security/identity-protection/windows-firewall/images/qmcryptoset.gif b/windows/security/threat-protection/windows-firewall/images/qmcryptoset.gif
similarity index 100%
rename from windows/security/identity-protection/windows-firewall/images/qmcryptoset.gif
rename to windows/security/threat-protection/windows-firewall/images/qmcryptoset.gif
diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-design2example1.gif b/windows/security/threat-protection/windows-firewall/images/wfas-design2example1.gif
similarity index 100%
rename from windows/security/identity-protection/windows-firewall/images/wfas-design2example1.gif
rename to windows/security/threat-protection/windows-firewall/images/wfas-design2example1.gif
diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-design3example1.gif b/windows/security/threat-protection/windows-firewall/images/wfas-design3example1.gif
similarity index 100%
rename from windows/security/identity-protection/windows-firewall/images/wfas-design3example1.gif
rename to windows/security/threat-protection/windows-firewall/images/wfas-design3example1.gif
diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-designexample1.gif b/windows/security/threat-protection/windows-firewall/images/wfas-designexample1.gif
similarity index 100%
rename from windows/security/identity-protection/windows-firewall/images/wfas-designexample1.gif
rename to windows/security/threat-protection/windows-firewall/images/wfas-designexample1.gif
diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-designflowchart1.gif b/windows/security/threat-protection/windows-firewall/images/wfas-designflowchart1.gif
similarity index 100%
rename from windows/security/identity-protection/windows-firewall/images/wfas-designflowchart1.gif
rename to windows/security/threat-protection/windows-firewall/images/wfas-designflowchart1.gif
diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-domainiso.gif b/windows/security/threat-protection/windows-firewall/images/wfas-domainiso.gif
similarity index 100%
rename from windows/security/identity-protection/windows-firewall/images/wfas-domainiso.gif
rename to windows/security/threat-protection/windows-firewall/images/wfas-domainiso.gif
diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-domainisoencrypt.gif b/windows/security/threat-protection/windows-firewall/images/wfas-domainisoencrypt.gif
similarity index 100%
rename from windows/security/identity-protection/windows-firewall/images/wfas-domainisoencrypt.gif
rename to windows/security/threat-protection/windows-firewall/images/wfas-domainisoencrypt.gif
diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-domainisohighsec.gif b/windows/security/threat-protection/windows-firewall/images/wfas-domainisohighsec.gif
similarity index 100%
rename from windows/security/identity-protection/windows-firewall/images/wfas-domainisohighsec.gif
rename to windows/security/threat-protection/windows-firewall/images/wfas-domainisohighsec.gif
diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-domainnag.gif b/windows/security/threat-protection/windows-firewall/images/wfas-domainnag.gif
similarity index 100%
rename from windows/security/identity-protection/windows-firewall/images/wfas-domainnag.gif
rename to windows/security/threat-protection/windows-firewall/images/wfas-domainnag.gif
diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-icon-checkbox.gif b/windows/security/threat-protection/windows-firewall/images/wfas-icon-checkbox.gif
similarity index 100%
rename from windows/security/identity-protection/windows-firewall/images/wfas-icon-checkbox.gif
rename to windows/security/threat-protection/windows-firewall/images/wfas-icon-checkbox.gif
diff --git a/windows/security/identity-protection/windows-firewall/images/wfas-implement.gif b/windows/security/threat-protection/windows-firewall/images/wfas-implement.gif
similarity index 100%
rename from windows/security/identity-protection/windows-firewall/images/wfas-implement.gif
rename to windows/security/threat-protection/windows-firewall/images/wfas-implement.gif
diff --git a/windows/security/identity-protection/windows-firewall/images/wfasdomainisoboundary.gif b/windows/security/threat-protection/windows-firewall/images/wfasdomainisoboundary.gif
similarity index 100%
rename from windows/security/identity-protection/windows-firewall/images/wfasdomainisoboundary.gif
rename to windows/security/threat-protection/windows-firewall/images/wfasdomainisoboundary.gif
diff --git a/windows/security/identity-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md b/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md
rename to windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md
index 88bf7a60c3..e40d8d7a2e 100644
--- a/windows/security/identity-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md
+++ b/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/isolated-domain-gpos.md b/windows/security/threat-protection/windows-firewall/isolated-domain-gpos.md
similarity index 97%
rename from windows/security/identity-protection/windows-firewall/isolated-domain-gpos.md
rename to windows/security/threat-protection/windows-firewall/isolated-domain-gpos.md
index 584608f5b5..d32fbbad7b 100644
--- a/windows/security/identity-protection/windows-firewall/isolated-domain-gpos.md
+++ b/windows/security/threat-protection/windows-firewall/isolated-domain-gpos.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/isolated-domain.md b/windows/security/threat-protection/windows-firewall/isolated-domain.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/isolated-domain.md
rename to windows/security/threat-protection/windows-firewall/isolated-domain.md
index ff2b3914ed..32a9043172 100644
--- a/windows/security/identity-protection/windows-firewall/isolated-domain.md
+++ b/windows/security/threat-protection/windows-firewall/isolated-domain.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/isolating-apps-on-your-network.md b/windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/isolating-apps-on-your-network.md
rename to windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md
index fa46126446..ca4b001e6a 100644
--- a/windows/security/identity-protection/windows-firewall/isolating-apps-on-your-network.md
+++ b/windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md
@@ -5,6 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 10/13/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/link-the-gpo-to-the-domain.md b/windows/security/threat-protection/windows-firewall/link-the-gpo-to-the-domain.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/link-the-gpo-to-the-domain.md
rename to windows/security/threat-protection/windows-firewall/link-the-gpo-to-the-domain.md
index 60fbc82328..746570ffbd 100644
--- a/windows/security/identity-protection/windows-firewall/link-the-gpo-to-the-domain.md
+++ b/windows/security/threat-protection/windows-firewall/link-the-gpo-to-the-domain.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md b/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md
rename to windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md
index e1793dc9f8..7eefeac0b2 100644
--- a/windows/security/identity-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md
+++ b/windows/security/threat-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md b/windows/security/threat-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md
rename to windows/security/threat-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md
index 9c3e678890..d45ed57dfc 100644
--- a/windows/security/identity-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md
+++ b/windows/security/threat-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md
similarity index 96%
rename from windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md
rename to windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md
index 6c935f8c41..2894154e47 100644
--- a/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md
+++ b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md
similarity index 97%
rename from windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md
rename to windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md
index f99c3dfeb5..f4e67423c5 100644
--- a/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md
+++ b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md
similarity index 95%
rename from windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md
rename to windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md
index 04fceb336d..485b4917f9 100644
--- a/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md
+++ b/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/02/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/open-windows-firewall-with-advanced-security.md b/windows/security/threat-protection/windows-firewall/open-windows-firewall-with-advanced-security.md
similarity index 97%
rename from windows/security/identity-protection/windows-firewall/open-windows-firewall-with-advanced-security.md
rename to windows/security/threat-protection/windows-firewall/open-windows-firewall-with-advanced-security.md
index d14fa0d2a9..a49296f5d8 100644
--- a/windows/security/identity-protection/windows-firewall/open-windows-firewall-with-advanced-security.md
+++ b/windows/security/threat-protection/windows-firewall/open-windows-firewall-with-advanced-security.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/planning-certificate-based-authentication.md b/windows/security/threat-protection/windows-firewall/planning-certificate-based-authentication.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/planning-certificate-based-authentication.md
rename to windows/security/threat-protection/windows-firewall/planning-certificate-based-authentication.md
index e876f9cde7..75bbce24b9 100644
--- a/windows/security/identity-protection/windows-firewall/planning-certificate-based-authentication.md
+++ b/windows/security/threat-protection/windows-firewall/planning-certificate-based-authentication.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/planning-domain-isolation-zones.md b/windows/security/threat-protection/windows-firewall/planning-domain-isolation-zones.md
similarity index 97%
rename from windows/security/identity-protection/windows-firewall/planning-domain-isolation-zones.md
rename to windows/security/threat-protection/windows-firewall/planning-domain-isolation-zones.md
index 717d5b0f83..9ec2562b8a 100644
--- a/windows/security/identity-protection/windows-firewall/planning-domain-isolation-zones.md
+++ b/windows/security/threat-protection/windows-firewall/planning-domain-isolation-zones.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/planning-gpo-deployment.md b/windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/planning-gpo-deployment.md
rename to windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md
index 12e737f353..6222a6da9c 100644
--- a/windows/security/identity-protection/windows-firewall/planning-gpo-deployment.md
+++ b/windows/security/threat-protection/windows-firewall/planning-gpo-deployment.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md b/windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md
similarity index 97%
rename from windows/security/identity-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md
rename to windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md
index 9cdb57a7f3..d43c0a263c 100644
--- a/windows/security/identity-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md
+++ b/windows/security/threat-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/planning-isolation-groups-for-the-zones.md b/windows/security/threat-protection/windows-firewall/planning-isolation-groups-for-the-zones.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/planning-isolation-groups-for-the-zones.md
rename to windows/security/threat-protection/windows-firewall/planning-isolation-groups-for-the-zones.md
index 44804c8c56..38d6aa0b45 100644
--- a/windows/security/identity-protection/windows-firewall/planning-isolation-groups-for-the-zones.md
+++ b/windows/security/threat-protection/windows-firewall/planning-isolation-groups-for-the-zones.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/planning-network-access-groups.md b/windows/security/threat-protection/windows-firewall/planning-network-access-groups.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/planning-network-access-groups.md
rename to windows/security/threat-protection/windows-firewall/planning-network-access-groups.md
index 39d5ac3285..2a53064efd 100644
--- a/windows/security/identity-protection/windows-firewall/planning-network-access-groups.md
+++ b/windows/security/threat-protection/windows-firewall/planning-network-access-groups.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/planning-server-isolation-zones.md b/windows/security/threat-protection/windows-firewall/planning-server-isolation-zones.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/planning-server-isolation-zones.md
rename to windows/security/threat-protection/windows-firewall/planning-server-isolation-zones.md
index 91b3f895f0..0dc7dc181b 100644
--- a/windows/security/identity-protection/windows-firewall/planning-server-isolation-zones.md
+++ b/windows/security/threat-protection/windows-firewall/planning-server-isolation-zones.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md b/windows/security/threat-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md
rename to windows/security/threat-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md
index e5b08697f1..73a2f757c7 100644
--- a/windows/security/identity-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md
+++ b/windows/security/threat-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/planning-the-gpos.md b/windows/security/threat-protection/windows-firewall/planning-the-gpos.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/planning-the-gpos.md
rename to windows/security/threat-protection/windows-firewall/planning-the-gpos.md
index 7223799e78..f3db2bbad9 100644
--- a/windows/security/identity-protection/windows-firewall/planning-the-gpos.md
+++ b/windows/security/threat-protection/windows-firewall/planning-the-gpos.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md b/windows/security/threat-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md
rename to windows/security/threat-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md
index ebd4d51ffc..9a39c0de1d 100644
--- a/windows/security/identity-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md
+++ b/windows/security/threat-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md b/windows/security/threat-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md
rename to windows/security/threat-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md
index 3f7fedacfe..a2f19872e7 100644
--- a/windows/security/identity-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md
+++ b/windows/security/threat-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/procedures-used-in-this-guide.md b/windows/security/threat-protection/windows-firewall/procedures-used-in-this-guide.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/procedures-used-in-this-guide.md
rename to windows/security/threat-protection/windows-firewall/procedures-used-in-this-guide.md
index cd7c4edaf0..d3ae509319 100644
--- a/windows/security/identity-protection/windows-firewall/procedures-used-in-this-guide.md
+++ b/windows/security/threat-protection/windows-firewall/procedures-used-in-this-guide.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md b/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md
similarity index 97%
rename from windows/security/identity-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md
rename to windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md
index 96c1ca94eb..2ab0ca6442 100644
--- a/windows/security/identity-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md
+++ b/windows/security/threat-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
@@ -18,7 +19,7 @@ ms.date: 04/19/2017
Although network perimeter firewalls provide important protection to network resources from external threats, there are network threats that a perimeter firewall cannot protect against. Some attacks might successfully penetrate the perimeter firewall, and at that point what can stop it? Other attacks might originate from inside the network, such as malware that is brought in on portable media and run on a trusted device. Portable device are often taken outside the network and connected directly to the Internet, without adequate protection between the device and security threats.
-Reports of targeted attacks against organizations, governments, and individuals have become more widespread in recent years. For a general overview of these threats, also known as advanced persistent threats (APT), see the [Microsoft Security Intelligence Report](http://www.microsoft.com/security/sir/default.aspx).
+Reports of targeted attacks against organizations, governments, and individuals have become more widespread in recent years. For a general overview of these threats, also known as advanced persistent threats (APT), see the [Microsoft Security Intelligence Report](https://www.microsoft.com/security/sir/default.aspx).
Running a host-based firewall on every device that your organization manages is an important layer in a "defense-in-depth" security strategy. A host-based firewall can help protect against attacks that originate from inside the network and also provide additional protection against attacks from outside the network that manage to penetrate the perimeter firewall. It also travels with a portable device to provide protection when it is away from the organization's network.
diff --git a/windows/security/identity-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md b/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md
rename to windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md
index 779a932959..b9a8de9993 100644
--- a/windows/security/identity-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md
+++ b/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md
rename to windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md
index 05964574a6..05a97f9e40 100644
--- a/windows/security/identity-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md
+++ b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/restrict-access-to-only-trusted-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/restrict-access-to-only-trusted-devices.md
rename to windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md
index 9bdfeb710a..4ff811eafc 100644
--- a/windows/security/identity-protection/windows-firewall/restrict-access-to-only-trusted-devices.md
+++ b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md b/windows/security/threat-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md
rename to windows/security/threat-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md
index c7896c65f7..565a73b576 100644
--- a/windows/security/identity-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md
+++ b/windows/security/threat-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md b/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md
similarity index 96%
rename from windows/security/identity-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md
rename to windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md
index 484c6d3772..6bac7d1d1f 100644
--- a/windows/security/identity-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md
+++ b/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md
@@ -5,6 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
@@ -85,7 +86,7 @@ Add-ADGroupMember -Identity "IPsec client and servers" -Members $computer
$computer = Get-ADComputer -LDAPFilter "(name=server1)"
Add-ADGroupMember -Identity "IPsec client and servers" -Members $computer
-# Create and link the GPO to the domain
+# Create and link the GPO to the domain
$gpo = New-gpo IPsecRequireInRequestOut
$gpo | new-gplink -target "dc=corp,dc=contoso,dc=com" -LinkEnabled Yes
@@ -94,7 +95,7 @@ $gpo | Set-GPPermissions -TargetName "IPsec client and servers" -TargetType Grou
$gpo | Set-GPPermissions -TargetName "Authenticated Users" -TargetType Group -PermissionLevel None -Replace
#Set up the certificate for authentication
-$gponame = "corp.contoso.com\IPsecRequireInRequestOut"
+$gponame = "corp.contoso.com\IPsecRequireInRequestOut"
$certprop = New-NetIPsecAuthProposal -machine -cert -Authority "DC=com, DC=contoso, DC=corp, CN=corp-APP1-CA"
$myauth = New-NetIPsecPhase1AuthSet -DisplayName "IKEv2TestPhase1AuthSet" -proposal $certprop –PolicyStore GPO:$gponame
@@ -126,7 +127,7 @@ New-NetIPsecRule -DisplayName "My IKEv2 Rule" -RemoteAddress any -Phase1AuthSet
Make sure that you install the required certificates on the participating computers.
>**Note:**
-- For local devices, you can import the certificates manually if you have administrator access to the computer. For more info, see [Import or export certificates and private keys](http://windows.microsoft.com/windows-vista/Import-or-export-certificates-and-private-keys).
+- For local devices, you can import the certificates manually if you have administrator access to the computer. For more info, see [Import or export certificates and private keys](https://windows.microsoft.com/windows-vista/Import-or-export-certificates-and-private-keys).
- You need a root certificate and a computer certificate on all devices that participate in the secure connection. Save the computer certificate in the **Personal/Certificates** folder.
- For remote devices, you can create a secure website to facilitate access to the script and certificates.
diff --git a/windows/security/identity-protection/windows-firewall/server-isolation-gpos.md b/windows/security/threat-protection/windows-firewall/server-isolation-gpos.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/server-isolation-gpos.md
rename to windows/security/threat-protection/windows-firewall/server-isolation-gpos.md
index b59c41958c..5d7aec4d89 100644
--- a/windows/security/identity-protection/windows-firewall/server-isolation-gpos.md
+++ b/windows/security/threat-protection/windows-firewall/server-isolation-gpos.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/server-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/server-isolation-policy-design-example.md
rename to windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md
index 4b13a1d554..a0bac113cf 100644
--- a/windows/security/identity-protection/windows-firewall/server-isolation-policy-design-example.md
+++ b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 04/19/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/server-isolation-policy-design.md
rename to windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md
index 4a20f290d1..016568e7c7 100644
--- a/windows/security/identity-protection/windows-firewall/server-isolation-policy-design.md
+++ b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md b/windows/security/threat-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md
rename to windows/security/threat-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md
index 5d8b1b2e47..1dae92ce6c 100644
--- a/windows/security/identity-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md
+++ b/windows/security/threat-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md b/windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md
similarity index 98%
rename from windows/security/identity-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md
rename to windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md
index 2c0c44064d..5be8b4b176 100644
--- a/windows/security/identity-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md
+++ b/windows/security/threat-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md
@@ -5,6 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md b/windows/security/threat-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md
rename to windows/security/threat-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md
index d981220703..a41e88727a 100644
--- a/windows/security/identity-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md
+++ b/windows/security/threat-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md
similarity index 96%
rename from windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md
rename to windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md
index aa3448684e..64ec16e1ac 100644
--- a/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md
+++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md
@@ -5,6 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
@@ -23,7 +24,7 @@ In future versions of Windows, Microsoft might remove the netsh functionality fo
Windows PowerShell and netsh command references are at the following locations.
-- [Netsh Commands for Windows Defender Firewall](http://technet.microsoft.com/library/cc771920)
+- [Netsh Commands for Windows Defender Firewall](https://technet.microsoft.com/library/cc771920)
## Scope
@@ -38,11 +39,11 @@ This guide is intended for IT pros, system administrators, and IT managers, and
| Section | Description |
| - | - |
| [Set profile global defaults](#bkmk-profileglobaldefaults) | Enable and control firewall behavior|
-| [Deploy basic firewall rules](#deploy-basic-firewall-rules)| How to create, modify, and delete firewall rules|
-| [Manage Remotely](#manage-remotely) | Remote management by using `-CimSession`|
-| [Deploy basic IPsec rule settings](#deploy-basic-ipsec-rule-settings) | IPsec rules and associated parameters|
-| [Deploy secure firewall rules with IPsec](#deploy-secure-firewall-rules-with-ipsec) | Domain and server isolation|
-| [Additional resources](#additional-resources) | More information about Windows PowerShell|
+| [Deploy basic firewall rules](#deploy-basic-firewall-rules)| How to create, modify, and delete firewall rules|
+| [Manage Remotely](#manage-remotely) | Remote management by using `-CimSession`|
+| [Deploy basic IPsec rule settings](#deploy-basic-ipsec-rule-settings) | IPsec rules and associated parameters|
+| [Deploy secure firewall rules with IPsec](#deploy-secure-firewall-rules-with-ipsec) | Domain and server isolation|
+| [Additional resources](#additional-resources) | More information about Windows PowerShell|
## Set profile global defaults
@@ -73,7 +74,7 @@ The following scriptlets set the default inbound and outbound actions, specifies
**Netsh**
``` syntax
-netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound
+netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound
netsh advfirewall set allprofiles settings inboundusernotification enable
netsh advfirewall set allprofiles settings unicastresponsetomulticast enable
netsh advfirewall set allprofiles logging filename %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log
@@ -87,26 +88,26 @@ Set-NetFirewallProfile -DefaultInboundAction Block -DefaultOutboundAction Allow
### Disable Windows Defender Firewall with Advanced Security
-Microsoft recommends that you do not disable Windows Defender Firewall because you lose other benefits provided by the service, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, [Windows Service Hardening](http://go.microsoft.com/fwlink/?linkid=104976), and [boot time filters](https://blogs.technet.microsoft.com/networking/2009/03/24/stopping-the-windows-authenticating-firewall-service-and-the-boot-time-policy/).
+Microsoft recommends that you do not disable Windows Defender Firewall because you lose other benefits provided by the service, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, [Windows Service Hardening](https://go.microsoft.com/fwlink/?linkid=104976), and [boot time filters](https://blogs.technet.microsoft.com/networking/2009/03/24/stopping-the-windows-authenticating-firewall-service-and-the-boot-time-policy/).
Disabling Windows Defender Firewall with Advanced Security can also cause problems, including:
- Start menu can stop working
- Modern applications can fail to install or update
-- Activation of Windows via phone fails
+- Activation of Windows via phone fails
- Application or OS incompatibilities that depend on Windows Defender Firewall
-Microsoft recommends disabling Windows Defender Firewall only when installing a third-party firewall, and resetting Windows Defender Firewall back to defaults when the third-party software is disabled or removed.
+Microsoft recommends disabling Windows Defender Firewall only when installing a third-party firewall, and resetting Windows Defender Firewall back to defaults when the third-party software is disabled or removed.
If disabling Windows Defender Firewall is required, do not disable it by stopping the Windows Defender Firewall service (in the **Services** snap-in, the display name is Windows Defender Firewall and the service name is MpsSvc).
Stopping the Windows Defender Firewall service is not supported by Microsoft.
-Non-Microsoft firewall software can programmatically disable only the parts of Windows Defender Firewall that need to be disabled for compatibility.
-You should not disable the firewall yourself for this purpose.
+Non-Microsoft firewall software can programmatically disable only the parts of Windows Defender Firewall that need to be disabled for compatibility.
+You should not disable the firewall yourself for this purpose.
The proper method to disable the Windows Defender Firewall is to disable the Windows Defender Firewall Profiles and leave the service running.
-Use the following procedure to turn the firewall off, or disable the Group Policy setting **Computer Configuration|Administrative Templates|Network|Network Connections|Windows Defender Firewall|Domain Prolfile|Windows Defender Firewall:Protect all network connections**.
+Use the following procedure to turn the firewall off, or disable the Group Policy setting **Computer Configuration|Administrative Templates|Network|Network Connections|Windows Defender Firewall|Domain Prolfile|Windows Defender Firewall:Protect all network connections**.
For more information, see [Windows Defender Firewall with Advanced Security deployment guide](windows-firewall-with-advanced-security-deployment-guide.md).
The following example disables Windows Defender Firewall for all profiles.
@@ -145,13 +146,13 @@ Here, **domain.contoso.com** is the name of your Active Directory Domain Service
``` syntax
netsh advfirewall set store gpo=domain.contoso.com\gpo_name
-netsh advfirewall firewall add rule name="Block Outbound Telnet" dir=out program=%SystemRoot%\System32\telnet.exe protocol=tcp localport=23 action=block
+netsh advfirewall firewall add rule name="Block Outbound Telnet" dir=out program=%SystemRoot%\System32\telnet.exe protocol=tcp localport=23 action=block
```
Windows PowerShell
``` syntax
-New-NetFirewallRule -DisplayName “Block Outbound Telnet” -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe –Protocol TCP –LocalPort 23 -Action Block –PolicyStore domain.contoso.com\gpo_name
+New-NetFirewallRule -DisplayName “Block Outbound Telnet” -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe –Protocol TCP –LocalPort 23 -Action Block –PolicyStore domain.contoso.com\gpo_name
```
### GPO Caching
@@ -165,7 +166,7 @@ Windows PowerShell
``` syntax
$gpo = Open-NetGPO –PolicyStore domain.contoso.com\gpo_name
New-NetFirewallRule -DisplayName “Block Outbound Telnet” -Direction Outbound -Program %SystemRoot%\System32\telnet.exe –Protocol TCP –LocalPort 23 -Action Block –GPOSession $gpo
-Save-NetGPO –GPOSession $gpo
+Save-NetGPO –GPOSession $gpo
```
Note that this does not batch your individual changes, it loads and saves the entire GPO at once. So if any other changes are made by other administrators, or in a different Windows PowerShell window, saving the GPO overwrites those changes.
@@ -226,7 +227,7 @@ If the group is not specified at rule creation time, the rule can be added to th
Windows PowerShell
``` syntax
-$rule = Get-NetFirewallRule -DisplayName “Allow Inbound Telnet”
+$rule = Get-NetFirewallRule -DisplayName “Allow Inbound Telnet”
$rule.Group = “Telnet Management”
$rule | Set-NetFirewallRule
```
@@ -341,7 +342,7 @@ New-NetIPsecRule -DisplayName “Require Inbound Authentication” -PolicyStore
### Add custom authentication methods to an IPsec rule
-If you want to create a custom set of quick-mode proposals that includes both AH and ESP in an IPsec rule object, you create the associated objects separately and link their associations. For more information about authentication methods, see [Choosing the IPsec Protocol](http://technet.microsoft.com/library/cc757847(WS.10).aspx) .
+If you want to create a custom set of quick-mode proposals that includes both AH and ESP in an IPsec rule object, you create the associated objects separately and link their associations. For more information about authentication methods, see [Choosing the IPsec Protocol](https://technet.microsoft.com/library/cc757847(WS.10).aspx) .
You can then use the newly created custom quick-mode policies when you create IPsec rules. The cryptography set object is linked to an IPsec rule object.
@@ -479,7 +480,7 @@ For objects that come from a GPO (the *–PolicyStoreSourceType* parameter is sp
Windows PowerShell
``` syntax
-Get-NetIPsecRule –DisplayName “Require Inbound Authentication” –TracePolicyStore
+Get-NetIPsecRule –DisplayName “Require Inbound Authentication” –TracePolicyStore
```
It is important to note that the revealed sources do not contain a domain name.
@@ -502,7 +503,7 @@ Windows PowerShell
``` syntax
$kerbprop = New-NetIPsecAuthProposal –Machine –Kerberos
$Phase1AuthSet = New-NetIPsecPhase1AuthSet -DisplayName "Kerberos Auth Phase1" -Proposal $kerbprop –PolicyStore domain.contoso.com\domain_isolation
-New-NetIPsecRule –DisplayName “Basic Domain Isolation Policy” –Profile Domain –Phase1AuthSet $Phase1AuthSet.Name –InboundSecurity Require –OutboundSecurity Request –PolicyStore domain.contoso.com\domain_isolation
+New-NetIPsecRule –DisplayName “Basic Domain Isolation Policy” –Profile Domain –Phase1AuthSet $Phase1AuthSet.Name –InboundSecurity Require –OutboundSecurity Request –PolicyStore domain.contoso.com\domain_isolation
```
### Configure IPsec tunnel mode
@@ -578,7 +579,7 @@ To deploy server isolation, we layer a firewall rule that restricts traffic to a
The following firewall rule allows Telnet traffic from user accounts that are members of a custom group called “Authorized to Access Server.” This access can additionally be restricted based on the device, user, or both by specifying the restriction parameters.
-A Security Descriptor Definition Language (SDDL) string is created by extending a user or group’s security identifier (SID). For more information about finding a group’s SID, see: [Finding the SID for a group account](http://technet.microsoft.com/library/cc753463(WS.10).aspx#bkmk_FINDSID).
+A Security Descriptor Definition Language (SDDL) string is created by extending a user or group’s security identifier (SID). For more information about finding a group’s SID, see: [Finding the SID for a group account](https://technet.microsoft.com/library/cc753463(WS.10).aspx#bkmk_FINDSID).
Restricting access to a group allows administrations to extend strong authentication support through Windows Defender Firewall and/or IPsec policies.
@@ -600,7 +601,7 @@ Windows PowerShell
$secureMachineGroup = "D:(A;;CC;;;$SIDofSecureMachineGroup)"
```
-For more information about how to create security groups or how to determine the SDDL string, see [Working with SIDs](http://technet.microsoft.com/library/ff730940.aspx).
+For more information about how to create security groups or how to determine the SDDL string, see [Working with SIDs](https://technet.microsoft.com/library/ff730940.aspx).
Telnet is an application that does not provide encryption. This application can send data, such as names and passwords, over the network. This data can be intercepted by malicious users. If an administrator would like to allow the use of Telnet, but protect the traffic, a firewall rule that requires IPsec encryption can be created. This is necessary so that the administrator can be certain that when this application is used, all of the traffic sent or received by this port is encrypted. If IPsec fails to authorize the connection, no traffic is allowed from this application.
@@ -633,7 +634,7 @@ Set-NetFirewallSetting -RemoteMachineTransportAuthorizationList $secureMachineGr
### Create firewall rules that allow IPsec-protected network traffic (authenticated bypass)
-Authenticated bypass allows traffic from a specified trusted device or user to override firewall block rules. This is helpful when an administrator wants to use scanning servers to monitor and update devices without the need to use port-level exceptions. For more information, see [How to enable authenticated firewall bypass](http://technet.microsoft.com/library/cc753463(WS.10).aspx).
+Authenticated bypass allows traffic from a specified trusted device or user to override firewall block rules. This is helpful when an administrator wants to use scanning servers to monitor and update devices without the need to use port-level exceptions. For more information, see [How to enable authenticated firewall bypass](https://technet.microsoft.com/library/cc753463(WS.10).aspx).
In this example, we assume that a blocking firewall rule exists. This example permits any network traffic on any port from any IP address to override the block rule, if the traffic is authenticated as originating from a device or user account that is a member of the specified device or user security group.
diff --git a/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md
rename to windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md
index 7167d7496a..b89e03159e 100644
--- a/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md
+++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 08/17/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md
similarity index 99%
rename from windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md
rename to windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md
index 7714a6969c..17bc826d98 100644
--- a/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md
+++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md
@@ -6,6 +6,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 10/05/2017
---
diff --git a/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md
similarity index 94%
rename from windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security.md
rename to windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md
index 9bf49e209f..9b266aec88 100644
--- a/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security.md
+++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md
@@ -5,6 +5,7 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.sitesec: library
ms.pagetype: security
+ms.localizationpriority: medium
author: brianlic-msft
ms.date: 10/13/2017
---
@@ -38,7 +39,7 @@ To help address your organizational network security challenges, Windows Defende
| Topic | Description
| - | - |
| [Isolating Microsoft Store Apps on Your Network](isolating-apps-on-your-network.md) | You can customize your Windows Defender Firewall configuration to isolate the network access of Microsoft Store apps that run on devices. |
-| [Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server 2012](securing-end-to-end-ipsec-connections-by-using-ikev2.md) | You can use IKEv2 to help secure your end-to-end IPSec connections. |
+| [Securing End-to-End IPsec Connections by Using IKEv2](securing-end-to-end-ipsec-connections-by-using-ikev2.md) | You can use IKEv2 to help secure your end-to-end IPSec connections. |
| [Windows Defender Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md) | Learn more about using Windows PowerShell to manage the Windows Defender Firewall. |
| [Windows Defender Firewall with Advanced Security Design Guide](windows-firewall-with-advanced-security-design-guide.md) | Learn how to create a design for deploying Windows Defender Firewall with Advanced Security. |
| [Windows Defender Firewall with Advanced Security Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md) | Learn how to deploy Windows Defender Firewall with Advanced Security. |
diff --git a/windows/security/wdatp/images/WDATP-components.png b/windows/security/wdatp/images/WDATP-components.png
deleted file mode 100644
index 51f4335265..0000000000
Binary files a/windows/security/wdatp/images/WDATP-components.png and /dev/null differ
diff --git a/windows/security/wdatp/images/wdatp-pillars.png b/windows/security/wdatp/images/wdatp-pillars.png
deleted file mode 100644
index 06ad5e6ed2..0000000000
Binary files a/windows/security/wdatp/images/wdatp-pillars.png and /dev/null differ
diff --git a/windows/security/wdatp/images/wdatp-pillars2.png b/windows/security/wdatp/images/wdatp-pillars2.png
deleted file mode 100644
index bbe88f3638..0000000000
Binary files a/windows/security/wdatp/images/wdatp-pillars2.png and /dev/null differ
diff --git a/windows/security/wdatp/index.md b/windows/security/wdatp/index.md
deleted file mode 100644
index cb401fa3e4..0000000000
--- a/windows/security/wdatp/index.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-title: Windows Defender Advanced Threat Protection
-description: Windows Defender Advanced Threat Protection is an enterprise security service that helps detect and respond to possible cybersecurity threats related to advanced persistent threats.
-keywords: introduction to Windows Defender Advanced Threat Protection, introduction to Windows Defender ATP, cybersecurity, advanced persistent threat, enterprise security, machine behavioral sensor, cloud security, analytics, threat intelligence
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: security
-ms.author: macapara
-author: mjcaparas
-ms.date: 06/04/2018
----
-
-# Windows Defender Advanced Threat Protection
-
-Windows Defender Advanced Threat Protection (Windows Defender ATP)is a unified platform for preventative protection, post-breach detection, automated investigation and response, employing intelligent protection to protect endpoints from cyber threats.
-
-
-
-
-**Attack surface reduction**
-The attack surface reduction set of capabilities provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations.
-
-**Next generation protection**
-To further reinforce the security perimeter of your network, Windows Defender ATP uses next generation protection designed to catch all types of emerging threats.
-
-**Endpoint detection and response**
-Endpoint detection and response capabilities are put in place to detect, investigate, and respond to advanced threats that may have made it past the first two security pillars.
-
-**Auto investigation and remediation**
-In conjunction with being able to quickly respond to advanced attacks, Windows Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale.
-
-**Security posture**
-Windows Defender ATP also provides a security posture capability to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security state of your network.
-
-**Management and APIs**
-Windows Defender ATP provides integrated configuration management in the cloud. The service also supports third-party mobile device management (MDM) tools, cross-platform support, and APIs that allow customers to create custom threat intelligence and automate workflows.
-
-Understand how capabilities align within the Windows Defender ATP suite offering:
-
-
- Attack surface reduction | Next generation protection | Endpoint detection and response | Auto investigation and remediation | Security posture
-:---|:---|:---|:---|:---
- [Hardware based isolation](https://docs.microsoft.com/en-us/windows/security/hardware-protection/)
[Realtime and historical threat hunting](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)
[Threat intelligence and custom detections](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection) | [Forensic collection](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection#collect-investigation-package-from-machines)
[Reporting and trends](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection)
-
-These capabilities are available across multiple products that make up the Windows Defender ATP platform. For more information on how to leverage all the Windows Defender ATP capabilities, see [Threat protection](https://docs.microsoft.com/en-us/windows/security/threat-protection/index).
-
-
diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md
index 78339d5cb2..7a67f0f951 100644
--- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md
+++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md
@@ -22,7 +22,7 @@ Below is a list of some of the new and updated features included in the initial
### Provisioning devices using Windows Imaging and Configuration Designer (ICD)
-With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. Using Windows Provisioning, an IT administrator can easily specify desired configuration and settings required to enroll the devices into management (through a wizard-driven user interface) and then apply that configuration to target devices in a matter of minutes. It is best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers.
+With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. Using Windows Provisioning, an IT administrator can easily specify desired configuration and settings required to enroll the devices into management (through a wizard-driven user interface) and then apply that configuration to target devices in a matter of minutes. It is best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers.
[Learn more about provisioning in Windows 10.](/windows/configuration/provisioning-packages/provisioning-packages)
@@ -33,9 +33,9 @@ With Windows 10, you can create provisioning packages that let you quickly and e
#### New Applocker features in Windows 10, version 1507
-- A new parameter was added to the [New-AppLockerPolicy](http://technet.microsoft.com/library/hh847211.aspx) Windows PowerShell cmdlet that lets you choose whether executable and DLL rule collections apply to non-interactive processes. To enable this, set the **ServiceEnforcement** to **Enabled**.
-- A new [AppLocker](http://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) configuration service provider was add to allow you to enable AppLocker rules by using an MDM server.
-- You can manage Windows 10 Mobile devices by using the new [AppLocker CSP](http://msdn.microsoft.com/library/windows/hardware/dn920019.aspx).
+- A new parameter was added to the [New-AppLockerPolicy](https://technet.microsoft.com/library/hh847211.aspx) Windows PowerShell cmdlet that lets you choose whether executable and DLL rule collections apply to non-interactive processes. To enable this, set the **ServiceEnforcement** to **Enabled**.
+- A new [AppLocker](https://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) configuration service provider was add to allow you to enable AppLocker rules by using an MDM server.
+- You can manage Windows 10 Mobile devices by using the new [AppLocker CSP](https://msdn.microsoft.com/library/windows/hardware/dn920019.aspx).
[Learn how to manage AppLocker within your organization](/windows/device-security/applocker/applocker-overview).
@@ -229,7 +229,7 @@ In Windows 10, User Account Control has added some improvements.
#### New User Account Control features in Windows 10, version 1507
-- **Integration with the Antimalware Scan Interface (AMSI)**. The [AMSI](http://msdn.microsoft.com/library/windows/desktop/dn889587.aspx) scans all UAC elevation requests for malware. If malware is detected, the admin privilege is blocked.
+- **Integration with the Antimalware Scan Interface (AMSI)**. The [AMSI](https://msdn.microsoft.com/library/windows/desktop/dn889587.aspx) scans all UAC elevation requests for malware. If malware is detected, the admin privilege is blocked.
[Learn how to manage User Account Control within your organization](/windows/access-protection/user-account-control/user-account-control-overview).
@@ -237,8 +237,8 @@ In Windows 10, User Account Control has added some improvements.
Windows 10 provides a set of VPN features that both increase enterprise security and provide an improved user experience, including:
-- Always-on auto connection behavior
-- App=triggered VPN
+- Always-on auto connection behavior
+- App=triggered VPN
- VPN traffic filters
- Lock down VPN
- Integration with Microsoft Passport for Work
@@ -252,7 +252,7 @@ Windows 10 provides mobile device management (MDM) capabilities for PCs, laptop
### MDM support
-MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Microsoft Store, VPN configuration, and more.
+MDM policies for Windows 10 align with the policies supported in Windows 8.1 and are expanded to address even more enterprise scenarios, such as managing multiple users who have Microsoft Azure Active Directory (Azure AD) accounts, full control over the Microsoft Store, VPN configuration, and more.
MDM support in Windows 10 is based on [Open Mobile Alliance (OMA)](https://go.microsoft.com/fwlink/p/?LinkId=533885) Device Management (DM) protocol 1.2.1 specification.
@@ -271,7 +271,7 @@ When a personal device is unenrolled, the user's data and apps are untouched, wh
Enterprises have the following identity and management choices.
| Area | Choices |
-|---|---|
+|---|---|
| Identity | Active Directory; Azure AD |
| Grouping | Domain join; Workgroup; Azure AD join |
| Device management | Group Policy; System Center Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) |
@@ -306,7 +306,7 @@ Administrators can also use mobile device management (MDM) or Group Policy to di
### Microsoft Store for Business
**New in Windows 10, version 1511**
-With the Microsoft Store for Business, organizations can make volume purchases of Windows apps. The Store for Business provides app purchases based on organizational identity, flexible distribution options, and the ability to reclaim or re-use licenses. Organizations can also use the Store for Business to create a private store for their employees that includes apps from the Store, as well private Line-of-Business (LOB) apps.
+With the Microsoft Store for Business, organizations can make volume purchases of Windows apps. The Store for Business provides app purchases based on organizational identity, flexible distribution options, and the ability to reclaim or re-use licenses. Organizations can also use the Store for Business to create a private store for their employees that includes apps from the Store, as well private Line-of-Business (LOB) apps.
For more information, see [Microsoft Store for Business overview](/microsoft-store/windows-store-for-business-overview).
@@ -323,7 +323,7 @@ By using [Group Policy Objects](https://go.microsoft.com/fwlink/p/?LinkId=699279
- **Use with existing tools** such as System Center Configuration Manager and the [Enterprise Mobility Suite](https://go.microsoft.com/fwlink/p/?LinkId=699281).
-Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as [Windows Server Update Services (WSUS)](http://technet.microsoft.com/library/hh852345.aspx) and [System Center Configuration Manager](http://technet.microsoft.com/library/gg682129.aspx).
+Together, these Windows Update for Business features help reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. Windows Update for Business is a free service for all Windows 10 Pro, Enterprise, and Education editions, and can be used independent of, or in conjunction with, existing device management solutions such as [Windows Server Update Services (WSUS)](https://technet.microsoft.com/library/hh852345.aspx) and [System Center Configuration Manager](https://technet.microsoft.com/library/gg682129.aspx).
Learn more about [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb).
diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md
index 9beb4709cd..a363f852cd 100644
--- a/windows/whats-new/whats-new-windows-10-version-1703.md
+++ b/windows/whats-new/whats-new-windows-10-version-1703.md
@@ -210,7 +210,7 @@ To check out all the details, see [Configure Delivery Optimization for Windows 1
### Uninstalled in-box apps no longer automatically reinstall
-Starting with Windows 10, version 1703, in-box apps that were uninstalled by the user won't automatically reinstall as part of the feature update installation process.
+Starting with Windows 10, version 1703, in-box apps that were uninstalled by the user won't automatically reinstall as part of the feature update installation process.
Additionally, apps de-provisioned by admins on Windows 10, version 1703 machines will stay de-provisioned after future feature update installations. This will not apply to the update from Windows 10, version 1607 (or earlier) to version 1703.
@@ -234,7 +234,7 @@ Some of the other new CSPs are:
- The [EnterpriseAppVManagement CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp) is used to manage virtual applications in Windows 10 PCs (Enterprise and Education editions) and enables App-V sequenced apps to be streamed to PCs even when managed by MDM.
-IT pros can use the new [MDM Migration Analysis Tool (MMAT)](http://aka.ms/mmat) to determine which Group Policy settings have been configured for a user or computer and cross-reference those settings against a built-in list of supported MDM policies. MMAT can generate both XML and HTML reports indicating the level of support for each Group Policy setting and MDM equivalents.
+IT pros can use the new [MDM Migration Analysis Tool (MMAT)](https://aka.ms/mmat) to determine which Group Policy settings have been configured for a user or computer and cross-reference those settings against a built-in list of supported MDM policies. MMAT can generate both XML and HTML reports indicating the level of support for each Group Policy setting and MDM equivalents.
[Learn more about new MDM capabilities.](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/new-in-windows-mdm-enrollment-management#whatsnew10)
@@ -244,7 +244,7 @@ The Windows version of mobile application management (MAM) is a lightweight solu
For more info, see [Implement server-side support for mobile application management on Windows](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/implement-server-side-mobile-application-management).
-### MDM diagnostics
+### MDM diagnostics
In Windows 10, version 1703, we continue our work to improve the diagnostic experience for modern management. By introducing auto-logging for mobile devices, Windows will automatically collect logs when encountering an error in MDM, eliminating the need to have always-on logging for memory-constrained devices. Additionally, we are introducing [Microsoft Message Analyzer](https://www.microsoft.com/download/details.aspx?id=44226) as an additional tool to help Support personnel quickly reduce issues to their root cause, while saving time and cost.
@@ -314,7 +314,7 @@ Miracast over Infrastructure offers a number of benefits:
Users attempt to connect to a Miracast receiver as they did previously. When the list of Miracast receivers is populated, Windows 10 will identify that the receiver is capable of supporting a connection over the infrastructure. When the user selects a Miracast receiver, Windows 10 will attempt to resolve the device's hostname via standard DNS, as well as via multicast DNS (mDNS). If the name is not resolvable via either DNS method, Windows 10 will fall back to establishing the Miracast session using the standard Wi-Fi direct connection.
-### Enabling Miracast over Infrastructure
+### Enabling Miracast over Infrastructure
If you have a device that has been updated to Windows 10, version 1703, then you automatically have this new feature. To take advantage of it in your environment, you need to ensure the following is true within your deployment:
@@ -322,8 +322,8 @@ If you have a device that has been updated to Windows 10, version 1703, then you
- A Windows PC or Surface Hub can act as a Miracast over Infrastructure *receiver*. A Windows PC or phone can act as a Miracast over Infrastructure *source*.
- As a Miracast receiver, the PC or Surface Hub must be connected to your enterprise network via either Ethernet or a secure Wi-Fi connection (e.g. using either WPA2-PSK or WPA2-Enterprise security). If the Hub is connected to an open Wi-Fi connection, Miracast over Infrastructure will disable itself.
- As a Miracast source, the PC or phone must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection.
-- The DNS Hostname (device name) of the device needs to be resolvable via your DNS servers. You can achieve this by either allowing your device to register automatically via Dynamic DNS, or by manually creating an A or AAAA record for the device's hostname.
-- Windows 10 PCs must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection.
+- The DNS Hostname (device name) of the device needs to be resolvable via your DNS servers. You can achieve this by either allowing your device to register automatically via Dynamic DNS, or by manually creating an A or AAAA record for the device's hostname.
+- Windows 10 PCs must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection.
It is important to note that Miracast over Infrastructure is not a replacement for standard Miracast. Instead, the functionality is complementary, and provides an advantage to users who are part of the enterprise network. Users who are guests to a particular location and don’t have access to the enterprise network will continue to connect using the Wi-Fi Direct connection method.
@@ -334,7 +334,7 @@ The following new features aren't part of Windows 10, but help you make the most
Upgrade Readiness helps you ensure that applications and drivers are ready for a Windows 10 upgrade. The solution provides up-to-date application and driver inventory, information about known issues, troubleshooting guidance, and per-device readiness and tracking details. The Upgrade Readiness tool moved from public preview to general availability on March 2, 2017.
-The development of Upgrade Readiness has been heavily influenced by input from the community the development of new features is ongoing. To begin using Upgrade Readiness, add it to an existing Operation Management Suite (OMS) workspace or sign up for a new OMS workspace with the Upgrade Readiness solution enabled.
+The development of Upgrade Readiness has been heavily influenced by input from the community the development of new features is ongoing. To begin using Upgrade Readiness, add it to an existing Operation Management Suite (OMS) workspace or sign up for a new OMS workspace with the Upgrade Readiness solution enabled.
For more information about Upgrade Readiness, see the following topics:
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
- --
5
-
+
**Figure 2. The “Who owns this PC?” page in initial Windows 10 setup**
2. On the **Choose how you’ll connect** page, select **Join Azure AD**, and then click **Next**, as illustrated in **Figure 3**.
-
+
**Figure 3. The “Choose how you’ll connect” page in initial Windows 10 setup**
3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 4**.
-
+
**Figure 4. The “Let’s get you signed in” page in initial Windows 10 setup**
Now the device is Azure AD joined to the company’s subscription.
@@ -130,19 +130,19 @@ Now the device is Azure AD joined to the company’s subscription.
1. Go to **Settings > Accounts > Access work or school**, as illustrated in **Figure 5**.
-
+
**Figure 5. Connect to work or school configuration in Settings**
2. In **Set up a work or school account**, click **Join this device to Azure Active Directory**, as illustrated in **Figure 6**.
-
+
**Figure 6. Set up a work or school account**
3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 7**.
-
+
**Figure 7. The “Let’s get you signed in” dialog box**
Now the device is Azure AD joined to the company’s subscription.
@@ -157,7 +157,7 @@ Now the device is Azure AD joined to the company’s subscription.
Or,
+