mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Merge branch 'main' into cz-7600331-win11sysreq
This commit is contained in:
Aaron Czechowski
GitHub
commit
fce6931494
@ -20519,6 +20519,11 @@
|
||||
"source_path": "windows/client-management/mdm/policy-ddf-file.md",
|
||||
"redirect_url": "/windows/client-management/mdm/configuration-service-provider-ddf",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/identity-protection/credential-guard/dg-readiness-tool.md",
|
||||
"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard",
|
||||
"redirect_document_id": true
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,16 +1,12 @@
|
||||
---
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
ms.date: 12/16/2022
|
||||
ms.date: 02/14/2023
|
||||
ms.reviewer: cathask
|
||||
manager: aaroncz
|
||||
ms.prod: ie11
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
> [!WARNING]
|
||||
> **Update:** The retired, out-of-support Internet Explorer 11 desktop application is scheduled to be permanently disabled through a Microsoft Edge update on certain versions of Windows 10 on February 14, 2023.
|
||||
>
|
||||
> We highly recommend setting up IE mode in Microsoft Edge and disabling IE11 prior to this date to ensure your organization does not experience business disruption.
|
||||
>
|
||||
> For more information, see [Internet Explorer 11 desktop app retirement FAQ](https://aka.ms/iemodefaq).
|
||||
> [!CAUTION]
|
||||
> **Update:** The retired, out-of-support Internet Explorer 11 desktop application has been permanently disabled through a Microsoft Edge update on certain versions of Windows 10. For more information, see [Internet Explorer 11 desktop app retirement FAQ](https://aka.ms/iemodefaq).
|
||||
|
||||
@ -43,314 +43,314 @@ The following information lists the system apps on some Windows Enterprise OS ve
|
||||
- File Picker | Package name: 1527c705-839a-4832-9118-54d4Bd6a0c89
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- File Explorer | Package name: c5e2524a-ea46-4f67-841f-6a9465d9d515
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- App Resolver UX | Package name: E2A4F912-2574-4A75-9BB0-0D023378592B
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Add Suggested Folders To Library | Package name: F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- InputApp
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | | | ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | | | ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.AAD.Broker.Plugin | Package name: Microsoft.AAD.Broker.Plugin
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.AccountsControl | Package name: Microsoft.AccountsControl
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.AsyncTextService | Package name: Microsoft.AsyncTextService
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Hello setup UI | Package name: Microsoft.BioEnrollment
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.CredDialogHost
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.ECApp
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.LockApp
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft Edge | Package name: Microsoft.MicrosoftEdge
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.MicrosoftEdgeDevToolsClient
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.PPIProjection
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | | | ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | | | ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.Win32WebViewHost
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.Windows.Apprep.ChxApp
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.Windows.AssignedAccessLockApp
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.Windows.CapturePicker
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.Windows.CloudExperienceHost
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.Windows.ContentDeliveryManager
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Cortana | Package name: Microsoft.Windows.Cortana
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | | | ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | | | ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.Windows.OOBENetworkCaptivePort
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.Windows.OOBENetworkConnectionFlow
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.Windows.ParentalControls
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- People Hub | Package name: Microsoft.Windows.PeopleExperienceHost
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.Windows.PinningConfirmationDialog
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.Windows.SecHealthUI
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.Windows.SecureAssessmentBrowser
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Start | Package name: Microsoft.Windows.ShellExperienceHost
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Microsoft.XboxGameCallableUI
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Windows.CBSPreview
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Settings | Package name: Windows.immersivecontrolpanel
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Print 3D | Package name: Windows.Print3D
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ✔️ | | | ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ✔️ | ✔️ | | | ✔️ |
|
||||
|
||||
---
|
||||
|
||||
- Print UI | Package name: Windows.PrintDialog
|
||||
|
||||
---
|
||||
| Uninstall through UI? | 21H1 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- |
|
||||
| ❌ | ✔️ | ✔️| ✔️ |
|
||||
| Uninstall through UI? | 22H2 | 22H1 | 21H2 | 20H2 | 1809 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| | ❌ | ❌ | ✔️ | ✔️| ✔️ |
|
||||
|
||||
---
|
||||
|
||||
@ -836,7 +836,7 @@ Volume: Low.
|
||||
|
||||
<!-- AccountLogonLogoff_AuditSpecialLogon-Description-Begin -->
|
||||
<!-- Description-Source-DDF -->
|
||||
This policy setting allows you to audit events generated by special logons such as the following : The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](<https://go.microsoft.com/fwlink/?LinkId=121697>).
|
||||
This policy setting allows you to audit events generated by special logons such as the following: The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](<https://go.microsoft.com/fwlink/?LinkId=121697>).
|
||||
<!-- AccountLogonLogoff_AuditSpecialLogon-Description-End -->
|
||||
|
||||
<!-- AccountLogonLogoff_AuditSpecialLogon-Editable-Begin -->
|
||||
@ -2774,7 +2774,7 @@ This policy setting allows you to audit events generated by attempts to access t
|
||||
- If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made.
|
||||
|
||||
> [!NOTE]
|
||||
> Only the System Access Control List (SACL) for SAM_SERVER can be modified. Volume High on domain controllers. For information about reducing the amount of events generated in this subcategory, see [article 841001 in the Microsoft Knowledge Base](https//go.microsoft.com/fwlink/?LinkId=121698).
|
||||
> Only the System Access Control List (SACL) for SAM_SERVER can be modified. Volume High on domain controllers. For information about reducing the amount of events generated in this subcategory, see [article 841001 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121698).
|
||||
<!-- ObjectAccess_AuditSAM-Description-End -->
|
||||
|
||||
<!-- ObjectAccess_AuditSAM-Editable-Begin -->
|
||||
|
||||
@ -150,7 +150,7 @@ Descriptions of the properties:
|
||||
|
||||
**Policy timeline**:
|
||||
|
||||
The behavior of this policy setting differs in different Windows 10 versions. For Windows 10, version 1809 through version 1909, you can use name in `<accessgroup dec>` and SID in `<member name>`. For Windows 10, version 2004, you can use name or SID for both the elements, as described in the example.
|
||||
The behavior of this policy setting differs in different Windows 10 versions. For Windows 10, version 1809 through version 1909, you can use name in `<accessgroup desc>` and SID in `<member name>`. For Windows 10, version 2004, you can use name or SID for both the elements, as described in the example.
|
||||
|
||||
The following table describes how this policy setting behaves in different Windows 10 versions:
|
||||
|
||||
|
||||
@ -40,6 +40,7 @@ WindowsAdvancedThreatProtection
|
||||
----Configuration
|
||||
--------SampleSharing
|
||||
--------TelemetryReportingFrequency
|
||||
--------AadDdeviceId
|
||||
----Offboarding
|
||||
----DeviceTagging
|
||||
--------Group
|
||||
@ -48,34 +49,34 @@ WindowsAdvancedThreatProtection
|
||||
|
||||
The following list describes the characteristics and parameters.
|
||||
|
||||
<a href="" id="--device-vendor-msft-windowsadvancedthreatprotection"></a>**./Device/Vendor/MSFT/WindowsAdvancedThreatProtection**
|
||||
**./Device/Vendor/MSFT/WindowsAdvancedThreatProtection**
|
||||
The root node for the Windows Defender Advanced Threat Protection configuration service provider.
|
||||
|
||||
Supported operation is Get.
|
||||
|
||||
<a href="" id="onboarding"></a>**Onboarding**
|
||||
**Onboarding**
|
||||
Sets Windows Defender Advanced Threat Protection Onboarding blob and initiates onboarding to Windows Defender Advanced Threat Protection.
|
||||
|
||||
The data type is a string.
|
||||
|
||||
Supported operations are Get and Replace.
|
||||
|
||||
<a href="" id="healthstate"></a>**HealthState**
|
||||
**HealthState**
|
||||
Node that represents the Windows Defender Advanced Threat Protection health state.
|
||||
|
||||
<a href="" id="healthstate-lastconnected"></a>**HealthState/LastConnected**
|
||||
**HealthState/LastConnected**
|
||||
Contains the timestamp of the last successful connection.
|
||||
|
||||
Supported operation is Get.
|
||||
|
||||
<a href="" id="healthstate-senseisrunning"></a>**HealthState/SenseIsRunning**
|
||||
**HealthState/SenseIsRunning**
|
||||
Boolean value that identifies the Windows Defender Advanced Threat Protection Sense running state.
|
||||
|
||||
The default value is false.
|
||||
|
||||
Supported operation is Get.
|
||||
|
||||
<a href="" id="healthstate-onboardingstate"></a>**HealthState/OnboardingState**
|
||||
**HealthState/OnboardingState**
|
||||
Represents the onboarding state.
|
||||
|
||||
Supported operation is Get.
|
||||
@ -85,15 +86,15 @@ The following list shows the supported values:
|
||||
- 0 (default) – Not onboarded
|
||||
- 1 – Onboarded
|
||||
|
||||
<a href="" id="healthstate-orgid"></a>**HealthState/OrgId**
|
||||
**HealthState/OrgId**
|
||||
String that represents the OrgID.
|
||||
|
||||
Supported operation is Get.
|
||||
|
||||
<a href="" id="configuration"></a>**Configuration**
|
||||
**Configuration**
|
||||
Represents Windows Defender Advanced Threat Protection configuration.
|
||||
|
||||
<a href="" id="configuration-samplesharing"></a>**Configuration/SampleSharing**
|
||||
**Configuration/SampleSharing**
|
||||
Returns or sets the Windows Defender Advanced Threat Protection Sample Sharing configuration parameter.
|
||||
|
||||
The following list shows the supported values:
|
||||
@ -103,7 +104,7 @@ The following list shows the supported values:
|
||||
|
||||
Supported operations are Get and Replace.
|
||||
|
||||
<a href="" id="configuration-telemetryreportingfrequency"></a>**Configuration/TelemetryReportingFrequency**
|
||||
**Configuration/TelemetryReportingFrequency**
|
||||
Added in Windows 10, version 1703. Returns or sets the Windows Defender Advanced Threat Protection diagnostic data reporting frequency.
|
||||
|
||||
The following list shows the supported values:
|
||||
@ -113,26 +114,31 @@ The following list shows the supported values:
|
||||
|
||||
Supported operations are Get and Replace.
|
||||
|
||||
<a href="" id="offboarding"></a>**Offboarding**
|
||||
**Configuration/AadDeviceId**
|
||||
Returns or sets the Intune's reported known AadDeviceId for the machine
|
||||
|
||||
Supported operations are Get and Replace.
|
||||
|
||||
**Offboarding**
|
||||
Sets the Windows Defender Advanced Threat Protection Offboarding blob and initiates offboarding to Windows Defender Advanced Threat Protection.
|
||||
|
||||
The data type is a string.
|
||||
|
||||
Supported operations are Get and Replace.
|
||||
|
||||
<a href="" id="devicetagging"></a>**DeviceTagging**
|
||||
**DeviceTagging**
|
||||
Added in Windows 10, version 1709. Represents Windows Defender Advanced Threat Protection configuration for managing role based access and device tagging.
|
||||
|
||||
Supported operation is Get.
|
||||
|
||||
<a href="" id="group"></a>**DeviceTagging/Group**
|
||||
**DeviceTagging/Group**
|
||||
Added in Windows 10, version 1709. Device group identifiers.
|
||||
|
||||
The data type is a string.
|
||||
|
||||
Supported operations are Get and Replace.
|
||||
|
||||
<a href="" id="criticality"></a>**DeviceTagging/Criticality**
|
||||
**DeviceTagging/Criticality**
|
||||
Added in Windows 10, version 1709. Asset criticality value. Supported values:
|
||||
|
||||
- 0 - Normal
|
||||
@ -217,6 +223,16 @@ Supported operations are Get and Replace.
|
||||
</Target>
|
||||
</Item>
|
||||
</Get>
|
||||
<Get>
|
||||
<CmdID>7</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>
|
||||
./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/AadDeviceId
|
||||
</LocURI>
|
||||
</Target>
|
||||
</Item>
|
||||
</Get>
|
||||
<Get>
|
||||
<CmdID>11</CmdID>
|
||||
<Item>
|
||||
|
||||
@ -1,10 +1,7 @@
|
||||
---
|
||||
title: Configure Windows 10 taskbar (Windows 10)
|
||||
title: Configure Windows 10 taskbar
|
||||
description: Administrators can pin more apps to the taskbar and remove default pinned apps from the taskbar by adding a section to a layout modification XML file.
|
||||
keywords: [taskbar layout, pin apps]
|
||||
ms.prod: windows-client
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: lizgt2000
|
||||
ms.author: lizlong
|
||||
ms.topic: article
|
||||
@ -12,9 +9,12 @@ ms.localizationpriority: medium
|
||||
ms.date: 01/18/2018
|
||||
ms.reviewer:
|
||||
manager: aaroncz
|
||||
ms.collection: highpri
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier2
|
||||
ms.technology: itpro-configure
|
||||
---
|
||||
|
||||
# Configure Windows 10 taskbar
|
||||
|
||||
Starting in Windows 10, version 1607, administrators can pin more apps to the taskbar and remove default pinned apps from the taskbar by adding a `<TaskbarLayout>` section to a layout modification XML file. This method never removes user-pinned apps from the taskbar.
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Send feedback about Cortana at work back to Microsoft
|
||||
description: Learn how to send feedback to Microsoft about Cortana at work so you can provide more information to help diagnose reported issues.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Set up and test Cortana in Windows 10, versions 1909 and earlier, with Microsoft 365 in your organization
|
||||
description: Learn how to connect Cortana to Office 365 so employees are notified about regular meetings and unusual events. You can even set an alarm for early meetings.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: aczechowski
|
||||
|
||||
@ -4,6 +4,7 @@ ms.reviewer:
|
||||
manager: dougeby
|
||||
description: Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and for enterprise environments.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Configure Cortana with Group Policy and MDM settings (Windows)
|
||||
description: The list of Group Policy and mobile device management (MDM) policy settings that apply to Cortana at work.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Sign into Azure AD, enable the wake word, and try a voice query
|
||||
description: A test scenario walking you through signing in and managing the notebook.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Perform a quick search with Cortana at work (Windows)
|
||||
description: This scenario is a test scenario about how to perform a quick search with Cortana at work.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Set a reminder for a location with Cortana at work (Windows)
|
||||
description: A test scenario about how to set a location-based reminder using Cortana at work.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Use Cortana at work to find your upcoming meetings (Windows)
|
||||
description: A test scenario on how to use Cortana at work to find your upcoming meetings.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Use Cortana to send email to a co-worker (Windows)
|
||||
description: A test scenario about how to use Cortana at work to send email to a co-worker.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Review a reminder suggested by Cortana (Windows)
|
||||
description: A test scenario on how to use Cortana with the Suggested reminders feature.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Help protect data with Cortana and WIP (Windows)
|
||||
description: An optional test scenario about how to use Cortana at work with Windows Information Protection (WIP).
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Cortana at work testing scenarios
|
||||
description: Suggested testing scenarios that you can use to test Cortana in your organization.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Set up and test custom voice commands in Cortana for your organization (Windows)
|
||||
description: How to create voice commands that use Cortana to perform voice-enabled actions in your line-of-business (LOB) Universal Windows Platform (UWP) apps.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -4,6 +4,7 @@ ms.reviewer:
|
||||
manager: dougeby
|
||||
description: Cortana includes powerful configuration options specifically to optimize unique small to medium-sized business and enterprise environments.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Test scenario 1 – Sign in with your work or school account and use Cortana to manage the notebook
|
||||
description: A test scenario about how to sign in with your work or school account and use Cortana to manage the notebook.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Test scenario 2 - Perform a quick search with Cortana at work
|
||||
description: A test scenario about how to perform a quick search with Cortana at work.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Test scenario 3 - Set a reminder for a specific location using Cortana at work
|
||||
description: A test scenario about how to set up, review, and edit a reminder based on a location.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Use Cortana to find your upcoming meetings at work (Windows)
|
||||
description: A test scenario about how to use Cortana at work to find your upcoming meetings.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Use Cortana to send an email to co-worker (Windows)
|
||||
description: A test scenario on how to use Cortana at work to send email to a co-worker.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email
|
||||
description: A test scenario about how to use Cortana with the Suggested reminders feature.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -2,6 +2,7 @@
|
||||
title: Testing scenarios using Cortana in your business or organization
|
||||
description: A list of suggested testing scenarios that you can use to test Cortana in your organization.
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
author: aczechowski
|
||||
ms.localizationpriority: medium
|
||||
ms.author: aaroncz
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Customize and export Start layout (Windows 10)
|
||||
title: Customize and export Start layout
|
||||
description: The easiest method for creating a customized Start layout is to set up the Start screen and export the layout.
|
||||
ms.reviewer:
|
||||
manager: aaroncz
|
||||
@ -9,20 +9,21 @@ ms.author: lizlong
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/18/2018
|
||||
ms.collection: highpri
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier1
|
||||
ms.technology: itpro-configure
|
||||
---
|
||||
|
||||
# Customize and export Start layout
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
|
||||
>**Looking for consumer information?** See [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630)
|
||||
|
||||
The easiest method for creating a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test computer and then export the layout.
|
||||
The easiest method for creating a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test computer and then export the layout.
|
||||
|
||||
After you export the layout, decide whether you want to apply a *full* Start layout or a *partial* Start layout.
|
||||
|
||||
@ -31,7 +32,7 @@ When a full Start layout is applied, the users cannot pin, unpin, or uninstall a
|
||||
When [a partial Start layout](#configure-a-partial-start-layout) is applied, the contents of the specified tile groups cannot be changed, but users can move those groups, and can also create and customize their own groups.
|
||||
|
||||
>[!NOTE]
|
||||
>Partial Start layout is only supported on Windows 10, version 1511 and later.
|
||||
>Partial Start layout is only supported on Windows 10, version 1511 and later.
|
||||
|
||||
|
||||
|
||||
@ -49,7 +50,7 @@ To prepare a Start layout for export, you simply customize the Start layout on a
|
||||
|
||||
**To prepare a test computer**
|
||||
|
||||
1. Set up a test computer on which to customize the Start layout. Your test computer should have the operating system that is installed on the users’ computers (Windows 10 Pro, Enterprise, or Education). Install all apps and services that the Start layout should display.
|
||||
1. Set up a test computer on which to customize the Start layout. Your test computer should have the operating system that is installed on the users' computers (Windows 10 Pro, Enterprise, or Education). Install all apps and services that the Start layout should display.
|
||||
|
||||
2. Create a new user account that you will use to customize the Start layout.
|
||||
|
||||
@ -63,7 +64,7 @@ To prepare a Start layout for export, you simply customize the Start layout on a
|
||||
|
||||
To view all apps, click **All apps** in the bottom-left corner of Start. Right-click any app, and pin or unpin it from Start.
|
||||
|
||||
- **Unpin apps** that you don’t want to display. To unpin an app, right-click the app, and then click **Unpin from Start**.
|
||||
- **Unpin apps** that you don't want to display. To unpin an app, right-click the app, and then click **Unpin from Start**.
|
||||
|
||||
- **Drag tiles** on Start to reorder or group apps.
|
||||
|
||||
@ -89,7 +90,7 @@ When you have the Start layout that you want your users to see, use the [Export-
|
||||
|
||||
2. On a device running Windows 10, version 1607, 1703, or 1803, at the Windows PowerShell command prompt, enter the following command:
|
||||
|
||||
`Export-StartLayout –path <path><file name>.xml`
|
||||
`Export-StartLayout -path <path><file name>.xml`
|
||||
|
||||
On a device running Windows 10, version 1809 or higher, run the **Export-StartLayout** with the switch **-UseDesktopApplicationID**. For example:
|
||||
|
||||
|
||||
@ -7,7 +7,9 @@ ms.author: lizlong
|
||||
ms.reviewer: ericpapa
|
||||
ms.prod: windows-client
|
||||
ms.localizationpriority: medium
|
||||
ms.collection: highpri
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier1
|
||||
ms.technology: itpro-configure
|
||||
ms.date: 01/10/2023
|
||||
ms.topic: article
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Configure and customize Windows 11 taskbar | Microsoft Docs
|
||||
title: Configure and customize Windows 11 taskbar
|
||||
description: On Windows 11 devices, pin and unpin default apps and organization apps on the taskbar using an XML file. Deploy the taskbar XML file using Group Policy or MDM and Microsoft Intune. See what happens to the taskbar when the Windows OS client is installed or upgraded.
|
||||
manager: aaroncz
|
||||
ms.author: lizlong
|
||||
@ -7,7 +7,9 @@ ms.reviewer: chataylo
|
||||
ms.prod: windows-client
|
||||
author: lizgt2000
|
||||
ms.localizationpriority: medium
|
||||
ms.collection: highpri
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier1
|
||||
ms.technology: itpro-configure
|
||||
ms.date: 12/31/2017
|
||||
ms.topic: article
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Customize Windows 10 Start and taskbar with Group Policy (Windows 10)
|
||||
title: Customize Windows 10 Start and taskbar with group policy
|
||||
description: In Windows 10, you can use a Group Policy Object (GPO) to deploy a customized Start layout to users in a domain.
|
||||
ms.reviewer:
|
||||
manager: aaroncz
|
||||
@ -8,7 +8,9 @@ author: lizgt2000
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizlong
|
||||
ms.topic: article
|
||||
ms.collection: highpri
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier2
|
||||
ms.technology: itpro-configure
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
@ -8,7 +8,9 @@ ms.author: lizlong
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.prod: windows-client
|
||||
ms.collection: highpri
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier2
|
||||
ms.technology: itpro-configure
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
@ -41,7 +43,7 @@ foreach ($app in $installedapps)
|
||||
$aumidList
|
||||
```
|
||||
|
||||
You can add the –user <username> or the –allusers parameters to the get-AppxPackage cmdlet to list AUMIDs for other users. You must use an elevated Windows PowerShell prompt to use the –user or –allusers parameters.
|
||||
You can add the `-user <username>` or the `-allusers` parameters to the **Get-AppxPackage** cmdlet to list AUMIDs for other users. You must use an elevated Windows PowerShell prompt to use the `-user` or -`allusers` parameters.
|
||||
|
||||
## To find the AUMID by using File Explorer
|
||||
|
||||
@ -63,7 +65,7 @@ At a command prompt, type the following command:
|
||||
|
||||
`reg query HKEY_CURRENT_USER\Software\Classes\ActivatableClasses\Package /s /f AppUserModelID | find "REG_SZ"`
|
||||
|
||||
## Example
|
||||
### Example to get AUMIDs of the installed apps for the specified user
|
||||
|
||||
The following code sample creates a function in Windows PowerShell that returns an array of AUMIDs of the installed apps for the specified user.
|
||||
|
||||
@ -105,14 +107,14 @@ The following Windows PowerShell commands demonstrate how you can call the listA
|
||||
# Get a list of AUMIDs for the current account:
|
||||
listAumids
|
||||
|
||||
# Get a list of AUMIDs for an account named “CustomerAccount”:
|
||||
# Get a list of AUMIDs for an account named "CustomerAccount":
|
||||
listAumids("CustomerAccount")
|
||||
|
||||
# Get a list of AUMIDs for all accounts on the device:
|
||||
listAumids("allusers")
|
||||
```
|
||||
|
||||
## Example
|
||||
### Example to get the AUMID of any application in the Start menu
|
||||
|
||||
The following code sample creates a function in Windows PowerShell that returns the AUMID of any application currently listed in the Start menu.
|
||||
|
||||
@ -148,4 +150,3 @@ Get-AppAUMID -AppName Word
|
||||
# List all apps and their AUMID in the Start menu
|
||||
Get-AppAUMID
|
||||
```
|
||||
|
||||
|
||||
@ -1,17 +1,16 @@
|
||||
---
|
||||
title: Guidelines for choosing an app for assigned access (Windows 10/11)
|
||||
title: Guidelines for choosing an app for assigned access
|
||||
description: The following guidelines may help you choose an appropriate Windows app for your assigned access experience.
|
||||
keywords: [kiosk, lockdown, assigned access]
|
||||
ms.prod: windows-client
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
author: lizgt2000
|
||||
ms.localizationpriority: medium
|
||||
ms.author: lizlong
|
||||
ms.topic: article
|
||||
ms.reviewer: sybruckm
|
||||
manager: aaroncz
|
||||
ms.collection: highpri
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier2
|
||||
ms.technology: itpro-configure
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
@ -50,7 +49,7 @@ Avoid selecting Windows apps that are designed to launch other apps as part of t
|
||||
|
||||
Starting with Windows 10 version 1809+, Microsoft Edge includes support for kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode.](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy)
|
||||
|
||||
In Windows client, you can install the **Kiosk Browser** app from Microsoft to use as your kiosk app. For digital signage scenarios, you can configure **Kiosk Browser** to navigate to a URL and show only that content -- no navigation buttons, no address bar, etc. For kiosk scenarios, you can configure more settings, such as allowed and blocked URLs, navigation buttons, and end session buttons. For example, you could configure your kiosk to show the online catalog for your store, where customers can navigate between departments and items, but aren’t allowed to go to a competitor's website.
|
||||
In Windows client, you can install the **Kiosk Browser** app from Microsoft to use as your kiosk app. For digital signage scenarios, you can configure **Kiosk Browser** to navigate to a URL and show only that content -- no navigation buttons, no address bar, etc. For kiosk scenarios, you can configure more settings, such as allowed and blocked URLs, navigation buttons, and end session buttons. For example, you could configure your kiosk to show the online catalog for your store, where customers can navigate between departments and items, but aren't allowed to go to a competitor's website.
|
||||
|
||||
>[!NOTE]
|
||||
>Kiosk Browser supports a single tab. If a website has links that open a new tab, those links will not work with Kiosk Browser. Kiosk Browser does not support .pdfs.
|
||||
@ -155,7 +154,7 @@ You can create your own web browser Windows app by using the WebView class. Lear
|
||||
|
||||
## Secure your information
|
||||
|
||||
Avoid selecting Windows apps that may expose the information you don’t want to show in your kiosk, since kiosk usually means anonymous access and locates in a public setting like a shopping mall. For example, an app that has a file picker allows the user to gain access to files and folders on the user's system, avoid selecting these types of apps if they provide unnecessary data access.
|
||||
Avoid selecting Windows apps that may expose the information you don't want to show in your kiosk, since kiosk usually means anonymous access and locates in a public setting like a shopping mall. For example, an app that has a file picker allows the user to gain access to files and folders on the user's system, avoid selecting these types of apps if they provide unnecessary data access.
|
||||
|
||||
## App configuration
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
### YamlMime:Landing
|
||||
|
||||
title: Configure Windows client # < 60 chars
|
||||
summary: Find out how to apply custom configurations to Windows 10 and Windows 11 devices. Windows 10 provides many features and methods to help you configure or lock down specific parts of Windows client. # < 160 chars
|
||||
summary: Find out how to apply custom configurations to Windows client devices. Windows provides many features and methods to help you configure or lock down specific parts of Windows client. # < 160 chars
|
||||
|
||||
metadata:
|
||||
title: Configure Windows client # Required; page title displayed in search results. Include the brand. < 60 chars.
|
||||
@ -10,6 +10,7 @@ metadata:
|
||||
ms.prod: windows-client
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier1
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: dougeby
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Set up a single-app kiosk on Windows 10/11
|
||||
description: A single-use device is easy to set up in Windows 10 and Windows 11 for desktop editions (Pro, Enterprise, and Education).
|
||||
title: Set up a single-app kiosk on Windows
|
||||
description: A single-use device is easy to set up in Windows Pro, Enterprise, and Education editions.
|
||||
ms.reviewer: sybruckm
|
||||
manager: aaroncz
|
||||
ms.author: lizlong
|
||||
@ -8,7 +8,9 @@ ms.prod: windows-client
|
||||
author: lizgt2000
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.collection: highpri
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier1
|
||||
ms.technology: itpro-configure
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
@ -9,7 +9,9 @@ manager: aaroncz
|
||||
ms.reviewer: sybruckm
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: how-to
|
||||
ms.collection: highpri
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier2
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
@ -247,7 +249,7 @@ A few things to note here:
|
||||
- The test device on which you customize the Start layout should have the same OS version that is installed on the device where you plan to deploy the multi-app assigned access configuration.
|
||||
- Since the multi-app assigned access experience is intended for fixed-purpose devices, to ensure the device experiences are consistent and predictable, use the *full* Start layout option instead of the *partial* Start layout.
|
||||
- There are no apps pinned on the taskbar in the multi-app mode, and it's not supported to configure Taskbar layout using the `<CustomTaskbarLayoutCollection>` tag in a layout modification XML as part of the assigned access configuration.
|
||||
- The following example uses `DesktopApplicationLinkPath` to pin the desktop app to start. When the desktop app doesn’t have a shortcut link on the target device, [learn how to provision .lnk files using Windows Configuration Designer](#lnk-files).
|
||||
- The following example uses `DesktopApplicationLinkPath` to pin the desktop app to start. When the desktop app doesn't have a shortcut link on the target device, [learn how to provision .lnk files using Windows Configuration Designer](#lnk-files).
|
||||
|
||||
The following example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps on Start:
|
||||
|
||||
@ -284,7 +286,7 @@ The following example pins Groove Music, Movies & TV, Photos, Weather, Calculato
|
||||
|
||||
##### Taskbar
|
||||
|
||||
Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don’t attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want.
|
||||
Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don't attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want.
|
||||
|
||||
The following example exposes the taskbar to the end user:
|
||||
|
||||
@ -607,7 +609,7 @@ Lock the Taskbar | Enabled
|
||||
Prevent users from adding or removing toolbars | Enabled
|
||||
Prevent users from resizing the taskbar | Enabled
|
||||
Remove frequent programs list from the Start Menu | Enabled
|
||||
Remove ‘Map Network Drive’ and ‘Disconnect Network Drive’ | Enabled
|
||||
Remove 'Map Network Drive' and 'Disconnect Network Drive' | Enabled
|
||||
Remove the Security and Maintenance icon | Enabled
|
||||
Turn off all balloon notifications | Enabled
|
||||
Turn off feature advertisement balloon notifications | Enabled
|
||||
@ -615,7 +617,7 @@ Turn off toast notifications | Enabled
|
||||
Remove Task Manager | Enabled
|
||||
Remove Change Password option in Security Options UI | Enabled
|
||||
Remove Sign Out option in Security Options UI | Enabled
|
||||
Remove All Programs list from the Start Menu | Enabled – Remove and disable setting
|
||||
Remove All Programs list from the Start Menu | Enabled - Remove and disable setting
|
||||
Prevent access to drives from My Computer | Enabled - Restrict all drivers
|
||||
|
||||
>[!NOTE]
|
||||
|
||||
@ -1,14 +1,16 @@
|
||||
---
|
||||
title: Install Windows Configuration Designer (Windows 10/11)
|
||||
title: Install Windows Configuration Designer
|
||||
description: Learn how to install and use Windows Configuration Designer so you can easily configure devices running Windows 10/11.
|
||||
ms.prod: windows-client
|
||||
author: lizgt2000
|
||||
ms.author: lizlong
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.reviewer: gkomatsu
|
||||
ms.reviewer: kevinsheehan
|
||||
manager: aaroncz
|
||||
ms.collection: highpri
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier2
|
||||
ms.technology: itpro-configure
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
@ -1,14 +1,16 @@
|
||||
---
|
||||
title: Provisioning packages overview on Windows 10/11
|
||||
title: Provisioning packages overview
|
||||
description: With Windows 10 and Windows 11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Learn about what provisioning packages, are and what they do.
|
||||
ms.reviewer: gkomatsu
|
||||
ms.reviewer: kevinsheehan
|
||||
manager: aaroncz
|
||||
ms.prod: windows-client
|
||||
author: lizgt2000
|
||||
ms.author: lizlong
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.collection: highpri
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier2
|
||||
ms.technology: itpro-configure
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
@ -10,7 +10,7 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.reviewer:
|
||||
manager: aaroncz
|
||||
ms.collection:
|
||||
ms.collection: tier2
|
||||
appliesto:
|
||||
- ✅ <b>Windows 10</b>
|
||||
- ✅ <b>Windows 11</b>
|
||||
|
||||
@ -10,7 +10,7 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.reviewer:
|
||||
manager: aaroncz
|
||||
ms.collection:
|
||||
ms.collection: tier2
|
||||
appliesto:
|
||||
- ✅ <b>Windows 10</b>
|
||||
- ✅ <b>Windows 11</b>
|
||||
|
||||
@ -10,7 +10,7 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.reviewer:
|
||||
manager: aaroncz
|
||||
ms.collection:
|
||||
ms.collection: tier2
|
||||
appliesto:
|
||||
- ✅ <b>Windows 10</b>
|
||||
- ✅ <b>Windows 11</b>
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Configure access to Microsoft Store (Windows 10)
|
||||
title: Configure access to Microsoft Store
|
||||
description: Learn how to configure access to Microsoft Store for client computers and mobile devices in your organization.
|
||||
ms.reviewer:
|
||||
manager: aaroncz
|
||||
@ -9,7 +9,9 @@ ms.author: lizlong
|
||||
ms.topic: conceptual
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 11/29/2022
|
||||
ms.collection: highpri
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier2
|
||||
ms.technology: itpro-configure
|
||||
---
|
||||
|
||||
|
||||
@ -3,6 +3,7 @@ title: Administering UE-V with Windows PowerShell and WMI
|
||||
description: Learn how User Experience Virtualization (UE-V) provides Windows PowerShell cmdlets to help administrators perform various UE-V tasks.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Administering UE-V
|
||||
description: Learn how to perform administrative tasks for User Experience Virtualization (UE-V). These tasks include configuring the UE-V service and recovering lost settings.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Application Template Schema Reference for UE-V
|
||||
description: Learn details about the XML structure of the UE-V settings location templates and learn how to edit these files.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Changing the Frequency of UE-V Scheduled Tasks
|
||||
description: Learn how to create a script that uses the Schtasks.exe command-line options so you can change the frequency of UE-V scheduled tasks.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Configuring UE-V with Group Policy Objects
|
||||
description: In this article, learn how to configure User Experience Virtualization (UE-V) with Group Policy objects.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Configuring UE-V with Microsoft Configuration Manager
|
||||
description: Learn how to configure User Experience Virtualization (UE-V) with Microsoft Configuration Manager.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Deploy required UE-V features
|
||||
description: Learn how to install and configure User Experience Virtualization (UE-V) features, for example, a network share that stores and retrieves user settings.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Use UE-V with custom applications
|
||||
description: Use User Experience Virtualization (UE-V) to create your own custom settings location templates with the UE-V template generator.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: User Experience Virtualization for Windows 10, version 1607
|
||||
description: Overview of User Experience Virtualization for Windows 10, version 1607
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 05/02/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Get Started with UE-V
|
||||
description: Use the steps in this article to deploy User Experience Virtualization (UE-V) for the first time in a test environment.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 03/08/2018
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Manage Administrative Backup and Restore in UE-V
|
||||
description: Learn how an administrator of User Experience Virtualization (UE-V) can back up and restore application and Windows settings to their original state.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Manage Configurations for UE-V
|
||||
description: Learn to manage the configuration of the User Experience Virtualization (UE-V) service and also learn to manage storage locations for UE-V resources.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Managing UE-V Settings Location Templates Using Windows PowerShell and WM
|
||||
description: Managing UE-V Settings Location Templates Using Windows PowerShell and WMI
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Manage UE-V Service and Packages with Windows PowerShell and WMI
|
||||
description: Managing the UE-V service and packages with Windows PowerShell and WMI
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Migrating UE-V settings packages
|
||||
description: Learn to relocate User Experience Virtualization (UE-V) user settings packages either when you migrate to a new server or when you perform backups.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Prepare a UE-V Deployment
|
||||
description: Learn about the types of User Experience Virtualization (UE-V) deployment you can execute and what preparations you can make beforehand to be successful.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: User Experience Virtualization (UE-V) Release Notes
|
||||
description: Read the latest information required to successfully install and use User Experience Virtualization (UE-V) that isn't included in the UE-V documentation.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Security Considerations for UE-V
|
||||
description: Learn about accounts and groups, log files, and other security-related considerations for User Experience Virtualization (UE-V).
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Sync Methods for UE-V
|
||||
description: Learn how User Experience Virtualization (UE-V) service sync methods let you synchronize users’ application and Windows settings with the settings storage location.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Sync Trigger Events for UE-V
|
||||
description: Learn how User Experience Virtualization (UE-V) lets you synchronize your application and Windows settings across all your domain-joined devices.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Synchronizing Microsoft Office with UE-V
|
||||
description: Learn how User Experience Virtualization (UE-V) supports the synchronization of Microsoft Office application settings.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Technical Reference for UE-V
|
||||
description: Use this technical reference to learn about the various features of User Experience Virtualization (UE-V).
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Troubleshooting UE-V
|
||||
description: Use this technical reference to find resources for troubleshooting User Experience Virtualization (UE-V) for Windows 10.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Upgrade to UE-V for Windows 10
|
||||
description: Use these few adjustments to upgrade from User Experience Virtualization (UE-V) 2.x to the latest version of UE-V.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Using UE-V with Application Virtualization applications
|
||||
description: Learn how to use User Experience Virtualization (UE-V) with Microsoft Application Virtualization (App-V).
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: What's New in UE-V for Windows 10, version 1607
|
||||
description: Learn about what's new in User Experience Virtualization (UE-V) for Windows 10, including new features and capabilities.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -3,6 +3,7 @@ title: Working with Custom UE-V Templates and the UE-V Template Generator
|
||||
description: Create your own custom settings location templates by working with Custom User Experience Virtualization (UE-V) Templates and the UE-V Template Generator.
|
||||
author: aczechowski
|
||||
ms.prod: windows-client
|
||||
ms.collection: tier3
|
||||
ms.date: 04/19/2017
|
||||
ms.reviewer:
|
||||
manager: dougeby
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Customize and manage the Windows 10 Start and taskbar layout (Windows 10) | Microsoft Docs
|
||||
title: Customize and manage the Windows 10 Start and taskbar layout
|
||||
description: On Windows devices, customize the start menu layout and taskbar using XML, group policy, provisioning package, or MDM policy. You can add pinned folders, add a start menu size, pin apps to the taskbar, and more.
|
||||
ms.reviewer:
|
||||
manager: aaroncz
|
||||
@ -9,7 +9,9 @@ ms.author: lizlong
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 08/05/2021
|
||||
ms.collection: highpri
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier2
|
||||
ms.technology: itpro-configure
|
||||
---
|
||||
|
||||
@ -25,7 +27,7 @@ ms.technology: itpro-configure
|
||||
>
|
||||
> **Looking for OEM information?** See [Customize the Taskbar](/windows-hardware/customize/desktop/customize-the-windows-11-taskbar) and [Customize the Start layout](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu).
|
||||
|
||||
Your organization can deploy a customized Start and taskbar to Windows 10 Professional, Enterprise, or Education devices. Use a standard, customized Start layout on devices that are common to multiple users, and devices that are locked down. Configuring the taskbar allows you to pin useful apps for your users, and remove apps that are pinned by default.
|
||||
Your organization can deploy a customized Start and taskbar to Windows 10 Professional, Enterprise, or Education devices. Use a standard, customized Start layout on devices that are common to multiple users, and devices that are locked down. Configuring the taskbar allows you to pin useful apps for your users, and remove apps that are pinned by default.
|
||||
|
||||
>[!NOTE]
|
||||
>Support for applying a customized taskbar using MDM is added in Windows 10, version 1703.
|
||||
@ -215,7 +217,7 @@ On Windows 10 version 1607 and later, the new taskbar layout for upgrades apply
|
||||
|
||||
If your Start layout customization isn't applied as you expect, open the **Event Viewer**. Go to **Applications and Services Log** > **Microsoft** > **Windows** > **ShellCommon-StartLayoutPopulation** > **Operational**. Look for the following events:
|
||||
|
||||
- **Event 22**: The XML is malformed. The specified file isn’t valid XML. This event can happen if the file has extra spaces or unexpected characters. Or, if the file isn't saved in the UTF8 format.
|
||||
- **Event 22**: The XML is malformed. The specified file isn't valid XML. This event can happen if the file has extra spaces or unexpected characters. Or, if the file isn't saved in the UTF8 format.
|
||||
- **Event 64**: The XML is valid, and has unexpected values. This event can happen when the configuration isn't understood, elements aren't in [the required order](start-layout-xml-desktop.md#required-order), or source isn't found, such as a missing or misspelled `.lnk`.
|
||||
|
||||
## Next steps
|
||||
|
||||
@ -9,7 +9,8 @@ ms.reviewer:
|
||||
manager: aaroncz
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/20/2022
|
||||
ms.topic: reference
|
||||
ms.topic: conceptual
|
||||
ms.collection: tier1
|
||||
appliesto:
|
||||
- ✅ <b>Windows 10</b>
|
||||
- ✅ <b>Windows 11</b>
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Configure Windows Spotlight on the lock screen (Windows 10)
|
||||
title: Configure Windows Spotlight on the lock screen
|
||||
description: Windows Spotlight is an option for the lock screen background that displays different background images on the lock screen.
|
||||
ms.reviewer:
|
||||
manager: aaroncz
|
||||
@ -9,7 +9,9 @@ ms.author: lizlong
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 04/30/2018
|
||||
ms.collection: highpri
|
||||
ms.collection:
|
||||
- highpri
|
||||
- tier2
|
||||
ms.technology: itpro-configure
|
||||
---
|
||||
|
||||
@ -23,7 +25,7 @@ ms.technology: itpro-configure
|
||||
|
||||
Windows Spotlight is an option for the lock screen background that displays different background images and occasionally offers suggestions on the lock screen. Windows Spotlight is available in all desktop editions of Windows 10.
|
||||
|
||||
For managed devices running Windows 10 Enterprise and Windows 10 Education, enterprise administrators can configure a mobile device management (MDM) or Group Policy setting to prevent users from using the Windows Spotlight background. For managed devices running Windows 10 Pro, version 1607, administrators can disable suggestions for third party apps.
|
||||
For managed devices running Windows 10 Enterprise and Windows 10 Education, enterprise administrators can configure a mobile device management (MDM) or Group Policy setting to prevent users from using the Windows Spotlight background. For managed devices running Windows 10 Pro, version 1607, administrators can disable suggestions for third party apps.
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
@ -99,4 +101,4 @@ The recommendation for custom lock screen images that include text (such as a le
|
||||
[Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -166,19 +166,30 @@
|
||||
href: update/waas-configure-wufb.md
|
||||
- name: Use Windows Update for Business and WSUS
|
||||
href: update/wufb-wsus.md
|
||||
- name: Windows Update for Business deployment service
|
||||
href: update/deployment-service-overview.md
|
||||
items:
|
||||
- name: Troubleshoot the Windows Update for Business deployment service
|
||||
href: update/deployment-service-troubleshoot.md
|
||||
- name: Enforcing compliance deadlines for updates
|
||||
href: update/wufb-compliancedeadlines.md
|
||||
- name: Integrate Windows Update for Business with management solutions
|
||||
href: update/waas-integrate-wufb.md
|
||||
- name: 'Walkthrough: use Group Policy to configure Windows Update for Business'
|
||||
href: update/waas-wufb-group-policy.md
|
||||
- name: 'Walkthrough: use Intune to configure Windows Update for Business'
|
||||
- name: 'Walkupdatesthrough: use Intune to configure Windows Update for Business'
|
||||
href: update/deploy-updates-intune.md
|
||||
- name: Windows Update for Business deployment service
|
||||
items:
|
||||
- name: Windows Update for Business deployment service overview
|
||||
href: update/deployment-service-overview.md
|
||||
- name: Prerequisites for Windows Update for Business deployment service
|
||||
href: update/deployment-service-prerequisites.md
|
||||
- name: Deploy updates with the deployment service
|
||||
items:
|
||||
- name: Deploy feature updates using Graph Explorer
|
||||
href: update/deployment-service-feature-updates.md
|
||||
- name: Deploy expedited updates using Graph Explorer
|
||||
href: update/deployment-service-expedited-updates.md
|
||||
- name: Deploy driver and firmware updates using Graph Explorer
|
||||
href: update/deployment-service-drivers.md
|
||||
- name: Troubleshoot Windows Update for Business deployment service
|
||||
href: update/deployment-service-troubleshoot.md
|
||||
- name: Monitor
|
||||
items:
|
||||
- name: Windows Update for Business reports
|
||||
|
||||
@ -25,6 +25,8 @@
|
||||
href: delivery-optimization-workflow.md
|
||||
- name: Using a proxy with Delivery Optimization
|
||||
href: delivery-optimization-proxy.md
|
||||
- name: Testing Delivery Optimization
|
||||
href: delivery-optimization-test.md
|
||||
- name: Microsoft Connected Cache
|
||||
items:
|
||||
- name: Microsoft Connected Cache overview
|
||||
|
||||
@ -20,14 +20,13 @@ ms.date: 12/31/2017
|
||||
|
||||
## Download request workflow
|
||||
|
||||
This workflow allows Delivery Optimization to securely and efficiently deliver requested content to the calling device. Delivery Optimization uses content metadata to determine all available locations to pull content from, as well as content verification.
|
||||
|
||||
This workflow allows Delivery Optimization to securely and efficiently deliver requested content to the calling device. Delivery Optimization uses content metadata to verify the content and to determine all available locations to pull content from.
|
||||
|
||||
1. When a download starts, the Delivery Optimization client attempts to get its content metadata. This content metadata is a hash file containing the SHA-256 block-level hashes of each piece in the file (typically one piece = 1 MB).
|
||||
2. The authenticity of the content metadata file itself is verified prior to any content being downloaded using a hash that is obtained via an SSL channel from the Delivery Optimization service. The same channel is used to ensure the content is curated and authorized to leverage peer-to-peer.
|
||||
2. The authenticity of the content metadata file itself is verified prior to any content being downloaded using a hash that is obtained via an SSL channel from the Delivery Optimization service. The same channel is used to ensure the content is curated and authorized to use peer-to-peer.
|
||||
3. When Delivery Optimization pulls a certain piece of the hash from another peer, it verifies the hash against the known hash in the content metadata file.
|
||||
4. If a peer provides an invalid piece, that piece is discarded. When a peer sends multiple bad pieces, it's banned and will no longer be used as a source by the Delivery Optimization client performing the download.
|
||||
5. If Delivery Optimization is unable to obtain the content metadata file, or if the verification of the hash file itself fails, the download will fall back to "simple mode” (pulling content only from an HTTP source) and peer-to-peer won't be allowed.
|
||||
5. If Delivery Optimization is unable to obtain the content metadata file, or if the verification of the hash file itself fails, the download will fall back to "simple mode”. Simple mode will only pull content from the HTTP source and peer-to-peer won't be allowed.
|
||||
6. Once downloading is complete, Delivery Optimization uses all retrieved pieces of the content to put the file together. At that point, the Delivery Optimization caller (for example, Windows Update) checks the entire file to verify the signature prior to installing it.
|
||||
|
||||
## Delivery Optimization service endpoint and data information
|
||||
@ -35,8 +34,8 @@ This workflow allows Delivery Optimization to securely and efficiently deliver r
|
||||
|Endpoint hostname | Port|Name|Description|Data sent from the computer to the endpoint
|
||||
|--------------------------------------------|--------|---------------|-----------------------|------------------------|
|
||||
| geover-prod.do.dsp.mp.microsoft.com <br> geo-prod.do.dsp.mp.microsoft.com <br> geo.prod.do.dsp.mp.microsoft.com <br> geover.prod.do.dsp.mp.microsoft.com | 443 | Geo | Service used to identify the location of the device in order to direct it to the nearest data center. | **Profile**: The device type (for example, PC or Xbox) <br> **doClientVersion**: The version of the DoSvc client <br> **groupID**: Group the device belongs to (set with DownloadMode = '2' (Group download mode) + groupID group policy / MDM policies) |
|
||||
| kv\*.prod.do.dsp.mp.microsoft.com | 443| KeyValue | Bootstrap service provides endpoints for all other services as well as device configs. | **countryCode**: The country the client is connected from <br> **doClientVersion**: The version of the DoSvc client <br> **Profile**: The device type (for example, PC or Xbox) <br> **eId**: Client grouping Id <br> **CacheHost**: Cache host id |
|
||||
| cp\*.prod.do.dsp.mp.microsoft.com <br> | 443 | Content Policy | Provides content specific policies as well as content metadata URLs. | **Profile**: The device type (for example, PC or Xbox) <br> **ContentId**: The content identifier <br> **doClientVersion**: The version of the DoSvc client <br> **countryCode**: The country the client is connected from <br> **altCatalogId**: If ContentId isn't available, use the download URL instead <br> **eId**: Client grouping Id <br> **CacheHost**: Cache host id |
|
||||
| disc\*.prod.do.dsp.mp.microsoft.com | 443 | Discovery | Directs clients to a particular instance of the peer matching service (Array), ensuing that clients are collocated by factors, such as content, groupId and external IP. | **Profile**: The device type (for example, PC or Xbox) <br> **ContentId**: The content identifier <br> **doClientVersion**: The version of the DoSvc client <br> **partitionId**: Client partitioning hint <br> **altCatalogId**: If ContentId isn't available, use the download URL instead <br> **eId**: Client grouping Id |
|
||||
| array\*.prod.do.dsp.mp.microsoft.com | 443 | Arrays | Provides the client with list of peers that have the same content and belong to the same peer group. | **Profile**: The device type (for example, PC or Xbox) <br> **ContentId**: The content identifier <br> **doClientVersion**: The version of the DoSvc client <br> **altCatalogId**: If ContentId isn't available, use the download URL instead <br> **PeerId**: Identity of the device running DO client <br> **ReportedIp**: The internal / private IP Address <br> **IsBackground**: Is the download interactive or background <br> **Uploaded**: Total bytes uploaded to peers <br> **Downloaded**: Total bytes downloaded from peers <br> **DownloadedCdn**: Total bytes downloaded from CDN <br> **Left**: Bytes left to download <br> **Peers Wanted**: Total number of peers wanted <br> **Group Id**: Group the device belongs to (set via DownloadMode 2 + Group ID GP / MDM policies) <br> **Scope**: The Download mode <br> **UploadedBPS**: The upload speed in bytes per second <br> **DownloadBPS**: The download speed in Bytes per second <br> **eId**: Client grouping Id |
|
||||
| kv\*.prod.do.dsp.mp.microsoft.com | 443| KeyValue | Bootstrap service provides endpoints for all other services and device configs. | **countryCode**: The country the client is connected from <br> **doClientVersion**: The version of the DoSvc client <br> **Profile**: The device type (for example, PC or Xbox) <br> **eId**: Client grouping ID <br> **CacheHost**: Cache host ID |
|
||||
| cp\*.prod.do.dsp.mp.microsoft.com <br> | 443 | Content Policy | Provides content specific policies and as content metadata URLs. | **Profile**: The device type (for example, PC or Xbox) <br> **ContentId**: The content identifier <br> **doClientVersion**: The version of the DoSvc client <br> **countryCode**: The country the client is connected from <br> **altCatalogID**: If ContentID isn't available, use the download URL instead <br> **eID**: Client grouping ID <br> **CacheHost**: Cache host ID |
|
||||
| disc\*.prod.do.dsp.mp.microsoft.com | 443 | Discovery | Directs clients to a particular instance of the peer matching service (Array), ensuing that clients are collocated by factors, such as content, groupID and external IP. | **Profile**: The device type (for example, PC or Xbox) <br> **ContentID**: The content identifier <br> **doClientVersion**: The version of the DoSvc client <br> **partitionID**: Client partitioning hint <br> **altCatalogID**: If ContentID isn't available, use the download URL instead <br> **eID**: Client grouping ID |
|
||||
| array\*.prod.do.dsp.mp.microsoft.com | 443 | Arrays | Provides the client with list of peers that have the same content and belong to the same peer group. | **Profile**: The device type (for example, PC or Xbox) <br> **ContentID**: The content identifier <br> **doClientVersion**: The version of the DoSvc client <br> **altCatalogID**: If ContentID isn't available, use the download URL instead <br> **PeerID**: Identity of the device running DO client <br> **ReportedIp**: The internal / private IP Address <br> **IsBackground**: Is the download interactive or background <br> **Uploaded**: Total bytes uploaded to peers <br> **Downloaded**: Total bytes downloaded from peers <br> **DownloadedCdn**: Total bytes downloaded from CDN <br> **Left**: Bytes left to download <br> **Peers Wanted**: Total number of peers wanted <br> **Group ID**: Group the device belongs to (set via DownloadMode 2 + Group ID GP / MDM policies) <br> **Scope**: The Download mode <br> **UploadedBPS**: The upload speed in bytes per second <br> **DownloadBPS**: The download speed in Bytes per second <br> **eID**: Client grouping ID |
|
||||
| dl.delivery.mp.microsoft.com <br> emdl.ws.microsoft.com | 80 | Delivery Optimization metadata file hosting | CDN hostnames for Delivery Optimization content metadata files | Metadata download can come from different hostnames, but it's required for peer to peer. |
|
||||
|
||||
@ -59,8 +59,7 @@ landingContent:
|
||||
- text: Optimize Windows 10 or later update delivery with Configuration Manager
|
||||
url: /mem/configmgr/sum/deploy-use/optimize-windows-10-update-delivery#windows-delivery-optimization
|
||||
- text: Delivery Optimization settings in Microsoft Intune
|
||||
url: /mem/intune/configuration/delivery-optimization-windows
|
||||
|
||||
url: /mem/intune/configuration/delivery-optimization-windows
|
||||
|
||||
# Card
|
||||
- title: Microsoft Connected Cache (MCC) for Enterprise and Education
|
||||
|
||||
@ -20,59 +20,57 @@ ms.date: 12/31/2017
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
> **Looking for more Group Policy settings?** See the master spreadsheet available at the [Download Center](https://www.microsoft.com/download/details.aspx?id=103506).
|
||||
> **Looking for Group Policy objects?** See [Delivery Optimization reference](waas-delivery-optimization-reference.md) or the master spreadsheet available at the Download Center [for Windows 11](https://www.microsoft.com/en-us/download/details.aspx?id=104594) or [for Windows 10](https://www.microsoft.com/en-us/download/details.aspx?id=104678).
|
||||
|
||||
There are a great many details you can set in Delivery Optimization to customize it to do just what you need it to. This topic summarizes them for your reference. If you just need an overview of Delivery Optimization, see [Delivery Optimization for Windows client updates](waas-delivery-optimization.md). If you need information about setting up Delivery Optimization, including tips for the best settings in different scenarios, see [Set up Delivery Optimization for Windows client updates](waas-delivery-optimization-setup.md).
|
||||
There are many configuration options you can set in Delivery Optimization to customize the content delivery experience specific to your environment needs. This topic summarizes those configurations for your reference. If you just need an overview of Delivery Optimization, see [What is Delivery Optimization](waas-delivery-optimization.md). If you need information about setting up Delivery Optimization, including tips for the best settings in different scenarios, see [Set up Delivery Optimization for Windows](waas-delivery-optimization-setup.md).
|
||||
|
||||
## Delivery Optimization options
|
||||
|
||||
You can use Group Policy or an MDM solution like Intune to configure Delivery Optimization.
|
||||
|
||||
You will find the Delivery Optimization settings in Group Policy under **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization**.
|
||||
You'll find the Delivery Optimization settings in Group Policy under **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization**.
|
||||
In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimization/**.
|
||||
|
||||
[//]: # (something about Intune UX--perhaps link to relevant Intune docs?)
|
||||
|
||||
### Summary of Delivery Optimization settings
|
||||
|
||||
| Group Policy setting | MDM setting | Supported from version |
|
||||
| --- | --- | --- |
|
||||
| [Download mode](#download-mode) | DODownloadMode | 1511 |
|
||||
| [Group ID](#group-id) | DOGroupID | 1511 |
|
||||
| [Minimum RAM (inclusive) allowed to use Peer Caching](#minimum-ram-inclusive-allowed-to-use-peer-caching) | DOMinRAMAllowedToPeer | 1703 |
|
||||
| [Minimum disk size allowed to use Peer Caching](#minimum-disk-size-allowed-to-use-peer-caching) | DOMinDiskSizeAllowedToPeer | 1703 |
|
||||
| [Max Cache Age](#max-cache-age) | DOMaxCacheAge | 1511 |
|
||||
| [Max Cache Size](#max-cache-size) | DOMaxCacheSize | 1511 |
|
||||
| [Absolute Max Cache Size](#absolute-max-cache-size) | DOAbsoluteMaxCacheSize | 1607 |
|
||||
| [Modify Cache Drive](#modify-cache-drive) | DOModifyCacheDrive | 1607 |
|
||||
| [Minimum Peer Caching Content File Size](#minimum-peer-caching-content-file-size) | DOMinFileSizeToCache | 1703 |
|
||||
| [Maximum Download Bandwidth](#maximum-download-bandwidth) | DOMaxDownloadBandwidth | 1607 (removed in Windows 10, version 2004; use [Maximum Background Download Bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) or [Maximum Foreground Download Bandwidth (in KB/s)](#maximum-foreground-download-bandwidth-in-kbs) instead)|
|
||||
| [Percentage of Maximum Download Bandwidth](#percentage-of-maximum-download-bandwidth) | DOPercentageMaxDownloadBandwidth | 1607 (removed in Windows 10, version 2004; use [Maximum Background Download Bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) or [Maximum Foreground Download Bandwidth (in KB/s)](#maximum-foreground-download-bandwidth-in-kbs) instead)|
|
||||
| [Max Upload Bandwidth](#max-upload-bandwidth) | DOMaxUploadBandwidth | 1607 (removed in Windows 10, version 2004) |
|
||||
| [Monthly Upload Data Cap](#monthly-upload-data-cap) | DOMonthlyUploadDataCap | 1607 |
|
||||
| [Minimum Background QoS](#minimum-background-qos) | DOMinBackgroundQoS | 1607 |
|
||||
| [Enable Peer Caching while the device connects via VPN](#enable-peer-caching-while-the-device-connects-via-vpn) | DOAllowVPNPeerCaching | 1709 |
|
||||
| [Allow uploads while the device is on battery while under set Battery level](#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) | DOMinBatteryPercentageAllowedToUpload | 1709 |
|
||||
| [MaxForegroundDownloadBandwidth](#maximum-foreground-download-bandwidth) | DOPercentageMaxForegroundBandwidth | 1803 |
|
||||
| [MaxBackgroundDownloadBandwidth](#maximum-background-download-bandwidth) | DOPercentageMaxBackgroundBandwidth | 1803 |
|
||||
| [SetHoursToLimitBackgroundDownloadBandwidth](#set-business-hours-to-limit-background-download-bandwidth) | DOSetHoursToLimitBackgroundDownloadBandwidth | 1803 |
|
||||
| [SetHoursToLimitForegroundDownloadBandwidth](#set-business-hours-to-limit-foreground-download-bandwidth) |DOSetHoursToLimitForegroundDownloadBandwidth | 1803 |
|
||||
| [Select a method to restrict Peer Selection](#select-a-method-to-restrict-peer-selection) |DORestrictPeerSelectionBy | 1803 |
|
||||
| [Select the source of Group IDs](#select-the-source-of-group-ids) | DOGroupIDSource | 1803 |
|
||||
| [Delay background download from http (in secs)](#delay-background-download-from-http-in-secs) | DODelayBackgroundDownloadFromHttp | 1803 |
|
||||
| [Delay foreground download from http (in secs)](#delay-foreground-download-from-http-in-secs) | DODelayForegroundDownloadFromHttp | 1803 |
|
||||
| [Delay foreground download cache server fallback (in secs)](#delay-foreground-download-cache-server-fallback-in-secs) | DelayCacheServerFallbackForeground | 1903 |
|
||||
| [Delay background download cache server fallback (in secs)](#delay-background-download-cache-server-fallback-in-secs) | DelayCacheServerFallbackBackground | 1903 |
|
||||
| [Cache Server Hostname](#cache-server-hostname) | DOCacheHost | 1809 |
|
||||
| [Cache Server Hostname Source](#cache-server-hostname-source) | DOCacheHostSource | 2004 |
|
||||
| [Maximum Foreground Download Bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) | DOMaxForegroundDownloadBandwidth | 2004 |
|
||||
| [Maximum Background Download Bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) | DOMaxBackgroundDownloadBandwidth | 2004 |
|
||||
| Group Policy setting | MDM setting | Supported from version | Notes |
|
||||
| --- | --- | --- | ------- |
|
||||
| [Download mode](#download-mode) | DODownloadMode | 1511 | Default is set to LAN(1). The Group [Download mode](#download-mode) (2) combined with [Group ID](#group-id), enables administrators to create custom device groups that will share content between devices in the group.|
|
||||
| [Group ID](#group-id) | DOGroupID | 1511 | Used with Group [Download mode](#download-mode). If not set, check [GroupIDSource](#select-the-source-of-group-ids). When GroupID or GroupIDSource policies aren't set, the GroupID will be defined as the AD Site (1), Authenticated domain SID (2) or AAD Tenant ID (5), in that order. |
|
||||
| [Select the source of Group IDs](#select-the-source-of-group-ids) | DOGroupIDSource | 1803 | If not set, check [Group ID](#group-id). When the GroupID or GroupIDSource policies aren't set, the Group will be defined as the AD Site (1), Authenticated domain SID (2) or AAD Tenant ID (5), in that order. |
|
||||
| [Select a method to restrict peer selection](#select-a-method-to-restrict-peer-selection) | DORestrictPeerSelectionBy | 1803 | Starting in Windows 11, consumer devices default to using 'Local discovery (DNS-SD)' and commercial devices default to using 'Subnet'. |
|
||||
| [Minimum RAM (inclusive) allowed to use peer caching](#minimum-ram-inclusive-allowed-to-use-peer-caching) | DOMinRAMAllowedToPeer | 1703 | Default value is 4 GB. |
|
||||
| [Minimum disk size allowed to use peer caching](#minimum-disk-size-allowed-to-use-peer-caching) | DOMinDiskSizeAllowedToPeer | 1703 | Default value is 32 GB. |
|
||||
| [Max cache age](#max-cache-age) | DOMaxCacheAge | 1511 | Default value is 259,200 seconds (three days). |
|
||||
| [Max cache size](#max-cache-size) | DOMaxCacheSize | 1511 | Default value is 20%. |
|
||||
| [Absolute max cache size (in GBs)](#absolute-max-cache-size) | DOAbsoluteMaxCacheSize | 1607 | Default value is 10 GB.|
|
||||
| [Modify cache drive](#modify-cache-drive) | DOModifyCacheDrive | 1607 | Default to the operating system drive through the %SYSTEMDRIVE% environment variable. |
|
||||
| [Minimum peer caching content file size](#minimum-peer-caching-content-file-size) | DOMinFileSizeToCache | 1703 | Default file size is 50 MB. |
|
||||
| [Monthly upload data cap](#monthly-upload-data-cap) | DOMonthlyUploadDataCap | 1607 | Default value is 20 GB. |
|
||||
| [Minimum background QoS](#minimum-background-qos) | DOMinBackgroundQoS | 1607 | Recommend setting this to 500 KB/s. Default value is 2500 KB/s. |
|
||||
| [Enable peer caching while the device connects via VPN](#enable-peer-caching-while-the-device-connects-via-vpn) | DOAllowVPNPeerCaching | 1709 | Default is to not allow peering while on VPN. |
|
||||
| [Allow uploads while the device is on battery while under set battery level](#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) | DOMinBatteryPercentageAllowedToUpload | 1709 | Default is to not allow peering while on battery. |
|
||||
| [Maximum foreground download bandwidth (percentage)](#maximum-foreground-download-bandwidth) | DOPercentageMaxForegroundBandwidth | 1803 | Default is '0' which will dynamically adjust. |
|
||||
| [Maximum background download bandwidth (percentage)](#maximum-background-download-bandwidth) | DOPercentageMaxBackgroundBandwidth | 1803 | Default is '0' which will dynamically adjust. |
|
||||
| [Maximum foreground download bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) | DOMaxForegroundDownloadBandwidth | 2004 | Default is '0' which will dynamically adjust. |
|
||||
| [Maximum background download bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) | DOMaxBackgroundDownloadBandwidth | 2004 | Default is '0' which will dynamically adjust. |
|
||||
| [Set hours to limit background download bandwidth](#set-business-hours-to-limit-background-download-bandwidth) | DOSetHoursToLimitBackgroundDownloadBandwidth | 1803 | Default isn't set. |
|
||||
| [Set hours to limit foreground download bandwidth](#set-business-hours-to-limit-foreground-download-bandwidth) |DOSetHoursToLimitForegroundDownloadBandwidth | 1803 | Default isn't set. |
|
||||
| [Delay background download from HTTP (in secs)](#delay-background-download-from-http-in-secs) | DODelayBackgroundDownloadFromHttp | 1803 | Default isn't set. For peering, use this policy to delay the fallback to the HTTP source. [Learn more](#policies-to-prioritize-the-use-of-peer-to-peer-and-cache-server-sources) about the different delay options. |
|
||||
| [Delay foreground download from HTTP (in secs)](#delay-foreground-download-from-http-in-secs) | DODelayForegroundDownloadFromHttp | 1803 | Default isn't set. For peering, use this policy to delay the fallback to the HTTP source. [Learn more](#policies-to-prioritize-the-use-of-peer-to-peer-and-cache-server-sources) about the different delay options.|
|
||||
| [Delay foreground download Cache Server fallback (in secs)](#delay-foreground-download-cache-server-fallback-in-secs) | DelayCacheServerFallbackForeground | 1903 | Default isn't set. For Microsoft Connected Cache content use this policy to delay the fallback to the HTTP source. [Learn more](#policies-to-prioritize-the-use-of-peer-to-peer-and-cache-server-sources) about the different delay options. |
|
||||
| [Delay background download Cache Server fallback (in secs)](#delay-background-download-cache-server-fallback-in-secs) | DelayCacheServerFallbackBackground | 1903 | Default isn't set. For Microsoft Connected Cache content use this policy to delay the fallback to the HTTP source. [Learn more](#policies-to-prioritize-the-use-of-peer-to-peer-and-cache-server-sources) about the different delay options.|
|
||||
| [Cache Server Hostname](#cache-server-hostname) | DOCacheHost | 1809 | Default is it has no value. |
|
||||
| [Cache Server Hostname Source](#cache-server-hostname-source) | DOCacheHostSource | 2004 | Default is it has no value. |
|
||||
| [Maximum download bandwidth](#maximum-download-bandwidth) | DOMaxDownloadBandwidth | 1607 (deprecated in Windows 10, version 2004); use [Maximum background download bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) or [Maximum foreground download bandwidth (in KB/s)](#maximum-foreground-download-bandwidth-in-kbs) instead)| Default is '0' which will dynamically adjust. |
|
||||
| [Percentage of maximum download bandwidth](#percentage-of-maximum-download-bandwidth) | DOPercentageMaxDownloadBandwidth | 1607 (deprecated in Windows 10, version 2004); use [Maximum background download bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) or [Maximum foreground download bandwidth (in KB/s)](#maximum-foreground-download-bandwidth-in-kbs) instead)| Default is '0' which will dynamically adjust. |
|
||||
| [Maximum upload bandwidth](#max-upload-bandwidth) | DOMaxUploadBandwidth | 1607 (deprecated in Windows 10, version 2004) | Default is '0' (unlimited). |
|
||||
|
||||
### More detail on Delivery Optimization settings
|
||||
|
||||
[Group ID](#group-id), combined with Group [Download mode](#download-mode), enables administrators to create custom device groups that will share content between devices in the group.
|
||||
#### Locally cached updates
|
||||
|
||||
Delivery Optimization uses locally cached updates. In cases where devices have ample local storage and you would like to cache more content, or if you have limited storage and would like to cache less, use the following settings to adjust the Delivery Optimization cache to suit your scenario:
|
||||
Delivery Optimization uses locally cached updates to deliver contact via peers. The more content available in the cache, the more likely that peering can be used. In cases where devices have enough local storage and you'd like to cache more content. Likewise, if you have limited storage and would prefer to cache less, use the following settings to adjust the Delivery Optimization cache to suit your scenario:
|
||||
|
||||
- [Max Cache Size](#max-cache-size) and [Absolute Max Cache Size](#absolute-max-cache-size) control the amount of space the Delivery Optimization cache can use.
|
||||
- [Max Cache Age](#max-cache-age) controls the retention period for each update in the cache.
|
||||
@ -83,20 +81,35 @@ Delivery Optimization uses locally cached updates. In cases where devices have a
|
||||
|
||||
All cached files have to be above a set minimum size. This size is automatically set by the Delivery Optimization cloud services, but when local storage is sufficient and the network isn't strained or congested, administrators might choose to change it to obtain increased performance. You can set the minimum size of files to cache by adjusting [Minimum Peer Caching Content File Size](#minimum-peer-caching-content-file-size).
|
||||
|
||||
Additional options available that control the impact Delivery Optimization has on your network include the following:
|
||||
#### Impact to network
|
||||
|
||||
- [Maximum Download Bandwidth](#maximum-download-bandwidth) and [Percentage of Maximum Download Bandwidth](#percentage-of-maximum-download-bandwidth) control the download bandwidth used by Delivery Optimization.
|
||||
- [Max Upload Bandwidth](#max-upload-bandwidth) controls the Delivery Optimization upload bandwidth usage.
|
||||
- [Monthly Upload Data Cap](#monthly-upload-data-cap) controls the amount of data a client can upload to peers each month.
|
||||
- [Minimum Background QoS](#minimum-background-qos) lets administrators guarantee a minimum download speed for Windows updates. This setting adjusts the amount of data downloaded directly from Windows Update or WSUS servers, rather than other peers in the network.
|
||||
- [Maximum Foreground Download Bandwidth](#maximum-foreground-download-bandwidth) specifies the **maximum foreground download bandwidth** that Delivery Optimization uses, across all concurrent download activities, as a percentage of available download bandwidth.
|
||||
More options available that control the impact Delivery Optimization has on your network include the following:
|
||||
|
||||
- [Minimum Background QoS](#minimum-background-qos) lets administrators guarantee a minimum download speed for Windows updates. This setting adjusts the amount of data downloaded directly from HTTP sources, rather than other peers in the network.
|
||||
- [Maximum Foreground Download Bandwidth](#maximum-foreground-download-bandwidth) specifies the maximum foreground download bandwidth*hat Delivery Optimization uses, across all concurrent download activities, as a percentage of available download bandwidth.
|
||||
- [Maximum Background Download Bandwidth](#maximum-background-download-bandwidth) specifies the **maximum background download bandwidth** that Delivery Optimization uses, across all concurrent download activities, as a percentage of available download bandwidth.
|
||||
- [Set Business Hours to Limit Background Download Bandwidth](#set-business-hours-to-limit-background-download-bandwidth) specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.
|
||||
- [Set Business Hours to Limit Foreground Download Bandwidth](#set-business-hours-to-limit-foreground-download-bandwidth) specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth.
|
||||
- [Select a method to restrict Peer Selection](#select-a-method-to-restrict-peer-selection) restricts peer selection by the options you select.
|
||||
- [Select the source of Group IDs](#select-the-source-of-group-ids) restricts peer selection to a specific source.
|
||||
- [Delay background download from http (in secs)](#delay-background-download-from-http-in-secs) allows you to delay the use of an HTTP source in a background download that is allowed to use P2P.
|
||||
- [Delay foreground download from http (in secs)](#delay-foreground-download-from-http-in-secs) allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use P2P.
|
||||
|
||||
#### Policies to prioritize the use of Peer-to-Peer and Cache Server sources
|
||||
|
||||
When Delivery Optimization client is configured to use peers and Microsoft Connected Cache (MCC), to achieve the best possible content delivery experience, the client will connect to both MCC and peers in parallel. If the desired content can’t be obtained from MCC or peers, Delivery Optimization will automatically fallback to the HTTP source to get the requested content. There are four settings that allow you to prioritize peer-to-peer or MCC sources by delaying the immediate fallback to HTTP source which is the default behavior.
|
||||
|
||||
##### Peer-to-peer delay fallback settings
|
||||
|
||||
- [Delay foreground download from HTTP (in secs)](#delay-foreground-download-from-http-in-secs) allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use P2P.
|
||||
- [Delay background download from HTTP (in secs)](#delay-background-download-from-http-in-secs) allows you to delay the use of an HTTP source in a background download that is allowed to use P2P.
|
||||
|
||||
##### Microsoft Connected Cache (MCC) delay fallback settings
|
||||
|
||||
- [Delay foreground download Cache Server fallback (in secs)](#delay-foreground-download-cache-server-fallback-in-secs) allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use a cache server.
|
||||
- [Delay background download from HTTP (in secs)](#delay-background-download-from-http-in-secs) allows you to delay the use of an HTTP source in a background download that is allowed to use a cache server.
|
||||
|
||||
**If both peer-to-peer and MCC are configured, the peer-to-peer delay settings will take precedence over the cache server delay settings.** This allows Delivery Optimization to discover peers first then recognize the fallback setting for the MCC cache server.
|
||||
|
||||
#### System resource usage
|
||||
|
||||
Administrators can further customize scenarios where Delivery Optimization will be used with the following settings:
|
||||
|
||||
@ -107,7 +120,7 @@ Administrators can further customize scenarios where Delivery Optimization will
|
||||
|
||||
### Download mode
|
||||
|
||||
Download mode dictates which download sources clients are allowed to use when downloading Windows updates in addition to Windows Update servers. The following table shows the available download mode options and what they do. Additional technical details for these policies are available in [Policy CSP - Delivery Optimization](/windows/client-management/mdm/policy-csp-deliveryoptimization).
|
||||
Download mode dictates which download sources clients are allowed to use when downloading Windows updates in addition to Windows Update servers. The following table shows the available download mode options and what they do. Other technical details for these policies are available in [Policy CSP - Delivery Optimization](/windows/client-management/mdm/policy-csp-deliveryoptimization).
|
||||
|
||||
| Download mode option | Functionality when set |
|
||||
| --- | --- |
|
||||
@ -116,19 +129,17 @@ Download mode dictates which download sources clients are allowed to use when do
|
||||
| Group (2) | When group mode is set, the group is automatically selected based on the device's Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use GroupID option to create your own custom group independently of domains and AD DS sites. Starting with Windows 10, version 1803, you can use the GroupIDSource parameter to take advantage of other method to create groups dynamically. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. |
|
||||
| Internet (3) | Enable Internet peer sources for Delivery Optimization. |
|
||||
| Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable, unreachable or when the content file size is less than 10 MB. In this mode, Delivery Optimization provides a reliable download experience, with no peer-to-peer caching. |
|
||||
|Bypass (100) |Bypass Delivery Optimization and use BITS, instead. You should only select this mode if you use WSUS and prefer to use BranchCache. You do not need to set this option if you are using Configuration Manager. If you want to disable peer-to-peer functionality, it's best to set **DownloadMode** to **(0)** or **(99)**. |
|
||||
| Bypass (100) | This option is deprecated starting in Windows 11. If you want to disable peer-to-peer functionality, it's best to set DownloadMode to (0). If your device doesn’t have internet access, set Download Mode to (99). Bypass Delivery Optimization and use BITS, instead. You should only select this mode if you use WSUS and prefer to use BranchCache. You don't need to set this option if you're using Configuration Manager. |
|
||||
|
||||
> [!NOTE]
|
||||
> Starting in Windows 11, the Bypass option of Download Mode is no longer used.
|
||||
> Starting in Windows 11, the Bypass option of Download Mode is deprecated.
|
||||
>
|
||||
> [!NOTE]
|
||||
> When you use Azure Active Directory tenant, AD Site, or AD Domain as the source of group IDs, the association of devices participating in the group should not be relied on for an authentication of identity of those devices.
|
||||
|
||||
### Group ID
|
||||
|
||||
By default, peer sharing on clients using the Group download mode (option 2) is limited to the same domain in Windows 10, version 1511, and the same domain and Active Directory Domain Services site in Windows 10, version 1607. By using the Group ID setting, you can optionally create a custom group that contains devices that should participate in Delivery Optimization but do not fall within those domain or Active Directory Domain Services site boundaries, including devices in another domain. Using Group ID, you can further restrict the default group (for example, you could create a subgroup representing an office building), or extend the group beyond the domain, allowing devices in multiple domains in your organization to be peers. This setting requires the custom group to be specified as a GUID on each device that participates in the custom group.
|
||||
|
||||
[//]: # (Configuration Manager boundary group option; GroupID Source policy)
|
||||
By default, peer sharing on clients using the Group download mode (option 2) is limited to the same domain in Windows 10, version 1511, and the same domain and Active Directory Domain Services site in Windows 10, version 1607. By using the Group ID setting, you can optionally create a custom group that contains devices that should participate in Delivery Optimization but don't fall within those domain or Active Directory Domain Services site boundaries, including devices in another domain. Using Group ID, you can further restrict the default group (for example, you could create a subgroup representing an office building), or extend the group beyond the domain, allowing devices in multiple domains in your organization to be peers. This setting requires the custom group to be specified as a GUID on each device that participates in the custom group.
|
||||
|
||||
>[!NOTE]
|
||||
>To generate a GUID using Powershell, use [```[guid]::NewGuid()```](https://blogs.technet.microsoft.com/heyscriptingguy/2013/07/25/powertip-create-a-new-guid-by-using-powershell/)
|
||||
@ -139,14 +150,14 @@ By default, peer sharing on clients using the Group download mode (option 2) is
|
||||
|
||||
Starting in Windows 10, version 1803, set this policy to restrict peer selection to a specific source, when using a GroupID policy. The options are:
|
||||
|
||||
- 0 = not set
|
||||
- 0 = Not set
|
||||
- 1 = AD Site
|
||||
- 2 = Authenticated domain SID
|
||||
- 3 = DHCP Option ID (with this option, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID)
|
||||
- 4 = DNS Suffix
|
||||
- 5 = Starting with Windows 10, version 1903, you can use the Azure Active Directory (AAD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5.
|
||||
|
||||
When set, the Group ID is assigned automatically from the selected source. If you set this policy, the GroupID policy will be ignored. The default behavior, when neither the GroupID or GroupIDSource policies are set, is to determine the Group ID using AD Site (1), Authenticated domain SID (2) or AAD Tenant ID (5), in that order. If GroupIDSource is set to either DHCP Option ID (3) or DNS Suffix (4) and those methods fail, the default behavior is used instead. The option set in this policy only applies to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. If you set the value to anything other than 0-5, the policy is ignored.
|
||||
When set, the Group ID is assigned automatically from the selected source. If you set this policy, the GroupID policy will be ignored. The default behavior, when the GroupID or GroupIDSource policies aren't set, is to determine the Group ID using AD Site (1), Authenticated domain SID (2) or AAD Tenant ID (5), in that order. If GroupIDSource is set to either DHCP Option ID (3) or DNS Suffix (4) and those methods fail, the default behavior is used instead. The option set in this policy only applies to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. If you set the value to anything other than 0-5, the policy is ignored.
|
||||
|
||||
### Minimum RAM (inclusive) allowed to use Peer Caching
|
||||
|
||||
@ -165,7 +176,7 @@ In environments configured for Delivery Optimization, you might want to set an e
|
||||
|
||||
### Max Cache Size
|
||||
|
||||
This setting limits the maximum amount of space the Delivery Optimization cache can use as a percentage of the available drive space, from 1 to 100. For example, if you set this value to 10 on a Windows client device that has 100 GB of available drive space, then Delivery Optimization will use up to 10 GB of that space. Delivery Optimization will constantly assess the available drive space and automatically clear the cache to keep the maximum cache size under the set percentage. **The default value is 20**.
|
||||
This setting limits the maximum amount of space the Delivery Optimization cache can use as a percentage of the available drive space, from 1 to 100. For example, if you set this value to 10 on a Windows client device that has 100 GB of available drive space, then Delivery Optimization will use up to 10 GB of that space. Delivery Optimization will constantly assess the available drive space and automatically clear the cache to keep the maximum cache size under the set percentage. **The default value is 20%**.
|
||||
|
||||
### Absolute Max Cache Size
|
||||
|
||||
@ -173,7 +184,7 @@ This setting specifies the maximum number of gigabytes the Delivery Optimization
|
||||
|
||||
### Minimum Peer Caching Content File Size
|
||||
|
||||
This setting specifies the minimum content file size in MB enabled to use Peer Caching. The recommended values are from 1 to 100000. **The default file size is 50MB** to participate in peering.
|
||||
This setting specifies the minimum content file size in MB enabled to use Peer Caching. The recommended values are from 1 to 100000. **The default file size is 50 MB** to participate in peering.
|
||||
|
||||
### Maximum Download Bandwidth
|
||||
|
||||
@ -184,11 +195,11 @@ This setting specifies the maximum download bandwidth that can be used across al
|
||||
|
||||
### Maximum Foreground Download Bandwidth
|
||||
|
||||
Starting in Windows 10, version 1803, specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. **The default value of "0"** means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads. However, downloads from LAN peers are not throttled even when this policy is set.
|
||||
Starting in Windows 10, version 1803, specifies the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. **The default value of "0"** means that Delivery Optimization dynamically adjusts to use the available bandwidth for foreground downloads. However, downloads from LAN peers aren't throttled even when this policy is set.
|
||||
|
||||
### Maximum Background Download Bandwidth
|
||||
|
||||
Starting in Windows 10, version 1803, specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. **The default value of "0"** means that Delivery Optimization dynamically adjusts to use the available bandwidth for background downloads. However, downloads from LAN peers are not throttled even when this policy is set.
|
||||
Starting in Windows 10, version 1803, specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. **The default value of "0"** means that Delivery Optimization dynamically adjusts to use the available bandwidth for background downloads. However, downloads from LAN peers aren't throttled even when this policy is set.
|
||||
|
||||
### Percentage of Maximum Download Bandwidth
|
||||
|
||||
@ -199,43 +210,45 @@ This setting specifies the maximum download bandwidth that Delivery Optimization
|
||||
|
||||
### Max Upload Bandwidth
|
||||
|
||||
This setting allows you to limit the number of upload bandwidth individual clients can use for Delivery Optimization. Consider this setting when clients are providing content to requesting peers on the network. This option is set in kilobytes per second (KB/s). **The default value is "0", or "unlimited"** which means Delivery Optimization dynamically optimizes for minimal usage of upload bandwidth; however it does not cap the upload bandwidth rate at a set rate.
|
||||
This setting allows you to limit the number of upload bandwidth individual clients can use for Delivery Optimization. Consider this setting when clients are providing content to requesting peers on the network. This option is set in kilobytes per second (KB/s). **The default value is "0" or "unlimited"** which means Delivery Optimization dynamically optimizes for minimal usage of upload bandwidth; however it doesn't cap the upload bandwidth rate at a set rate.
|
||||
|
||||
### Set Business Hours to Limit Background Download Bandwidth
|
||||
|
||||
Starting in Windows 10, version 1803, specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. **By default, this policy is not set.**
|
||||
Starting in Windows 10, version 1803, specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. **By default, this policy isn't set.**
|
||||
|
||||
### Set Business Hours to Limit Foreground Download Bandwidth
|
||||
|
||||
Starting in Windows 10, version 1803, specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. **By default, this policy is not set.**
|
||||
Starting in Windows 10, version 1803, specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. **By default, this policy isn't set.**
|
||||
|
||||
### Select a method to restrict peer selection
|
||||
|
||||
Starting in Windows 10, version 1803, set this policy to restrict peer selection via selected option. In Windows 11 the 'Local Peer Discovery' option was introduced to restrict peer discovery to the local network. Currently the available options include: 0 = NAT, 1 = Subnet mask, and 2 = Local Peer Discovery. These options apply to both Download Modes LAN (1) and Group (2) and therefore means there is no peering between subnets. **The default value in Windows 11 is set to "Local Peer Discovery"**.
|
||||
Starting in Windows 10, version 1803, set this policy to restrict peer selection via selected option. In Windows 11 the 'Local Peer Discovery' option was introduced to restrict peer discovery to the local network. Currently the available options include: 0 = NAT, 1 = Subnet mask, and 2 = Local Peer Discovery. These options apply to both Download Modes LAN (1) and Group (2) and therefore means there's no peering between subnets. **The default value in Windows 11 is set to "Local Peer Discovery"**.
|
||||
|
||||
If Group mode is set, Delivery Optimization will connect to locally discovered peers that are also part of the same Group (have the same Group ID).
|
||||
|
||||
The Local Peer Discovery (DNS-SD) option can only be set via MDM delivered policies on Windows 11 builds. This feature can be enabled in supported Windows 10 builds by setting the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DORestrictPeerSelectionBy` value to **2**.
|
||||
|
||||
### Delay background download from http (in secs)
|
||||
### Delay background download from HTTP (in secs)
|
||||
|
||||
Starting in Windows 10, version 1803, this allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer. The maximum value is 4294967295 seconds. **By default, this policy is not set.**
|
||||
Starting in Windows 10, version 1803, this allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer. The maximum value is 4294967295 seconds. **By default, this policy isn't set.**
|
||||
|
||||
### Delay foreground download from http (in secs)
|
||||
### Delay foreground download from HTTP (in secs)
|
||||
|
||||
Starting in Windows 10, version 1803, allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer. The maximum value is 4294967295 seconds. **By default, this policy is not set.**
|
||||
Starting in Windows 10, version 1803, allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer. The maximum value is 4294967295 seconds. **By default, this policy isn't set.**
|
||||
|
||||
### Delay Foreground Download Cache Server Fallback (in secs)
|
||||
|
||||
Starting in Windows 10, version 1903, allows you to delay the fallback from cache server to the HTTP source for foreground content download by X seconds. If you set the policy to delay foreground download from http, it will apply first (to allow downloads from peers first). **By default, this policy is not set.**
|
||||
Starting in Windows 10, version 1903, allows you to delay the fallback from cache server to the HTTP source for foreground content download by X seconds. If the 'Delay foreground download from HTTP' policy is set, it will apply first (to allow downloads from peers) and then this policy will be applied. **By default, this policy isn't set.**
|
||||
|
||||
By default this policy isn't set. So,
|
||||
|
||||
### Delay Background Download Cache Server Fallback (in secs)
|
||||
|
||||
Starting in Windows 10, version 1903, set this policy to delay the fallback from cache server to the HTTP source for a background content download by X seconds. If you set the policy to delay background download from http, it will apply first (to allow downloads from peers first). **By default, this policy is not set.**
|
||||
Starting in Windows 10, version 1903, set this policy to delay the fallback from cache server to the HTTP source for a background content download by X seconds. If the 'Delay background download from HTTP' policy is set, it will apply first (to allow downloads from peers) and then this policy will be applied. **By default, this policy isn't set.**
|
||||
|
||||
### Minimum Background QoS
|
||||
|
||||
This value specifies the minimum download speed guarantee that a client attempts to achieve and will fulfill by downloading more kilobytes from Windows Update servers or WSUS. The lower this value is, the more content will be sourced using peers on the network rather than Windows Update. The higher this value, the more content is received from Windows Update servers or WSUS, versus peers on the local network. **The default value is 500KB/s**
|
||||
This value specifies the minimum download speed guarantee that a client attempts to achieve and will fulfill by downloading more kilobytes from HTTP sources . The lower this value is, the more content will be sourced using peers on the network rather than HTTP sources. The higher this value, the more content is received from HTTP sources, versus peers on the local network. **The default value is 2500 KB/s.**
|
||||
|
||||
### Modify Cache Drive
|
||||
|
||||
@ -247,7 +260,7 @@ This setting specifies the total amount of data in gigabytes that a Delivery Opt
|
||||
|
||||
### Enable Peer Caching while the device connects via VPN
|
||||
|
||||
This setting determines whether a device will be allowed to participate in Peer Caching while connected to VPN. **By default, if a VPN connection is detected, peering is not allowed.** Specify "true" to allow the device to participate in Peer Caching while connected via VPN to the domain network. The device can download from or upload to other domain network devices, either on VPN or on the corporate domain network.
|
||||
This setting determines whether a device will be allowed to participate in Peer Caching while connected to VPN. **By default, if a VPN connection is detected, peering isn't allowed.** Specify "true" to allow the device to participate in Peer Caching while connected via VPN to the domain network. The device can download from or upload to other domain network devices, either on VPN or on the corporate domain network.
|
||||
|
||||
### Allow uploads while the device is on battery while under set Battery level
|
||||
|
||||
@ -259,10 +272,10 @@ The device can download from peers while on battery regardless of this policy.
|
||||
|
||||
### Cache Server Hostname
|
||||
|
||||
Set this policy to designate one or more Microsoft Connected Cache servers to be used by Delivery Optimization. You can set one or more FQDNs or IP Addresses that are comma-separated, for example: myhost.somerandomhost.com,myhost2.somrandomhost.com,10.10.1.7. **By default, this policy is empty.**
|
||||
Set this policy to designate one or more Microsoft Connected Cache servers to be used by Delivery Optimization. You can set one or more FQDNs or IP Addresses that are comma-separated, for example: myhost.somerandomhost.com,myhost2.somerandomhost.com,10.10.1.7. **By default, this policy has no value.**
|
||||
|
||||
>[!IMPORTANT]
|
||||
> Any value will signify that the policy is set. For example, an empty string ("") is not considered empty.
|
||||
> Any value will signify that the policy is set. For example, an empty string ("") isn't considered empty.
|
||||
|
||||
### Cache Server Hostname Source
|
||||
|
||||
|
||||
@ -25,16 +25,19 @@ ms.date: 12/19/2022
|
||||
|
||||
You can use Group Policy or an MDM solution like Intune to configure Delivery Optimization.
|
||||
|
||||
You will find the Delivery Optimization settings in Group Policy under **Computer Configuration\Administrative Templates\Windows Components\Delivery Optimization**.
|
||||
You'll find the Delivery Optimization settings in Group Policy under **Computer Configuration\Administrative Templates\Windows Components\Delivery Optimization**.
|
||||
|
||||
Starting with Microsoft Intune version 1902, you can set many Delivery Optimization policies as a profile, which you can then apply to groups of devices. For more information, see [Delivery Optimization settings in Microsoft Intune](/mem/intune/configuration/delivery-optimization-windows).
|
||||
|
||||
**Starting with Windows 10, version 1903**, you can use the Azure Active Directory (Azure AD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5.
|
||||
**Starting with Windows 10, version 1903**, you can use the Azure Active Directory (Azure AD) Tenant ID as a means to define groups. To do this set the value for [DOGroupIDSource](waas-delivery-optimization-reference.md#select-the-source-of-group-ids) to its new maximum value of 5.
|
||||
|
||||
## Allow service endpoints
|
||||
|
||||
When using a firewall, it's important that the Delivery Optimization Service endpoints are allowed and associated ports are open. For more information, see [Delivery Optimization FAQ](waas-delivery-optimization-faq.yml#what-hostnames-should-i-allow-through-my-firewall-to-support-delivery-optimization) for more information.
|
||||
|
||||
## Allow content endpoints
|
||||
|
||||
When using a firewall, it is important that the content endpoints are allowed and associated ports are open. For more information, see [Endpoints for Delivery Optimization and Microsoft Connected Cache content](delivery-optimization-endpoints.md).
|
||||
|
||||
When using a firewall, it's important that the content endpoints are allowed and associated ports are open. For more information, see [Endpoints for Delivery Optimization and Microsoft Connected Cache content](delivery-optimization-endpoints.md).
|
||||
|
||||
## Recommended Delivery Optimization settings
|
||||
|
||||
@ -57,13 +60,13 @@ Quick-reference table:
|
||||
| Use case | Policy | Recommended value | Reason |
|
||||
| --- | --- | --- | --- |
|
||||
| Hub & spoke topology | Download mode | 1 or 2 | Automatic grouping of peers to match your topology |
|
||||
| Sites with > 30 devices | Minimum file size to cache | 10 MB (or 1 MB) | Leverage peers-to-peer capability in more downloads |
|
||||
| Sites with > 30 devices | Minimum file size to cache | 10 MB (or 1 MB) | Use peers-to-peer capability in more downloads |
|
||||
| Large number of mobile devices | Allow uploads on battery power | 60% | Increase # of devices that can upload while limiting battery drain |
|
||||
| Labs with AC-powered devices | Content Expiration | 7 (up to 30) days | Leverage devices that can upload more for a longer period |
|
||||
| Labs with AC-powered devices | Content expiration | 7 (up to 30) days | Leverage devices that can upload more for a longer period |
|
||||
|
||||
### Hybrid WAN scenario
|
||||
|
||||
For this scenario, grouping devices by domain allows devices to be included in peer downloads and uploads across VLANs. **Set Download Mode to 2 - Group**. The default group is the authenticated domain or Active Directory site. If your domain-based group is too wide, or your Active Directory sites aren't aligned with your site network topology, then you should consider additional options for dynamically creating groups, for example by using the GroupIDSrc parameter.
|
||||
For this scenario, grouping devices by domain allows devices to be included in peer downloads and uploads across VLANs. **Set Download Mode to 2 - Group**. The default group, when the GroupID or GroupIDSource policies aren't set, is the AD Site (1), Authenticated domain SID (2) or AAD Tenant ID (5), in that order. If your domain-based group is too wide, or your Active Directory sites aren't aligned with your site network topology, then you should consider other options for dynamically creating groups, for example by using the [DOGroupIDSource](waas-delivery-optimization-reference.md#select-the-source-of-group-ids) policy.
|
||||
|
||||
To do this in Group Policy go to **Computer Configuration\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**.
|
||||
|
||||
@ -71,14 +74,14 @@ To do this with MDM, go to **./Device/Vendor/MSFT/Policy/Config/DeliveryOptimiza
|
||||
|
||||
### Hub and spoke topology with boundary groups
|
||||
|
||||
The default download mode setting is **1**; this means all devices breaking out to the internet using the same public IP will be considered as a single peer group. To prevent peer-to-peer activity across groups, you should set the download mode to **2**. If you have already defined Active Directory sites per hub or branch office, then you don't need to do anything else. If you're not using Active Directory sites, you should set *RestrictPeerSelectionBy* policies to restrict the activity to the subnet or set a different source for Groups by using the GroupIDSrc parameter. See [Select a method to restrict peer selection](waas-delivery-optimization-reference.md#select-a-method-to-restrict-peer-selection).
|
||||
The default download mode setting is **1**; this means all devices breaking out to the internet using the same public IP will be considered as a single peer group. To prevent peer-to-peer activity across your WAN, you should set the download mode to **2**. If you have already defined Active Directory sites per hub or branch office, then you don't need to do anything else since those will be used by default as the source for creation of Group IDs. If you're not using Active Directory sites, you should set a different source for Groups by using the [DOGroupIDSource](waas-delivery-optimization-reference.md#select-the-source-of-group-ids) options or the [DORestrictPeerSelectionBy](waas-delivery-optimization-reference.md#select-a-method-to-restrict-peer-selection) policy to restrict the activity to the subnet.
|
||||
|
||||
To do this in Group Policy go to ****Computer Configuration\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**.
|
||||
To do this in Group Policy go to **Computer Configuration\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**.
|
||||
|
||||
To do this with MDM, go to **./Device/Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set [DODownloadMode](/windows/client-management/mdm/policy-csp-deliveryoptimization#dodownloadmode) to **2**.
|
||||
|
||||
> [!NOTE]
|
||||
> For more information about using Delivery Optimization with Configuration Manager boundary groups, see [Delivery Optmization](/mem/configmgr/core/plan-design/hierarchy/fundamental-concepts-for-content-management#delivery-optimization).
|
||||
> For more information about using Delivery Optimization with Configuration Manager boundary groups, see [Delivery Optimization for Configuration Manager](/mem/configmgr/core/plan-design/hierarchy/fundamental-concepts-for-content-management#delivery-optimization).
|
||||
|
||||
### Large number of mobile devices
|
||||
|
||||
@ -90,11 +93,11 @@ To do this with MDM, go to **./Device/Vendor/MSFT/Policy/Config/DeliveryOptimiza
|
||||
|
||||
### Plentiful free space and large numbers of devices
|
||||
|
||||
Many devices now come with large internal drives. You can set Delivery Optimization to take better advantage of this space (especially if you have large numbers of devices) by changing the minimum file size to cache. If you have more than 30 devices in your local network or group, change it from the default 50 MB to 10 MB. If you have more than 100 devices (and are running Windows 10, version 1803 or later), set this value to 1 MB.
|
||||
Many devices now come with large internal drives. You can set Delivery Optimization to take better advantage of this space (especially if you have large numbers of devices) by changing the minimum file size to cache. If you've more than 30 devices in your local network or group, change it from the default 50 MB to 10 MB. If you've more than 100 devices (and are running Windows 10, version 1803 or later), set this value to 1 MB.
|
||||
|
||||
To do this in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Delivery Optimization** and set **Minimum Peer Caching Content File Size** to 10 (if you have more than 30 devices) or 1 (if you have more than 100 devices).
|
||||
To do this in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Delivery Optimization** and set **Minimum Peer Caching Content File Size** to 10 (if you've more than 30 devices) or 1 (if you've more than 100 devices).
|
||||
|
||||
To do this with MDM, go to **./Device/Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set [DOMinFileSizeToCache](/windows/client-management/mdm/policy-csp-deliveryoptimization#dominfilesizetocache) to 100 (if you have more than 30 devices) or 1 (if you have more than 100 devices).
|
||||
To do this with MDM, go to **./Device/Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set [DOMinFileSizeToCache](/windows/client-management/mdm/policy-csp-deliveryoptimization#dominfilesizetocache) to 100 (if you've more than 30 devices) or 1 (if you've more than 100 devices).
|
||||
|
||||
### Lab scenario
|
||||
|
||||
@ -104,18 +107,18 @@ To do this in Group Policy, go to **Computer Configuration\Administrative Templa
|
||||
|
||||
To do this with MDM, go to **./Device/Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set [DOMaxCacheAge](/windows/client-management/mdm/policy-csp-deliveryoptimization#domaxcacheage) to 7 or more (up to 30 days).
|
||||
|
||||
[Learn more](delivery-optimization-test.md) about Delivery Optimization testing scenarios.
|
||||
|
||||
<!--Using include file, waas-delivery-optimization-monitor.md, for shared content on DO monitoring-->
|
||||
[!INCLUDE [Monitor Delivery Optimization](includes/waas-delivery-optimization-monitor.md)]
|
||||
|
||||
### Monitor with Windows Update for Business Delivery Optimization Report
|
||||
|
||||
### Monitor with Update Compliance
|
||||
Windows Update for Business Delivery Optimization Report provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer, Microsoft Connected Cache (MCC), HTTP source/CDN distribution over the past 28 days.
|
||||
|
||||
Update Compliance provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days.
|
||||
:::image type="content" source="/windows/deployment/update/images/wufb-do-overview.png" alt-text="This screenshot shows the Windows Update for Business report, Delivery Optimization status in Update Compliance." lightbox="/windows/deployment/update/images/wufb-do-overview.png":::
|
||||
|
||||
[[DO status](images/UC_workspace_DO_status.png)](images/UC_workspace_DO_status.png#lightbox)
|
||||
|
||||
For details, see [Delivery Optimization in Update Compliance](../update/update-compliance-delivery-optimization.md).
|
||||
For details, see [Windows Update for Business Delivery Optimization Report](../update/wufb-reports-overview.md).
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
@ -135,17 +138,17 @@ If you don't see any bytes coming from peers the cause might be one of the follo
|
||||
Try these steps:
|
||||
|
||||
1. Start a download of an app that is larger than 50 MB from the Store (for example "Candy Crush Saga").
|
||||
2. Run `Get-DeliveryOptimizationStatus` from an elevated PowerShell window and observe the [DownloadMode](waas-delivery-optimization-reference.md#download-mode) setting. For peering to work, DownloadMode should be 1, 2, or 3.
|
||||
3. If DownloadMode is 99, it could indicate your device is unable to reach the Delivery Optimization cloud services. Ensure that the Delivery Optimization host names are allowed access: most importantly **\*.do.dsp.mp.microsoft.com**.
|
||||
2. Run `Get-DeliveryOptimizationStatus` from an elevated PowerShell window and observe the [DODownloadMode](waas-delivery-optimization-reference.md#download-mode) setting. For peering to work, download mode should be 1, 2, or 3.
|
||||
3. If the download mode is 99, it could indicate your device is unable to reach the Delivery Optimization cloud services. Ensure that the Delivery Optimization host names are allowed access: most importantly **\*.do.dsp.mp.microsoft.com**.
|
||||
|
||||
### The cloud service doesn't see other peers on the network
|
||||
|
||||
Try these steps:
|
||||
|
||||
1. Download the same app on two different devices on the same network, waiting 10 – 15 minutes between downloads.
|
||||
2. Run `Get-DeliveryOptimizationStatus` from an elevated PowerShell window and ensure that **[DownloadMode](waas-delivery-optimization-reference.md#download-mode)** is 1 or 2 on both devices.
|
||||
2. Run `Get-DeliveryOptimizationStatus` from an elevated PowerShell window and ensure that **[DODownloadMode](waas-delivery-optimization-reference.md#download-mode)** is 1 or 2 on both devices.
|
||||
3. Run `Get-DeliveryOptimizationPerfSnap` from an elevated PowerShell window on the second device. The **NumberOfPeers** field should be non-zero.
|
||||
4. If the number of peers is zero and **[DownloadMode](waas-delivery-optimization-reference.md#download-mode)** is 1, ensure that both devices are using the same public IP address to reach the internet (you can easily do this by opening a browser window and do a search for “what is my IP”). In the case where devices are not reporting the same public IP address, configure **[DownloadMode](waas-delivery-optimization-reference.md#download-mode)** to 2 (Group) and use a custom **[GroupID (Guid)](waas-delivery-optimization-reference.md#group-id)**, to fix this.
|
||||
4. If the number of peers is zero and **[DODownloadMode](waas-delivery-optimization-reference.md#download-mode)** is 1, ensure that both devices are using the same public IP address to reach the internet (you can easily do this by opening a browser window and do a search for “what is my IP”). In the case where devices aren't reporting the same public IP address, configure **[DODownloadMode](waas-delivery-optimization-reference.md#download-mode)** to 2 (Group) and use a custom **[DOGroupID (Guid)](waas-delivery-optimization-reference.md#group-id)**, to fix this.
|
||||
|
||||
> [!NOTE]
|
||||
> Starting in Windows 10, version 2004, `Get-DeliveryOptimizationStatus` has a new option `-PeerInfo` which returns a real-time list of the connected peers.
|
||||
@ -155,7 +158,7 @@ Try these steps:
|
||||
Try a Telnet test between two devices on the network to ensure they can connect using port 7680. Follow these steps:
|
||||
|
||||
1. Install Telnet by running `dism /online /Enable-Feature /FeatureName:TelnetClient` from an elevated command prompt.
|
||||
2. Run the test. For example, if you are on device with IP 192.168.8.12 and you are trying to test the connection to 192.168.9.17 run `telnet 192.168.9.17 7680` (the syntax is *telnet [destination IP] [port]*. You will either see a connection error or a blinking cursor like this /_. The blinking cursor means success.
|
||||
2. Run the test. For example, if you are on device with IP 192.168.8.12 and you're trying to test the connection to 192.168.9.17 run `telnet 192.168.9.17 7680` (the syntax is *telnet [destination IP] [port]*. You'll either see a connection error or a blinking cursor like this /_. The blinking cursor means success.
|
||||
|
||||
> [!NOTE]
|
||||
> You can also use [Test-NetConnection](/powershell/module/nettcpip/test-netconnection) instead of Telnet to run the test.
|
||||
|
||||
@ -21,11 +21,13 @@ ms.date: 12/31/2017
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
> **Looking for Group Policy objects?** See [Delivery Optimization reference](waas-delivery-optimization-reference.md) or the master spreadsheet available at the [Download Center](https://www.microsoft.com/download/details.aspx?id=102158).
|
||||
> **Looking for Group Policy objects?** See [Delivery Optimization reference](waas-delivery-optimization-reference.md) or the master spreadsheet available at the Download Center [for Windows 11](https://www.microsoft.com/en-us/download/details.aspx?id=104594) or [for Windows 10](https://www.microsoft.com/en-us/download/details.aspx?id=104678).
|
||||
|
||||
Windows updates, upgrades, and applications can contain packages with large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages among multiple devices in your deployment. Delivery Optimization is a cloud-managed solution that allows clients to download those packages from alternate sources (such as other peers on the network) in addition to the traditional Internet-based servers. You can use Delivery Optimization with Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or Microsoft Configuration Manager (when installation of Express Updates is enabled).
|
||||
Windows updates, upgrades, and applications can contain packages with large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. Delivery Optimization is a reliable HTTP downloader with a cloud-managed solution that allows Windows devices to download those packages from alternate sources if desired (such as other devices on the network and/or a dedicated cache server) in addition to the traditional internet-based servers (referred to as 'HTTP sources' throughout Delivery Optimization documents). You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages among multiple devices in your deployment however, the use of peer-to-peer is completely optional.
|
||||
|
||||
Access to the Delivery Optimization cloud services and the Internet, are both requirements for using the peer-to-peer functionality of Delivery Optimization.
|
||||
To use either the peer-to-peer functionality or the Microsoft Connected Cache features, devices must have access to the Internet and Delivery Optimization cloud services. When Delivery Optimization is configured to use peers and Microsoft Connected Cache (MCC), to achieve the best possible content delivery experience, the client will connect to MCC and peers in parallel. If the desired content can't be obtained from MCC or peers, Delivery Optimization will seamlessly fall back to the HTTP source to get the requested content.
|
||||
|
||||
You can use Delivery Optimization with Windows Update, Windows Server Update Services (WSUS), Microsoft Intune/Windows Update for Business, or Microsoft Configuration Manager (when installation of Express Updates is enabled).
|
||||
|
||||
For information about setting up Delivery Optimization, including tips for the best settings in different scenarios, see [Set up Delivery Optimization](waas-delivery-optimization-setup.md). For a comprehensive list of all Delivery Optimization settings, see [Delivery Optimization reference](waas-delivery-optimization-reference.md).
|
||||
|
||||
@ -60,7 +62,7 @@ The following table lists the minimum Windows 10 version that supports Delivery
|
||||
| MDM Agent | Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
|
||||
| Xbox Game Pass (PC) | Windows 10 1809, Windows 11 | :heavy_check_mark: | | :heavy_check_mark: |
|
||||
| Windows Package Manager| Windows 10 1809, Windows 11 | :heavy_check_mark: | | |
|
||||
| MSIX | Windows 10 2004, Windows 11 | :heavy_check_mark: | | |
|
||||
| MSIX Installer| Windows 10 2004, Windows 11 | :heavy_check_mark: | | |
|
||||
|
||||
#### Windows Server
|
||||
|
||||
|
||||
@ -14,11 +14,10 @@ ms.date: 12/31/2017
|
||||
|
||||
# Optimize Windows update delivery
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
|
||||
|
||||
@ -30,7 +29,7 @@ Two methods of peer-to-peer content distribution are available.
|
||||
|
||||
Windows Update, Windows Update for Business, and Windows Server Update Services (WSUS) can use Delivery Optimization. Delivery Optimization can significantly reduce the amount of network traffic to external Windows Update sources and the time it takes for clients to retrieve the updates.
|
||||
|
||||
- [BranchCache](../update/waas-branchcache.md) is a bandwidth optimization technology that is included in some editions of Windows Server 2016 and Windows operating systems, as well as in some editions of Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, and Windows 7.
|
||||
- [BranchCache](../update/waas-branchcache.md) is a bandwidth optimization technology that is included in some editions of Windows Server 2016 and Windows operating systems, and in some editions of Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, and Windows 7.
|
||||
|
||||
>[!NOTE]
|
||||
>Full BranchCache functionality is supported in Windows 10 Enterprise and Education; Windows 10 Pro supports some BranchCache functionality, including BITS transfers used for servicing operations.
|
||||
@ -47,7 +46,7 @@ Two methods of peer-to-peer content distribution are available.
|
||||
> [!NOTE]
|
||||
> Microsoft Configuration Manager has an additional feature called Client Peer Cache that allows peer-to-peer content sharing between clients you use Configuration Manager to manage, in the same Configuration Manager boundary Group. For more information, see [Client Peer Cache](/configmgr/core/plan-design/hierarchy/client-peer-cache).
|
||||
>
|
||||
> In addition to Client Peer Cache, similar functionality is available in the Windows Preinstallation Environment (Windows PE) for imaging-related content. Using this technology, clients imaging with Configuration Manager task sequences can source operating system images, driver packages, boot images, packages, and programs from peers instead of distribution points. For detailed information about how Windows PE Peer Cache works and how to configure it, see [Prepare Windows PE peer cache to reduce WAN traffic in Microsoft Configuration Manager](/configmgr/osd/get-started/prepare-windows-pe-peer-cache-to-reduce-wan-traffic).
|
||||
> In addition to Client Peer Cache, similar functionality is available in the Windows Pre-installation Environment (Windows PE) for imaging-related content. Using this technology, clients imaging with Configuration Manager task sequences can source operating system images, driver packages, boot images, packages, and programs from peers instead of distribution points. For detailed information about how Windows PE Peer Cache works and how to configure it, see [Prepare Windows PE peer cache to reduce WAN traffic in Microsoft Configuration Manager](/configmgr/osd/get-started/prepare-windows-pe-peer-cache-to-reduce-wan-traffic).
|
||||
|
||||
## Express update delivery
|
||||
|
||||
@ -57,6 +56,7 @@ Windows client quality update downloads can be large because every package conta
|
||||
> Express update delivery applies to quality update downloads. Starting with Windows 10, version 1709, Express update delivery also applies to feature update downloads for clients connected to Windows Update and Windows Update for Business.
|
||||
|
||||
### How Microsoft supports Express
|
||||
|
||||
- **Express on Microsoft Configuration Manager** starting with version 1702 of Configuration Manager and Windows 10, version 1703 or later, or Windows 10, version 1607 with the April 2017 cumulative update.
|
||||
- **Express on WSUS Standalone**
|
||||
|
||||
@ -67,6 +67,7 @@ Windows client quality update downloads can be large because every package conta
|
||||
### How Express download works
|
||||
|
||||
For OS updates that support Express, there are two versions of the file payload stored on the service:
|
||||
|
||||
1. **Full-file version** - essentially replacing the local versions of the update binaries.
|
||||
2. **Express version** - containing the deltas needed to patch the existing binaries on the device.
|
||||
|
||||
|
||||
337
windows/deployment/update/deployment-service-drivers.md
Normal file
337
windows/deployment/update/deployment-service-drivers.md
Normal file
@ -0,0 +1,337 @@
|
||||
---
|
||||
title: Deploy drivers and firmware updates with Windows Update for Business deployment service.
|
||||
description: Use Windows Update for Business deployment service to deploy driver and firmware updates.
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 02/14/2023
|
||||
---
|
||||
|
||||
# Deploy drivers and firmware updates with Windows Update for Business deployment service
|
||||
<!--7260403, 7512398-->
|
||||
***(Applies to: Windows 11 & Windows 10)***
|
||||
|
||||
The Windows Update for Business deployment service is used to approve and schedule software updates. The deployment service exposes its capabilities through the [Microsoft Graph API](/graph/use-the-api). You can call the API directly, through a [Graph SDK](/graph/sdks/sdks-overview), or integrate them with a management tool such as [Microsoft Intune](/mem/intune).
|
||||
|
||||
This article uses [Graph Explorer](/graph/graph-explorer/graph-explorer-overview) to walk through the entire process of deploying a driver update to clients. In this article, you will:
|
||||
> [!div class="checklist"]
|
||||
>
|
||||
> - [Open Graph Explorer](#open-graph-explorer)
|
||||
> - [Run queries to identify devices](#run-queries-to-identify-devices)
|
||||
> - [Enroll devices](#enroll-devices)
|
||||
> - [Create a deployment audience and add audience members](#create-a-deployment-audience-and-add-audience-members)
|
||||
> - [Create an update policy](#create-an-update-policy)
|
||||
> - [Review applicable driver content](#review-applicable-driver-content)
|
||||
> - [Approve driver content for deployment](#approve-driver-content-for-deployment)
|
||||
> - [Revoke content approval](#revoke-content-approval)
|
||||
> - [Unenroll devices](#unenroll-devices)
|
||||
|
||||
## Prerequisites
|
||||
|
||||
All of the [prerequisites for the Windows Update for Business deployment service](deployment-service-prerequisites.md) must be met.
|
||||
|
||||
### Permissions
|
||||
|
||||
<!--Using include for Graph Explorer permissions-->
|
||||
[!INCLUDE [Windows Update for Business deployment service permissions using Graph Explorer](./includes/wufb-deployment-graph-explorer-permissions.md)]
|
||||
|
||||
## Open Graph Explorer
|
||||
|
||||
<!--Using include for Graph Explorer sign in-->
|
||||
[!INCLUDE [Graph Explorer sign in](./includes/wufb-deployment-graph-explorer.md)]
|
||||
|
||||
## Run queries to identify devices
|
||||
|
||||
<!--Using include for Graph Explorer device queries-->
|
||||
[!INCLUDE [Graph Explorer device queries](./includes/wufb-deployment-find-device-name-graph-explorer.md)]
|
||||
|
||||
## Enroll devices
|
||||
|
||||
When you enroll devices into driver management, the deployment service becomes the authority for driver updates coming from Windows Update. Devices don't receive drivers or firmware from Windows Update until a deployment is manually created or they're added to a driver update policy with approvals.
|
||||
|
||||
<!--Using include for enrolling devices using Graph Explorer-->
|
||||
[!INCLUDE [Graph Explorer enroll devices](./includes/wufb-deployment-enroll-device-graph-explorer.md)]
|
||||
|
||||
## Create a deployment audience and add audience members
|
||||
|
||||
<!--Using include for creating deployment audiences and adding audience members using Graph Explorer-->
|
||||
[!INCLUDE [Graph Explorer enroll devices](./includes/wufb-deployment-audience-graph-explorer.md)]
|
||||
|
||||
Once a device has been enrolled and added to a deployment audience, the Windows Update for Business deployment service will start collecting scan results from Windows Update to build a catalog of applicable drivers to be browsed, approved, and scheduled for deployment.
|
||||
|
||||
## Create an update policy
|
||||
|
||||
Update policies define how content is deployed to a deployment audience. An [update policy](/graph/api/resources/windowsupdates-updatepolicy) ensures deployments to a deployment audience behave in a consistent manner without having to create and manage multiple individual deployments. When a content approval is added to the policy, it's deployed to the devices in the associated audiences. The deployment and monitoring settings are optional.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Any [deployment settings](/graph/api/resources/windowsupdates-deploymentsettings) configured for a [content approval](#approve-driver-content-for-deployment) will be combined with the existing update policy's deployment settings. If the content approval and update policy specify the same deployment setting, the setting from the content approval is used.
|
||||
|
||||
|
||||
### Create a policy and define the settings later
|
||||
|
||||
To create a policy without any deployment settings, in the request body specify the **Audience ID** as `id`. In the following example, the **Audience ID** is `d39ad1ce-0123-4567-89ab-cdef01234567`, and the `id` given in the response is the **Policy ID**:
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"audience": {
|
||||
"@odata.id": "d39ad1ce-0123-4567-89ab-cdef01234567"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Response returning the policy, without any additional settings specified, that has a **Policy ID** of `9011c330-1234-5678-9abc-def012345678`:
|
||||
|
||||
```json
|
||||
HTTP/1.1 202 Accepted
|
||||
content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/updatePolicies/$entity",
|
||||
"id": "9011c330-1234-5678-9abc-def012345678",
|
||||
"createdDateTime": "2023-01-25T05:32:21.9721459Z",
|
||||
"autoEnrollmentUpdateCategories": [],
|
||||
"complianceChangeRules": [],
|
||||
"deploymentSettings": {
|
||||
"schedule": null,
|
||||
"monitoring": null,
|
||||
"contentApplicability": null,
|
||||
"userExperience": null,
|
||||
"expedite": null
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Specify settings during policy creation
|
||||
|
||||
To create a policy with additional settings, in the request body:
|
||||
- Specify the **Audience ID** as `id`
|
||||
- Define any [deployment settings](/graph/api/resources/windowsupdates-deploymentsettings).
|
||||
- Add the `content-length` header to the request if a status code of 411 occurs. The value should be the length of the request body in bytes. For information on error codes, see [Microsoft Graph error responses and resource types](/graph/errors).
|
||||
|
||||
In the following driver update policy example, any deployments created by a content approval will start 7 days after approval for **Audience ID** `d39ad1ce-0123-4567-89ab-cdef01234567`:
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.updatePolicy",
|
||||
"audience": {
|
||||
"@odata.id": "d39ad1ce-0123-4567-89ab-cdef01234567"
|
||||
},
|
||||
"complianceChanges": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApproval"
|
||||
}
|
||||
],
|
||||
"complianceChangeRules": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApprovalRule",
|
||||
"contentFilter": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.driverUpdateFilter"
|
||||
},
|
||||
"durationBeforeDeploymentStart": "P7D"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
### Review and edit update policy settings
|
||||
|
||||
To review the policy settings, run the following query using the **Policy ID**, for example `9011c330-1234-5678-9abc-def012345678`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies/9011c330-1234-5678-9abc-def012345678
|
||||
```
|
||||
|
||||
To edit the policy settings, **PATCH** the policy using the **Policy ID**. Run the following **PATCH** to automatically approve driver content that's recommended by `Microsoft`for deployment for **Policy ID** `9011c330-1234-5678-9abc-def012345678`:
|
||||
|
||||
``` msgraph-interactive
|
||||
PATCH https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies/9011c330-1234-5678-9abc-def012345678
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"complianceChangeRules": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApprovalRule",
|
||||
"contentFilter": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.driverUpdateFilter"
|
||||
}
|
||||
}
|
||||
],
|
||||
"deploymentSettings": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.deploymentSettings",
|
||||
"contentApplicability": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApplicabilitySettings",
|
||||
"offerWhileRecommendedBy": ["microsoft"]
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
## Review applicable driver content
|
||||
|
||||
Once Windows Update for Business deployment service has scan results from devices, the applicability for driver and firmware updates can be displayed for a deployment audience. Each applicable update returns the following information:
|
||||
|
||||
- An `id` for its [catalog entry](/graph/api/resources/windowsupdates-catalogentry)
|
||||
- The **Azure AD ID** of the devices it's applicable to
|
||||
- Information describing the update such as the name and version.
|
||||
|
||||
To display [applicable content](/graph/api/resources/windowsupdates-applicablecontent), run a query using the **Audience ID**, for example `d39ad1ce-0123-4567-89ab-cdef01234567`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/applicableContent
|
||||
```
|
||||
|
||||
The following truncated response displays:
|
||||
- An **Azure AD ID** of `01234567-89ab-cdef-0123-456789abcdef`
|
||||
- The **Catalog ID** of `5d6dede684ba5c4a731d62d9c9c2a99db12c5e6015e9f8ad00f3e9387c7f399c`
|
||||
|
||||
```json
|
||||
"matchedDevices": [
|
||||
{
|
||||
"recommendedBy": [
|
||||
"Microsoft"
|
||||
],
|
||||
"deviceId": "01ea3c90-12f5-4093-a4c9-c1434657c976"
|
||||
}
|
||||
],
|
||||
"catalogEntry": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.driverUpdateCatalogEntry",
|
||||
"id": "5d6dede684ba5c4a731d62d9c9c2a99db12c5e6015e9f8ad00f3e9387c7f399c",
|
||||
"displayName": "Microsoft - Test - 1.0.0.1",
|
||||
"deployableUntilDateTime": null,
|
||||
"releaseDateTime": "0001-01-21T04:18:32Z",
|
||||
"description": "Microsoft test driver update released in January 2021",
|
||||
"driverClass": "OtherHardware",
|
||||
"provider": "Microsoft",
|
||||
"setupInformationFile": null,
|
||||
"manufacturer": "Microsoft",
|
||||
"version": "1.0.0.1",
|
||||
"versionDateTime": "2021-01-11T02:43:14Z"
|
||||
```
|
||||
|
||||
## Approve driver content for deployment
|
||||
|
||||
Each driver update is associated with a unique [catalog entry](/graph/api/resources/windowsupdates-catalogentry). Approve content for drivers and firmware by adding a [content approval](/graph/api/resources/windowsupdates-contentapproval) for the catalog entry to an existing policy. Content approval is a [compliance change](/graph/api/resources/windowsupdates-compliance) for the policy.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Any [deployment settings](/graph/api/resources/windowsupdates-deploymentsettings) configured for the content approval will be combined with the existing [update policy's](#create-an-update-policy) deployment settings. If the content approval and update policy specify the same deployment setting, the setting from the content approval is used.
|
||||
|
||||
Add a content approval to an existing policy, **Policy ID** `9011c330-1234-5678-9abc-def012345678` for the driver update with the **Catalog ID** `5d6dede684ba5c4a731d62d9c9c2a99db12c5e6015e9f8ad00f3e9387c7f399c`. Schedule the start date for February 14, 2023 at 1 AM UTC:
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies/9011c330-1234-5678-9abc-def012345678/complianceChanges
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApproval",
|
||||
"content": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.catalogContent",
|
||||
"catalogEntry": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.driverUpdateCatalogEntry",
|
||||
"id": "5d6dede684ba5c4a731d62d9c9c2a99db12c5e6015e9f8ad00f3e9387c7f399c"
|
||||
}
|
||||
},
|
||||
"deploymentSettings": {
|
||||
"@odata.type": "microsoft.graph.windowsUpdates.deploymentSettings",
|
||||
"schedule": {
|
||||
"startDateTime": "2023-02-14T01:00:00Z"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
The response for a content approval returns content and deployment settings along with an `id`, which is the **Compliance Change ID**. The **Compliance Change ID** is `c03911a7-9876-5432-10ab-cdef98765432` in the following truncated response:
|
||||
|
||||
```json
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApproval",
|
||||
"id": "c03911a7-9876-5432-10ab-cdef98765432",
|
||||
"createdDateTime": "2023-02-02T17:54:39.173292Z",
|
||||
"isRevoked": false,
|
||||
"revokedDateTime": "0001-01-01T00:00:00Z",
|
||||
"content": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.catalogContent",
|
||||
"catalogEntry": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.driverUpdateCatalogEntry",
|
||||
"id": "5d6dede684ba5c4a731d62d9c9c2a99db12c5e6015e9f8ad00f3e9387c7f399c"
|
||||
}
|
||||
},
|
||||
"deploymentSettings": {
|
||||
"schedule": {
|
||||
"startDateTime": "2023-02-14T01:00:00Z",
|
||||
```
|
||||
|
||||
Review all of the compliance changes to a policy with the most recent changes listed in the response first. The following example returns the compliance changes for a policy with the **Policy ID** `9011c330-1234-5678-9abc-def012345678` and sorts by `createdDateTime` in descending order:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies/9011c330-1234-5678-9abc-def012345678/complianceChanges?orderby=createdDateTime desc
|
||||
```
|
||||
|
||||
> [!TIP]
|
||||
> There should only be one **Compliance Change ID** per **Catalog ID** for a policy. If there are multiple **Compliance Change IDs** for the same **Catalog ID** then, most likely, there's multiple deployments for the same piece of content targeted to the same audience but with different deployment behaviors. To remove the duplicate, [delete the compliance change](/graph/api/resources/windowsupdates-compliancechange-delete) with the duplicate **Catalog ID**. Deleting the compliance change will mark any deployments created by the approval as `archived`.
|
||||
|
||||
To retrieve the deployment ID, use the [expand parameter](/graph/query-parameters#expand-parameter) to review the deployment information related the content approval. The following example displays the content approval and the deployment information for **Compliance Change ID** `c03911a7-9876-5432-10ab-cdef98765432` in update **Policy ID** `9011c330-1234-5678-9abc-def012345678`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies/9011c330-1234-5678-9abc-def012345678/complianceChanges/c03911a7-9876-5432-10ab-cdef98765432/$/microsoft.graph.windowsUpdates.contentApproval?$expand=deployments
|
||||
```
|
||||
|
||||
### Edit deployment settings for a content approval
|
||||
|
||||
Since content approval is a compliance change for the policy, when you [update a content approval](/graph/api/resources/windowsupdates--contentapproval-update), you're editing the compliance change for the policy. The following example changes the `startDateTime` for the **Compliance Change ID** of `c03911a7-9876-5432-10ab-cdef98765432` in the update **Policy ID** `9011c330-1234-5678-9abc-def012345678` to February 28, 2023 at 5 AM UTC:
|
||||
|
||||
```msgraph-interactive
|
||||
PATCH https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies/9011c330-1234-5678-9abc-def012345678/complianceChanges/c03911a7-9876-5432-10ab-cdef98765432
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApproval",
|
||||
"deploymentSettings": {
|
||||
"@odata.type": "microsoft.graph.windowsUpdates.deploymentSettings",
|
||||
"schedule": {
|
||||
"startDateTime": "2023-02-28T05:00:00Z"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
## Revoke content approval
|
||||
|
||||
Approval for content can be revoked by setting the `isRevoked` property of the [compliance change](/graph/api/resources/windowsupdates-compliance) to true. This setting can be changed while a deployment is in progress. However, revoking will only prevent the content from being offered to devices if they haven't already received it. To resume offering the content, a new [approval](#approve-driver-content-for-deployment) will need to be created.
|
||||
|
||||
|
||||
```msgraph-interactive
|
||||
PATCH https://graph.microsoft.com/beta/admin/windows/updates/updatePolicies/9011c330-1234-5678-9abc-def012345678/complianceChanges/c03911a7-9876-5432-10ab-cdef98765432
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.contentApproval",
|
||||
"isRevoked": true
|
||||
}
|
||||
```
|
||||
|
||||
To display all deployments with the most recently created returned first, order deployments based on the `createdDateTime`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/deployments?orderby=createdDateTime desc
|
||||
```
|
||||
|
||||
## Unenroll devices
|
||||
|
||||
<!--Using include for removing device enrollment-->
|
||||
[!INCLUDE [Graph Explorer enroll devices](./includes/wufb-deployment-graph-unenroll.md)]
|
||||
|
||||
## Policy considerations for drivers
|
||||
|
||||
<!--Using include for Policy considerations for drivers-->
|
||||
[!INCLUDE [Windows Update for Business deployment service driver policy considerations](./includes/wufb-deployment-driver-policy-considerations.md)]
|
||||
@ -0,0 +1,196 @@
|
||||
---
|
||||
title: Deploy expedited updates with Windows Update for Business deployment service
|
||||
description: Use Windows Update for Business deployment service to deploy expedited updates.
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 02/14/2023
|
||||
---
|
||||
|
||||
# Deploy expedited updates with Windows Update for Business deployment service
|
||||
|
||||
<!--7512398-->
|
||||
***(Applies to: Windows 11 & Windows 10)***
|
||||
|
||||
In this article, you will:
|
||||
> [!div class="checklist"]
|
||||
>
|
||||
> * [Open Graph Explorer](#open-graph-explorer)
|
||||
> * [Run queries to identify test devices](#run-queries-to-identify-devices)
|
||||
> * [List catalog entries for expedited updates](#list-catalog-entries-for-expedited-updates)
|
||||
> * [Create a deployment](#create-a-deployment)
|
||||
> * [Add members to the deployment audience](#add-members-to-the-deployment-audience)
|
||||
> * [Delete a deployment](#delete-a-deployment)
|
||||
|
||||
## Prerequisites
|
||||
|
||||
All of the [prerequisites for the Windows Update for Business deployment service](deployment-service-prerequisites.md) must be met.
|
||||
|
||||
### Permissions
|
||||
|
||||
<!--Using include for Graph Explorer permissions-->
|
||||
[!INCLUDE [Windows Update for Business deployment service permissions using Graph Explorer](./includes/wufb-deployment-graph-explorer-permissions.md)]
|
||||
|
||||
## Open Graph Explorer
|
||||
|
||||
<!--Using include for Graph Explorer sign in-->
|
||||
[!INCLUDE [Graph Explorer sign in](./includes/wufb-deployment-graph-explorer.md)]
|
||||
|
||||
## Run queries to identify devices
|
||||
|
||||
<!--Using include for Graph Explorer device queries-->
|
||||
[!INCLUDE [Graph Explorer device queries](./includes/wufb-deployment-find-device-name-graph-explorer.md)]
|
||||
|
||||
## List catalog entries for expedited updates
|
||||
|
||||
Each update is associated with a unique [catalog entry](/graph/api/resources/windowsupdates-catalogentry). You can query the catalog to find updates that can be expedited. The `id` returned is the **Catalog ID** and is used to create a deployment. The following query lists all security updates that can be deployed as expedited updates by the deployment service. Using `$top=3` and ordering by `ReleaseDateTimeshows` displays the three most recent updates.
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/catalog/entries?$filter=isof('microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry') and microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry/isExpeditable eq true&$orderby=releaseDateTime desc&$top=3
|
||||
```
|
||||
|
||||
The following truncated response displays a **Catalog ID** of `693fafea03c24cca819b3a15123a8880f217b96a878b6d6a61be021d476cc432` for the `01/10/2023 - 2023.01 B Security Updates for Windows 10 and later` security update:
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/catalog/entries",
|
||||
"value": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry",
|
||||
"id": "693fafea03c24cca819b3a15123a8880f217b96a878b6d6a61be021d476cc432",
|
||||
"displayName": "01/10/2023 - 2023.01 B Security Updates for Windows 10 and later",
|
||||
"deployableUntilDateTime": null,
|
||||
"releaseDateTime": "2023-01-10T00:00:00Z",
|
||||
"isExpeditable": true,
|
||||
"qualityUpdateClassification": "security"
|
||||
},
|
||||
...
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Create a deployment
|
||||
|
||||
When creating a deployment, there are [multiple options](/graph/api/resources/windowsupdates-deploymentsettings) available to define how the deployment behaves. The following example creates a deployment for the `01/10/2023 - 2023.01 B Security Updates for Windows 10 and later` security update with catalog entry ID `693fafea03c24cca819b3a15123a8880f217b96a878b6d6a61be021d476cc432`, and defines the `expedite` and `userExperience` deployment options in the request body.
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/deployments
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.deployment",
|
||||
"content": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.catalogContent",
|
||||
"catalogEntry": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry",
|
||||
"id": "693fafea03c24cca819b3a15123a8880f217b96a878b6d6a61be021d476cc432"
|
||||
}
|
||||
},
|
||||
"settings": {
|
||||
"@odata.type": "microsoft.graph.windowsUpdates.deploymentSettings",
|
||||
"expedite": {
|
||||
"isExpedited": true
|
||||
},
|
||||
"userExperience": {
|
||||
"daysUntilForcedReboot": 2
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
The request returns a 201 Created response code and a [deployment](/graph/api/resources/windowsupdates-deployment) object in the response body for the newly created deployment, which includes:
|
||||
|
||||
- The **Deployment ID** `de910e12-3456-7890-abcd-ef1234567890` of the newly created deployment.
|
||||
- The **Audience ID** `d39ad1ce-0123-4567-89ab-cdef01234567` of the newly created deployment audience.
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/deployments/$entity",
|
||||
"id": "de910e12-3456-7890-abcd-ef1234567890",
|
||||
"createdDateTime": "2023-02-09T22:55:04.8547517Z",
|
||||
"lastModifiedDateTime": "2023-02-09T22:55:04.8547524Z",
|
||||
"state": {
|
||||
"effectiveValue": "offering",
|
||||
"requestedValue": "none",
|
||||
"reasons": []
|
||||
},
|
||||
"content": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.catalogContent",
|
||||
"catalogEntry@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/deployments('de910e12-3456-7890-abcd-ef1234567890')/content/microsoft.graph.windowsUpdates.catalogContent/catalogEntry/$entity",
|
||||
"catalogEntry": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.qualityUpdateCatalogEntry",
|
||||
"id": "693fafea03c24cca819b3a15123a8880f217b96a878b6d6a61be021d476cc432",
|
||||
"displayName": null,
|
||||
"deployableUntilDateTime": null,
|
||||
"releaseDateTime": "2023-01-10T00:00:00Z",
|
||||
"isExpeditable": false,
|
||||
"qualityUpdateClassification": "security"
|
||||
}
|
||||
},
|
||||
"settings": {
|
||||
"schedule": null,
|
||||
"monitoring": null,
|
||||
"contentApplicability": null,
|
||||
"userExperience": {
|
||||
"daysUntilForcedReboot": 2
|
||||
},
|
||||
"expedite": {
|
||||
"isExpedited": true
|
||||
}
|
||||
},
|
||||
"audience@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/deployments('de910e12-3456-7890-abcd-ef1234567890')/audience/$entity",
|
||||
"audience": {
|
||||
"id": "d39ad1ce-0123-4567-89ab-cdef01234567",
|
||||
"applicableContent": []
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Add members to the deployment audience
|
||||
|
||||
The **Audience ID**, `d39ad1ce-0123-4567-89ab-cdef01234567`, was created when the deployment was created. The **Audience ID** is used to add members to the deployment audience. After the deployment audience is updated, Windows Update starts offering the update to the devices according to the deployment settings. As long as the deployment exists and the device is in the audience, the update will be expedited.
|
||||
|
||||
The following example adds two devices to the deployment audience using the **Azure AD ID** for each device:
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/updateAudience
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"addMembers": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcdef"
|
||||
},
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcde0"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
To verify the devices were added to the audience, run the following query using the **Audience ID** of `d39ad1ce-0123-4567-89ab-cdef01234567`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/members
|
||||
```
|
||||
|
||||
## Delete a deployment
|
||||
|
||||
To stop an expedited deployment, DELETE the deployment. Deleting the deployment will prevent the content from being offered to devices if they haven't already received it. To resume offering the content, a new approval will need to be created.
|
||||
|
||||
|
||||
The following example deletes the deployment with a **Deployment ID** of `de910e12-3456-7890-abcd-ef1234567890`:
|
||||
|
||||
```msgraph-interactive
|
||||
DELETE https://graph.microsoft.com/beta/admin/windows/updates/deployments/de910e12-3456-7890-abcd-ef1234567890
|
||||
```
|
||||
|
||||
|
||||
<!--Using include for Update Health Tools log location-->
|
||||
[!INCLUDE [Windows Update for Business deployment service permissions using Graph Explorer](./includes/wufb-deployment-update-health-tools-logs.md)]
|
||||
292
windows/deployment/update/deployment-service-feature-updates.md
Normal file
292
windows/deployment/update/deployment-service-feature-updates.md
Normal file
@ -0,0 +1,292 @@
|
||||
---
|
||||
title: Deploy feature updates with Windows Update for Business deployment service.
|
||||
description: Use Windows Update for Business deployment service to deploy feature updates.
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 02/14/2023
|
||||
---
|
||||
|
||||
# Deploy feature updates with Windows Update for Business deployment service
|
||||
<!--7512398-->
|
||||
***(Applies to: Windows 11 & Windows 10)***
|
||||
|
||||
The Windows Update for Business deployment service is used to approve and schedule software updates. The deployment service exposes its capabilities through the [Microsoft Graph API](/graph/use-the-api). You can call the API directly, through a [Graph SDK](/graph/sdks/sdks-overview), or integrate them with a management tool such as [Microsoft Intune](/mem/intune).
|
||||
|
||||
This article uses [Graph Explorer](/graph/graph-explorer/graph-explorer-overview) to walk through the entire process of deploying a feature update to clients. In this article, you will:
|
||||
|
||||
In this article, you will:
|
||||
> [!div class="checklist"]
|
||||
> * [Open Graph Explorer](#open-graph-explorer)
|
||||
> * [Run queries to identify devices](#run-queries-to-identify-devices)
|
||||
> * [Enroll devices](#enroll-devices)
|
||||
> * [List catalog entries for feature updates](#list-catalog-entries-for-feature-updates)
|
||||
> * [Create a deployment](#create-a-deployment)
|
||||
> * [Add members to the deployment audience](#add-members-to-the-deployment-audience)
|
||||
> * [Pause a deployment](#pause-a-deployment)
|
||||
> * [Delete a deployment](#delete-a-deployment)
|
||||
> * [Unenroll devices](#unenroll-devices)
|
||||
|
||||
|
||||
## Prerequisites
|
||||
|
||||
All of the [prerequisites for the Windows Update for Business deployment service](deployment-service-prerequisites.md) must be met.
|
||||
|
||||
### Permissions
|
||||
|
||||
<!--Using include for Graph Explorer permissions-->
|
||||
[!INCLUDE [Windows Update for Business deployment service permissions using Graph Explorer](./includes/wufb-deployment-graph-explorer-permissions.md)]
|
||||
|
||||
## Open Graph Explorer
|
||||
|
||||
<!--Using include for Graph Explorer sign in-->
|
||||
[!INCLUDE [Graph Explorer sign in](./includes/wufb-deployment-graph-explorer.md)]
|
||||
|
||||
## Run queries to identify devices
|
||||
|
||||
<!--Using include for Graph Explorer device queries-->
|
||||
[!INCLUDE [Graph Explorer device queries](./includes/wufb-deployment-find-device-name-graph-explorer.md)]
|
||||
|
||||
## Enroll devices
|
||||
|
||||
When you enroll devices into feature update management, the deployment service becomes the authority for feature updates coming from Windows Update.
|
||||
As long as a device remains enrolled in feature update management through the deployment service, the device doesn't receive any other feature updates from Windows Update unless explicitly deployed using the deployment service. A device is offered the specified feature update if it hasn't already received the update. For example, if you deploy Windows 11 feature update version 22H2 to a device that's enrolled into feature update management and is currently on an older version of Windows 11, the device updates to version 22H2. If the device is already running version 22H2 or a later version, it stays on its current version.
|
||||
|
||||
> [!TIP]
|
||||
> Windows Update for Business reports has a [workbook](wufb-reports-workbook.md#feature-updates-tab) that displays the current operating system version for devices. In the workbook, go to the **Feature updates** tab and in the **In Service feature update** tile, select the **View details** link to open the details flyout. The OS version and Azure AD ID of devices can easily be exported into a .csv file or opened in [Azure Monitor Logs](/azure/azure-monitor/logs/log-query-overview) to help when creating a deployment audience.
|
||||
|
||||
<!--Using include for enrolling devices using Graph Explorer-->
|
||||
[!INCLUDE [Graph Explorer enroll devices](./includes/wufb-deployment-enroll-device-graph-explorer.md)]
|
||||
|
||||
## List catalog entries for feature updates
|
||||
|
||||
Each feature update is associated with a unique [catalog entry](/graph/api/resources/windowsupdates-catalogentry). The `id` returned is the **Catalog ID** and is used to create a deployment. Feature updates are deployable until they reach their support retirement dates. For more information, see the support lifecycle dates for [Windows 10](/lifecycle/products/windows-10-enterprise-and-education) and [Windows 11](/lifecycle/products/windows-11-enterprise-and-education) Enterprise and Education editions. The following query lists all deployable feature update catalog entries:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/catalog/entries?$filter=isof('microsoft.graph.windowsUpdates.featureUpdateCatalogEntry')
|
||||
```
|
||||
|
||||
The following truncated response displays a **Catalog ID** of `d9049ddb-0ca8-4bc1-bd3c-41a456ef300f` for the Windows 11, version 22H2 feature update:
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/catalog/entries",
|
||||
"value": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.featureUpdateCatalogEntry",
|
||||
"id": "d9049ddb-0ca8-4bc1-bd3c-41a456ef300f",
|
||||
"displayName": "Windows 11, version 22H2",
|
||||
"deployableUntilDateTime": "2025-10-14T00:00:00Z",
|
||||
"releaseDateTime": "2022-09-20T00:00:00Z",
|
||||
"version": "Windows 11, version 22H2"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Create a deployment
|
||||
|
||||
When creating a deployment for a feature update, there are multiple options available to define how the deployment behaves. The deployment and monitoring settings are optional. The following [deployment settings](/graph/api/resources/windowsupdates-deploymentsettings) are defined in the example request body for deploying the Windows 11, version 22H2 feature update (**Catalog ID** of `d9049ddb-0ca8-4bc1-bd3c-41a456ef300f`):
|
||||
|
||||
- Deployment [start date](/graph/api/resources/windowsupdates-schedulesettings) of February 14, 2023 at 5 AM UTC
|
||||
- [Gradual rollout](/graph/api/resources/windowsupdates-gradualrolloutsettings) at a rate of 100 devices every three days
|
||||
- [Monitoring rule](/graph/api/resources/windowsupdates-monitoringrule) that will pause the deployment if five devices rollback the feature update
|
||||
- Default [safeguard hold](/graph/api/resources/windowsupdates-safeguardprofile) behavior of applying all applicable safeguards to devices in a deployment
|
||||
- When safeguard holds aren't explicitly defined, the default safeguard hold behavior is applied automatically
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/deployments
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"content": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.catalogContent",
|
||||
"catalogEntry": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.featureUpdateCatalogEntry",
|
||||
"id": "d9049ddb-0ca8-4bc1-bd3c-41a456ef300f"
|
||||
}
|
||||
},
|
||||
"settings": {
|
||||
"@odata.type": "microsoft.graph.windowsUpdates.deploymentSettings",
|
||||
"schedule": {
|
||||
"startDateTime": "2023-02-14T05:00:00Z",
|
||||
"gradualRollout": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.rateDrivenRolloutSettings",
|
||||
"durationBetweenOffers": "P3D",
|
||||
"devicesPerOffer": "100"
|
||||
}
|
||||
},
|
||||
"monitoring": {
|
||||
"monitoringRules": [
|
||||
{
|
||||
"signal": "rollback",
|
||||
"threshold": 5,
|
||||
"action": "pauseDeployment"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
The response body will contain:
|
||||
- The new **Deployment ID**, `de910e12-3456-7890-abcd-ef1234567890` in the example
|
||||
- The new **Audience ID**, `d39ad1ce-0123-4567-89ab-cdef01234567` in the example
|
||||
- Any settings defined in the deployment request body
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/deployments/$entity",
|
||||
"id": "de910e12-3456-7890-abcd-ef1234567890",
|
||||
"createdDateTime": "2023-02-07T19:21:15.425905Z",
|
||||
"lastModifiedDateTime": "2023-02-07T19:21:15Z",
|
||||
"state": {
|
||||
"effectiveValue": "scheduled",
|
||||
"requestedValue": "none",
|
||||
"reasons": []
|
||||
},
|
||||
"content": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.catalogContent",
|
||||
"catalogEntry@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/deployments('de910e12-3456-7890-abcd-ef1234567890')/content/microsoft.graph.windowsUpdates.catalogContent/catalogEntry/$entity",
|
||||
"catalogEntry": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.featureUpdateCatalogEntry",
|
||||
"id": "d9049ddb-0ca8-4bc1-bd3c-41a456ef300f",
|
||||
"displayName": "Windows 11, version 22H2",
|
||||
"deployableUntilDateTime": "2025-10-14T00:00:00Z",
|
||||
"releaseDateTime": "0001-01-01T00:00:00Z",
|
||||
"version": "Windows 11, version 22H2"
|
||||
}
|
||||
},
|
||||
"settings": {
|
||||
"contentApplicability": null,
|
||||
"userExperience": null,
|
||||
"expedite": null,
|
||||
"schedule": {
|
||||
"startDateTime": "2023-02-14T05:00:00Z",
|
||||
"gradualRollout": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.rateDrivenRolloutSettings",
|
||||
"durationBetweenOffers": "P3D",
|
||||
"devicesPerOffer": 100
|
||||
}
|
||||
},
|
||||
"monitoring": {
|
||||
"monitoringRules": [
|
||||
{
|
||||
"signal": "rollback",
|
||||
"threshold": 5,
|
||||
"action": "pauseDeployment"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"audience@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/deployments('de910e12-3456-7890-abcd-ef1234567890')/audience/$entity",
|
||||
"audience": {
|
||||
"id": "d39ad1ce-0123-4567-89ab-cdef01234567",
|
||||
"applicableContent": []
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Edit a deployment
|
||||
|
||||
To [update deployment](/graph/api/windowsupdates-deployment-update), PATCH the deployment resource by its **Deployment ID** and supply the updated settings in the request body. The following example keeps the existing gradual rollout settings that were defined when creating the deployment but changes the deployment start date to February 28, 2023 at 5 AM UTC:
|
||||
|
||||
```msgraph-interactive
|
||||
PATCH https://graph.microsoft.com/beta/admin/windows/updates/deployments/de910e12-3456-7890-abcd-ef1234567890
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"settings": {
|
||||
"@odata.type": "microsoft.graph.windowsUpdates.deploymentSettings",
|
||||
"schedule": {
|
||||
"startDateTime": "2023-02-28T05:00:00Z",
|
||||
"gradualRollout": {
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.rateDrivenRolloutSettings",
|
||||
"durationBetweenOffers": "P3D",
|
||||
"devicesPerOffer": "100"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
Verify the deployment settings for the deployment with a **Deployment ID** of `de910e12-3456-7890-abcd-ef1234567890`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/deployments/de910e12-3456-7890-abcd-ef1234567890
|
||||
```
|
||||
|
||||
## Add members to the deployment audience
|
||||
|
||||
The **Audience ID**, `d39ad1ce-0123-4567-89ab-cdef01234567`, was created when the deployment was created. The **Audience ID** is used to add members to the deployment audience. After the deployment audience is updated, Windows Update starts offering the update to the devices according to the deployment settings. As long as the deployment exists and the device is in the audience, the update will be offered.
|
||||
|
||||
The following example adds three devices to the deployment audience using the **Azure AD ID** for each device:
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/updateAudience
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"addMembers": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcdef"
|
||||
},
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcde0"
|
||||
},
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcde1"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
To verify the devices were added to the audience, run the following query using the **Audience ID** of `d39ad1ce-0123-4567-89ab-cdef01234567`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/members
|
||||
```
|
||||
|
||||
## Pause a deployment
|
||||
|
||||
To pause a deployment, PATCH the deployment to have a `requestedValue` of `paused` for the [deploymentState](/graph/api/resources/windowsupdates-deploymentstate). To resume the deployment, use the value `none` and the state will either update to `offering` or `scheduled` if the deployment hasn't reached the start date yet.
|
||||
|
||||
The following example pauses the deployment with a **Deployment ID** of `de910e12-3456-7890-abcd-ef1234567890`:
|
||||
|
||||
```msgraph-interactive
|
||||
|
||||
PATCH https://graph.microsoft.com/beta/admin/windows/updates/deployments/de910e12-3456-7890-abcd-ef1234567890
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.deployment",
|
||||
"state": {
|
||||
"@odata.type": "microsoft.graph.windowsUpdates.deploymentState",
|
||||
"requestedValue": "paused"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Delete a deployment
|
||||
|
||||
To remove the deployment completely, DELETE the deployment. Deleting the deployment will prevent the content from being offered to devices if they haven't already received it. To resume offering the content, a new approval will need to be created.
|
||||
|
||||
|
||||
The following example deletes the deployment with a **Deployment ID** of `de910e12-3456-7890-abcd-ef1234567890`:
|
||||
|
||||
```msgraph-interactive
|
||||
DELETE https://graph.microsoft.com/beta/admin/windows/updates/deployments/de910e12-3456-7890-abcd-ef1234567890
|
||||
```
|
||||
|
||||
## Unenroll devices
|
||||
|
||||
<!--Using include for removing device enrollment-->
|
||||
[!INCLUDE [Graph Explorer enroll devices](./includes/wufb-deployment-graph-unenroll.md)]
|
||||
@ -6,98 +6,67 @@ author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.topic: overview
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
|
||||
|
||||
# Windows Update for Business deployment service
|
||||
|
||||
**Applies to**
|
||||
***(Applies to: Windows 11 & Windows 10)***
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
The Windows Update for Business deployment service is a cloud service within the Windows Update for Business product family. It's designed to work with your existing [Windows Update for Business](waas-manage-updates-wufb.md) policies and [Windows Update for Business reports](wufb-reports-overview.md). The deployment service provides control over the approval, scheduling, and safeguarding of updates delivered from Windows Update to managed devices. The service is privacy focused and backed by leading industry compliance certifications.
|
||||
|
||||
The Windows Update for Business deployment service is a cloud service within the Windows Update for Business product family. It provides control over the approval, scheduling, and safeguarding of updates delivered from Windows Update. It's designed to work in harmony with your existing Windows Update for Business policies.
|
||||
Windows Update for Business product family has three elements:
|
||||
|
||||
The deployment service is designed for IT Pros who are looking for more control than is provided through deferral policies and deployment rings. It provides the following abilities:
|
||||
- Client policy to govern update experiences and timing, which are available through Group Policy and CSPs
|
||||
- [Windows Update for Business reports](wufb-reports-overview.md) to monitor update deployment
|
||||
- Deployment service APIs to approve and schedule specific updates for deployment, which are available through the Microsoft Graph and associated SDKs (including PowerShell)
|
||||
|
||||
- You can schedule deployment of updates to start on a specific date (for example, deploy 20H2 to specified devices on March 14, 2021).
|
||||
- You can stage deployments over a period of days or weeks by using rich expressions (for example, deploy 20H2 to 500 devices per day, beginning on March 14, 2021).
|
||||
- You can bypass pre-configured Windows Update for Business policies to immediately deploy a security update across your organization when emergencies arise.
|
||||
- You can benefit from deployments with automatic piloting tailored to your unique device population to ensure coverage of hardware and software in your organization.
|
||||
- You can use safeguards against likely update issues that have been identified by Microsoft machine-learning algorithms and automatically hold the deployment for any affected devices.
|
||||
The deployment service complements existing Windows Update for Business capabilities, including existing device policies and the[Windows Update for Business reports workbook](wufb-reports-workbook.md).
|
||||
|
||||
The service is privacy focused and backed by leading industry compliance certifications.
|
||||
:::image type="content" source="media/7512398-deployment-service-overview.png" alt-text="Diagram displaying the three elements that are parts of the Windows Update for Business family.":::
|
||||
|
||||
## How it works
|
||||
## How the deployment service works
|
||||
|
||||
The deployment service complements existing Windows Update for Business capabilities, including existing device policies and [Windows Update for Businesss reports](wufb-reports-overview.md).
|
||||
With most update management solutions, usually update policies are set on the client itself using either registry edits, Group Policy, or an MDM solution that leverages CSPs. This means that the end user experience and deployment settings for updates are ultimately determined by the individual device settings. However, with Windows Update for Business deployment service, the service is the central point of control for update deployment behavior. Because the deployment service is directly integrated with Windows Update, once the admin defines the deployment behavior, Windows Update is already aware of how device should be directed to install updates when the device scans. The deployment service creates a direct communication channel between a management tool (including scripting tools such as Windows PowerShell) and the Windows Update service so that the approval and offering of content can be directly controlled by an admin.
|
||||
|
||||
:::image type="content" source="media/wufbds-product-large.png" alt-text="Elements in following text.":::
|
||||
|
||||
Windows Update for Business comprises three elements:
|
||||
- Client policy to govern update experiences and timing – available through Group Policy and CSPs
|
||||
- Deployment service APIs to approve and schedule specific updates – available through the Microsoft Graph and associated SDKs (including PowerShell)
|
||||
- Windows Update for Business reports to monitor update deployment
|
||||
|
||||
Unlike existing client policy, the deployment service doesn't interact with devices directly. The service is native to the cloud and all operations take place between various Microsoft services. It creates a direct communication channel between a management tool (including scripting tools such as Windows PowerShell) and the Windows Update service so that the approval and offering of content can be directly controlled by an IT Pro.
|
||||
|
||||
:::image type="content" source="media/wufbds-interaction-small.png" alt-text="Process described in following text.":::
|
||||
|
||||
Using the deployment service typically follows a common pattern:
|
||||
1. IT Pro uses a management tool to select devices and approve content to be deployed. This tool could be PowerShell, a Microsoft Graph app or a more complete management solution such as Microsoft Intune.
|
||||
2. The chosen tool conveys your approval, scheduling, and device selection information to the deployment service.
|
||||
1. An admin uses a management tool to select devices and approve content to be deployed. This tool could be PowerShell, a Microsoft Graph app, or a more complete management solution such as Microsoft Intune.
|
||||
2. The chosen management tool conveys your approval, scheduling, and device selection information to the deployment service.
|
||||
3. The deployment service processes the content approval and compares it with previously approved content. Final update applicability is determined and conveyed to Windows Update, which then offers approved content to devices on their next check for updates.
|
||||
|
||||
The deployment service exposes these capabilities through Microsoft [Graph REST APIs](/graph/overview). You can call the APIs directly, through a Graph SDK, or integrate them with a management tool such as Microsoft Intune.
|
||||
:::image type="content" source="media/wufbds-interaction-small.png" alt-text="Diagram displaying ":::
|
||||
|
||||
## Prerequisites
|
||||
The deployment service exposes these capabilities through Microsoft [Graph REST APIs](/graph/overview). You can call the APIs directly, through a Graph SDK, or integrate them with a management tool such as [Microsoft Intune](/mem/intune).
|
||||
|
||||
To work with the deployment service, devices must meet all these requirements:
|
||||
## Capabilities of the Windows Update for Business deployment service
|
||||
|
||||
- Be running Windows 10, version 1709 or later (or Windows 11)
|
||||
- Be joined to Azure Active Directory (AD) or Hybrid AD
|
||||
- Have one of the following Windows 10 or Windows 11 editions installed:
|
||||
- Pro
|
||||
- Enterprise
|
||||
- Education
|
||||
- Pro Education
|
||||
- Pro for Workstations
|
||||
The deployment service is designed for IT Pros who are looking for more control than is provided through deferral policies and deployment rings. The service provides the following capabilities for updates:
|
||||
|
||||
Additionally, your organization must have one of the following subscriptions:
|
||||
- Windows 10/11 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, or E5)
|
||||
- Windows 10/11 Education A3 or A5 (included in Microsoft 365 A3 or A5)
|
||||
- Windows Virtual Desktop Access E3 or E5
|
||||
- Microsoft 365 Business Premium
|
||||
- **Approval and scheduling**: Approve and schedule deployment of updates to start on a specific date
|
||||
- *Example*: Deploy the Windows 11 22H2 feature update to specified devices on February 17, 2023.
|
||||
- **Gradual rollout**: Stage deployments over a period of days or weeks by specifying gradual rollout settings
|
||||
- *Example*: Deploy the Windows 11 22H2 feature update to 500 devices per day, beginning on February 17, 2023
|
||||
- **Expedite**: Bypass the configured Windows Update for Business policies to immediately deploy a security update across the organization
|
||||
- **Safeguard holds**: Automatically holds the deployment for devices that may be impacted by an update issue identified by Microsoft machine-learning algorithms
|
||||
|
||||
## Getting started
|
||||
Certain capabilities are available for specific update classifications:
|
||||
|
||||
To use the deployment service, you use a management tool built on the platform, script common actions using PowerShell, or build your own application.
|
||||
|Capabilities | [Quality updates](deployment-service-expedited-updates.md) | [Feature updates](deployment-service-feature-updates.md) | [Drivers and firmware](deployment-service-drivers.md)|
|
||||
|---|---|---|---|
|
||||
|Approval and scheduling | | Yes | Yes |
|
||||
|Gradual rollout | | Yes | |
|
||||
|Expedite | Yes | | |
|
||||
|Safeguard holds| | Yes | |
|
||||
|
||||
### Using Microsoft Intune
|
||||
|
||||
Intune integrates with the deployment service to provide Windows client update management capabilities. For more information, see [Feature updates for Windows 10 and later policy in Intune](/mem/intune/protect/windows-10-feature-updates).
|
||||
|
||||
### Scripting common actions using PowerShell
|
||||
|
||||
The Microsoft Graph SDK includes a PowerShell extension that you can use to script and automate common update actions. For more information, see [Get started with the Microsoft Graph PowerShell SDK](/graph/powershell/get-started).
|
||||
|
||||
### Building your own application
|
||||
|
||||
Microsoft Graph makes deployment service APIs available through. Get started with these learning paths:
|
||||
- Learning path: [Microsoft Graph Fundamentals](/training/paths/m365-msgraph-fundamentals/)
|
||||
- Learning path: [Build apps with Microsoft Graph](/training/paths/m365-msgraph-associate/)
|
||||
|
||||
Once you're familiar with Microsoft Graph development, see [Windows updates API overview in Microsoft Graph](/graph/windowsupdates-concept-overview) for more.
|
||||
|
||||
## Deployment protections
|
||||
|
||||
The deployment service protects deployments through a combination of rollout controls and machine-learning algorithms that monitor deployments and react to issues during the rollout.
|
||||
|
||||
### Schedule rollouts with automatic piloting
|
||||
### Gradual rollout
|
||||
|
||||
The deployment service allows any update to be deployed over a period of days or weeks. Once an update has been scheduled, the deployment service optimizes the deployment based on the scheduling parameters and unique attributes spanning the devices being updated. The service follows these steps:
|
||||
|
||||
@ -106,80 +75,45 @@ The deployment service allows any update to be deployed over a period of days or
|
||||
3. Start deploying to earlier waves to build coverage of device attributes present in the population.
|
||||
4. Continue deploying at a uniform rate until all waves are complete and all devices are updated.
|
||||
|
||||
This built-in piloting capability complements your existing ring structure and provides another support for reducing and managing risk during an update. Unlike tools such as Desktop Analytics, this capability is intended to operate within each ring. The deployment service doesn't provide a workflow for creating rings themselves.
|
||||
|
||||
You should continue to use deployment rings as part of the servicing strategy for your organization, but use gradual rollouts to add scheduling convenience and other protections within each ring.
|
||||
This built-in piloting capability complements your existing [deployment ring](waas-quick-start.md) structure and provides another support for reducing and managing risk during an update. This capability is intended to operate within each ring. The deployment service doesn't provide a workflow for creating rings themselves. Continue to use deployment rings as part of the servicing strategy for your organization, but use gradual rollouts to add scheduling convenience and other protections within each ring.
|
||||
|
||||
### Safeguard holds against likely and known issues
|
||||
|
||||
Microsoft uses [safeguard holds](/windows/deployment/update/safeguard-holds) to protect devices from encountering known quality or compatibility issues by preventing them from installing the update or upgrade. For Windows 11 deployments, the deployment service extends these safeguard holds to also protect devices that Microsoft identifies as being at a higher risk of experiencing problems after an update (such as operating system rollbacks, app crashes, or graphics issues). The service temporarily holds the deployment for these devices while Microsoft investigates the likely issue. Safeguard holds apply to deployments by default, but you can opt out.
|
||||
|
||||
To verify whether a device is affected by a safeguard hold, see [Am I affected by a safeguard hold?](/windows/deployment/update/safeguard-holds#am-i-affected-by-a-safeguard-hold)
|
||||
Microsoft uses [safeguard holds](/windows/deployment/update/safeguard-holds) to protect devices from encountering known quality or compatibility issues by preventing them from installing the update or upgrade. For Windows 11 deployments, the deployment service also extends safeguard holds to protect devices that Microsoft identifies as being at a higher risk of experiencing problems after an update (such as operating system rollbacks, app crashes, or graphics issues). The service temporarily holds the deployment for these devices while Microsoft investigates the likely issue. Safeguard holds apply to deployments by default, but you can opt out. To verify whether a device is affected by a safeguard hold, see [Am I affected by a safeguard hold?](/windows/deployment/update/safeguard-holds#am-i-affected-by-a-safeguard-hold).
|
||||
|
||||
### Monitoring deployments to detect rollback issues
|
||||
|
||||
During deployments of Windows 11 or Windows 10 feature updates, driver combinations can sometimes result in an unexpected update failure that makes the device revert to the previously installed operating system version. The deployment service can monitor devices for such issues and automatically pause deployments when this happens, giving you time to detect and mitigate issues.
|
||||
|
||||
### How to enable deployment protections
|
||||
## Get started with the deployment service
|
||||
|
||||
Deployment scheduling controls are always available, but to take advantage of the unique deployment protections tailored to your population, devices must share diagnostic data with Microsoft.
|
||||
To use the deployment service, you use a management tool built on the platform like Microsoft Intune, script common actions using PowerShell, or build your own application.
|
||||
|
||||
#### Device prerequisites
|
||||
To learn more about the deployment service and the deployment process, see:
|
||||
|
||||
- Diagnostic data is set to *Required* or *Optional*.
|
||||
- The **AllowWUfBCloudProcessing** policy is set to **8**.
|
||||
- [Prerequisites for Windows Update for Business deployment service](deployment-service-prerequisites.md)
|
||||
- [Deploy feature updates using Graph Explorer](deployment-service-feature-updates.md)
|
||||
- [Deploy expedited updates using Graph Explorer](deployment-service-expedited-updates.md)
|
||||
- [Deploy driver and firmware updates using Graph Explorer](deployment-service-drivers.md)
|
||||
|
||||
#### Set the **AllowWUfBCloudProcessing** policy
|
||||
### Scripting common actions using PowerShell
|
||||
|
||||
To enroll devices in Windows Update for Business cloud processing, set the **AllowWUfBCloudProcessing** policy using mobile device management (MDM) policy or Group Policy.
|
||||
The Microsoft Graph SDK includes a PowerShell extension that you can use to script and automate common update actions. For more information, see [Get started with the Microsoft Graph PowerShell SDK](/graph/powershell/get-started).
|
||||
|
||||
| Policy| Sets registry key under `HKLM\Software`|
|
||||
|--|--|
|
||||
| GPO for Windows 10, version 1809 or later: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow WUfB Cloud Processing** | `\Policies\Microsoft\Windows\DataCollection\AllowWUfBCloudProcessing` |
|
||||
| MDM for Windows 10, version 1809 or later: ../Vendor/MSFT/ Policy/Config/System/**AllowWUfBCloudProcessing** | `\Microsoft\PolicyManager\current\device\System\AllowWUfBCloudProcessing` |
|
||||
### Building your own application
|
||||
|
||||
Following is an example of setting the policy using Intune:
|
||||
Microsoft Graph makes deployment service APIs available through. Get started with the resources below:
|
||||
|
||||
1. Sign in to the [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
- Learning path: [Microsoft Graph Fundamentals](/training/paths/m365-msgraph-fundamentals/)
|
||||
- Learning path: [Build apps with Microsoft Graph](/training/paths/m365-msgraph-associate/)
|
||||
|
||||
2. Select **Devices** > **Configuration profiles** > **Create profile**.
|
||||
- Windows Update for Business deployment service [sample driver deployment application](https://github.com/microsoftgraph/windowsupdates-webapplication-sample) on GitHub
|
||||
- [Windows updates API overview in Microsoft Graph](/graph/windowsupdates-concept-overview)
|
||||
|
||||
3. Select **Windows 10 and later** in **Platform**, select **Templates** in **Profile type**, select **Custom** in **Template name**, and then select **Create**.
|
||||
### Use Microsoft Intune
|
||||
|
||||
4. In **Basics**, enter a meaningful name and a description for the policy, and then select **Next**.
|
||||
|
||||
5. In **Configuration settings**, select **Add**, enter the following settings, select **Save**, and then select **Next**.
|
||||
- Name: **AllowWUfBCloudProcessing**
|
||||
- Description: Enter a description.
|
||||
- OMA-URI: `./Vendor/MSFT/Policy/Config/System/AllowWUfBCloudProcessing`
|
||||
- Data type: **Integer**
|
||||
- Value: **8**
|
||||
|
||||
6. In **Assignments**, select the groups that will receive the profile, and then select **Next**.
|
||||
|
||||
7. In **Review + create**, review your settings, and then select **Create**.
|
||||
|
||||
8. (Optional) To verify that the policy reached the client, check the value of the following registry entry:
|
||||
|
||||
`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\System\AllowWUfBCloudProcessing`
|
||||
|
||||
## Best practices
|
||||
Follow these suggestions for the best results with the service.
|
||||
|
||||
### Device onboarding
|
||||
|
||||
- Wait until devices finish provisioning before managing with the service. If a device is being provisioned by Autopilot, it can only be managed by the deployment service after it finishes provisioning (typically one day).
|
||||
|
||||
- Use the deployment service for feature update management without feature update deferral policy. If you want to use the deployment service to manage feature updates on a device that previously used a feature update deferral policy, it's best to set the feature update deferral policy to **0** days to avoid having multiple conditions governing feature updates. You should only change the feature update deferral policy value to 0 days after you've confirmed that the device was enrolled in the service with no errors.
|
||||
|
||||
### General
|
||||
|
||||
Avoid using different channels to manage the same resources. If you use Microsoft Intune along with Microsoft Graph APIs or PowerShell, aspects of resources (such as devices, deployments, updatable asset groups) might be overwritten if you use both channels to manage the same resources. Instead, only manage each resource through the channel that created it.
|
||||
|
||||
|
||||
## Next steps
|
||||
|
||||
To learn more about the deployment service, try the following:
|
||||
Microsoft Intune integrates with the deployment service to provide Windows client update management capabilities. For more information, see:
|
||||
|
||||
- [Feature updates for Windows 10 and later policy in Intune](/mem/intune/protect/windows-10-feature-updates)
|
||||
- [Windows updates API overview in Microsoft Graph](/graph/windowsupdates-concept-overview)
|
||||
- [Expedite Windows quality updates in Microsoft Intune](/mem/intune/protect/windows-10-expedite-updates)
|
||||
|
||||
|
||||
108
windows/deployment/update/deployment-service-prerequisites.md
Normal file
108
windows/deployment/update/deployment-service-prerequisites.md
Normal file
@ -0,0 +1,108 @@
|
||||
---
|
||||
title: Prerequisites for the Windows Update for Business deployment service
|
||||
description: Prerequisites for using the Windows Update for Business deployment service.
|
||||
ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.localizationpriority: medium
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: article
|
||||
ms.technology: itpro-updates
|
||||
ms.date: 02/14/2023
|
||||
---
|
||||
|
||||
# Windows Update for Business deployment service prerequisites
|
||||
<!--7512398-->
|
||||
***(Applies to: Windows 11 & Windows 10)***
|
||||
|
||||
Before you begin the process of deploying updates with Windows Update for Business deployment service, ensure you meet the prerequisites.
|
||||
|
||||
## Azure and Azure Active Directory
|
||||
|
||||
- An Azure subscription with [Azure Active Directory](/azure/active-directory/)
|
||||
- Devices must be Azure Active Directory-joined and meet the below OSrequirements.
|
||||
- Devices can be [Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join) or [hybrid Azure AD joined](/azure/active-directory/devices/concept-azure-ad-join-hybrid).
|
||||
- Devices that are [Azure AD registered](/azure/active-directory/devices/concept-azure-ad-register) only (Workplace joined) aren't supported with Windows Update for Business
|
||||
|
||||
## Licensing
|
||||
|
||||
Windows Update for Business deployment service requires users of the devices to have one of the following licenses:
|
||||
|
||||
- Windows 10/11 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, or E5)
|
||||
- Windows 10/11 Education A3 or A5 (included in Microsoft 365 A3 or A5)
|
||||
- Windows Virtual Desktop Access E3 or E5
|
||||
- Microsoft 365 Business Premium
|
||||
|
||||
## Operating systems and editions
|
||||
|
||||
- Windows 11 Professional, Education, Enterprise, Pro Education, or Pro for Workstations editions
|
||||
- Windows 10 Professional, Education, Enterprise, Pro Education, or Pro for Workstations editions
|
||||
|
||||
Windows Update for Business deployment service supports Windows client devices on the **General Availability Channel**.
|
||||
|
||||
### Windows operating system updates
|
||||
|
||||
- Expediting updates requires the *Update Health Tools* on the clients. The tools are installed starting with [KB 4023057](https://support.microsoft.com/topic/kb4023057-update-for-windows-10-update-service-components-fccad0ca-dc10-2e46-9ed1-7e392450fb3a). To confirm the presence of the Update Health Tools on a device:
|
||||
- Look for the folder **C:\Program Files\Microsoft Update Health Tools** or review *Add Remove Programs* for **Microsoft Update Health Tools**.
|
||||
- As an Admin, run the following PowerShell script: `Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -match "Microsoft Update Health Tools"}`
|
||||
|
||||
- For [Changes to Windows diagnostic data collection](/windows/privacy/changes-to-windows-diagnostic-data-collection#services-that-rely-on-enhanced-diagnostic-data), installing the January 2023 release preview cumulative update, or a later equivalent update, is recommended
|
||||
|
||||
## Diagnostic data requirements
|
||||
|
||||
Deployment scheduling controls are always available. However, to take advantage of the unique deployment protections tailored to your population and to [deploy driver updates](deployment-service-drivers.md), devices must share diagnostic data with Microsoft. For these features, at minimum, the deployment service requires devices to send [diagnostic data](/windows/privacy/configure-windows-diagnostic-data-in-your-organization#diagnostic-data-settings) at the *Required* level (previously called *Basic*) for these features.
|
||||
|
||||
When you use [Windows Update for Business reports](wufb-reports-overview.md) in conjunction with the deployment service, using diagnostic data at the following levels allows device names to appear in reporting:
|
||||
|
||||
- *Optional* level (previously *Full*) for Windows 11 devices
|
||||
- *Enhanced* level for Windows 10 devices
|
||||
|
||||
## Permissions
|
||||
|
||||
- [Windows Update for Business deployment service](/graph/api/resources/windowsupdates) operations require [WindowsUpdates.ReadWrite.All](/graph/permissions-reference#windows-updates-permissions)
|
||||
- Some roles, such as the [Windows Update deployment administrator](/azure/active-directory/roles/permissions-reference#windows-update-deployment-administrator), already have the permissions.
|
||||
|
||||
> [!NOTE]
|
||||
> Leveraging other parts of the Graph API might require additional permissions. For example, to display [device](/graph/api/resources/device) information, a minimum of [Device.Read.All](/graph/permissions-reference#device-permissions) permission is needed.
|
||||
|
||||
## Required endpoints
|
||||
|
||||
- Have access to the following endpoints:
|
||||
|
||||
- [Windows Update endpoints](/windows/privacy/manage-windows-1809-endpoints#windows-update)
|
||||
- *.prod.do.dsp.mp.microsoft.com
|
||||
- *.windowsupdate.com
|
||||
- *.dl.delivery.mp.microsoft.com
|
||||
- *.update.microsoft.com
|
||||
- *.delivery.mp.microsoft.com
|
||||
- tsfe.trafficshaping.dsp.mp.microsoft.com
|
||||
- Windows Update for Business deployment service endpoints
|
||||
|
||||
- devicelistenerprod.microsoft.com
|
||||
- login.windows.net
|
||||
- payloadprod*.blob.core.windows.net
|
||||
|
||||
- [Windows Push Notification Services](/windows/uwp/design/shell/tiles-and-notifications/firewall-allowlist-config): *(Recommended, but not required. Without this access, devices might not expedite updates until their next daily check for updates.)*
|
||||
- *.notify.windows.com
|
||||
|
||||
|
||||
## Limitations
|
||||
|
||||
<!--Using include for deployment service limitations-->
|
||||
[!INCLUDE [Windows Update for Business deployment service limitations](./includes/wufb-deployment-limitations.md)]
|
||||
|
||||
## Policy considerations for drivers
|
||||
|
||||
<!--Using include for Policy considerations for drivers-->
|
||||
[!INCLUDE [Windows Update for Business deployment service driver policy considerations](./includes/wufb-deployment-driver-policy-considerations.md)]
|
||||
|
||||
|
||||
## General tips for the deployment service
|
||||
|
||||
Follow these suggestions for the best results with the service:
|
||||
|
||||
- Wait until devices finish provisioning before managing with the service. If a device is being provisioned by Autopilot, it can only be managed by the deployment service after it finishes provisioning (typically one day).
|
||||
|
||||
- Use the deployment service for feature update management without feature update deferral policy. If you want to use the deployment service to manage feature updates on a device that previously used a feature update deferral policy, it's best to set the feature update deferral policy to **0** days to avoid having multiple conditions governing feature updates. You should only change the feature update deferral policy value to 0 days after you've confirmed that the device was enrolled in the service with no errors.
|
||||
|
||||
- Avoid using different channels to manage the same resources. If you use Microsoft Intune along with Microsoft Graph APIs or PowerShell, aspects of resources (such as devices, deployments, updatable asset groups) might be overwritten if you use both channels to manage the same resources. Instead, only manage each resource through the channel that created it.
|
||||
@ -15,10 +15,7 @@ ms.date: 12/31/2017
|
||||
|
||||
# Troubleshoot the Windows Update for Business deployment service
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
***(Applies to: Windows 11 & Windows 10)***
|
||||
|
||||
This troubleshooting guide addresses the most common issues that IT administrators face when using the Windows Update for Business [deployment service](deployment-service-overview.md). For a general troubleshooting guide for Windows Update, see [Windows Update troubleshooting](/troubleshoot/windows-client/deployment/windows-update-issues-troubleshooting?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json).
|
||||
|
||||
@ -35,3 +32,30 @@ This troubleshooting guide addresses the most common issues that IT administrato
|
||||
|
||||
- Check that the device is scanning the Windows Update service and not a different endpoint. If the device is scanning for updates from a WSUS endpoint, for example, it might receive different updates. To learn more about scanning for updates, see [Scanning updates](how-windows-update-works.md#scanning-updates).
|
||||
- **Feature updates only**: Check that the device is successfully enrolled in feature update management by the deployment service. A device that is not successfully enrolled might receive different updates according to its feature update deferral period, for example. A device that is successfully enrolled will be represented by an Azure AD device resource with an update management enrollment for feature updates and have no Azure AD device registration errors.
|
||||
|
||||
### The device installed a newer update then the expedited update I deployed
|
||||
|
||||
There are some scenarios when a deployment to expedite an update results in the installation of a more recent update than specified in policy. This result occurs when the newer update includes and surpasses the specified update, and that newer update is available before a device checks in to install the update that's specified in the expedite update policy.
|
||||
|
||||
Installing the most recent quality update reduces disruptions to the device and user while applying the benefits of the intended update. This avoids having to install multiple updates, which each might require separate reboots.
|
||||
|
||||
A more recent update is deployed when the following conditions are met:
|
||||
|
||||
- The device isn't targeted with a deferral policy that blocks installation of a more recent update. In this case, the most recently available update that isn't deferred is the update that might install.
|
||||
|
||||
- During the process to expedite an update, the device runs a new scan that detects the newer update. This can occur due to the timing of:
|
||||
- When the device restarts to complete installation
|
||||
- When the device runs its daily scan
|
||||
- When a new update becomes available
|
||||
|
||||
When a scan identifies a newer update, Windows Update attempts to stop installation of the original update, cancel the restart, and then starts the download and installation of the more recent update.
|
||||
|
||||
While expedite update deployments will override an update deferral for the update version that's specified, they don't override deferrals that are in place for any other update version.
|
||||
|
||||
<!--Using include for Update Health Tools log location-->
|
||||
[!INCLUDE [Windows Update for Business deployment service permissions using Graph Explorer](./includes/wufb-deployment-update-health-tools-logs.md)]
|
||||
|
||||
## Policy considerations for drivers
|
||||
|
||||
<!--Using include for Policy considerations for drivers-->
|
||||
[!INCLUDE [Windows Update for Business deployment service driver policy considerations](./includes/wufb-deployment-driver-policy-considerations.md)]
|
||||
|
||||
@ -0,0 +1,63 @@
|
||||
---
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.technology: itpro-updates
|
||||
ms.prod: windows-client
|
||||
ms.topic: include
|
||||
ms.date: 02/14/2023
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
<!--This file is shared by deployment-service-drivers.md and the deployment-service-feature-updates.md articles. Headings may be driven by article context. 7512398 -->
|
||||
A deployment audience is a collection of devices that you want to deploy updates to. The audience needs to be created first, then members are added to the audience. Use the following steps to create a deployment audience, add members, and verify it:
|
||||
|
||||
1. To create a new audience, **POST** to the [deployment audience](/graph/api/resources/windowsupdates-deploymentaudience) resource with a request body of `{}`.
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences
|
||||
content-type: application/json
|
||||
|
||||
{}
|
||||
```
|
||||
|
||||
The POST returns an HTTP status code of `201 Created` as a response with the following body, where `id` is the **Audience ID**:
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/beta/$metadata#admin/windows/updates/deploymentAudiences/$entity",
|
||||
"id": "d39ad1ce-0123-4567-89ab-cdef01234567",
|
||||
"reportingDeviceCount": 0,
|
||||
"applicableContent": []
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
1. Add devices, using their **Azure AD ID**, to the deployment audience so they become audience members. Specify the deployment **Audience ID** in the URL field and the devices to add in the request body. The `id` property specifies the **Azure AD ID** of the device.
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/updateAudience
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"addMembers": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcdef"
|
||||
},
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcde0"
|
||||
},
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcde1"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
1. To verify the devices were added to the audience, run the following query using the **Audience ID** of `d39ad1ce-0123-4567-89ab-cdef01234567`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/beta/admin/windows/updates/deploymentAudiences/d39ad1ce-0123-4567-89ab-cdef01234567/members
|
||||
```
|
||||
@ -0,0 +1,45 @@
|
||||
---
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.technology: itpro-updates
|
||||
ms.prod: windows-client
|
||||
ms.topic: include
|
||||
ms.date: 02/14/2023
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
<!--This file is shared by deployment-service-drivers.md, deployment-service-troubleshoot.md, and the deployment-service-prerequisites.md articles. Headings may be driven by article context. 7512398 -->
|
||||
|
||||
It's possible for the service to receive content approval but the content doesn't get installed on the device because of a Group Policy, CSP, or registry setting on the device. In some cases, organizations specifically configure these policies to fit their current or future needs. For instance, organizations may want to review applicable driver content through the deployment service, but not allow installation. Configuring this sort of behavior can be useful, especially when transitioning management of driver updates due to changing organizational needs. The following list describes driver related update policies that can affect deployments through the deployment service:
|
||||
|
||||
### Policies that exclude drivers from Windows Update for a device
|
||||
|
||||
The following policies exclude drivers from Windows Update for a device:
|
||||
|
||||
- **Locations of policies that exclude drivers**:
|
||||
- **Group Policy**: `\Windows Components\Windows Update\Do not include drivers with Windows Updates` set to `enabled`
|
||||
- **CSP**: [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-csp-update#excludewudriversinqualityupdate) set to `1`
|
||||
- **Registry**: `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\ExcludeWUDriversFromQualityUpdates` set to `1`
|
||||
- **Intune**: [**Windows Drivers** update setting](/mem/intune/protect/windows-update-settings#update-settings) for the update ring set to `Allow`
|
||||
|
||||
**Behavior with the deployment service**: Devices with driver exclusion polices that are enrolled for **drivers** and added to an audience though the deployment service:
|
||||
- Will display the applicable driver content in the deployment service
|
||||
- Won't install drivers that are approved from the deployment service
|
||||
- If drivers are deployed to a device that's blocking them, the deployment service displays the driver is being offered and reporting displays the install is pending.
|
||||
|
||||
### Policies that define the source for driver updates
|
||||
|
||||
The following policies define the source for driver updates as either Windows Update or Windows Server Update Service (WSUS):
|
||||
|
||||
- **Locations of policies that define an update source**:
|
||||
- **Group Policy**: `\Windows Components\Windows Update\Manage updates offered from Windows Server Update Service\Specify source service for specific classes of Windows Updates` set to `enabled` with the `Driver Updates` option set to `Windows Update`
|
||||
- **CSP**: [SetPolicyDrivenUpdateSourceForDriverUpdates](/windows/client-management/mdm/policy-csp-update#setpolicydrivenupdatesourcefordriverupdates) set to `0` for Windows Update as the source
|
||||
- **Registry**: `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\SetPolicyDrivenUpdateSourceForDriverUpdates` set to `0`. Under `\AU`, `UseUpdateClassPolicySource` also needs to be set to `1`
|
||||
- **Intune**: Not applicable. Intune deploys updates using Windows Update for Business. [Co-managed clients from Configuration Manager](/mem/configmgr/comanage/overview?toc=/mem/configmgr/cloud-attach/toc.json&bc=/mem/configmgr/cloud-attach/breadcrumb/toc.json) with the workload for Windows Update policies set to Intune will also use Windows Update for Business.
|
||||
|
||||
**Behavior with the deployment service**: Devices with these update source policies that are enrolled for **drivers** and added to an audience though the deployment service:
|
||||
- Will display the applicable driver content in the deployment service
|
||||
- Will install drivers that are approved from the deployment service
|
||||
|
||||
> [!NOTE]
|
||||
> When the scan source for drivers is set to WSUS, the deployment service doesn't get inventory events from devices. This means that the deployment service won't be able to report the applicability of a driver for the device.
|
||||
@ -0,0 +1,45 @@
|
||||
---
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.technology: itpro-updates
|
||||
ms.prod: windows-client
|
||||
ms.topic: include
|
||||
ms.date: 02/14/2023
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
<!--This file is shared by deployment-service-drivers.md and the deployment-service-feature-updates.md articles. Headings may be driven by article context. 7512398 -->
|
||||
|
||||
You enroll devices based on the types of updates you want them to receive. Currently, you can enroll devices to receive feature updates (`feature`) or drivers (`driver`). You can enroll devices to receive updates from multiple update classifications.
|
||||
|
||||
1. To enroll devices, POST to [updatableAssets](/graph/api/resources/windowsupdates-updatableasset) using [enrollAssets](/graph/api/windowsupdates-updatableasset-enrollassets). The following example enrolls three devices to receive driver updates:
|
||||
1. In Graph Explorer, select **POST** from the drop-down list for the HTTP verb.
|
||||
1. Enter the following request into the URL field: </br>
|
||||
`https://graph.microsoft.com/beta/admin/windows/updates/updatableAssets/enrollAssets`
|
||||
1. In the **Request body** tab, enter the following JSON, supplying the following information:
|
||||
- **Azure AD Device ID** as `id`
|
||||
- Either `feature` or `driver` for the updateCategory
|
||||
|
||||
```json
|
||||
{
|
||||
"updateCategory": "driver",
|
||||
"assets": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcdef"
|
||||
},
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcde0"
|
||||
},
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcde1"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
1. Select the **Run query** button. The results will appear in the **Response** window. In this case, the HTTP status code of `202 Accepted`.
|
||||
|
||||
:::image type="content" source="../media/7512398-deployment-enroll-asset-graph.png" alt-text="Screenshot of successfully enrolling assets through Graph Explorer." lightbox="../media/7512398-deployment-enroll-asset-graph.png" :::
|
||||
@ -0,0 +1,54 @@
|
||||
---
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.technology: itpro-updates
|
||||
ms.prod: windows-client
|
||||
ms.topic: include
|
||||
ms.date: 02/14/2023
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
<!--This file is shared by deployment-service-drivers.md, deployment-service-expedited-updates.md, and the deployment-service-feature-updates.md articles. Headings may be driven by article context. 7512398 -->
|
||||
|
||||
Use the [device](/graph/api/resources/device) resource type to find clients to enroll into the deployment service. Change the query parameters to fit your specific needs. For more information, see [Use query parameters](/graph/query-parameters).
|
||||
|
||||
- Displays the **AzureAD Device ID** and **Name** of all devices:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/v1.0/devices?$select=deviceid,displayName
|
||||
```
|
||||
|
||||
- Displays the **AzureAD Device ID** and **Name** for devices that have a name starting with `Test`:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/v1.0/devices?$filter=startswith(displayName,'Test')&$select=deviceid,displayName
|
||||
```
|
||||
|
||||
|
||||
### Add a request header for advanced queries
|
||||
|
||||
For the next requests, set the **ConsistencyLevel** header to `eventual`. For more information about advanced query parameters, see [Advanced query capabilities on Azure AD directory objects](/graph/aad-advanced-queries).
|
||||
|
||||
1. In Graph Explorer, select the **Request headers** tab.
|
||||
1. For **Key** type in `ConsistencyLevel` and for **Value**, type `eventual`.
|
||||
1. Select the **Add** button. When you're finished, remove the request header by selecting the trash can icon.
|
||||
|
||||
:::image type="content" source="../media/7512398-deployment-service-graph-modify-header.png" alt-text="Screenshot of the request headers tab in Graph Explorer" lightbox="../media/7512398-deployment-service-graph-modify-header.png":::
|
||||
|
||||
- Display the **Name** and **Operating system version** for the device that has `01234567-89ab-cdef-0123-456789abcdef` as the **AzureAD Device ID**:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/v1.0/devices?$search="deviceid:01234567-89ab-cdef-0123-456789abcdef"&$select=displayName,operatingSystemVersion
|
||||
```
|
||||
|
||||
- To find devices that likely aren't virtual machines, filter for devices that don't have virtual machine listed as the model but do have a manufacturer listed. Display the **AzureAD Device ID**, **Name**, and **Operating system version** for each device:
|
||||
|
||||
```msgraph-interactive
|
||||
GET https://graph.microsoft.com/v1.0/devices?$filter=model ne 'virtual machine' and NOT(manufacturer eq null)&$count=true&$select=deviceid,displayName,operatingSystemVersion
|
||||
```
|
||||
|
||||
> [!Tip]
|
||||
> Requests using the [device](/graph/api/resources/device) resource type typically have both an `id` and a `deviceid`:
|
||||
> - The `deviceid` is the **Azure AD Device ID** and will be used in this article.
|
||||
> - Later in this article, this `deviceid` will be used as an `id` when you make certain requests such as adding a device to a deployment audience.
|
||||
> - The `id` from the [device](/graph/api/resources/device) resource type is usually the Azure AD Object ID, which won't be used in this article.
|
||||
@ -0,0 +1,18 @@
|
||||
---
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.technology: itpro-updates
|
||||
ms.prod: windows-client
|
||||
ms.topic: include
|
||||
ms.date: 02/14/2023
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
<!--This file is shared by deployment-service-drivers.md, deployment-service-expedited-updates.md, and the deployment-service-feature-updates.md articles. Headings may be driven by article context. 7512398 -->
|
||||
|
||||
The following permissions are needed for the queries listed in this article:
|
||||
|
||||
- [WindowsUpdates.ReadWrite.All](/graph/permissions-reference#windows-updates-permissions) for [Windows Update for Business deployment service](/graph/api/resources/windowsupdates) operations.
|
||||
- At least [Device.Read.All](/graph/permissions-reference#device-permissions) permission to display [device](/graph/api/resources/device) information.
|
||||
|
||||
Some roles, such as the [Windows Update deployment administrator](/azure/active-directory/roles/permissions-reference#windows-update-deployment-administrator), already have these permissions.
|
||||
@ -0,0 +1,34 @@
|
||||
---
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.technology: itpro-updates
|
||||
ms.prod: windows-client
|
||||
ms.topic: include
|
||||
ms.date: 02/14/2023
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
<!--This file is shared by deployment-service-drivers.md, deployment-service-expedited-updates.md, and the deployment-service-feature-updates.md articles. Headings may be driven by article context. 7512398 -->
|
||||
|
||||
For this article, you'll use Graph Explorer to make requests to the [Microsoft Graph APIs](/graph/api/resources/windowsupdates-updates?view=graph-rest-beta&preserve-view=true) to retrieve, add, delete, and update data. Graph Explorer is a developer tool that lets you learn about Microsoft Graph APIs. For more information about using Graph Explorer, see [Get started with Graph Explorer](/graph/graph-explorer/overview).
|
||||
|
||||
> [!WARNING]
|
||||
>
|
||||
> - Requests listed in this article require signing in with a Microsoft 365 account. If needed, a free one month trial is available for [Microsoft 365 Business Premium](https://www.microsoft.com/microsoft-365/business/microsoft-365-business-premium).
|
||||
> - Using a test tenant to learn and verify the deployment process is highly recommended. Graph Explorer is intended to be a learning tool. Ensure you understand [granting consent](/graph/security-authorization) and the [consent type](/graph/api/resources/oauth2permissiongrant#properties) for Graph Explorer before proceeding.
|
||||
|
||||
1. From a browser, go to [Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) and sign in using an Azure Active Directory (Azure AD) user account.
|
||||
1. You may need to enable the [`WindowsUpdates.ReadWrite.All` permission](/graph/permissions-reference#windows-updates-permissions) to use the queries in this article. To enable the permission:
|
||||
1. Select the **Modify permissions** tab in Graph Explorer.
|
||||
1. In the permissions dialog box, select the **WindowsUpdates.ReadWrite.All** permission then select **Consent**. You may need to sign in again to grant consent.
|
||||
|
||||
:::image type="content" source="../media/7512398-wufbds-graph-modify-permission.png" alt-text="Screenshot of the modify permissions tab in Graph Explorer" lightbox="../media/7512398-wufbds-graph-modify-permission.png" :::
|
||||
|
||||
1. To make requests:
|
||||
1. Select either GET, POST, PUT, PATCH, or DELETE from the drop-down list for the HTTP method.
|
||||
1. Enter the request into the URL field. The version will populate automatically based on the URL.
|
||||
1. If you need to modify the request body, edit the **Request body** tab.
|
||||
1. Select the **Run query** button. The results will appear in the **Response** window.
|
||||
|
||||
> [!TIP]
|
||||
> When reviewing [Microsoft Graph documentation](/graph/), you may notice example requests usually list `content-type: application/json`. Specifying `content-type` typically isn't required for Graph Explorer, but you can add it to the request by selecting the **Headers** tab and adding the `content-type` to the **Request headers** field as the **Key** and `application/json` as the **Value**.
|
||||
@ -0,0 +1,42 @@
|
||||
---
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.technology: itpro-updates
|
||||
ms.prod: windows-client
|
||||
ms.topic: include
|
||||
ms.date: 02/14/2023
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
<!--This file is shared by deployment-service-drivers.md and the deployment-service-feature-updates.md articles. Headings may be driven by article context. 7512398 -->
|
||||
|
||||
When a device no longer needs to be managed by the deployment service, unenroll it. Just like [enrolling a device](#enroll-devices), specify either `driver` or `feature` as the value for the `updateCategory`. The device will no longer receive updates from the deployment service for the specified update category. Depending on the device's configuration, it may start to receive updates from Windows Update. For instance, if a device is still enrolled for feature updates, but it's unenrolled from drivers:
|
||||
|
||||
- Existing driver deployments from the service won't be offered to the device
|
||||
- The device will continue to receive feature updates from the deployment service
|
||||
- Drivers may start being installed from Windows Update depending on the device's configuration
|
||||
|
||||
To unenroll a device, POST to [updatableAssets](/graph/api/resources/windowsupdates-updatableasset) using [unenrollAssets](/graph/api/windowsupdates-updatableasset-unenrollassets). In the request body, specify:
|
||||
- **Azure AD Device ID** as `id` for the device
|
||||
- Either `feature` or `driver` for the updateCategory
|
||||
|
||||
The following example removes `driver` enrollment for two devices, `01234567-89ab-cdef-0123-456789abcdef` and `01234567-89ab-cdef-0123-456789abcde0`:
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/admin/windows/updates/updatableAssets/unenrollAssets
|
||||
content-type: application/json
|
||||
|
||||
{
|
||||
"updateCategory": "driver",
|
||||
"assets": [
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcdef"
|
||||
},
|
||||
{
|
||||
"@odata.type": "#microsoft.graph.windowsUpdates.azureADDevice",
|
||||
"id": "01234567-89ab-cdef-0123-456789abcde0"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,13 @@
|
||||
---
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.technology: itpro-updates
|
||||
ms.prod: windows-client
|
||||
ms.topic: include
|
||||
ms.date: 02/14/2023
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
<!--This file is shared by deployment-service-overview.md and the deployment-service-prerequisites.md articles. Headings may be driven by article context. 7512398 -->
|
||||
|
||||
Windows Update for Business deployment service is a Windows service hosted in Azure that uses Windows diagnostic data. You should be aware that Windows Update for Business deployment service doesn't meet [US Government community compliance (GCC)](/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/gcc#us-government-community-compliance) requirements. For a list of GCC offerings for Microsoft products and services, see the [Microsoft Trust Center](/compliance/regulatory/offering-home). Windows Update for Business deployment service is available in the Azure Commercial cloud, but not available for GCC High or United States Department of Defense customers.
|
||||
@ -0,0 +1,21 @@
|
||||
---
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.technology: itpro-updates
|
||||
ms.prod: windows-client
|
||||
ms.topic: include
|
||||
ms.date: 02/14/2023
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
<!--This file is shared by deployment-service-expedite.md and the deployment-service-troubleshoot.md articles. Headings may be driven by article context. 7512398 -->
|
||||
## Log location for the Update Health Tools
|
||||
|
||||
The Update Health Tools are used when you deploy expedited updates. In some cases, you may wish to review the logs for the Update Health Tools.
|
||||
|
||||
**Log location**: `%ProgramFiles%\Microsoft Update Health Tools\Logs`
|
||||
|
||||
- The logs are in `.etl` format.
|
||||
- Microsoft offers [PerfView as a download on GitHub](https://github.com/Microsoft/perfview/blob/main/documentation/Downloading.md), which displays `.etl` files.
|
||||
|
||||
For more information, see [Troubleshooting expedited updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/get-the-most-out-of-expedited-windows-quality-updates/ba-p/3659741).
|
||||
@ -1,9 +1,9 @@
|
||||
---
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: dougeby
|
||||
ms.prod: w10
|
||||
ms.collection: M365-modern-desktop
|
||||
manager: aaroncz
|
||||
ms.technology: itpro-updates
|
||||
ms.prod: windows-client
|
||||
ms.topic: include
|
||||
ms.date: 08/18/2022
|
||||
ms.localizationpriority: medium
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
---
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: dougeby
|
||||
ms.prod: w10
|
||||
ms.collection: M365-modern-desktop
|
||||
manager: aaroncz
|
||||
ms.technology: itpro-updates
|
||||
ms.prod: windows-client
|
||||
ms.topic: include
|
||||
ms.date: 04/06/2022
|
||||
ms.localizationpriority: medium
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
---
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: dougeby
|
||||
ms.prod: w10
|
||||
ms.collection: M365-modern-desktop
|
||||
manager: aaroncz
|
||||
ms.technology: itpro-updates
|
||||
ms.prod: windows-client
|
||||
ms.topic: include
|
||||
ms.date: 08/18/2022
|
||||
ms.localizationpriority: medium
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.prod: w10
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.technology: itpro-updates
|
||||
ms.prod: windows-client
|
||||
ms.topic: include
|
||||
ms.date: 12/05/2022
|
||||
ms.localizationpriority: medium
|
||||
@ -11,4 +11,5 @@ ms.localizationpriority: medium
|
||||
<!--This file is shared by all Update Compliance v1 articles. -->
|
||||
|
||||
> [!Important]
|
||||
> Update Compliance is [deprecated](/windows/whats-new/deprecated-features) and is no longer accepting new onboarding requests. Update Compliance has been replaced by [Windows Update for Business reports](..\wufb-reports-overview.md). If you're currently using Update Compliance, you can continue to use it, but you can't change your `CommercialID`. Support for Update Compliance will end on March 31, 2023 when the service will be [retired](/windows/whats-new/feature-lifecycle#terminology).
|
||||
> - Update Compliance is [deprecated](/windows/whats-new/deprecated-features) and is no longer accepting new onboarding requests. Update Compliance has been replaced by [Windows Update for Business reports](..\wufb-reports-overview.md). If you're currently using Update Compliance, you can continue to use it, but you can't change your `CommercialID`. Support for Update Compliance will end on March 31, 2023 when the service will be [retired](/windows/whats-new/feature-lifecycle#terminology).
|
||||
> - Changes have been made to the Windows diagnostic data processor configuration. For more information, see [Windows diagnostic data processor changes](/windows/deployment/update/windows-diagnostic-data-processor-changes).
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user