mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-15 06:47:21 +00:00
Merged PR 15021: TIMNA public preview updates
This commit is contained in:
Dolcita Montemayor
commit
fc914751c3
@ -6,6 +6,11 @@
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md",
|
||||
"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure",
|
||||
"redirect_document_id": true
|
||||
|
||||
@ -42,7 +42,7 @@ ms:topic: include
|
||||
|
||||
### Related policies
|
||||
|
||||
- [Disable Lockdown of Start Pages](#disable-lockdown-of-start-pages-include): [!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../shortdesc/disable-lockdown-of-start-pages-shortdesc.md)]
|
||||
- [Disable Lockdown of Start Pages](#disable-lockdown-of-start-pages): [!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../shortdesc/disable-lockdown-of-start-pages-shortdesc.md)]
|
||||
|
||||
- [Configure Open Microsoft Edge With](../available-policies.md#configure-open-microsoft-edge-with): [!INCLUDE [configure-open-microsoft-edge-with-shortdesc](../shortdesc/configure-open-microsoft-edge-with-shortdesc.md)]
|
||||
|
||||
|
||||
@ -236,7 +236,7 @@ In the following table, we show you the features available in both Microsoft Edg
|
||||
|---------------|:----------------:|:---------------:|
|
||||
| Print support |  |  |
|
||||
| Multi-tab support |  |  |
|
||||
| Allow/Block URL support |  <p>*\*For Microsoft Edge kiosk mode use* [Windows Defender Firewall](#_*Windows_Defender_Firewall)*. Microsoft kiosk browser has custom policy support.* |  |
|
||||
| Allow/Block URL support |  <p>*\*For Microsoft Edge kiosk mode use* Windows Defender Firewall*. Microsoft kiosk browser has custom policy support.* |  |
|
||||
| Configure Home Button |  |  |
|
||||
| Set Start page(s) URL |  |  <p>*Same as Home button URL* |
|
||||
| Set New Tab page URL |  |  |
|
||||
|
||||
@ -67,7 +67,7 @@ If you use Automatic Updates in your company, but want to stop your users from a
|
||||
- **Download and use the Internet Explorer 11 Blocker Toolkit.** Includes a Group Policy template and a script that permanently blocks Internet Explorer 11 from being offered by Windows Update or Microsoft Update as a high-priority update. You can download this kit from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=40722).
|
||||
|
||||
>[!NOTE]
|
||||
>The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](#faq).
|
||||
>The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](https://docs.microsoft.com/internet-explorer/ie11-faq/faq-for-it-pros-ie11).
|
||||
|
||||
- **Use an update management solution to control update deployment.** If you already use an update management solution, like [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [System Center 2012 Configuration Manager](https://go.microsoft.com/fwlink/?LinkID=276664), you should use that instead of the Internet Explorer Blocker Toolkit.
|
||||
|
||||
|
||||
@ -137,7 +137,7 @@ If you've previously used Set up School PCs to provision student devices, you ca
|
||||
The provisioning package on your USB drive will be named SetUpSchoolPCs_*ABCDE* (Expires *MM-DD-YYYY*).ppkg, where *ABCDE* is the device name you added (if any), and *MM-DD-YYYY* is the month, day, and year when the package will expire.
|
||||
|
||||
> [!NOTE]
|
||||
> If you selected **Office 365 for Windows 10 S (Education Preview)**, this step will take about 30-45 minutes. You can jump ahead to task 3, [Express configure Intune for Education to manage devices, users, and policies](#task3), and then finish the rest of task 2 afterwards.
|
||||
> If you selected **Office 365 for Windows 10 S (Education Preview)**, this step will take about 30-45 minutes. You can jump ahead to task 3, [Express configure Intune for Education to manage devices, users, and policies](#it-task3), and then finish the rest of task 2 afterwards.
|
||||
|
||||
12. Follow the instructions in the **Get the student PCs ready** page to start setting up **Device B**.
|
||||
13. Follow the instructions in the **Install the package** page to apply the provisioning package to **Device B**. For more guidance, you can follow the steps in [Apply the provisioning package](#apply-the-provisioning-package).
|
||||
|
||||
@ -122,7 +122,7 @@ To change an existing package's name, right-click the package folder on your dev
|
||||
|
||||
1. Select how you want to sign in.
|
||||
a. (Recommended) To enable student PCs to automatically be connect to Office 365, Azure AD, and management services like Intune for Education, click **Sign-in**. Then go to step 3.
|
||||
b. To complete setup without signing in, click **Continue without account**. Student PCs won't be connected to your school's cloud services and managing them will be more difficult later. Continue to [Wireless network](use-set-up-school-pcs-app.md#Wireless-network).
|
||||
b. To complete setup without signing in, click **Continue without account**. Student PCs won't be connected to your school's cloud services and managing them will be more difficult later. Continue to [Wireless network](#wireless-network).
|
||||
2. In the new window, select the account you want to use throughout setup.
|
||||
|
||||
|
||||
|
||||
@ -167,7 +167,7 @@ Microsoft Intune provides mobile device management, app management, and PC manag
|
||||
|
||||
|
||||
|
||||
Intune should now be added to your tenant. We'll come back to Intune later when we [Configure Microsoft Store for Business for app distribution](#17-configure-windows-store-for-business-for-app-distribution).
|
||||
Intune should now be added to your tenant. We'll come back to Intune later when we [Configure Microsoft Store for Business for app distribution](#17-configure-microsoft-store-for-business-for-app-distribution).
|
||||
|
||||
### 1.4 Add Azure AD to your domain
|
||||
Microsoft Azure is an open and flexible cloud platform that enables you to quickly build, deploy, and manage apps across a global network of Microsoft-managed datacenters. In this walkthrough, we won't be using the full power of Azure and we'll primarily use it to create groups that we then use for provisioning through Intune.
|
||||
|
||||
@ -34,7 +34,7 @@ Before you deploy Office with App-V, review the following requirements.
|
||||
|
||||
|Task|Requirement|
|
||||
|---|---|
|
||||
|Packaging|All Office applications you wish to deploy to users must be in a single package.<br>In App-V and later, you must use the Office Deployment Tool to create packages. The Sequencer doesn't support package creation.<br>If you're deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2013 and Project 2013 with Office](#bkmk-deploy-visio-project).|
|
||||
|Packaging|All Office applications you wish to deploy to users must be in a single package.<br>In App-V and later, you must use the Office Deployment Tool to create packages. The Sequencer doesn't support package creation.<br>If you're deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2013 and Project 2013 with Office](#deploying-visio-2013-and-project-2013-with-office).|
|
||||
|Publishing|You can only publish one Office package per client computer.<br>You must publish the Office package globally, not to the user.|
|
||||
|Deploying Office 365 ProPlus, Visio Pro for Office 365, or Project Pro for Office 365 to a shared computer using Remote Desktop Services.|You must enable [shared computer activation](https://docs.microsoft.com/DeployOffice/overview-of-shared-computer-activation-for-office-365-proplus).<br>You don’t need to use shared computer activation if you’re deploying a volume licensed product, such as Office Professional Plus 2013, Visio Professional 2013, or Project Professional 2013.|
|
||||
|
||||
@ -45,7 +45,7 @@ The following table describes the recommended methods for excluding specific Off
|
||||
|Task|Details|
|
||||
|---|---|
|
||||
|Use the **ExcludeApp** setting when you create the package by using the Office Deployment Tool.|Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.<br>For more information, see [ExcludeApp element](https://docs.microsoft.com/DeployOffice/configuration-options-for-the-office-2016-deployment-tool?ui=en-US&rs=en-US&ad=US#excludeapp-element).|
|
||||
|Modify the **DeploymentConfig.xml** file|Modify the **DeploymentConfig.xml** file after creating the package. This file contains the default package settings for all users on a computer running the App-V Client.<br>For more information, see [Disabling Office 2013 applications](#bkmk-disable-office-apps).|
|
||||
|Modify the **DeploymentConfig.xml** file|Modify the **DeploymentConfig.xml** file after creating the package. This file contains the default package settings for all users on a computer running the App-V Client.<br>For more information, see [Disabling Office 2013 applications](#disabling-office-2013-applications).|
|
||||
|
||||
## Creating an Office 2013 package for App-V with the Office Deployment Tool
|
||||
|
||||
@ -268,12 +268,12 @@ Add-AppvClientPackage <Path_to_AppV_Package> | Publish-AppvClientPackage –glob
|
||||
|
||||
To manage your Office App-V packages, use the same operations as you would for any other package, but there are a few exceptions, as outlined in the following sections.
|
||||
|
||||
* [Enabling Office plug-ins by using connection groups](#bkmk-enable-office-plugins)
|
||||
* [Disabling Office 2013 applications](#bkmk-disable-office-apps)
|
||||
* [Disabling Office 2013 shortcuts](#bkmk-disable-shortcuts)
|
||||
* [Managing Office 2013 package upgrades](#bkmk-manage-office-pkg-upgrd)
|
||||
* [Managing Office 2013 licensing upgrades](#bkmk-manage-office-lic-upgrd)
|
||||
* [Deploying Visio 2013 and Project 2013 with Office](#bkmk-deploy-visio-project)
|
||||
* [Enabling Office plug-ins by using connection groups](#enabling-office-plug-ins-by-using-connection-groups)
|
||||
* [Disabling Office 2013 applications](#disabling-office-2013-applications)
|
||||
* [Disabling Office 2013 shortcuts](#disabling-office-2013-shortcuts)
|
||||
* [Managing Office 2013 package upgrades](#managing-office-2013-package-upgrades)
|
||||
* [Managing Office 2013 licensing upgrades](#managing-office-2013-licensing-upgrades)
|
||||
* [Deploying Visio 2013 and Project 2013 with Office](#deploying-visio-2013-and-project-2013-with-office)
|
||||
|
||||
### Enabling Office plug-ins by using connection groups
|
||||
|
||||
|
||||
@ -33,7 +33,7 @@ Using Shell Launcher, you can configure a kiosk device that runs a Windows deskt
|
||||
>- [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview) - Application control policies
|
||||
>- [Mobile Device Management](https://docs.microsoft.com/windows/client-management/mdm) - Enterprise management of device security policies
|
||||
>
|
||||
>You can also configure a kiosk device that runs a Windows desktop application by using the [Provision kiosk devices wizard](#wizard).
|
||||
>You can also configure a kiosk device that runs a Windows desktop application by using the [Provision kiosk devices wizard](kiosk-single-app.md#wizard).
|
||||
|
||||
|
||||
|
||||
|
||||
@ -49,6 +49,7 @@ You can configure multi-app kiosks using [Microsoft Intune](#intune) or a [provi
|
||||
To configure a kiosk in Microsoft Intune, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/kiosk-settings). For explanations of the specific settings, see [Windows 10 and later device settings to run as a kiosk in Intune](https://docs.microsoft.com/intune/kiosk-settings-windows).
|
||||
|
||||
|
||||
<span id="provision" />
|
||||
## Configure a kiosk using a provisioning package
|
||||
|
||||
Process:
|
||||
|
||||
@ -156,6 +156,7 @@ The following table describes the attributes that you must use to specify the si
|
||||
|
||||
For example, a tile with Size="2x2", Row="2", and Column="2" results in a tile located at (2,2) where (0,0) is the top-left corner of a group.
|
||||
|
||||
<span id="start-tile" />
|
||||
#### start:Tile
|
||||
|
||||
You can use the **start:Tile** tag to pin any of the following apps to Start:
|
||||
@ -178,6 +179,7 @@ The following example shows how to pin the Microsoft Edge Universal Windows app:
|
||||
Column="0"/>
|
||||
```
|
||||
|
||||
<span id="start-desktopapplicationtile" />
|
||||
#### start:DesktopApplicationTile
|
||||
|
||||
You can use the **start:DesktopApplicationTile** tag to pin a Windows desktop application to Start. There are two ways you can specify a Windows desktop application:
|
||||
@ -238,6 +240,7 @@ The following example shows how to create a tile of the Web site's URL, which yo
|
||||
>[!NOTE]
|
||||
>In Windows 10, version 1703, **Export-StartLayout** will use **DesktopApplicationLinkPath** for the .url shortcut. You must change **DesktopApplicationLinkPath** to **DesktopApplicationID** and provide the URL.
|
||||
|
||||
<span id="start-secondarytile" />
|
||||
#### start:SecondaryTile
|
||||
|
||||
You can use the **start:SecondaryTile** tag to pin a Web link through a Microsoft Edge secondary tile. This method doesn't require any additional action compared to the method of using legacy .url shortcuts (through the start:DesktopApplicationTile tag).
|
||||
|
||||
@ -229,7 +229,9 @@
|
||||
#### [Windows Update error code reference](update/windows-update-error-reference.md)
|
||||
#### [Other Windows Update resources](update/windows-update-resources.md)
|
||||
### [Optimize Windows 10 update delivery](update/waas-optimize-windows-10-updates.md)
|
||||
#### [Configure Delivery Optimization for Windows 10 updates](update/waas-delivery-optimization.md)
|
||||
#### [Delivery Optimization for Windows 10 updates](update/waas-delivery-optimization.md)
|
||||
#### [Set up Delivery Optimization for Windows 10 updates](update/waas-delivery-optimization-setup.md)
|
||||
#### [Delivery Optimization reference](update/waas-delivery-optimization-reference.md)
|
||||
#### [Configure BranchCache for Windows 10 updates](update/waas-branchcache.md)
|
||||
#### [Whitepaper: Windows Updates using forward and reverse differentials](update/PSFxWhitepaper.md)
|
||||
### [Best practices for feature updates on mission-critical devices](update/feature-update-mission-critical.md)
|
||||
|
||||
|
Before Width: | Height: | Size: 223 KiB After Width: | Height: | Size: 223 KiB |
@ -30,7 +30,7 @@ The Delivery Optimization Status section includes three blades:
|
||||
|
||||
|
||||
## Device Configuration blade
|
||||
Devices can be set to use different download modes; these download modes determine in what situations Delivery Optimization will use peer-to-peer distribution to accomplish the downloads. The top section shows the number of devices configured to use peer-to-peer distribution in *Peering On* compared to *Peering Off* modes. The table shows a breakdown of the various download mode configurations seen in your environment. For more information about the different configuration options, see [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md#download-mode).
|
||||
Devices can be set to use different download modes; these download modes determine in what situations Delivery Optimization will use peer-to-peer distribution to accomplish the downloads. The top section shows the number of devices configured to use peer-to-peer distribution in *Peering On* compared to *Peering Off* modes. The table shows a breakdown of the various download mode configurations seen in your environment. For more information about the different configuration options, see [Set up Delivery Optimization for Windows 10 updates](waas-delivery-optimization-setup.md) for recommendations for different scenarios or [Delivery Optimization reference](waas-delivery-optimization-reference.md#download-mode) for complete details of this setting.
|
||||
|
||||
## Content Distribution (%) blade
|
||||
The first of two blades showing information on content breakdown, this blade shows a ring chart summarizing **Bandwidth Savings %**, which is the percentage of data received from peer sources out of the total data downloaded (for any device that used peer-to-peer distribution).
|
||||
|
||||
@ -0,0 +1,223 @@
|
||||
---
|
||||
title: Delivery Optimization reference
|
||||
description: Reference of all Delivery Optimization settings and descriptions of same
|
||||
keywords: oms, operations management suite, wdav, updates, downloads, log analytics
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: JaimeO
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Delivery Optimization reference
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
There are a great many details you can set in Delivery Optimization to customize it to do just what you need it to. This topic summarizes them for your reference.
|
||||
|
||||
## Delivery Optimization options
|
||||
|
||||
You can use Group Policy or an MDM solution like Intune to configure Delivery Optimization.
|
||||
|
||||
You will find the Delivery Optimization settings in Group Policy under **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization**.
|
||||
In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimization/**.
|
||||
|
||||
[//]: # (something about Intune UX--perhaps link to relevant Intune docs?)
|
||||
|
||||
### Summary of Delivery Optimization settings :
|
||||
|
||||
| Group Policy setting | MDM setting | Supported from version |
|
||||
| --- | --- | --- |
|
||||
| [Download mode](#download-mode) | DODownloadMode | 1511 |
|
||||
| [Group ID](#group-id) | DOGroupID | 1511 |
|
||||
| [Minimum RAM (inclusive) allowed to use Peer Caching](#minimum-ram-allowed-to-use-peer-caching) | DOMinRAMAllowedToPeer | 1703 |
|
||||
| [Minimum disk size allowed to use Peer Caching](#minimum-disk-size-allowed-to-use-peer-caching) | DOMinDiskSizeAllowedToPeer | 1703 |
|
||||
| [Max Cache Age](#max-cache-age) | DOMaxCacheAge | 1511 |
|
||||
| [Max Cache Size](#max-cache-size) | DOMaxCacheSize | 1511 |
|
||||
| [Absolute Max Cache Size](#absolute-max-cache-size) | DOAbsoluteMaxCacheSize | 1607 |
|
||||
| [Modify Cache Drive](#modify-cache-drive) | DOModifyCacheDrive | 1607 |
|
||||
| [Minimum Peer Caching Content File Size](#minimum-peer-caching-content-file-size) | DOMinFileSizeToCache | 1703 |
|
||||
| [Maximum Download Bandwidth](#maximum-download-bandwidth) | DOMaxDownloadBandwidth | 1607 |
|
||||
| [Percentage of Maximum Download Bandwidth](#percentage-of-maximum-download-bandwidth) | DOPercentageMaxDownloadBandwidth | 1607 |
|
||||
| [Max Upload Bandwidth](#max-upload-bandwidth) | DOMaxUploadBandwidth | 1607 |
|
||||
| [Monthly Upload Data Cap](#monthly-upload-data-cap) | DOMonthlyUploadDataCap | 1607 |
|
||||
| [Minimum Background QoS](#minimum-background-qos) | DOMinBackgroundQoS | 1607 |
|
||||
| [Enable Peer Caching while the device connects via VPN](#enable-peer-caching-while-the-device-connects-via-vpn) | DOAllowVPNPeerCaching | 1709 |
|
||||
| [Allow uploads while the device is on battery while under set Battery level](#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) | DOMinBatteryPercentageAllowedToUpload | 1709 |
|
||||
| [MaxForegroundDownloadBandwidth](#maximum-foreground-download-bandwidth) | DOPercentageMaxForegroundBandwidth | 1803 |
|
||||
| [MaxBackgroundDownloadBandwidth](#maximum-background-download-bandwidth) | DOPercentageMaxBackgroundBandwidth | 1803 |
|
||||
| [SetHoursToLimitBackgroundDownloadBandwidth](#set-business-hours-to-limit-background-download-bandwidth) | DOSetHoursToLimitBackgroundDownloadBandwidth | 1803 |
|
||||
| [SetHoursToLimitForegroundDownloadBandwidth](#set-business-hours-to-limit-foreground-download-bandwidth) |DOSetHoursToLimitForegroundDownloadBandwidth | 1803 |
|
||||
| [Select a method to restrict Peer Selection](#select-a-method-to-restrict-peer-selection) |DORestrictPeerSelectionBy | 1803 |
|
||||
| [Select the source of Group IDs](#select-the-source-of-group-ids) | DOGroupIDSource | 1803 |
|
||||
| [Delay background download from http (in secs)](#delay-background-download-from-http-in-secs) | DODelayBackgroundDownloadFromHttp | 1803 |
|
||||
| [Delay foreground download from http (in secs)](#delay-foreground-download-from-http-in-secs) | DODelayForegroundDownloadFromHttp | 1803 |
|
||||
|
||||
### More detail on Delivery Optimization settings:
|
||||
|
||||
[Group ID](#group-id), combined with Group [Download mode](#download-mode), enables administrators to create custom device groups that will share content between devices in the group.
|
||||
|
||||
Delivery Optimization uses locally cached updates. In cases where devices have ample local storage and you would like to cache more content, or if you have limited storage and would like to cache less, use the following settings to adjust the Delivery Optimization cache to suit your scenario:
|
||||
- [Max Cache Size](#max-cache-size) and [Absolute Max Cache Size](#absolute-max-cache-size) control the amount of space the Delivery Optimization cache can use.
|
||||
- [Max Cache Age](#max-cache-age) controls the retention period for each update in the cache.
|
||||
- The system drive is the default location for the Delivery Optimization cache. [Modify Cache Drive](#modify-cache-drive) allows administrators to change that location.
|
||||
|
||||
>[!NOTE]
|
||||
>It is possible to configure preferred cache devices. For more information, see [Set “preferred” cache devices for Delivery Optimization](#set-preferred-cache-devices).
|
||||
|
||||
All cached files have to be above a set minimum size. This size is automatically set by the Delivery Optimization cloud services, but when local storage is sufficient and the network isn't strained or congested, administrators might choose to change it to obtain increased performance. You can set the minimum size of files to cache by adjusting [Minimum Peer Caching Content File Size](#minimum-peer-caching-content-file-size).
|
||||
|
||||
Additional options available that control the impact Delivery Optimization has on your network include the following:
|
||||
- [Maximum Download Bandwidth](#maximum-download-bandwidth) and [Percentage of Maximum Download Bandwidth](#percentage-of-maximum-download-bandwidth) control the download bandwidth used by Delivery Optimization.
|
||||
- [Max Upload Bandwidth](#max-upload-bandwidth) controls the Delivery Optimization upload bandwidth usage.
|
||||
- [Monthly Upload Data Cap](#monthly-upload-data-cap) controls the amount of data a client can upload to peers each month.
|
||||
- [Minimum Background QoS](#minimum-background-qos) lets administrators guarantee a minimum download speed for Windows updates. This is achieved by adjusting the amount of data downloaded directly from Windows Update or WSUS servers, rather than other peers in the network.
|
||||
- [Maximum Foreground Download Bandwidth](#maximum-foreground-download-bandwidth) specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth.
|
||||
- [Maximum Background Download Bandwidth](#maximum-background-download-bandwidth) specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth.
|
||||
- [Set Business Hours to Limit Background Download Bandwidth](#set-business-hours-to-limit-background-download-bandwidth) specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.
|
||||
- [Set Business Hours to Limit Foreground Download Bandwidth](#set-business-hours-to-limit-foreground-download-bandwidth) specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.
|
||||
- [Select a method to restrict Peer Selection](#select-a-method-to-restrict-peer-selection) restricts peer selection by the options you select.
|
||||
- [Select the source of Group IDs](#select-the-source-of-group-ids) restricts peer selection to a specific source.
|
||||
- [Delay background download from http (in secs)](#delay-background-download-from-http-in-secs) allows you to delay the use of an HTTP source in a background download that is allowed to use P2P.
|
||||
- [Delay foreground download from http (in secs)](#delay-foreground-download-from-http-in-secs) allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use P2P.
|
||||
|
||||
Administrators can further customize scenarios where Delivery Optimization will be used with the following settings:
|
||||
- [Minimum RAM (inclusive) allowed to use Peer Caching](#minimum-ram-allowed-to-use-peer-caching) sets the minimum RAM required for peer caching to be enabled.
|
||||
- [Minimum disk size allowed to use Peer Caching](#minimum-disk-size-allowed-to-use-peer-caching) sets the minimum disk size required for peer caching to be enabled.
|
||||
- [Enable Peer Caching while the device connects via VPN](#enable-peer-caching-while-the-device-connects-via-vpn) allows clients connected through VPN to use peer caching.
|
||||
- [Allow uploads while the device is on battery while under set Battery level](#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) controls the minimum battery level required for uploads to occur. You must enable this policy to allow upload while on battery.
|
||||
|
||||
### Download mode
|
||||
|
||||
Download mode dictates which download sources clients are allowed to use when downloading Windows updates in addition to Windows Update servers. The following table shows the available download mode options and what they do. Additional technical details for these policies are available in [Policy CSP - Delivery Optimization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization).
|
||||
|
||||
| Download mode option | Functionality when set |
|
||||
| --- | --- |
|
||||
| HTTP Only (0) | This setting disables peer-to-peer caching but still allows Delivery Optimization to download content over HTTP from the download's original source. This mode uses additional metadata provided by the Delivery Optimization cloud services for a peerless reliable and efficient download experience. |
|
||||
| LAN (1 – Default) | This default operating mode for Delivery Optimization enables peer sharing on the same network. The Delivery Optimization cloud service finds other clients that connect to the Internet using the same public IP as the target client. These clients then attempts to connect to other peers on the same network by using their private subnet IP.|
|
||||
| Group (2) | When group mode is set, the group is automatically selected based on the device’s Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use GroupID option to create your own custom group independently of domains and AD DS sites. Starting with Windows 10, version 1803, you can use the GroupIDSource parameter to take advantage of other method to create groups dynamically. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. |
|
||||
| Internet (3) | Enable Internet peer sources for Delivery Optimization. |
|
||||
| Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable, unreachable or when the content file size is less than 10 MB. In this mode, Delivery Optimization provides a reliable download experience, with no peer-to-peer caching. |
|
||||
|Bypass (100) | Bypass Delivery Optimization and use BITS, instead. You should only select this mode if you use WSUS and prefer to use BranchCache. You do not need to set this option if you are using SCCM. If you want to disable peer-to-peer functionality, it's best to set **DownloadMode** to **0** or **99**. |
|
||||
|
||||
>[!NOTE]
|
||||
>Group mode is a best-effort optimization and should not be relied on for an authentication of identity of devices participating in the group.
|
||||
|
||||
### Group ID
|
||||
|
||||
By default, peer sharing on clients using the group download mode is limited to the same domain in Windows 10, version 1511, and the same domain and AD DS site in Windows 10, version 1607. By using the Group ID setting, you can optionally create a custom group that contains devices that should participate in Delivery Optimization but do not fall within those domain or AD DS site boundaries, including devices in another domain. Using Group ID, you can further restrict the default group (for example, you could create a sub-group representing an office building), or extend the group beyond the domain, allowing devices in multiple domains in your organization to be peers. This setting requires the custom group to be specified as a GUID on each device that participates in the custom group.
|
||||
|
||||
[//]: # (SCCM Boundary Group option; GroupID Source policy)
|
||||
|
||||
>[!NOTE]
|
||||
>To generate a GUID using Powershell, use [```[guid]::NewGuid()```](https://blogs.technet.microsoft.com/heyscriptingguy/2013/07/25/powertip-create-a-new-guid-by-using-powershell/)
|
||||
>
|
||||
>This configuration is optional and not required for most implementations of Delivery Optimization.
|
||||
|
||||
### Select the source of Group IDs
|
||||
Starting in Windows 10, version 1803, set this policy to restrict peer selection to a specific source. The options are:
|
||||
- 0 = not set
|
||||
- 1 = AD Site
|
||||
- 2 = Authenticated domain SID
|
||||
- 3 = DHCP Option ID (with this option, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID)
|
||||
- 4 = DNS Suffix
|
||||
|
||||
When set, the Group ID is assigned automatically from the selected source. If you set this policy, the GroupID policy will be ignored. The option set in this policy only applies to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. If you set the value to anything other than 0-4, the policy is ignored.
|
||||
|
||||
|
||||
### Minimum RAM (inclusive) allowed to use Peer Caching
|
||||
|
||||
This setting specifies the minimum RAM size in GB required to use Peer Caching. For example if the minimum set is 1 GB, then devices with 1 GB or higher available RAM will be allowed to use Peer caching. The recommended values are 1 to 4 GB, and the default value is 4 GB.
|
||||
|
||||
### Minimum disk size allowed to use Peer Caching
|
||||
|
||||
This setting specifies the required minimum disk size (capacity in GB) for the device to use Peer Caching. The recommended values are 64 to 256 GB, and the default value is 32 GB.
|
||||
|
||||
>[!NOTE]
|
||||
>If the [Modify Cache Drive](#modify-cache-drive) policy is set, the disk size check will apply to the new working directory specified by this policy.
|
||||
|
||||
|
||||
### Max Cache Age
|
||||
|
||||
In environments configured for Delivery Optimization, you might want to set an expiration on cached updates and Windows application installation files. If so, this setting defines the maximum number of seconds each file can be held in the Delivery Optimization cache on each Windows 10 client device. The default Max Cache Age value is 259,200 seconds (3 days). Alternatively, organizations might choose to set this value to “0” which means “unlimited” to avoid peers re-downloading content. When “Unlimited” value is set, Delivery Optimization will hold the files in the cache longer and will clean up the cache as needed (for example when the cache size exceeded the maximum space allowed).
|
||||
|
||||
### Max Cache Size
|
||||
|
||||
This setting limits the maximum amount of space the Delivery Optimization cache can use as a percentage of the available drive space, from 1 to 100. For example, if you set this value to 10 on a Windows 10 client device that has 100 GB of available drive space, then Delivery Optimization will use up to 10 GB of that space. Delivery Optimization will constantly assess the available drive space and automatically clear the cache to keep the maximum cache size under the set percentage. The default value for this setting is 20.
|
||||
|
||||
### Absolute Max Cache Size
|
||||
|
||||
This setting specifies the maximum number of gigabytes the Delivery Optimization cache can use. This is different from the [**Max Cache Size**](#max-cache-size) setting, which is a percentage of available disk space. Also, if you configure this policy, it will override the [**Max Cache Size**](#max-cache-size) setting. The default value for this setting is 10 GB.
|
||||
|
||||
### Minimum Peer Caching Content File Size
|
||||
|
||||
This setting specifies the minimum content file size in MB enabled to use Peer Caching. The recommended values are from 1 to 100000 MB.
|
||||
|
||||
### Maximum Download Bandwidth
|
||||
|
||||
This setting specifies the maximum download bandwidth that can be used across all concurrent Delivery Optimization downloads in kilobytes per second (KB/s). A default value of 0 means that Delivery Optimization will dynamically adjust and optimize the maximum bandwidth used.
|
||||
|
||||
### Maximum Foreground Download Bandwidth
|
||||
|
||||
Starting in Windows 10, version 1803, specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. The default value of 0 means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads. However, downloads from LAN peers are not throttled even when this policy is set.
|
||||
|
||||
### Maximum Background Download Bandwidth
|
||||
|
||||
Starting in Windows 10, version 1803, specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. The default value of 0 means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads. However, downloads from LAN peers are not throttled even when this policy is set.
|
||||
|
||||
### Percentage of Maximum Download Bandwidth
|
||||
|
||||
This setting specifies the maximum download bandwidth that Delivery Optimization can use across all concurrent download activities as a percentage of available download bandwidth. The default value 0 means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads.
|
||||
|
||||
### Max Upload Bandwidth
|
||||
|
||||
This setting allows you to limit the amount of upload bandwidth individual clients can use for Delivery Optimization. Consider this setting when clients are providing content to requesting peers on the network. This option is set in kilobytes per second (KB/s). The default setting is 0, or “unlimited” which means Delivery Optimization dynamically optimizes for minimal usage of upload bandwidth; however it does not cap the upload bandwidth rate at a set rate.
|
||||
|
||||
### Set Business Hours to Limit Background Download Bandwidth
|
||||
Starting in Windows 10, version 1803, specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.
|
||||
|
||||
### Set Business Hours to Limit Foreground Download Bandwidth
|
||||
Starting in Windows 10, version 1803, specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.
|
||||
|
||||
### Select a method to restrict peer selection
|
||||
Starting in Windows 10, version 1803, set this policy to restrict peer selection via selected option.
|
||||
Currently the only available option is **1 = Subnet mask** This option (Subnet mask) applies to both Download Modes LAN (1) and Group (2).
|
||||
|
||||
|
||||
|
||||
### Delay background download from http (in secs)
|
||||
Starting in Windows 10, version 1803, this allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer.
|
||||
|
||||
### Delay foreground download from http (in secs)
|
||||
Starting in Windows 10, version 1803, allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer.
|
||||
|
||||
### Minimum Background QoS
|
||||
|
||||
This value specifies the minimum download speed guarantee that a client attempts to achieve and will fulfill by downloading more kilobytes from Windows Update servers or WSUS. Simply put, the lower this value is, the more content will be sourced using peers on the network rather than Windows Update. The higher this value, the more content is received from Windows Update servers or WSUS, versus peers on the local network.
|
||||
|
||||
### Modify Cache Drive
|
||||
|
||||
This setting allows for an alternate Delivery Optimization cache location on the clients. By default, the cache is stored on the operating system drive through the %SYSTEMDRIVE% environment variable. You can set the value to an environment variable (e.g., %SYSTEMDRIVE%), a drive letter (e.g., D:), or a folder path (e.g., D:\DOCache).
|
||||
|
||||
### Monthly Upload Data Cap
|
||||
|
||||
This setting specifies the total amount of data in gigabytes that a Delivery Optimization client can upload to Internet peers per month. A value of 0 means that an unlimited amount of data can be uploaded. The default value for this setting is 20 GB.
|
||||
|
||||
### Enable Peer Caching while the device connects via VPN
|
||||
|
||||
This setting determines whether a device will be allowed to participate in Peer Caching while connected to VPN. Specify "true" to allow the device to participate in Peer Caching while connected via VPN to the domain network. This means the device can download from or upload to other domain network devices, either on VPN or on the corporate domain network.
|
||||
|
||||
### Allow uploads while the device is on battery while under set Battery level
|
||||
|
||||
This setting specifies battery levels at which a device will be allowed to upload data. Specify any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and Group peers while on DC power (Battery). Uploads will automatically pause when the battery level drops below the set minimum battery level. The recommended value to set if you allow uploads on battery is 40 (for 40%).
|
||||
The device can download from peers while on battery regardless of this policy.
|
||||
|
||||
>[!IMPORTANT]
|
||||
> By default, devices **will not upload while on battery**. To enable uploads while on battery, you need to enable this policy and set the battery value under which uploads pause.
|
||||
159
windows/deployment/update/waas-delivery-optimization-setup.md
Normal file
159
windows/deployment/update/waas-delivery-optimization-setup.md
Normal file
@ -0,0 +1,159 @@
|
||||
---
|
||||
title: Set up Delivery Optimization
|
||||
description: Delivery Optimization is a new peer-to-peer distribution method in Windows 10
|
||||
keywords: oms, operations management suite, wdav, updates, downloads, log analytics
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: JaimeO
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Set up Delivery Optimization for Windows 10 updates
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
## Recommended Delivery Optimization settings
|
||||
|
||||
Delivery Optimization offers a great many settings to fine-tune its behavior (see [Delivery Optimization reference](waas-delivery-optimization-reference.md) for a comprehensive list), but for the most efficient performance, there are just a few key parameters that will have the greates impact if particular situations exist in your deployment:
|
||||
|
||||
- Does your topology include multiple breakouts to the internet (i.e., a "hybrid WAN") or are there only a few connections to the internet, so that all requests appear to come from a single external IP address (a "hub and spoke" topology)?
|
||||
- If you use boundary groups in your topology, how many devices are present in a given group?
|
||||
- What percentage of your devices are mobile?
|
||||
- Do your devices have a lot of free space on their drives?
|
||||
- Do you have a lab scenario with many devices on AC power?
|
||||
|
||||
>[!NOTE]
|
||||
>These scenarios (and the recommended settings for each) are not mutually exclusive. It's possible that your deployment might involve more than one of these scenarios, in which case you can employ the related settings in any combination as needed. In all cases, however, "download mode" is the most important one to set.
|
||||
|
||||
Quick-reference table:
|
||||
|
||||
| Use case | Policy | Recommended value | Reason |
|
||||
| --- | --- | --- | --- |
|
||||
| Hub & spoke topology | Download mode | 1 or 2 | Automatic grouping of peers to match your topology |
|
||||
| Sites with > 30 devices | Minimum file size to cache | 10 MB (or 1 MB) | Leverage peers-to-peer capability in more downloads |
|
||||
| Large number of mobile devices | Allow uploads on battery power | 60% | Increase # of devices that can upload while limiting battery drain |
|
||||
| Labs with AC-powered devices | Content Expiration | 7 (up to 30) days | Leverage devices that can upload more for a longer period |
|
||||
|
||||
|
||||
### Hybrid WAN scenario
|
||||
|
||||
For this scenario, grouping devices by domain allows devices to be included in peer downloads and uploads across VLANs. **Set Download Mode to 2 - Group**. The default group is the authenticated domain or Active Directory site. If your domain-based group is too wide, or your Active Directory sites aren’t aligned with your site network topology, then you should consider additional options for dynamically creating groups, for example by using the GroupIDSrc parameter.
|
||||
|
||||
|
||||
[//]: # is there a topic on GroupIDSrc we can link to?
|
||||
|
||||
To do this in Group Policy go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**.
|
||||
|
||||
To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set DODownloadMode to 1 or 2.
|
||||
|
||||
### Hub and spoke topology with boundary groups
|
||||
|
||||
The default download mode setting is **1**; this means all devices breaking out to the internet using the same public IP will be considered as a single peer group. To prevent peer-to-peer activity across groups, you should set the download mode to **2**. If you have already defined Active Directory sites per hub or branch office, then you don't need to do anything else. If you're not using Active Directory sites, you should set *RestrictPeerSelectionBy* policies to restrict the activity to the subnet or set a different source for Groups by using the GroupIDSrc parameter. See [Select a method to restrict peer selection](waas-delivery-optimization-reference.md#select-a-method-to-restrict-peer-selection).
|
||||
|
||||
|
||||
|
||||
To do this in Group Policy go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**.
|
||||
|
||||
To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DODownloadMode** to **2**.
|
||||
|
||||
|
||||
### Large number of mobile devices
|
||||
|
||||
If you have a mobile workforce with a great many mobile devices, set Delivery Optimization to allow uploads on battery power, while limiting the use to prevent battery drain. A setting for **DOMinBatteryPercentageAllowedToUpload** of 60% is a good starting point, though you might want to adjust it later.
|
||||
|
||||
To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Allow uploads while the device is on battery while under set Battery level** to 60.
|
||||
|
||||
To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DOMinBatteryPercentageAllowedToUpload** to 60.
|
||||
|
||||
### Plentiful free space and large numbers of devices
|
||||
|
||||
Many devices now come with large internal drives. You can set Delivery Optimization to take better advantage of this space (especially if you have large numbers of devices) by changing the minimum file size to cache. If you have more than 30 devices in your local network or group, change it from the default 50 MB to 10 MB. If you have more than 100 devices (and are running Windows 10, version 1803 or later), set this value to 1 MB.
|
||||
|
||||
[//]: # default of 50 aimed at consumer
|
||||
|
||||
To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Minimum Peer Caching Content File Size** to 100 (if you have more than 30 devices) or 1 (if you have more than 100 devices).
|
||||
|
||||
To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DOMinFileSizeToCache** to 100 (if you have more than 30 devices) or 1 (if you have more than 100 devices).
|
||||
|
||||
### Lab scenario
|
||||
|
||||
In a lab situation, you typically have a large number of devices that are plugged in and have a lot of free disk space. By increasing the content expiration interval, you can take advantage of these devices, using them as excellent upload sources in order to upload much more content over a longer period.
|
||||
|
||||
To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Max Cache Age** to **6048000** (7 days) or more (up to 30 days).
|
||||
|
||||
To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set DOMaxCacheAge to 7 or more (up to 30 days).
|
||||
|
||||
[//]: # material about "preferred" devices; remove MinQos/MaxCacheAge; table format?
|
||||
|
||||
|
||||
## Monitor Delivery Optimization
|
||||
[//]: # How to tell if it’s working? What values are reasonable; which are not? If not, which way to adjust and how? -- check PercentPeerCaching for files > minimum >= 50%
|
||||
|
||||
### Windows PowerShell cmdlets for analyzing usage
|
||||
**Starting in Windows 10, version 1703**, you can use two new PowerShell cmdlets to check the performance of Delivery Optimization:
|
||||
|
||||
`Get-DeliveryOptimizationStatus` returns a real-time snapshot of all current Delivery Optimization jobs.
|
||||
|
||||
| Key | Value |
|
||||
| --- | --- |
|
||||
| File ID | A GUID that identifies the file being processed |
|
||||
| Priority | Priority of the download; values are **foreground** or **background** |
|
||||
| FileSize | Size of the file |
|
||||
| TotalBytesDownloaded | The number of bytes from any source downloaded so far |
|
||||
| PercentPeerCaching |The percentage of bytes downloaded from peers versus over HTTP |
|
||||
| BytesFromPeers | Total bytes downloaded from peer devices (sum of bytes downloaded from LAN, Group, and Internet Peers) |
|
||||
| BytesfromHTTP | Total number of bytes received over HTTP |
|
||||
| DownloadDuration | Total download time in seconds |
|
||||
| Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but is not uploading yet); **Caching** (download completed successfully and is ready to upload or uploading); **Paused** (download/upload paused by caller) |
|
||||
|
||||
|
||||
|
||||
`Get-DeliveryOptimizationPerfSnap` returns a list of key performance data:
|
||||
|
||||
- Number of files downloaded
|
||||
- Number of files uploaded
|
||||
- Total bytes downloaded
|
||||
- Total bytes uploaded
|
||||
- Average transfer size (download); that is, the number bytes downloaded divided by the number of files
|
||||
- Average transfer size (upload); the number of bytes uploaded divided by the number of files
|
||||
- Peer efficiency; same as PercentPeerCaching
|
||||
|
||||
Using the `-Verbose` option returns additional information:
|
||||
|
||||
- Bytes from peers (per type)
|
||||
- Bytes from CDN (the number of bytes received over HTTP)
|
||||
- Average number of peer connections per download
|
||||
|
||||
|
||||
**Starting in Windows 10, version 1803:**
|
||||
|
||||
`Get-DeliveryOptimizationLog [-Path <etl file path, supports wildcards>] [-Flush]`
|
||||
|
||||
If `Path` is not specified, this cmdlet reads all logs from the dosvc log directory, which requires administrator permissions. If `Flush` is specified, the cmdlet stops dosvc before reading logs.
|
||||
|
||||
Log entries are written to the PowerShell pipeline as objects. To dump logs to a text file, run `Get-DeliveryOptimizationLog | Set-Content <output file>` or something similar.
|
||||
|
||||
[//]: # (section on what to look for in logs, list of peers, connection failures)
|
||||
|
||||
`Get-DeliveryOptimizationPerfSnapThisMonth`
|
||||
|
||||
Returns data similar to that from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month.
|
||||
|
||||
[//]: # (possibly move to Troubleshooting)
|
||||
|
||||
### Monitor with Update Compliance
|
||||
|
||||
The Update Compliance solution of Windows Analytics provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days.
|
||||
|
||||
|
||||
|
||||
For details, see [Delivery Optimization in Update Compliance](update-compliance-delivery-optimization.md).
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure Delivery Optimization for Windows 10 updates (Windows 10)
|
||||
description: Delivery Optimization is a new peer-to-peer distribution method in Windows 10
|
||||
description: Delivery Optimization is a peer-to-peer distribution method in Windows 10
|
||||
keywords: oms, operations management suite, wdav, updates, downloads, log analytics
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -8,12 +8,11 @@ ms.sitesec: library
|
||||
author: JaimeO
|
||||
ms.localizationpriority: medium
|
||||
ms.author: jaimeo
|
||||
ms.date: 04/30/2018
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Configure Delivery Optimization for Windows 10 updates
|
||||
# Delivery Optimization for Windows 10 updates
|
||||
|
||||
|
||||
**Applies to**
|
||||
@ -22,7 +21,7 @@ ms.topic: article
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
Windows updates, upgrades, and applications can contain packages with very large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those packages from alternate sources (such as other peers on the network) in addition to the traditional Internet-based Windows Update servers. You can use Delivery Optimization in conjunction with stand-alone Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or System Center Configuration Manager when installation of Express Updates is enabled.
|
||||
Windows updates, upgrades, and applications can contain packages with very large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those packages from alternate sources (such as other peers on the network) in addition to the traditional Internet-based servers. You can use Delivery Optimization in conjunction with Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or System Center Configuration Manager (when installation of Express Updates is enabled).
|
||||
|
||||
Delivery Optimization is a cloud-managed solution. Access to the Delivery Optimization cloud services is a requirement. This means that in order to use the peer-to-peer functionality of Delivery Optimization, devices must have access to the internet.
|
||||
|
||||
@ -30,6 +29,8 @@ Delivery Optimization is a cloud-managed solution. Access to the Delivery Optimi
|
||||
>[!NOTE]
|
||||
>WSUS can also use [BranchCache](waas-branchcache.md) for content sharing and caching. If Delivery Optimization is enabled on devices that use BranchCache, Delivery Optimization will be used instead.
|
||||
|
||||
## Requirements
|
||||
|
||||
The following table lists the minimum Windows 10 version that supports Delivery Optimization:
|
||||
|
||||
| Device type | Minimum Windows version |
|
||||
@ -39,325 +40,57 @@ The following table lists the minimum Windows 10 version that supports Delivery
|
||||
| IoT devices | 1803 |
|
||||
| HoloLens devices | 1803 |
|
||||
|
||||
**Types of download packages supported by Delivery Optimization**
|
||||
|
||||
By default in Windows 10 Enterprise and Education editions, Delivery Optimization allows peer-to-peer sharing on the organization's own network only, but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune.
|
||||
| Download package | Minimum Windows version |
|
||||
|------------------|---------------|
|
||||
| Windows 10 updates (feature updates and quality updates) | 1511 |
|
||||
| Windows 10 drivers | 1511 |
|
||||
| Windows Store files | 1511 |
|
||||
| Windows Store for Business files | 1511 |
|
||||
| Windows Defender definition updates | 1511 |
|
||||
| Office Click-to-Run updates | 1709 |
|
||||
| Win32 apps for Intune | 1709 |
|
||||
| SCCM Express Updates | 1709 + Configuration Manager version 1711 |
|
||||
|
||||
For more details, see [Download mode](#download-mode).
|
||||
[//]: # (**Network requirements**)
|
||||
|
||||
## Delivery Optimization options
|
||||
|
||||
|
||||
|
||||
By default in Windows 10 Enterprise and Education editions, Delivery Optimization allows peer-to-peer sharing on the organization's own network only (specifically, all of the devices must be behind the same NAT), but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune.
|
||||
|
||||
For more details, see "Download mode" in [Delivery optimization reference](waas-delivery-optimization-reference.md#download-mode).
|
||||
|
||||
|
||||
## Set up Delivery Optimization
|
||||
|
||||
See [Set up Delivery Optimization](waas-delivery-optimization-setup.md) for suggested values for a number of common scenarios.
|
||||
|
||||
You can use Group Policy or an MDM solution like Intune to configure Delivery Optimization.
|
||||
|
||||
You will find the Delivery Optimization settings in Group Policy under **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization**.
|
||||
In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimization/**.
|
||||
|
||||
Several Delivery Optimization features are configurable:
|
||||
[//]: # (Starting with Windows Intune version 1902, you can set many Delivery Optimization policies as a profile which you can then apply to groups of devices. For more information, see {LINK}.)
|
||||
|
||||
| Group Policy setting | MDM setting | Supported from version |
|
||||
| --- | --- | --- |
|
||||
| [Download mode](#download-mode) | DODownloadMode | 1511 |
|
||||
| [Group ID](#group-id) | DOGroupID | 1511 |
|
||||
| [Minimum RAM (inclusive) allowed to use Peer Caching](#minimum-ram-allowed-to-use-peer-caching) | DOMinRAMAllowedToPeer | 1703 |
|
||||
| [Minimum disk size allowed to use Peer Caching](#minimum-disk-size-allowed-to-use-peer-caching) | DOMinDiskSizeAllowedToPeer | 1703 |
|
||||
| [Max Cache Age](#max-cache-age) | DOMaxCacheAge | 1511 |
|
||||
| [Max Cache Size](#max-cache-size) | DOMaxCacheSize | 1511 |
|
||||
| [Absolute Max Cache Size](#absolute-max-cache-size) | DOAbsoluteMaxCacheSize | 1607 |
|
||||
| [Modify Cache Drive](#modify-cache-drive) | DOModifyCacheDrive | 1607 |
|
||||
| [Minimum Peer Caching Content File Size](#minimum-peer-caching-content-file-size) | DOMinFileSizeToCache | 1703 |
|
||||
| [Maximum Download Bandwidth](#maximum-download-bandwidth) | DOMaxDownloadBandwidth | 1607 |
|
||||
| [Percentage of Maximum Download Bandwidth](#percentage-of-maximum-download-bandwidth) | DOPercentageMaxDownloadBandwidth | 1607 |
|
||||
| [Max Upload Bandwidth](#max-upload-bandwidth) | DOMaxUploadBandwidth | 1607 |
|
||||
| [Monthly Upload Data Cap](#monthly-upload-data-cap) | DOMonthlyUploadDataCap | 1607 |
|
||||
| [Minimum Background QoS](#minimum-background-qos) | DOMinBackgroundQoS | 1607 |
|
||||
| [Enable Peer Caching while the device connects via VPN](#enable-peer-caching-while-the-device-connects-via-vpn) | DOAllowVPNPeerCaching | 1709 |
|
||||
| [Allow uploads while the device is on battery while under set Battery level](#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) | DOMinBatteryPercentageAllowedToUpload | 1709 |
|
||||
| [MaxForegroundDownloadBandwidth](#maximum-foreground-download-bandwidth) | DOPercentageMaxForegroundBandwidth | 1803 |
|
||||
| [MaxBackgroundDownloadBandwidth](#maximum-background-download-bandwidth) | DOPercentageMaxBackgroundBandwidth | 1803 |
|
||||
| [SetHoursToLimitBackgroundDownloadBandwidth](#set-business-hours-to-limit-background-download-bandwidth) | DOSetHoursToLimitBackgroundDownloadBandwidth | 1803 |
|
||||
| [SetHoursToLimitForegroundDownloadBandwidth](#set-business-hours-to-limit-foreground-download-bandwidth) |DOSetHoursToLimitForegroundDownloadBandwidth | 1803 |
|
||||
| [Select a method to restrict Peer Selection](#select-a-method-to-restrict-peer-selection) |DORestrictPeerSelectionBy | 1803 |
|
||||
| [Select the source of Group IDs](#select-the-source-of-group-ids) | DOGroupIdSource | 1803 |
|
||||
| [Delay background download from http (in secs)](#delay-background-download-from-http-in-secs) | DODelayBackgroundDownloadFromHttp | 1803 |
|
||||
| [Delay foreground download from http (in secs)](#delay-foreground-download-from-http-in-secs) | DODelayForegroundDownloadFromHttp | 1803 |
|
||||
## Reference
|
||||
|
||||
For complete list of every possible Delivery Optimization setting, see [Delivery Optimization reference](waas-delivery-optimization-reference.md).
|
||||
|
||||
|
||||
|
||||
|
||||
When configuring Delivery Optimization on Windows 10 devices, the first and most important thing to configure is the [Download mode](#download-mode), which dictates how Delivery Optimization downloads Windows updates.
|
||||
|
||||
While every other feature setting is optional, they offer enhanced control of the Delivery Optimization behavior.
|
||||
|
||||
[Group ID](#group-id), combined with Group [Download mode](#download-mode), enables administrators to create custom device groups that will share content between devices in the group.
|
||||
|
||||
Delivery Optimization uses locally cached updates. In cases where devices have ample local storage and you would like to cache more content, or if you have limited storage and would like to cache less, use the following settings to adjust the Delivery Optimization cache to suit your scenario:
|
||||
- [Max Cache Size](#max-cache-size) and [Absolute Max Cache Size](#absolute-max-cache-size) control the amount of space the Delivery Optimization cache can use.
|
||||
- [Max Cache Age](#max-cache-age) controls the retention period for each update in the cache.
|
||||
- The system drive is the default location for the Delivery Optimization cache. [Modify Cache Drive](#modify-cache-drive) allows administrators to change that location.
|
||||
|
||||
>[!NOTE]
|
||||
>It is possible to configure preferred cache devices. For more information, see [Set “preferred” cache devices for Delivery Optimization](#set-preferred-cache-devices).
|
||||
|
||||
All cached files have to be above a set minimum size. This size is automatically set by the Delivery Optimization cloud services, but when local storage is sufficient and the network isn't strained or congested, administrators might choose to change it to obtain increased performance. You can set the minimum size of files to cache by adjusting [Minimum Peer Caching Content File Size](#minimum-peer-caching-content-file-size).
|
||||
|
||||
Additional options available that control the impact Delivery Optimization has on your network include the following:
|
||||
- [Maximum Download Bandwidth](#maximum-download-bandwidth) and [Percentage of Maximum Download Bandwidth](#percentage-of-maximum-download-bandwidth) control the download bandwidth used by Delivery Optimization.
|
||||
- [Max Upload Bandwidth](#max-upload-bandwidth) controls the Delivery Optimization upload bandwidth usage.
|
||||
- [Monthly Upload Data Cap](#monthly-upload-data-cap) controls the amount of data a client can upload to peers each month.
|
||||
- [Minimum Background QoS](#minimum-background-qos) lets administrators guarantee a minimum download speed for Windows updates. This is achieved by adjusting the amount of data downloaded directly from Windows Update or WSUS servers, rather than other peers in the network.
|
||||
- [Maximum Foreground Download Bandwidth](#maximum-foreground-download-bandwidth) specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth.
|
||||
- [Maximum Background Download Bandwidth](#maximum-background-download-bandwidth) specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth.
|
||||
- [Set Business Hours to Limit Background Download Bandwidth](#set-business-hours-to-limit-background-download-bandwidth) specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.
|
||||
- [Set Business Hours to Limit Foreground Download Bandwidth](#set-business-hours-to-limit-foreground-download-bandwidth) specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.
|
||||
- [Select a method to restrict Peer Selection](#select-a-method-to-restrict-peer-selection) restricts peer selection by the options you select.
|
||||
- [Select the source of Group IDs](#select-the-source-of-group-ids) restricts peer selection to a specific source.
|
||||
- [Delay background download from http (in secs)](#delay-background-download-from-http-in-secs) allows you to delay the use of an HTTP source in a background download that is allowed to use P2P.
|
||||
- [Delay foreground download from http (in secs)](#delay-foreground-download-from-http-in-secs) allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use P2P.
|
||||
|
||||
|
||||
Administrators can further customize scenarios where Delivery Optimization will be used with the following settings:
|
||||
- [Minimum RAM (inclusive) allowed to use Peer Caching](#minimum-ram-allowed-to-use-peer-caching) sets the minimum RAM required for peer caching to be enabled.
|
||||
- [Minimum disk size allowed to use Peer Caching](#minimum-disk-size-allowed-to-use-peer-caching) sets the minimum disk size required for peer caching to be enabled.
|
||||
- [Enable Peer Caching while the device connects via VPN](#enable-peer-caching-while-the-device-connects-via-vpn) allows clients connected through VPN to use peer caching.
|
||||
- [Allow uploads while the device is on battery while under set Battery level](#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) controls the minimum battery level required for uploads to occur. You must enable this policy to allow upload while on battery.
|
||||
|
||||
### How Microsoft uses Delivery Optimization
|
||||
## How Microsoft uses Delivery Optimization
|
||||
At Microsoft, to help ensure that ongoing deployments weren’t affecting our network and taking away bandwidth for other services, Microsoft IT used a couple of different bandwidth management strategies. Delivery Optimization, peer-to-peer caching enabled through Group Policy, was piloted and then deployed to all managed devices using Group Policy. Based on recommendations from the Delivery Optimization team, we used the "group" configuration to limit sharing of content to only the devices that are members of the same Active Directory domain. The content is cached for 24 hours. More than 76 percent of content came from peer devices versus the Internet.
|
||||
|
||||
For more details, check out the [Adopting Windows as a Service at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft) technical case study.
|
||||
|
||||
The following is a detailed description of every configurable feature setting. Use these details when configuring any of the settings.
|
||||
|
||||
### Download mode
|
||||
|
||||
Download mode dictates which download sources clients are allowed to use when downloading Windows updates in addition to Windows Update servers. The following table shows the available download mode options and what they do. Additional technical details for these policies are available in [Policy CSP - Delivery Optimization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization).
|
||||
|
||||
| Download mode option | Functionality when set |
|
||||
| --- | --- |
|
||||
| HTTP Only (0) | This setting disables peer-to-peer caching but still allows Delivery Optimization to download content from Windows Update servers or WSUS servers. This mode uses additional metadata provided by the Delivery Optimization cloud services for a peerless reliable and efficient download experience. |
|
||||
| LAN (1 – Default) | This default operating mode for Delivery Optimization enables peer sharing on the same network. The Delivery Optimization cloud service finds other clients that connect to the Internet using the same public IP as the target client. These clients then attempts to connect to other peers on the same network by using their private subnet IP.|
|
||||
| Group (2) | When group mode is set, the group is automatically selected based on the device’s Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use the GroupID option to create your own custom group independently of domains and AD DS sites. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. |
|
||||
| Internet (3) | Enable Internet peer sources for Delivery Optimization. |
|
||||
| Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable, unreachable or when the content file size is less than 10 MB. In this mode, Delivery Optimization provides a reliable download experience, with no peer-to-peer caching. |
|
||||
|Bypass (100) | Bypass Delivery Optimization and use BITS, instead. For example, select this mode so that clients can use BranchCache. |
|
||||
|
||||
>[!NOTE]
|
||||
>Group mode is a best-effort optimization and should not be relied on for an authentication of identity of devices participating in the group.
|
||||
|
||||
### Group ID
|
||||
|
||||
By default, peer sharing on clients using the group download mode is limited to the same domain in Windows 10, version 1511, and the same domain and AD DS site in Windows 10, version 1607. By using the Group ID setting, you can optionally create a custom group that contains devices that should participate in Delivery Optimization but do not fall within those domain or AD DS site boundaries, including devices in another domain. Using Group ID, you can further restrict the default group (for example, you could create a sub-group representing an office building), or extend the group beyond the domain, allowing devices in multiple domains in your organization to be peers. This setting requires the custom group to be specified as a GUID on each device that participates in the custom group.
|
||||
|
||||
>[!NOTE]
|
||||
>To generate a GUID using Powershell, use [```[guid]::NewGuid()```](https://blogs.technet.microsoft.com/heyscriptingguy/2013/07/25/powertip-create-a-new-guid-by-using-powershell/)
|
||||
>
|
||||
>This configuration is optional and not required for most implementations of Delivery Optimization.
|
||||
|
||||
<span id="minimum-ram-allowed-to-use-peer-caching"/>
|
||||
### Minimum RAM (inclusive) allowed to use Peer Caching
|
||||
|
||||
This setting specifies the minimum RAM size in GB required to use Peer Caching. For example if the minimum set is 1 GB, then devices with 1 GB or higher available RAM will be allowed to use Peer caching. The recommended values are 1 to 4 GB, and the default value is 4 GB.
|
||||
|
||||
### Minimum disk size allowed to use Peer Caching
|
||||
|
||||
This setting specifies the required minimum disk size (capacity in GB) for the device to use Peer Caching. The recommended values are 64 to 256 GB, and the default value is 32 GB.
|
||||
|
||||
>[!NOTE]
|
||||
>If the [Modify Cache Drive](#modify-cache-drive) policy is set, the disk size check will apply to the new working directory specified by this policy.
|
||||
|
||||
|
||||
### Max Cache Age
|
||||
|
||||
In environments configured for Delivery Optimization, you might want to set an expiration on cached updates and Windows application installation files. If so, this setting defines the maximum number of seconds each file can be held in the Delivery Optimization cache on each Windows 10 client device. The default Max Cache Age value is 259,200 seconds (3 days). Alternatively, organizations might choose to set this value to “0” which means “unlimited” to avoid peers re-downloading content. When “Unlimited” value is set, Delivery Optimization will hold the files in the cache longer and will clean up the cache as needed (for example when the cache size exceeded the maximum space allowed).
|
||||
|
||||
### Max Cache Size
|
||||
|
||||
This setting limits the maximum amount of space the Delivery Optimization cache can use as a percentage of the available drive space, from 1 to 100. For example, if you set this value to 10 on a Windows 10 client device that has 100 GB of available drive space, then Delivery Optimization will use up to 10 GB of that space. Delivery Optimization will constantly assess the available drive space and automatically clear the cache to keep the maximum cache size under the set percentage. The default value for this setting is 20.
|
||||
|
||||
### Absolute Max Cache Size
|
||||
|
||||
This setting specifies the maximum number of gigabytes the Delivery Optimization cache can use. This is different from the [**Max Cache Size**](#max-cache-size) setting, which is a percentage of available disk space. Also, if you configure this policy, it will override the [**Max Cache Size**](#max-cache-size) setting. The default value for this setting is 10 GB.
|
||||
|
||||
### Minimum Peer Caching Content File Size
|
||||
|
||||
This setting specifies the minimum content file size in MB enabled to use Peer Caching. The recommended values are from 1 to 100000 MB.
|
||||
|
||||
### Maximum Download Bandwidth
|
||||
|
||||
This setting specifies the maximum download bandwidth that can be used across all concurrent Delivery Optimization downloads in kilobytes per second (KB/s). A default value of 0 means that Delivery Optimization will dynamically adjust and optimize the maximum bandwidth used.
|
||||
|
||||
### Maximum Foreground Download Bandwidth
|
||||
|
||||
Starting in Windows 10, version 1803, specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. The default value of 0 means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads. However, downloads from LAN peers are not throttled even when this policy is set.
|
||||
|
||||
### Maximum Background Download Bandwidth
|
||||
|
||||
Starting in Windows 10, version 1803, specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. The default value of 0 means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads. However, downloads from LAN peers are not throttled even when this policy is set.
|
||||
|
||||
### Percentage of Maximum Download Bandwidth
|
||||
|
||||
This setting specifies the maximum download bandwidth that Delivery Optimization can use across all concurrent download activities as a percentage of available download bandwidth. The default value 0 means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads.
|
||||
|
||||
### Max Upload Bandwidth
|
||||
|
||||
This setting allows you to limit the amount of upload bandwidth individual clients can use for Delivery Optimization. Consider this setting when clients are providing content to requesting peers on the network. This option is set in kilobytes per second (KB/s). The default setting is 0, or “unlimited” which means Delivery Optimization dynamically optimizes for minimal usage of upload bandwidth; however it does not cap the upload bandwidth rate at a set rate.
|
||||
|
||||
### Set Business Hours to Limit Background Download Bandwidth
|
||||
Starting in Windows 10, version 1803, specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.
|
||||
|
||||
### Set Business Hours to Limit Foreground Download Bandwidth
|
||||
Starting in Windows 10, version 1803, specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.
|
||||
|
||||
### Select a method to restrict peer selection
|
||||
Starting in Windows 10, version 1803, set this policy to restrict peer selection via selected option.
|
||||
Currently the only available option is **1 = Subnet mask** This option (Subnet mask) applies to both Download Modes LAN (1) and Group (2).
|
||||
|
||||
### Select the source of Group IDs
|
||||
Starting in Windows 10, version 1803, set this policy to restrict peer selection to a specific source. The options are:
|
||||
- 0 = not set
|
||||
- 1 = AD Site
|
||||
- 2 = Authenticated domain SID
|
||||
- 3 = DHCP Option ID (with this option, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID)
|
||||
- 4 = DNS Suffix
|
||||
|
||||
When set, the Group ID is assigned automatically from the selected source. If you set this policy, the GroupID policy will be ignored. The option set in this policy only applies to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. If you set the value to anything other than 0-4, the policy is ignored.
|
||||
|
||||
|
||||
### Delay background download from http (in secs)
|
||||
Starting in Windows 10, version 1803, allows you to delay the use of an HTTP source in a background download that is allowed to use P2P.
|
||||
|
||||
### Delay foreground download from http (in secs)
|
||||
Starting in Windows 10, version 1803, allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use P2P.
|
||||
|
||||
### Minimum Background QoS
|
||||
|
||||
This value specifies the minimum download speed guarantee that a client attempts to achieve and will fulfill by downloading more kilobytes from Windows Update servers or WSUS. Simply put, the lower this value is, the more content will be sourced using peers on the network rather than Windows Update. The higher this value, the more content is received from Windows Update servers or WSUS, versus peers on the local network.
|
||||
|
||||
### Modify Cache Drive
|
||||
|
||||
This setting allows for an alternate Delivery Optimization cache location on the clients. By default, the cache is stored on the operating system drive through the %SYSTEMDRIVE% environment variable. You can set the value to an environment variable (e.g., %SYSTEMDRIVE%), a drive letter (e.g., D:), or a folder path (e.g., D:\DOCache).
|
||||
|
||||
### Monthly Upload Data Cap
|
||||
|
||||
This setting specifies the total amount of data in gigabytes that a Delivery Optimization client can upload to Internet peers per month. A value of 0 means that an unlimited amount of data can be uploaded. The default value for this setting is 20 GB.
|
||||
|
||||
### Enable Peer Caching while the device connects via VPN
|
||||
|
||||
This setting determines whether a device will be allowed to participate in Peer Caching while connected to VPN. Specify "true" to allow the device to participate in Peer Caching while connected via VPN to the domain network. This means the device can download from or upload to other domain network devices, either on VPN or on the corporate domain network.
|
||||
|
||||
### Allow uploads while the device is on battery while under set Battery level
|
||||
|
||||
This setting specifies battery levels at which a device will be allowed to upload data. Specify any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and Group peers while on DC power (Battery). Uploads will automatically pause when the battery level drops below the set minimum battery level. The recommended value to set if you allow uploads on battery is 40 (for 40%).
|
||||
The device can download from peers while on battery regardless of this policy.
|
||||
|
||||
>[!IMPORTANT]
|
||||
> By default, devices **will not upload while on battery**. To enable uploads while on battery, you need to enable this policy and set the battery value under which uploads pause.
|
||||
|
||||
<span id="set-preferred-cache-devices"/>
|
||||
|
||||
## Set “preferred” cache devices for Delivery Optimization
|
||||
|
||||
In some cases, IT pros may have an interest in identifying specific devices that will be “preferred” as sources to other devices—for example, devices that have hard-wired connections, large drives that you can use as caches, or a high-end hardware profile. These preferred devices will act as a “master” for the update content related to that devices’s configuration (Delivery Optimization only caches content relative to the client downloading the content).
|
||||
|
||||
To specify which devices are preferred, you can set the **Max Cache Age** configuration with a value of **Unlimited** (0). As a result, these devices will be used more often as sources for other devices downloading the same files.
|
||||
|
||||
On devices that are not preferred, you can choose to set the following policy to prioritize data coming from local peers instead of the Internet. Set **DOMinBackgroundQoS** with a low value, for example, `64` (which is the equivalent of 64 KB/s).
|
||||
|
||||
## Troubleshooting steps if you don't see any bytes from peers
|
||||
|
||||
If you don’t see any bytes coming from peers the cause might be one of the following issues:
|
||||
|
||||
- Clients aren’t able to reach the Delivery Optimization cloud services.
|
||||
- The cloud service doesn’t see other peers on the network.
|
||||
- Clients aren’t able to connect to peers that are offered back from the cloud service.
|
||||
|
||||
### Clients aren't able to reach the Delivery Optimization cloud services.
|
||||
|
||||
To fix this issue, try the following steps:
|
||||
|
||||
1. Start a download of an app that is larger than 50 MB from the Store (for example Candy Crush Saga).
|
||||
2. Run `Get-DeliveryOptimizationStatus` from an elevated window and share the output (by setting the `DownloadMode` field to **1**).
|
||||
|
||||
### The cloud service doesn't see other peers on the network.
|
||||
|
||||
If you suspect this is the problem, try these steps:
|
||||
|
||||
1. Download the same app on another device on the same network.
|
||||
2. Run `Get-DeliveryOptimizationPerfSnap` from an elevated window (the `NumberOfPeers` field should be non-zero).
|
||||
|
||||
|
||||
### Clients aren't able to connect to peers offered by the cloud service
|
||||
|
||||
If you suspect this is the problem, run a Telnet test between two devices on the network to ensure they can connect using port 7680. To do this, follow these steps:
|
||||
|
||||
1. Install Telnet by running **dism /online /Enable-Feature /FeatureName:TelnetClient** from an elevated command prompt.
|
||||
2. Run the test. For example, if you are on device with IP 192.168.8.12 and you are trying to test the connection to 192.168.9.17 run **telnet 192.168.9.17 7680** (the syntax is *telnet [destination IP] [port]*. You will either see a connection error or a blinking cursor like this /_. The blinking cursor means success.
|
||||
|
||||
|
||||
## Windows PowerShell cmdlets for analyzing usage
|
||||
Starting in Windows 10, version 1703, you can use two new PowerShell cmdlets to check the performance of Delivery Optimization:
|
||||
|
||||
`Get-DeliveryOptimizationStatus` returns a real-time snapshot of all current Delivery Optimization jobs.
|
||||
|
||||
| Key | Value |
|
||||
| --- | --- |
|
||||
| File ID | A GUID that identifies the file being processed |
|
||||
| Priority | Priority of the download; values are **foreground** or **background** |
|
||||
| FileSize | Size of the file |
|
||||
| TotalBytesDownloaded | The number of bytes from any source downloaded so far |
|
||||
| PercentPeerCaching |The percentage of bytes downloaded from peers versus over HTTP |
|
||||
| BytesFromPeers | Total bytes downloaded from peer devices (sum of bytes downloaded from LAN, Group, and Internet Peers) |
|
||||
| BytesfromHTTP | Total number of bytes received over HTTP |
|
||||
| DownloadDuration | Total download time in seconds |
|
||||
| Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but is not uploading yet); **Caching** (download completed successfully and is ready to upload or uploading); **Paused** (download/upload paused by caller) |
|
||||
|
||||
Using the `-Verbose` option returns additional information:
|
||||
|
||||
| Key | Value |
|
||||
| --- | --- |
|
||||
| HTTPUrl| The URL where the download originates |
|
||||
| BytesFromLANPeers | Total bytes from peer devices on the same LAN |
|
||||
| BytesFromGroupPeers | Total bytes from peer devices in the same Group |
|
||||
| BytesFrom IntPeers | Total bytes from internet peers |
|
||||
| HTTPConnectionCount | Number of active connections over HTTP |
|
||||
| LANConnectionCount | Number of active connections over LAN |
|
||||
| GroupConnectionCount | Number of active connections to other devices in the Group |
|
||||
| IntConnectionCount | Number of active connections to internet peers |
|
||||
| DownloadMode | Indicates the download mode (see the "Download Mode" section for details) |
|
||||
|
||||
`Get-DeliveryOptimizationPerfSnap` returns a list of key performance data:
|
||||
|
||||
- Number of files downloaded
|
||||
- Number of files uploaded
|
||||
- Total bytes downloaded
|
||||
- Total bytes uploaded
|
||||
- Average transfer size (download); that is, the number bytes downloaded divided by the number of files
|
||||
- Average transfer size (upload); the number of bytes uploaded divided by the number of files
|
||||
- Peer efficiency; same as PercentPeerCaching
|
||||
|
||||
Using the `-Verbose` option returns additional information:
|
||||
|
||||
- Bytes from peers (per type)
|
||||
- Bytes from CDN (the number of bytes received over HTTP)
|
||||
- Average number of peer connections per download
|
||||
|
||||
|
||||
Starting in Windows 10, version 1803:
|
||||
|
||||
`Get-DeliveryOptimizationLog [-Path <etl file path, supports wildcards>] [-Flush]`
|
||||
|
||||
If `Path` is not specified, this cmdlet reads all logs from the dosvc log directory, which requires administrator permissions. If `Flush` is specified, the cmdlet stops dosvc before reading logs.
|
||||
|
||||
Log entries are written to the PowerShell pipeline as objects. To dump logs to a text file, run `Get-DeliveryOptimizationLog | Set-Content <output file>` or something similar.
|
||||
|
||||
`Get-DeliveryOptimizationPerfSnapThisMonth`
|
||||
|
||||
Returns data similar to that from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month.
|
||||
|
||||
## Frequently asked questions
|
||||
|
||||
**Does Delivery Optimization work with WSUS?**: Yes. Devices will obtain the update payloads from the WSUS server, but must also have an internet connection as they communicate with the Delivery Optimization cloud service for coordination.
|
||||
|
||||
**Which ports does Delivery Optimization use?**: For peer-to-peer traffic, it uses 7680 or 3544 (Teredo). For client-service communication, it uses port 80/443.
|
||||
**Which ports does Delivery Optimization use?**: For peer-to-peer traffic, it uses 7680 for TCP/IP or 3544 for NAT traversal (optionally Teredo). For client-service communication, it uses HTTP or HTTPS over port 80/443.
|
||||
|
||||
**What are the requirements if I use a proxy?**: You must allow Byte Range requests. See [Proxy requirements for Windows Update](https://support.microsoft.com/help/3175743/proxy-requirements-for-windows-update) for details.
|
||||
|
||||
@ -375,7 +108,10 @@ For the payloads (optional):
|
||||
- *.download.windowsupdate.com
|
||||
- *.windowsupdate.com
|
||||
|
||||
**Does Delivery Optimization use multicast?**: No. It relies on the cloud service for peer discovery, resulting in a list of peers and their IP addresses. Client devices then connect to their peers to obtain download files over TCP/IP.
|
||||
|
||||
[//]: # (**What data does Delivery Optimization send to the service?**)
|
||||
[//]: # (??????????????? I'm not sure we can avoid sharing this, per GDPR guidelines)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -8,7 +8,8 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: justinha
|
||||
ms.author: justinha
|
||||
ms.date: 11/07/2017
|
||||
ms.date: 03/28/2019
|
||||
|
||||
---
|
||||
|
||||
# Frequently asked questions - Windows Defender Application Guard
|
||||
@ -22,7 +23,7 @@ Answering frequently asked questions about Windows Defender Application Guard (A
|
||||
| | |
|
||||
|---|----------------------------|
|
||||
|**Q:** |Can I enable Application Guard on machines equipped with 4GB RAM?|
|
||||
|**A:** |We recommend 8GB RAM for optimal performance but you may use the following registry values to enable Application Guard on machines that aren't meeting the recommended hardware configuration. |
|
||||
|**A:** |We recommend 8GB RAM for optimal performance but you may use the following registry DWORD values to enable Application Guard on machines that aren't meeting the recommended hardware configuration. |
|
||||
||HKLM\software\Microsoft\Hvsi\SpecRequiredProcessorCount - Default is 4 cores. |
|
||||
||HKLM\software\Microsoft\Hvsi\SpecRequiredMemoryInGB - Default is 8GB.|
|
||||
||HKLM\software\Microsoft\Hvsi\SpecRequiredFreeDiskSpaceInGB - Default is 5GB.|
|
||||
|
||||
@ -8,7 +8,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: justinha
|
||||
ms.author: justinha
|
||||
ms.date: 11/27/2018
|
||||
ms.date: 03/28/2019
|
||||
---
|
||||
|
||||
# Windows Defender Application Guard overview
|
||||
@ -40,7 +40,7 @@ Application Guard has been created to target several types of systems:
|
||||
| | |
|
||||
|---|----------------------------|
|
||||
|**Q:** |Can I enable Application Guard on machines equipped with 4GB RAM?|
|
||||
|**A:** |We recommend 8GB RAM for optimal performance but you may use the following registry values to enable Application Guard on machines that aren't meeting the recommended hardware configuration. |
|
||||
|**A:** |We recommend 8GB RAM for optimal performance but you may use the following registry DWORD values to enable Application Guard on machines that aren't meeting the recommended hardware configuration. |
|
||||
||HKLM\software\Microsoft\Hvsi\SpecRequiredProcessorCount - Default is 4 cores. |
|
||||
||HKLM\software\Microsoft\Hvsi\SpecRequiredMemoryInGB - Default is 8GB.|
|
||||
||HKLM\software\Microsoft\Hvsi\SpecRequiredFreeDiskSpaceInGB - Default is 5GB.|
|
||||
|
||||
@ -52,8 +52,13 @@ You can create rules that determine the machines and alert severities to send em
|
||||
- **Rule name** - Specify a name for the notification rule.
|
||||
- **Include organization name** - Specify the customer name that appears on the email notification.
|
||||
- **Include tenant-specific portal link** - Adds a link with the tenant ID to allow access to a specific tenant.
|
||||
- **Include machine information** - Includes the machine name in the email alert body.
|
||||
|
||||
>[!NOTE]
|
||||
> This information might be processed by recipient mail servers that ar not in the geographic location you have selected for your Windows Defender ATP data.
|
||||
|
||||
- **Machines** - Choose whether to notify recipients for alerts on all machines (Global administrator role only) or on selected machine groups. For more information, see [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md).
|
||||
- **Alert severity** - Choose the alert severity level
|
||||
- **Alert severity** - Choose the alert severity level.
|
||||
|
||||
4. Click **Next**.
|
||||
|
||||
|
||||
@ -1,65 +0,0 @@
|
||||
---
|
||||
title: Submit cab files related to problems
|
||||
description: Use the command-line tool to obtain .cab file that can be used to investigate ASR rule issues.
|
||||
keywords: troubleshoot, error, fix, asr, windows defender eg, exploit guard, attack surface reduction
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 08/08/2018
|
||||
---
|
||||
|
||||
# Collect diagnostic data for file submissions
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
This topic describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using attack surface reduction rules, network protection, exploit protection, and controlled folder access.
|
||||
|
||||
In particular, you will be asked to collect and attach this data when using the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) if you indicate that you have encountered a problem with [attack surface reduction rules](attack-surface-reduction-exploit-guard.md) or [network protection](network-protection-exploit-guard.md).
|
||||
|
||||
Before attempting this process, ensure you have met all required pre-requisites and taken any other suggested troubleshooting steps as described in these topics:
|
||||
- [Troubleshoot attack surface reduction rules](troubleshoot-asr.md)
|
||||
- [Troubleshoot network protection](troubleshoot-np.md)
|
||||
|
||||
|
||||
|
||||
1. On the endpoint with the issue, obtain the Windows Defender .cab diagnostic file by following this process:
|
||||
|
||||
1. Open an administrator-level version of the command prompt:
|
||||
|
||||
1. Open the **Start** menu.
|
||||
|
||||
2. Type **cmd**. Right-click on **Command Prompt** and click **Run as administrator**.
|
||||
|
||||
3. Enter administrator credentials or approve the prompt.
|
||||
|
||||
2. Navigate to the Windows Defender directory. By default, this is C:\Program Files\Windows Defender, as in the following example:
|
||||
|
||||
```console
|
||||
cd c:\program files\windows defender
|
||||
```
|
||||
|
||||
3. Enter the following command and press **Enter**
|
||||
|
||||
```console
|
||||
mpcmdrun -getfiles
|
||||
```
|
||||
|
||||
4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt, but by default it will be in C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab.
|
||||
|
||||
2. Attach this .cab file to the submission form where indicated.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Troubleshoot attack surface reduction rules](troubleshoot-asr.md)
|
||||
- [Troubleshoot network protection](troubleshoot-np.md)
|
||||
|
||||
|
||||
@ -11,6 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 03/29/2019
|
||||
---
|
||||
|
||||
# Enable controlled folder access
|
||||
@ -21,11 +22,15 @@ ms.author: v-anbic
|
||||
|
||||
[Controlled folder access](controlled-folders-exploit-guard.md) helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). Controlled folder access is supported on Windows Server 2019 as well as Windows 10 clients.
|
||||
|
||||
This topic describes how to enable Controlled folder access with the Windows Security app, Group Policy, PowerShell, and mobile device management (MDM) configuration service providers (CSPs).
|
||||
You can enable controlled folder access by using any of the these methods:
|
||||
|
||||
## Enable and audit controlled folder access
|
||||
- Windows Security app
|
||||
- Intune
|
||||
- MDM
|
||||
- Group Policy
|
||||
- PowerShell cmdlets
|
||||
|
||||
You can enable controlled folder access with the Security Center app, Group Policy, PowerShell, or MDM CSPs. You can also set the feature to audit mode. Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine.
|
||||
Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine.
|
||||
|
||||
>[!NOTE]
|
||||
>The Controlled folder access feature will display the state in the Windows Security app under **Virus & threat protection settings**.
|
||||
@ -38,7 +43,7 @@ You can enable controlled folder access with the Security Center app, Group Poli
|
||||
>- System Center Endpoint Protection **Allow users to add exclusions and overrides**
|
||||
>For more information about disabling local list merging, see [Prevent or allow users to locally modify Windows Defender AV policy settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged).
|
||||
|
||||
## Windows Security app to enable controlled folder access
|
||||
## Windows Security app
|
||||
|
||||
1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
@ -46,8 +51,23 @@ You can enable controlled folder access with the Security Center app, Group Poli
|
||||
|
||||
3. Set the switch for **Controlled folder access** to **On**.
|
||||
|
||||
## Intune
|
||||
|
||||
### Use Group Policy to enable Controlled folder access
|
||||
1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
|
||||
1. Click **Device configuration** > **Profiles** > **Create profile**.
|
||||
1. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.
|
||||
|
||||
1. Click **Configure** > **Windows Defender Exploit Guard** > **Network filtering** > **Enable**.
|
||||
1. Type the path to each application that has access to protected folders and the path to any additional folder that needs protection and click **Add**.
|
||||
|
||||
1. Click **OK** to save each open blade and click **Create**.
|
||||
1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
|
||||
|
||||
## MDM
|
||||
|
||||
Use the [./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-controlledfolderaccessprotectedfolders) configuration service provider (CSP) to allow apps to make changes to protected folders.
|
||||
|
||||
## Group Policy
|
||||
|
||||
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
|
||||
@ -65,7 +85,7 @@ You can enable controlled folder access with the Security Center app, Group Poli
|
||||
>[!IMPORTANT]
|
||||
>To fully enable controlled folder access, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu.
|
||||
|
||||
### Use PowerShell to enable controlled folder access
|
||||
## PowerShell
|
||||
|
||||
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**.
|
||||
|
||||
@ -79,10 +99,6 @@ You can enable the feature in audit mode by specifying `AuditMode` instead of `E
|
||||
|
||||
Use `Disabled` to turn the feature off.
|
||||
|
||||
### Use MDM CSPs to enable controlled folder access
|
||||
|
||||
Use the [./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-controlledfolderaccessprotectedfolders) configuration service provider (CSP) to allow apps to make changes to protected folders.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md)
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 03/26/2019
|
||||
ms.date: 03/29/2019
|
||||
---
|
||||
|
||||
# Enable exploit protection
|
||||
@ -26,17 +26,22 @@ Many features from the Enhanced Mitigation Experience Toolkit (EMET) are include
|
||||
|
||||
You can also set mitigations to [audit mode](evaluate-exploit-protection.md). Audit mode allows you to test how the mitigations would work (and review events) without impacting the normal use of the machine.
|
||||
|
||||
## Enable exploit protection
|
||||
You can enable each mitigation separately by using any of the these methods:
|
||||
|
||||
- Windows Security app
|
||||
- Intune
|
||||
- MDM
|
||||
- Group Policy
|
||||
- PowerShell cmdlets
|
||||
|
||||
You enable and configure each exploit protection mitigation separately either by using the Windows Security app or PowerShell.
|
||||
They are configured by default in Windows 10.
|
||||
|
||||
You can set each mitigation to on, off, or to its default value.
|
||||
Some mitigations have additional options.
|
||||
|
||||
You can [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) and deploy it to other machines by using Group Policy.
|
||||
You can [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) and deploy them to other machines.
|
||||
|
||||
### Windows Security app
|
||||
## Windows Security app
|
||||
|
||||
1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
@ -103,9 +108,33 @@ CFG will be enabled for *miles.exe*.
|
||||
|
||||
5. Repeat this for all the apps and mitigations you want to configure. Click **Apply** when you're done setting up your configuration.
|
||||
|
||||
## Intune
|
||||
|
||||
1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
|
||||
1. Click **Device configuration** > **Profiles** > **Create profile**.
|
||||
1. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.
|
||||
|
||||
1. Click **Configure** > **Windows Defender Exploit Guard** > **Exploit protection**.
|
||||
1. Upload an [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) with the exploit protection settings:
|
||||
|
||||
1. Click **OK** to save each open blade and click **Create**.
|
||||
1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
|
||||
|
||||
### PowerShell
|
||||
## MDM
|
||||
|
||||
Use the [./Vendor/MSFT/Policy/Config/ExploitGuard/ExploitProtectionSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) configuration service provider (CSP) to enable or disable exploit protection mitigations or to use audit mode.
|
||||
|
||||
## Group Policy
|
||||
|
||||
1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
|
||||
|
||||
1. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
|
||||
|
||||
1. Expand the tree to **Windows components** > **Windows Defender Exploit Guard** > **Exploit Protection** > **Use a common set of exploit protection settings**.
|
||||
|
||||
6. Click **Enabled** and type the location of the [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) and click **OK**.
|
||||
|
||||
## PowerShell
|
||||
|
||||
You can use the PowerShell verb `Get` or `Set` with the cmdlet `ProcessMitigation`. Using `Get` will list the current configuration status of any mitigations that have been enabled on the device - add the `-Name` cmdlet and app exe to see mitigations for just that app:
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Turn network protection on
|
||||
title: Turn on network protection
|
||||
description: Enable Network protection with Group Policy, PowerShell, or MDM CSPs
|
||||
keywords: ANetwork protection, exploits, malicious website, ip, domain, domains, enable, turn on
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 03/27/2019
|
||||
ms.date: 03/28/2019
|
||||
---
|
||||
|
||||
# Enable network protection
|
||||
@ -24,14 +24,26 @@ ms.date: 03/27/2019
|
||||
You can [audit network protection](evaluate-network-protection.md) in a test environment to see which apps would be blocked before you enable it.
|
||||
You can enable network protection by using any of the these methods:
|
||||
|
||||
- Intune
|
||||
- MDM
|
||||
- Group Policy
|
||||
- PowerShell cmdlets
|
||||
- Registry
|
||||
|
||||
## Intune
|
||||
|
||||
1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
|
||||
1. Click **Device configuration** > **Profiles** > **Create profile**.
|
||||
1. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.
|
||||
|
||||
1. Click **Configure** > **Windows Defender Exploit Guard** > **Network filtering** > **Enable**.
|
||||
|
||||
1. Click **OK** to save each open blade and click **Create**.
|
||||
1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
|
||||
|
||||
## MDM
|
||||
|
||||
Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable and configure network protection.
|
||||
Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable or disable network protection or enable audit mode.
|
||||
|
||||
## Group Policy
|
||||
|
||||
@ -68,6 +80,16 @@ Set-MpPreference -EnableNetworkProtection AuditMode
|
||||
|
||||
Use `Disabled` insead of `AuditMode` or `Enabled` to turn the feature off.
|
||||
|
||||
##
|
||||
|
||||
Network protection can't be turned on using the Windows Security app, but you can enable it by using Registry editor.
|
||||
|
||||
1. Click **Start** and type **regedit** to open **Registry Editor**.
|
||||
1. Navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection
|
||||
1. Set the value:
|
||||
0=off
|
||||
1=on
|
||||
2=audit
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 11/16/2018
|
||||
ms.date: 03/27/2019
|
||||
---
|
||||
|
||||
# Evaluate network protection
|
||||
@ -22,71 +22,46 @@ ms.date: 11/16/2018
|
||||
|
||||
Network protection helps prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet.
|
||||
|
||||
This topic helps you evaluate Network protection by enabling the feature and guiding you to a testing site.
|
||||
This topic helps you evaluate Network protection by enabling the feature and guiding you to a testing site. The site in this evaluation topic are not malicious, they are specially created websites that pretend to be malicious. The site will replicate the behavior that would happen if a user visted a malicious site or domain.
|
||||
|
||||
>[!NOTE]
|
||||
>The site will replicate the behavior that would happen if a user visted a malicious site or domain. The sites in this evaluation topic are not malicious, they are specially created websites that pretend to be malicious.
|
||||
|
||||
>[!TIP]
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to see how other protection features work.
|
||||
|
||||
## Enable network protection
|
||||
## Enable network protection in audit mode
|
||||
|
||||
You can enable network protection in audit mode to see which IP addresses and domains would have been blocked if it was enabled.
|
||||
|
||||
You might want to do this to make sure it doesn't affect line-of-business apps or to get an idea of how often blocks occur.
|
||||
|
||||
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**
|
||||
2. Enter the following cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Set-MpPreference -EnableNetworkProtection Enabled
|
||||
Set-MpPreference -EnableNetworkProtection AuditMode
|
||||
```
|
||||
|
||||
You can also carry out the processes described in this topic in audit or disabled mode to see how the feature will work. Use the same PowerShell cmdlet as above, but replace "Enabled" with either "AuditMode" or "Disabled".
|
||||
|
||||
### Visit a (fake) malicious domain
|
||||
|
||||
1. Open Internet Explorer, Google Chrome, or any other browser of your choice.
|
||||
|
||||
1. Go to [https://smartscreentestratings2.net](https://smartscreentestratings2.net).
|
||||
|
||||
You will get a 403 Forbidden response in the browser, and you will see a notification that the network connnection was blocked.
|
||||
The network connection will be allowed and a test message will be displayed.
|
||||
|
||||
|
||||
|
||||
## Review network protection events in Windows Event Viewer
|
||||
|
||||
You can also review the Windows event log to see the events there were created when performing the demo. You can use the custom view below or [locate them manually](event-views-exploit-guard.md#list-of-attack-surface-reduction-events).
|
||||
To review apps that would have been blocked, open Event Viewer and filter for Event ID 1125 in the Microsoft-Windows-Windows-Defender/Operational log. The following table lists all network protection events.
|
||||
|
||||
1. Type **Event viewer** in the Start menu to open the Windows Event Viewer.
|
||||
|
||||
2. On the left panel, under **Actions**, click **Import custom view...**
|
||||
|
||||
3. Navigate to the Exploit Guard Evaluation Package, and select the file *np-events.xml*. Alternatively, [copy the XML directly](event-views-exploit-guard.md).
|
||||
|
||||
4. Click **OK**.
|
||||
|
||||
5. This will create a custom view that filters to only show the following events related to network protection:
|
||||
|
||||
Event ID | Description
|
||||
Event ID | Provide/Source | Description
|
||||
-|-
|
||||
5007 | Event when settings are changed
|
||||
1125 | Event when rule fires in audit mode
|
||||
1126 | Event when rule fires in block mode
|
||||
5007 | Windows Defender (Operational) | Event when settings are changed
|
||||
1125 | Windows Defender (Operational) | Event when a network connection is audited
|
||||
1126 | Windows Defender (Operational) | Event when a network connection is blocked
|
||||
|
||||
|
||||
## Use audit mode to measure impact
|
||||
|
||||
You can also enable the network protection feature in audit mode. This lets you see a record of which IP addresses and domains would have been blocked if the feature were enabled.
|
||||
|
||||
You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how often the feature will block connections during normal use.
|
||||
|
||||
To enable audit mode, use the following PowerShell cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Set-MpPreference -EnableNetworkProtection AuditMode
|
||||
```
|
||||
>[!TIP]
|
||||
>If you want to fully audit how network protection will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s).
|
||||
You can also use Group Policy, Intune, or MDM CSPs to configure and deploy the setting, as described in the main [Network protection topic](network-protection-exploit-guard.md).
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Protect your network](network-protection-exploit-guard.md)
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 78 KiB After Width: | Height: | Size: 56 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 11 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 78 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 28 KiB |
@ -11,6 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 03/27/2019
|
||||
---
|
||||
|
||||
# Troubleshoot attack surface reduction rules
|
||||
@ -26,12 +27,12 @@ When you use [attack surface reduction rules](attack-surface-reduction-exploit-g
|
||||
|
||||
There are four steps to troubleshooting these problems:
|
||||
|
||||
1. Confirm that you have met all pre-requisites
|
||||
1. Confirm prerequisites
|
||||
2. Use audit mode to test the rule
|
||||
3. Add exclusions for the specified rule (for false positives)
|
||||
3. Submit support logs
|
||||
|
||||
## Confirm pre-requisites
|
||||
## Confirm prerequisites
|
||||
|
||||
Attack surface reduction rules will only work on devices with the following conditions:
|
||||
|
||||
@ -45,27 +46,14 @@ If these pre-requisites have all been met, proceed to the next step to test the
|
||||
|
||||
## Use audit mode to test the rule
|
||||
|
||||
There are two ways that you can test if the rule is working.
|
||||
You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm attack surface reduction rules are generally working for pre-configured scenarios and processes on a device, or you can use audit mode, which enables rules for reporting only.
|
||||
|
||||
You can use a pre-configured demo tool to confirm attack surface reduction rules are generally working on the device, or you can use audit mode, which enables rules for reporting only.
|
||||
Follow these instructions in [Use the demo tool to see how attack surface reduction rules work](evaluate-attack-surface-reduction.md) to test the specific rule you are encountering problems with.
|
||||
|
||||
The demo tool uses pre-configured scenarios and processes, which can be useful to first see if the attack surface reduction rule feature as a whole is operating correctly.
|
||||
|
||||
If you encounter problems when running the demo tool, check that the device you are testing the tool on meets the [pre-requisites listed above](#confirm-pre-requisites).
|
||||
|
||||
Follow the instructions in [Use the demo tool to see how attack surface reduction rules work](evaluate-attack-surface-reduction.md) to test the specific rule you are encountering problems with.
|
||||
|
||||
>[!TIP]
|
||||
>While the instructions for using the demo tool are intended for evaluating or seeing how attack surface reduction rules work, you can use it to test that the rule works on known scenarios that we have already extensively tested before we released the feature.
|
||||
|
||||
Audit mode allows the rule to report as if it actually blocked the file or process, but will still allow the file to run.
|
||||
|
||||
1. Enable audit mode for the specific rule you want to test. Use Group Policy to set the rule to **Audit mode** (value: **2**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md).
|
||||
1. Enable audit mode for the specific rule you want to test. Use Group Policy to set the rule to **Audit mode** (value: **2**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md). Audit mode allows the rule to report the file or process, but will still allow it to run.
|
||||
2. Perform the activity that is causing an issue (for example, open or execute the file or process that should be blocked but is being allowed).
|
||||
3. [Review the attack surface reductio rule event logs](attack-surface-reduction-exploit-guard.md) to see if the rule would have blocked the file or process if the rule had been set to **Enabled**.
|
||||
|
||||
>[!TIP]
|
||||
>Audit mode will stop the rule from blocking the file or process.
|
||||
>
|
||||
>If a rule is not blocking a file or process that you are expecting it should block, first check if audit mode is enabled.
|
||||
>
|
||||
@ -74,36 +62,39 @@ Audit mode allows the rule to report as if it actually blocked the file or proce
|
||||
If you've tested the rule with the demo tool and with audit mode, and attack surface reduction rules are working on pre-configured scenarios, but the rule is not working as expected, proceed to either of the following sections based on your situation:
|
||||
|
||||
1. If the attack surface reduction rule is blocking something that it should not block (also known as a false positive), you can [first add an attack surface reduction rule exclusion](#add-exclusions-for-a-false-positive).
|
||||
2. If the attack surface reduction rule is not blocking something that it should block (also known as a false negative), you can proceed immediately to the last step, [collecting diagnostic data and submitting the issue to us](#collect-diagnostic-data).
|
||||
2. If the attack surface reduction rule is not blocking something that it should block (also known as a false negative), you can proceed immediately to the last step, [collecting diagnostic data and submitting the issue to us](#collect-diagnostic-data-for-file-submissions).
|
||||
|
||||
## Add exclusions for a false positive
|
||||
|
||||
You can add exclusions to prevent attack surface reduction rules from evaluating the excluded files or folders.
|
||||
If the attack surface reduction rule is blocking something that it should not block (also known as a false positive), you can add exclusions to prevent attack surface reduction rules from evaluating the excluded files or folders.
|
||||
|
||||
This is useful if you have enabled a rule, and it is blocking a file, process, or action that you believe it should not block. You can then collect data from an endpoint where the rule is not working correctly and send that information to us.
|
||||
|
||||
To add an exclusion, see the [Customize Attack surface reduction](customize-attack-surface-reduction.md) topic.
|
||||
To add an exclusion, see [Customize Attack surface reduction](customize-attack-surface-reduction.md).
|
||||
|
||||
>[!IMPORTANT]
|
||||
>You can specify individual files and folders to be excluded, but you cannot specify individual rules.
|
||||
>
|
||||
>This means any files or folders that are excluded will be excluded from all ASR rules.
|
||||
|
||||
If you have followed all previous troubleshooting steps, and you still have a problem (in particular, if you have a false positive), you should proceed to the next step to collect diagnostic information and send it to us.
|
||||
## Report a false positive or false negative
|
||||
|
||||
## Collect diagnostic data
|
||||
Use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) to report a false negative or false positive for network protection. With an E5 subscription, you can also [provide a link to any associated alert](../windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
You can use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) to report a problem with attack surface reduction rules.
|
||||
## Collect diagnostic data for file submissions
|
||||
|
||||
When you fill out the submission form, you will be asked to specify whether it is a false negative or false positive. If you have an E5 subscription for Windows Defender Advanced Threat Protection, you can also [provide a link to the associated alert](../windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) (if there is one).
|
||||
When you report a problem with attack surface reduction rules, you are asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues.
|
||||
|
||||
You must also attach associated files in a .zip file (such as the file or executable that is not being blocked, or being incorrectly blocked) along with a diagnostic .cab file to your submission.
|
||||
|
||||
Follow the link below for instructions on how to collect the .cab file:
|
||||
|
||||
> [!div class="nextstepaction"]
|
||||
> [Collect and submit diagnostic data](collect-cab-files-exploit-guard-submission.md)
|
||||
1. Open an elevated command prompt and change to the Windows Defender directory:
|
||||
```console
|
||||
cd c:\program files\windows defender
|
||||
```
|
||||
2. Run this command to generate the diagnostic logs:
|
||||
```console
|
||||
mpcmdrun -getfiles
|
||||
```
|
||||
3. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Attack surface reduction rules](attack-surface-reduction-exploit-guard.md)
|
||||
- [Enable attack surface reduction rules](enable-attack-surface-reduction.md)
|
||||
- [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md)
|
||||
|
||||
|
||||
@ -29,12 +29,12 @@ When you use [Network protection](network-protection-exploit-guard.md) you may e
|
||||
|
||||
There are four steps to troubleshooting these problems:
|
||||
|
||||
1. Confirm that you have met all pre-requisites
|
||||
1. Confirm prerequisites
|
||||
2. Use audit mode to test the rule
|
||||
3. Add exclusions for the specified rule (for false positives)
|
||||
3. Submit support logs
|
||||
|
||||
## Confirm pre-requisites
|
||||
## Confirm prerequisites
|
||||
|
||||
Network protection will only work on devices with the following conditions:
|
||||
|
||||
@ -45,48 +45,45 @@ Network protection will only work on devices with the following conditions:
|
||||
> - [Cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) is enabled.
|
||||
> - Audit mode is not enabled. Use [Group Policy](enable-network-protection.md#group-policy) to set the rule to **Disabled** (value: **0**).
|
||||
|
||||
If these pre-requisites have all been met, proceed to the next step to test the rule in audit mode.
|
||||
|
||||
## Use audit mode to test the rule
|
||||
## Use audit mode
|
||||
|
||||
There are two ways that you can test if the feature is working - you can use a demo website, and you can use audit mode.
|
||||
You can enable network protection in audit mode and then visit a website that we've created to demo the feature. All website connections will be allowed by network protection but an event will be logged to indicate any connection that would have been blocked if network protection was enabled.
|
||||
|
||||
You can enable network protection and then visit a website that we've created to demo the feature. The website will always be reported as blocked by network protection. See [Evaluate network protection](evaluate-network-protection.md) for instructions.
|
||||
|
||||
If you encounter problems when running the evaluation scenario, check that the device you are testing the tool on meets the [pre-requisites listed above](#confirm-pre-requisites).
|
||||
|
||||
>[!TIP]
|
||||
>While the instructions for using the demo website are intended for evaluating or seeing how network protection works, you can use it to test that the feature is working properly and narrow down on the cause of the problem.
|
||||
|
||||
You can also use audit mode and then attempt to visit the site or IP (IPv4) address you do or don't want to block. Audit mode lets network protection report to the Windows event log as if it actually blocked the site or connection to an IP address, but will still allow the file to run.
|
||||
|
||||
1. Enable audit mode for network protection. Use Group Policy to set the rule to **Audit mode** as described in the [Enable network protection topic](enable-network-protection.md#group-policy).
|
||||
1. Set network protection to **Audit mode**.
|
||||
```powershell
|
||||
Set-MpPreference -EnableNetworkProtection AuditMode
|
||||
```
|
||||
2. Perform the connection activity that is causing an issue (for example, attempt to visit the site, or connect to the IP address you do or don't want to block).
|
||||
3. [Review the network protection event logs](network-protection-exploit-guard.md#review-network-protection-events-in-windows-event-viewer) to see if the feature would have blocked the connection if it had been set to **Enabled**.
|
||||
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Audit mode will stop network protection from blocking known malicious connections.
|
||||
>
|
||||
>If network protection is not blocking a connection that you are expecting it should block, first check if audit mode is enabled.
|
||||
>
|
||||
>Audit mode may have been enabled for testing another feature in Windows Defender Exploit Guard, or by an automated PowerShell script, and may not have been disabled after the tests were completed.
|
||||
>If network protection is not blocking a connection that you are expecting it should block, enable the feature.
|
||||
|
||||
|
||||
If you've tested the feature with the demo site and with audit mode, and network protection is working on pre-configured scenarios, but is not working as expected for a specific connection, proceed to the next section to report the site or IP address.
|
||||
```powershell
|
||||
Set-MpPreference -EnableNetworkProtection Enabled
|
||||
```
|
||||
|
||||
## Report a false positive or false negative
|
||||
|
||||
You can use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) to report a problem with network protection.
|
||||
If you've tested the feature with the demo site and with audit mode, and network protection is working on pre-configured scenarios, but is not working as expected for a specific connection, use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) to report a false negative or false positive for network protection. With an E5 subscription, you can also [provide a link to any associated alert](../windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
When you fill out the submission form, you will be asked to specify whether it is a false negative or false positive. If you have an E5 subscription for Windows Defender Advanced Threat Protection, you can also [provide a link to the associated alert](../windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) (if there is one).
|
||||
## Collect diagnostic data for file submissions
|
||||
|
||||
You can also attach a diagnostic .cab file to your submission if you wish (this is not required). Follow the link below for instructions on how to collect the .cab file:
|
||||
When you report a problem with network protection, you are asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues.
|
||||
|
||||
> [!div class="nextstepaction"]
|
||||
> [Collect and submit diagnostic data Windows Defender Exploit Guard issues](collect-cab-files-exploit-guard-submission.md)
|
||||
1. Open an elevated command prompt and change to the Windows Defender directory:
|
||||
```console
|
||||
cd c:\program files\windows defender
|
||||
```
|
||||
2. Run this command to generate the diagnostic logs:
|
||||
```console
|
||||
mpcmdrun -getfiles
|
||||
```
|
||||
3. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Windows Defender Exploit Guard](windows-defender-exploit-guard.md)
|
||||
- [Network protection](network-protection-exploit-guard.md)
|
||||
- [Evaluate network protection](evaluate-network-protection.md)
|
||||
- [Enable network protection](enable-network-protection.md)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user