mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 06:17:22 +00:00
Merge remote-tracking branch 'refs/remotes/origin/master' into vs-8735292
This commit is contained in:
LizRoss
commit
fd42c60227
@ -13,22 +13,54 @@ You've already completed this step.
|
|||||||
|
|
||||||
We've tried to make editing an existing file as simple as possible.
|
We've tried to make editing an existing file as simple as possible.
|
||||||
|
|
||||||
- If you're already in the repo, just navigate to the file you want to make the edits to and click the **Edit** button.
|
**To edit a topic**
|
||||||
- Alternatively, if you're viewing a TechNet page in your browser, click the **Contribute** button on the top right of the page. You will be redirected to the relevant source file in the repo, where you can click the **Edit** button.
|
|
||||||
|
|
||||||
When you're done, submit a pull request back to the master branch of the official repository.
|
1. Go to the page on TechNet that you want to update, and then click **Contribute**.
|
||||||
|
|
||||||
After you create the pull request, a member of the writing team will review your changes.
|
|
||||||
|
|
||||||
If your request is accepted, updates are published to one of the following places:
|
2. Click the **Pencil** icon (in the red box) to edit the content.
|
||||||
|
|
||||||
- [Windows 10](https://technet.microsoft.com/itpro/windows)
|
|
||||||
- [Internet Explorer 11](https://technet.microsoft.com/itpro/internet-explorer)
|
|
||||||
- [Microsoft Edge](https://technet.microsoft.com/itpro/microsoft-edge)
|
3. Using markdown language, make your changes to the topic. For info about how to edit content using markdown, see:
|
||||||
- [Surface](https://technet.microsoft.com/itpro/surface)
|
- **If you're linked to the Microsoft organization in GitHub:** [Windows Open Publishing Guide Home](http://aka.ms/windows-op-guide)
|
||||||
- [Surface Hub](https://technet.microsoft.com/itpro/surface-hub)
|
|
||||||
- [Windows 10 for Education](https://technet.microsoft.com/edu/windows)
|
- **If you're external to Microsoft:** [Mastering Markdown](https://guides.github.com/features/mastering-markdown/)
|
||||||
- [Microsoft Desktop Optimization Pack](https://technet.microsoft.com/itpro/mdop)
|
|
||||||
|
4. Make your suggested change, and then click **Preview Changes** to make sure it looks correct.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
5. When you’re done editing the topic, scroll to the bottom of the page, and then click **Propose file change** to create a fork in your personal GitHub account.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
The **Comparing changes** screen appears to see what the changes are between your fork and the original content.
|
||||||
|
|
||||||
|
6. On the **Comparing changes** screen, you’ll see if there are any problems with the file you’re checking in.
|
||||||
|
|
||||||
|
If there are no problems, you’ll see the message, **Able to merge**.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
7. Click **Create pull request**.
|
||||||
|
|
||||||
|
8. Enter a title and description to give the approver the appropriate context about what’s in the request.
|
||||||
|
|
||||||
|
9. Scroll to the bottom of the page, making sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people.
|
||||||
|
|
||||||
|
10. Click **Create pull request**.
|
||||||
|
|
||||||
|
The pull request is sent to the writer of the topic and your edits are reviewed. If your request is accepted, updates are published to one of the following places:
|
||||||
|
|
||||||
|
- [Windows 10](https://technet.microsoft.com/itpro/windows)
|
||||||
|
- [Internet Explorer 11](https://technet.microsoft.com/itpro/internet-explorer)
|
||||||
|
- [Microsoft Edge](https://technet.microsoft.com/itpro/microsoft-edge)
|
||||||
|
- [Surface](https://technet.microsoft.com/itpro/surface)
|
||||||
|
- [Surface Hub](https://technet.microsoft.com/itpro/surface-hub)
|
||||||
|
- [Windows 10 for Education](https://technet.microsoft.com/edu/windows)
|
||||||
|
- [Microsoft Desktop Optimization Pack](https://technet.microsoft.com/itpro/mdop)
|
||||||
|
|
||||||
## Making more substantial changes
|
## Making more substantial changes
|
||||||
|
|
||||||
|
|||||||
@ -41,7 +41,7 @@ Use this procedure if you use Exchange on-prem.
|
|||||||
Open your on-prem Exchange Management Shell with administrator permissions, and run this cmdlet.
|
Open your on-prem Exchange Management Shell with administrator permissions, and run this cmdlet.
|
||||||
|
|
||||||
```ps1
|
```ps1
|
||||||
Enable-Mailbox 'HUB01@contoso.com' -RemoteRoutingAddress 'HUB01@contoso.com' -Room
|
Enable-RemoteMailbox 'HUB01@contoso.com' -RemoteRoutingAddress 'HUB01@contoso.com' -Room
|
||||||
```
|
```
|
||||||
|
|
||||||
4. Connect to Microsoft Exchange Online and set some properties for the account in Office 365.
|
4. Connect to Microsoft Exchange Online and set some properties for the account in Office 365.
|
||||||
|
|||||||
BIN
images/compare-changes.png
Normal file
BIN
images/compare-changes.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 31 KiB |
BIN
images/contribute-link.png
Normal file
BIN
images/contribute-link.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 9.8 KiB |
BIN
images/pencil-icon.png
Normal file
BIN
images/pencil-icon.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 9.8 KiB |
BIN
images/preview-changes.png
Normal file
BIN
images/preview-changes.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 13 KiB |
BIN
images/propose-file-change.png
Normal file
BIN
images/propose-file-change.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
@ -19,7 +19,7 @@ We recommend that you install the AGPM Server on the most recent version of the
|
|||||||
|
|
||||||
All versions of AGPM can manage only the policy settings that were introduced in the same version or an earlier version of the operating system on which AGPM is running. For example, if you install AGPM 4.0 SP2 on Windows Server 2012, you can manage policy settings that were introduced in Windows Server 2012 or earlier, but you cannot manage policy settings that were introduced later, in Windows 8.1 or Windows Server 2012 R2.
|
All versions of AGPM can manage only the policy settings that were introduced in the same version or an earlier version of the operating system on which AGPM is running. For example, if you install AGPM 4.0 SP2 on Windows Server 2012, you can manage policy settings that were introduced in Windows Server 2012 or earlier, but you cannot manage policy settings that were introduced later, in Windows 8.1 or Windows Server 2012 R2.
|
||||||
|
|
||||||
If the version of the GPMC on your AGPM Server is older than the version on the computers that administrators use to manage Group Policy, the AGPM Server will be unable to store any policy settings that are not available in the older version of the GPMC. For information about which policy settings are available with which operating systems, see the [Group Policy Settings Reference for Windows and Windows Server](https://go.microsoft.com/fwlink/?LinkId=157345).
|
If the version of the GPMC on your AGPM Server is older than the version on the computers that administrators use to manage Group Policy, the AGPM Server will be unable to store any policy settings that are not available in the older version of the GPMC. For a spreadsheet of Group Policy settings included in Windows, see [Group Policy Settings Reference for Windows and Windows Server](https://go.microsoft.com/fwlink/p/?LinkId=613627).
|
||||||
|
|
||||||
## AGPM 4.0 SP3
|
## AGPM 4.0 SP3
|
||||||
|
|
||||||
|
|||||||
@ -61,6 +61,7 @@
|
|||||||
### [Monitor activation [client]](monitor-activation-client.md)
|
### [Monitor activation [client]](monitor-activation-client.md)
|
||||||
### [Use the Volume Activation Management Tool [client]](use-the-volume-activation-management-tool-client.md)
|
### [Use the Volume Activation Management Tool [client]](use-the-volume-activation-management-tool-client.md)
|
||||||
### [Appendix: Information sent to Microsoft during activation [client]](appendix-information-sent-to-microsoft-during-activation-client.md)
|
### [Appendix: Information sent to Microsoft during activation [client]](appendix-information-sent-to-microsoft-during-activation-client.md)
|
||||||
|
## [Windows 10 Enterprise E3 in CSP Overview](windows-10-enterprise-e3-overview.md)
|
||||||
## [Windows 10 deployment tools reference](windows-10-deployment-tools-reference.md)
|
## [Windows 10 deployment tools reference](windows-10-deployment-tools-reference.md)
|
||||||
### [Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md)
|
### [Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md)
|
||||||
### [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md)
|
### [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md)
|
||||||
|
|||||||
@ -11,6 +11,11 @@ author: greg-lindsay
|
|||||||
# Change history for Deploy Windows 10
|
# Change history for Deploy Windows 10
|
||||||
This topic lists new and updated topics in the [Deploy Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md).
|
This topic lists new and updated topics in the [Deploy Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md).
|
||||||
|
|
||||||
|
## September 2016
|
||||||
|
| New or changed topic | Description |
|
||||||
|
|----------------------|-------------|
|
||||||
|
| [Windows 10 Enterprise E3 in CSP Overview](windows-10-enterprise-e3-overview.md) | New |
|
||||||
|
|
||||||
## RELEASE: Windows 10, version 1607
|
## RELEASE: Windows 10, version 1607
|
||||||
|
|
||||||
The topics in this library have been updated for Windows 10, version 1607 (also known as the Anniversary Update). The following new topics have been added:
|
The topics in this library have been updated for Windows 10, version 1607 (also known as the Anniversary Update). The following new topics have been added:
|
||||||
|
|||||||
BIN
windows/deploy/images/azureadjoined.png
Normal file
BIN
windows/deploy/images/azureadjoined.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 1.3 KiB |
BIN
windows/deploy/images/e3-activated.png
Normal file
BIN
windows/deploy/images/e3-activated.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 43 KiB |
BIN
windows/deploy/images/enterprise-e3-ad-connect.png
Normal file
BIN
windows/deploy/images/enterprise-e3-ad-connect.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 45 KiB |
BIN
windows/deploy/images/enterprise-e3-choose-how.png
Normal file
BIN
windows/deploy/images/enterprise-e3-choose-how.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 19 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
BIN
windows/deploy/images/enterprise-e3-lets-get-2.png
Normal file
BIN
windows/deploy/images/enterprise-e3-lets-get-2.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 25 KiB |
BIN
windows/deploy/images/enterprise-e3-lets-get.png
Normal file
BIN
windows/deploy/images/enterprise-e3-lets-get.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 15 KiB |
BIN
windows/deploy/images/enterprise-e3-set-up-work-or-school.png
Normal file
BIN
windows/deploy/images/enterprise-e3-set-up-work-or-school.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 27 KiB |
BIN
windows/deploy/images/enterprise-e3-sign-in.png
Normal file
BIN
windows/deploy/images/enterprise-e3-sign-in.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 818 KiB |
BIN
windows/deploy/images/enterprise-e3-who-owns.png
Normal file
BIN
windows/deploy/images/enterprise-e3-who-owns.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 11 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 25 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 26 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 37 KiB |
395
windows/deploy/windows-10-enterprise-e3-overview.md
Normal file
395
windows/deploy/windows-10-enterprise-e3-overview.md
Normal file
@ -0,0 +1,395 @@
|
|||||||
|
---
|
||||||
|
title: Windows 10 Enterprise E3 in CSP Overview
|
||||||
|
description: Describes Windows 10 Enterprise E3, an offering that delivers, by subscription, the features of Windows 10 Enterprise edition.
|
||||||
|
keywords: upgrade, update, task sequence, deploy
|
||||||
|
ms.prod: w10
|
||||||
|
ms.mktglfcycl: deploy
|
||||||
|
ms.sitesec: library
|
||||||
|
ms.pagetype: mdt
|
||||||
|
author: greg-lindsay
|
||||||
|
---
|
||||||
|
|
||||||
|
# Windows 10 Enterprise E3 in CSP Overview
|
||||||
|
|
||||||
|
Windows 10 Enterprise E3 launched in the Cloud Solution Provider (CSP) channel on September 1, 2016. Windows 10 Enterprise E3 in CSP is a new offering that delivers, by subscription, exclusive features reserved for Windows 10 Enterprise edition. This offering is available through the Cloud Solution Provider (CSP) channel via the Partner Center as an online service. Windows 10 Enterprise E3 in CSP provides a flexible, per-user subscription for small- and medium-sized organizations (from one to hundreds of users). To take advantage of this offering, you must have the following:
|
||||||
|
|
||||||
|
- Windows 10 Pro, version 1607 (also known as Windows 10 Anniversary Update) or later installed on the devices to be upgraded
|
||||||
|
|
||||||
|
- Azure Active Directory (Azure AD) available for identity management
|
||||||
|
|
||||||
|
Starting with Windows 10, version 1607 (Windows 10 Anniversary Update), you can move from Windows 10 Pro to Windows 10 Enterprise more easily than ever before—no keys and no reboots. After one of your users enters the Azure AD credentials associated with a Windows 10 Enterprise E3 license, the operating system turns from Windows 10 Pro to Windows 10 Enterprise and all the appropriate Windows 10 Enterprise features are unlocked. When a subscription license expires or is transferred to another user, the Windows 10 Enterprise device seamlessly steps back down to Windows 10 Pro.
|
||||||
|
|
||||||
|
Previously, only organizations with a Microsoft Volume Licensing Agreement could deploy Windows 10 Enterprise to their users. Now, with Windows 10 Enterprise E3 in CSP, small- and medium-sized organizations can more easily take advantage of Windows 10 Enterprise features.
|
||||||
|
|
||||||
|
When you purchase Windows 10 Enterprise E3 via a partner, you get the following benefits:
|
||||||
|
|
||||||
|
- **Windows 10 Enterprise edition**. Devices currently running Windows 10 Pro, version 1607 can get Windows 10 Enterprise Current Branch (CB) or Current Branch for Business (CBB). This benefit does not include Long Term Service Branch (LTSB).
|
||||||
|
|
||||||
|
- **Support from one to hundreds of users**. Although the Windows 10 Enterprise E3 in CSP program does not have a limitation on the number of licenses an organization can have, the program is designed for small- and medium-sized organizations.
|
||||||
|
|
||||||
|
- **Deploy on up to five devices**. For each user covered by the license, you can deploy Windows 10 Enterprise edition on up to five devices.
|
||||||
|
|
||||||
|
- **Roll back to Windows 10 Pro at any time**. When a user’s subscription expires or is transferred to another user, the Windows 10 Enterprise device reverts seamlessly to Windows 10 Pro edition (after a grace period of up to 90 days).
|
||||||
|
|
||||||
|
- **Monthly, per-user pricing model**. This makes Windows 10 Enterprise E3 affordable for any organization.
|
||||||
|
|
||||||
|
- **Move licenses between users**. Licenses can be quickly and easily reallocated from one user to another user, allowing you to optimize your licensing investment against changing needs.
|
||||||
|
|
||||||
|
How does the Windows 10 Enterprise E3 in CSP program compare with Microsoft Volume Licensing Agreements and Software Assurance?
|
||||||
|
|
||||||
|
- [Microsoft Volume Licensing](http://www.microsoft.com/en-us/licensing/default.aspx) programs are broader in scope, providing organizations with access to licensing for all Microsoft products.
|
||||||
|
|
||||||
|
- [Software Assurance](http://www.microsoft.com/en-us/Licensing/licensing-programs/software-assurance-default.aspx) provides organizations with the following categories of benefits:
|
||||||
|
|
||||||
|
- **Deployment and management**. These benefits include planning services, Microsoft Desktop Optimization (MDOP), Windows Virtual Desktop Access Rights, Windows-To-Go Rights, Windows Roaming Use Rights, Windows Thin PC, Windows RT Companion VDA Rights, and other benefits.
|
||||||
|
|
||||||
|
- **Training**. These benefits include training vouchers, online e-learning, and a home use program.
|
||||||
|
|
||||||
|
- **Support**. These benefits include 24x7 problem resolution support, backup capabilities for disaster recovery, System Center Global Service Monitor, and a passive secondary instance of SQL Server.
|
||||||
|
|
||||||
|
- **Specialized**. These benefits include step-up licensing availability (which enables you to migrate software from an earlier edition to a higher-level edition) and to spread license and Software Assurance payments across three equal, annual sums.
|
||||||
|
|
||||||
|
In addition, in Windows 10 Enterprise E3 in CSP, a partner can manage your licenses for you. With Software Assurance, you, the customer, manage your own licenses.
|
||||||
|
|
||||||
|
In summary, the Windows 10 Enterprise E3 in CSP program is an upgrade offering that provides small- and medium-sized organizations easier, more flexible access to the benefits of Windows 10 Enterprise edition, whereas Microsoft Volume Licensing programs and Software Assurance are broader in scope and provide benefits beyond access to Windows 10 Enterprise edition.
|
||||||
|
|
||||||
|
## Compare Windows 10 Pro and Enterprise editions
|
||||||
|
|
||||||
|
Windows 10 Enterprise edition has a number of features that are unavailable in Windows 10 Pro. Table 1 lists the Windows 10 Enterprise features not found in Windows 10 Pro. Many of these features are security-related, whereas others enable finer-grained device management.
|
||||||
|
|
||||||
|
*Table 1. Windows 10 Enterprise features not found in Windows 10 Pro*
|
||||||
|
|
||||||
|
<table>
|
||||||
|
<colgroup>
|
||||||
|
<col width="20%" />
|
||||||
|
<col width="80%" />
|
||||||
|
</colgroup>
|
||||||
|
<thead>
|
||||||
|
<tr class="header">
|
||||||
|
<th align="left">Feature</th>
|
||||||
|
<th align="left">Description</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
<tbody>
|
||||||
|
<tr class="odd">
|
||||||
|
<td align="left"><p>Credential Guard<strong>\*</strong></p></td>
|
||||||
|
<td align="left"><p>This feature uses virtualization-based security to help protect security secrets (for example, NTLM password hashes, Kerberos Ticket Granting Tickets) so that only privileged system software can access them. This helps prevent Pass-the-Hash or Pass-the-Ticket attacks.</p>
|
||||||
|
<p>Credential Guard has the following features:</p>
|
||||||
|
<ul>
|
||||||
|
<li><p>**Hardware-level security**. Credential Guard uses hardware platform security features (such as Secure Boot and virtualization) to help protect derived domain credentials and other secrets.</p></li>
|
||||||
|
<li><p>**Virtualization-based security**. Windows services that access derived domain credentials and other secrets run in a virtualized, protected environment that is isolated.</p></li>
|
||||||
|
<li><p>**Improved protection against persistent threats**. Credential Guard works with other technologies (e.g., Device Guard) to help provide further protection against attacks, no matter how persistent.</p></li>
|
||||||
|
<li><p>**Improved manageability**. Credential Guard can be managed through Group Policy, Windows Management Instrumentation (WMI), or Windows PowerShell.</p></li>
|
||||||
|
</ul>
|
||||||
|
<p>For more information, see [Protect derived domain credentials with Credential Guard](http://technet.microsoft.com/itpro/windows/keep-secure/credential-guard).</p>
|
||||||
|
<p>\* <i>Credential Guard requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)</i></p></td>
|
||||||
|
</tr>
|
||||||
|
<tr class="even">
|
||||||
|
<td align="left"><p>Device Guard</p></td>
|
||||||
|
<td align="left"><p>This feature is a combination of hardware and software security features that allows only trusted applications to run on a device. Even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to run executable code. Device Guard can use virtualization-based security (VBS) in Windows 10 Enterprise edition to isolate the Code Integrity service from the Windows kernel itself. With VBS, even if malware gains access to the kernel, the effects can be severely limited, because the hypervisor can prevent the malware from executing code.</p>
|
||||||
|
<p>Device Guard does the following:</p>
|
||||||
|
<ul>
|
||||||
|
<li><p>Helps protect against malware</p></li>
|
||||||
|
<li><p>Helps protect the Windows system core from vulnerability and zero-day exploits</p></li>
|
||||||
|
<li><p>Allows only trusted apps to run</p></li>
|
||||||
|
</ul>
|
||||||
|
<p>For more information, see [Introduction to Device Guard](https://technet.microsoft.com/itpro/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies).</p></td>
|
||||||
|
</tr>
|
||||||
|
<tr class="odd">
|
||||||
|
<td align="left"><p>AppLocker management</p></td>
|
||||||
|
<td align="left"><p>This feature helps IT pros determine which applications and files users can run on a device (also known as “whitelisting”). The applications and files that can be managed include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.</p>
|
||||||
|
<p>For more information, see [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview).</p></td>
|
||||||
|
</tr>
|
||||||
|
<tr class="even">
|
||||||
|
<td align="left"><p>Application Virtualization (App-V)</p></td>
|
||||||
|
<td align="left"><p>This feature makes applications available to end users without installing the applications directly on users’ devices. App-V transforms applications into centrally managed services that are never installed and don't conflict with other applications. This feature also helps ensure that applications are kept current with the latest security updates.</p>
|
||||||
|
<p>For more information, see [Getting Started with App-V for Windows 10](https://technet.microsoft.com/itpro/windows/manage/appv-getting-started).</p></td>
|
||||||
|
</tr>
|
||||||
|
<tr class="odd">
|
||||||
|
<td align="left"><p>User Experience Virtualization (UE-V)</p></td>
|
||||||
|
<td align="left"><p>With this feature, you can capture user-customized Windows and application settings and store them on a centrally managed network file share. When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to.</p>
|
||||||
|
<p>UE-V provides the ability to do the following:</p>
|
||||||
|
<ul>
|
||||||
|
<li><p>Specify which application and Windows settings synchronize across user devices</p></li>
|
||||||
|
<li><p>Deliver the settings anytime and anywhere users work throughout the enterprise</p></li>
|
||||||
|
<li><p>Create custom templates for your third-party or line-of-business applications</p></li>
|
||||||
|
<li><p>Recover settings after hardware replacement or upgrade, or after re-imaging a virtual machine to its initial state</p></li>
|
||||||
|
</ul>
|
||||||
|
<p>For more information, see [User Experience Virtualization (UE-V) for Windows 10 overview](https://technet.microsoft.com/itpro/windows/manage/uev-for-windows).</p></td>
|
||||||
|
</tr>
|
||||||
|
<tr class="even">
|
||||||
|
<td align="left"><p>Managed User Experience</p></td>
|
||||||
|
<td align="left"><p>This feature helps customize and lock down a Windows device’s user interface to restrict it to a specific task. For example, you can configure a device for a controlled scenario such as a kiosk or classroom device. The user experience would be automatically reset once a user signs off. You can also restrict access to services including Cortana or the Windows Store, and manage Start layout options, such as:</p>
|
||||||
|
<ul>
|
||||||
|
<li><p>Removing and preventing access to the Shut Down, Restart, Sleep, and Hibernate commands</p></li>
|
||||||
|
<li><p>Removing Log Off (the User tile) from the Start menu</p></li>
|
||||||
|
<li><p>Removing frequent programs from the Start menu</p></li>
|
||||||
|
<li><p>Removing the All Programs list from the Start menu</p></li>
|
||||||
|
<li><p>Preventing users from customizing their Start screen</p></li>
|
||||||
|
<li><p>Forcing Start menu to be either full-screen size or menu size</p></li>
|
||||||
|
<li><p>Preventing changes to Taskbar and Start menu settings</p></li>
|
||||||
|
</ul>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
## Preparing for deployment of Windows 10 Enterprise E3 licenses
|
||||||
|
|
||||||
|
You probably have on-premises Active Directory Domain Services (AD DS) domains. Users will use their domain-based credentials to sign in to the AD DS domain. Before you start deploying Windows 10 Enterprise E3 licenses to users, you need to synchronize the identities in the on-premises AD DS domain with Azure AD.
|
||||||
|
|
||||||
|
You might ask why you need to synchronize these identities. The answer is so that users will have a *single identity* that they can use to access their on-premises apps and cloud services that use Azure AD (such as Windows 10 Enterprise E3). This means that users can use their existing credentials to sign in to Azure AD and access the cloud services that you provide and manage for them.
|
||||||
|
|
||||||
|
**Figure 1** illustrates the integration between the on-premises AD DS domain with Azure AD. [Microsoft Azure Active Directory Connect](http://www.microsoft.com/en-us/download/details.aspx?id=47594) (Azure AD Connect) is responsible for synchronization of identities between the on-premises AD DS domain and Azure AD. Azure AD Connect is a service that you can install on-premises or in a virtual machine in Azure.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
**Figure 1. On-premises AD DS integrated with Azure AD**
|
||||||
|
|
||||||
|
For more information about integrating on-premises AD DS domains with Azure AD, see the following resources:
|
||||||
|
|
||||||
|
- [Integrating your on-premises identities with Azure Active Directory](http://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/)
|
||||||
|
- [Azure AD + Domain Join + Windows 10](https://blogs.technet.microsoft.com/enterprisemobility/2016/02/17/azure-ad-domain-join-windows-10/)
|
||||||
|
|
||||||
|
### Preparing for deployment: reviewing requirements
|
||||||
|
|
||||||
|
Devices must be running Windows 10 Pro, version 1607, and be Azure Active Directory joined, or domain joined with Azure AD Connect. Customers who are federated with Azure Active Directory are also eligible. For more information, see [Review requirements on devices](#review-requirements-on-devices), later in this topic.
|
||||||
|
|
||||||
|
<!-- Watch the preceding link if you divide this into multiple topics. -->
|
||||||
|
|
||||||
|
## Explore the upgrade experience
|
||||||
|
|
||||||
|
Now that your subscription has been established (by the partner who you work with) and Windows 10 Enterprise E3 licenses have been assigned to users, the users are ready to upgrade their devices running Windows 10 Pro, version 1607 edition to Windows 10 Enterprise edition. So what will the users experience? How will they upgrade their devices?
|
||||||
|
|
||||||
|
### Step 1: Join users’ devices to Azure AD
|
||||||
|
|
||||||
|
Users can join a device to Azure AD the first time they start the device (during setup), or they can join a device that they already use running Windows 10 Pro, version 1607.
|
||||||
|
|
||||||
|
**To join a device to Azure AD the first time the device is started**
|
||||||
|
|
||||||
|
1. During the initial setup, on the **Who owns this PC?** page, select **My organization**, and then click **Next**, as illustrated in **Figure 2**.
|
||||||
|
|
||||||
|
<img src="images/enterprise-e3-who-owns.png" alt="Who owns this PC? page in Windows 10 setup" width="624" height="351" />
|
||||||
|
|
||||||
|
**Figure 2. The “Who owns this PC?” page in initial Windows 10 setup**
|
||||||
|
|
||||||
|
2. On the **Choose how you’ll connect** page, select **Join Azure AD**, and then click **Next**, as illustrated in **Figure 3**.
|
||||||
|
|
||||||
|
<img src="images/enterprise-e3-choose-how.png" alt="Choose how you'll connect - page in Windows 10 setup" width="624" height="351" />
|
||||||
|
|
||||||
|
**Figure 3. The “Choose how you’ll connect” page in initial Windows 10 setup**
|
||||||
|
|
||||||
|
3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 4**.
|
||||||
|
|
||||||
|
<img src="images/enterprise-e3-lets-get.png" alt="Let's get you signed in - page in Windows 10 setup" width="624" height="351" />
|
||||||
|
|
||||||
|
**Figure 4. The “Let’s get you signed in” page in initial Windows 10 setup**
|
||||||
|
|
||||||
|
Now the device is Azure AD joined to the company’s subscription.
|
||||||
|
|
||||||
|
**To join a device to Azure AD when the device already has Windows 10 Pro, version 1607 installed and set up**
|
||||||
|
|
||||||
|
1. Go to **Settings > Accounts > Access work or school**, as illustrated in **Figure 5**.
|
||||||
|
|
||||||
|
<img src="images/enterprise-e3-connect-to-work-or-school.png" alt="Connect to work or school configuration" width="624" height="482" />
|
||||||
|
|
||||||
|
**Figure 5. Connect to work or school configuration in Settings**
|
||||||
|
|
||||||
|
2. In **Set up a work or school account**, click **Join this device to Azure Active Directory**, as illustrated in **Figure 6**.
|
||||||
|
|
||||||
|
<img src="images/enterprise-e3-set-up-work-or-school.png" alt="Set up a work or school account" width="624" height="603" />
|
||||||
|
|
||||||
|
**Figure 6. Set up a work or school account**
|
||||||
|
|
||||||
|
3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 7**.
|
||||||
|
|
||||||
|
<img src="images/enterprise-e3-lets-get-2.png" alt="Let's get you signed in - dialog box" width="624" height="603" />
|
||||||
|
|
||||||
|
**Figure 7. The “Let’s get you signed in” dialog box**
|
||||||
|
|
||||||
|
Now the device is Azure AD joined to the company’s subscription.
|
||||||
|
|
||||||
|
### Step 2: Sign in using Azure AD account
|
||||||
|
|
||||||
|
Once the device is joined to your Azure AD subscription, the user will sign in by using his or her Azure AD account, as illustrated in **Figure 8**. The Windows 10 Enterprise E3 license associated with the user will enable Windows 10 Enterprise edition capabilities on the device.
|
||||||
|
|
||||||
|
<img src="images/enterprise-e3-sign-in.png" alt="Sign in, Windows 10" width="624" height="351" />
|
||||||
|
|
||||||
|
**Figure 8. Sign in by using Azure AD account**
|
||||||
|
|
||||||
|
### Step 3: Verify that Enterprise edition is enabled
|
||||||
|
|
||||||
|
You can verify the Windows 10 Enterprise E3 subscription in **Settings > Update & Security > Activation**, as illustrated in **Figure 9**.
|
||||||
|
|
||||||
|
<span id="win-10-activated-subscription-active"/>
|
||||||
|
#### Figure 9 - Windows 10 Enterprise E3 subscription in Settings
|
||||||
|
|
||||||
|
<img src="images/enterprise-e3-win-10-activated-enterprise-subscription-active.png" alt="Windows 10 activated and subscription active" width="624" height="407" />
|
||||||
|
|
||||||
|
If there are any problems with the Windows 10 Enterprise E3 license or the activation of the license, the **Activation** panel will display the appropriate error message or status. You can use this information to help you diagnose the licensing and activation process.
|
||||||
|
|
||||||
|
## Troubleshoot the user experience
|
||||||
|
|
||||||
|
In some instances, users may experience problems with the Windows 10 Enterprise E3 subscription. The most common problems that users may experience are as follows:
|
||||||
|
|
||||||
|
- The existing Windows 10 Pro, version 1607 operating system is not activated.
|
||||||
|
|
||||||
|
- The Windows 10 Enterprise E3 subscription has lapsed or has been removed.
|
||||||
|
|
||||||
|
Use the following figures to help you troubleshoot when users experience these common problems:
|
||||||
|
|
||||||
|
- [Figure 9](#win-10-activated-subscription-active) illustrates a device in a healthy state, where Windows 10 Pro, version 1607 is activated and the Windows 10 Enterprise E3 subscription is active.
|
||||||
|
|
||||||
|
- [Figure 10](#win-10-not-activated) illustrates a device on which Windows 10 Pro, version 1607 is not activated, but the Windows 10 Enterprise E3 subscription is active.
|
||||||
|
|
||||||
|
- [Figure 11](#subscription-not-active) illustrates a device on which Windows 10 Pro, version 1607 is activated, but the Windows 10 Enterprise E3 subscription is lapsed or removed.
|
||||||
|
|
||||||
|
- [Figure 12](#win-10-not-activated-subscription-not-active) illustrates a device on which Windows 10 Pro, version 1607 license is not activated and the Windows 10 Enterprise E3 subscription is lapsed or removed.
|
||||||
|
|
||||||
|
<span id="win-10-not-activated"/>
|
||||||
|
### Figure 10 - Windows 10 Pro, version 1607 edition not activated in Settings
|
||||||
|
|
||||||
|
<img src="images/enterprise-e3-win-10-not-activated-enterprise-subscription-active.png" alt="Windows 10 not activated and subscription active" width="624" height="407" /><br><br>
|
||||||
|
|
||||||
|
<span id="subscription-not-active"/>
|
||||||
|
### Figure 11 - Windows 10 Enterprise E3 subscription lapsed or removed in Settings
|
||||||
|
|
||||||
|
<img src="images/enterprise-e3-win-10-activated-enterprise-subscription-not-active.png" alt="Windows 10 activated and subscription not active" width="624" height="407" /><br><br>
|
||||||
|
|
||||||
|
<span id="win-10-not-activated-subscription-not-active"/>
|
||||||
|
### Figure 12 - Windows 10 Pro, version 1607 edition not activated and Windows 10 Enterprise E3 subscription lapsed or removed in Settings
|
||||||
|
|
||||||
|
<img src="images/enterprise-e3-win-10-not-activated-enterprise-subscription-not-active.png" alt="Windows 10 not activated and subscription not active" width="624" height="407" /><br><br>
|
||||||
|
|
||||||
|
### Review requirements on devices
|
||||||
|
|
||||||
|
Devices must be running Windows 10 Pro, version 1607, and be Azure Active Directory joined, or domain joined with Azure AD Connect. Customers who are federated with Azure Active Directory are also eligible. You can use the following procedures to review whether a particular device meets requirements.
|
||||||
|
|
||||||
|
**To determine if a device is Azure Active Directory joined:**
|
||||||
|
|
||||||
|
1. Open a command prompt and type **dsregcmd /status**.
|
||||||
|
|
||||||
|
2. Review the output under Device State. If the **AzureAdJoined** status is YES, the device is Azure Active Directory joined.
|
||||||
|
|
||||||
|
**To determine the version of Windows 10:**
|
||||||
|
|
||||||
|
- At a command prompt, type:
|
||||||
|
**winver**
|
||||||
|
|
||||||
|
A popup window will display the Windows 10 version number and detailed OS build information.
|
||||||
|
|
||||||
|
If a device is running a previous version of Windows 10 Pro (for example, version 1511), it will not be upgraded to Windows 10 Enterprise when a user signs in, even if the user has been assigned a subscription in the CSP portal.
|
||||||
|
|
||||||
|
## Deploy Windows 10 Enterprise features
|
||||||
|
|
||||||
|
Now that you have Windows 10 Enterprise edition running on devices, how do you take advantage of the Enterprise edition features and capabilities? What are the next steps that need to be taken for each of the features discussed in [Table 1](#compare-windows-10-pro-and-enterprise-editions)?
|
||||||
|
|
||||||
|
The following sections provide you with the high-level tasks that need to be performed in your environment to help users take advantage of the Windows 10 Enterprise edition features.
|
||||||
|
|
||||||
|
### Credential Guard\*
|
||||||
|
|
||||||
|
You can implement Credential Guard on Windows 10 Enterprise devices by turning on Credential Guard on these devices. Credential Guard uses Windows 10 virtualization-based security features (Hyper-V features) that must be enabled on each device before you can turn on Credential Guard. You can turn on Credential Guard by using one of the following methods:
|
||||||
|
|
||||||
|
- **Automated**. You can automatically turn on Credential Guard for one or more devices by using Group Policy. The Group Policy settings automatically add the virtualization-based security features and configure the Credential Guard registry settings on managed devices.
|
||||||
|
|
||||||
|
- **Manual**. You can manually turn on Credential Guard by doing the following:
|
||||||
|
|
||||||
|
- Add the virtualization-based security features by using Programs and Features or Deployment Image Servicing and Management (DISM).
|
||||||
|
|
||||||
|
- Configure Credential Guard registry settings by using the Registry Editor or the [Device Guard and Credential Guard hardware readiness tool](http://www.microsoft.com/download/details.aspx?id=53337).
|
||||||
|
|
||||||
|
You can automate these manual steps by using a management tool such as System Center Configuration Manager.
|
||||||
|
|
||||||
|
For more information about implementing Credential Guard, see the following resources:
|
||||||
|
|
||||||
|
- [Protect derived domain credentials with Credential Guard](http://technet.microsoft.com/itpro/windows/keep-secure/credential-guard)
|
||||||
|
- [PC OEM requirements for Device Guard and Credential Guard](http://msdn.microsoft.com/library/windows/hardware/mt767514(v=vs.85).aspx)
|
||||||
|
- [Device Guard and Credential Guard hardware readiness tool](http://www.microsoft.com/download/details.aspx?id=53337)
|
||||||
|
|
||||||
|
\* *Requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)*
|
||||||
|
|
||||||
|
### Device Guard
|
||||||
|
|
||||||
|
Now that the devices have Windows 10 Enterprise, you can implement Device Guard on the Windows 10 Enterprise devices by performing the following steps:
|
||||||
|
|
||||||
|
1. **Optionally, create a signing certificate for code integrity policies**. As you deploy code integrity policies, you might need to sign catalog files or code integrity policies internally. To do this, you will either need a publicly issued code signing certificate (that you purchase) or an internal certificate authority (CA). If you choose to use an internal CA, you will need to create a code signing certificate.
|
||||||
|
|
||||||
|
2. **Create code integrity policies from “golden” computers**. When you have identified departments or roles that use distinctive or partly distinctive sets of hardware and software, you can set up “golden” computers containing that software and hardware. In this respect, creating and managing code integrity policies to align with the needs of roles or departments can be similar to managing corporate images. From each “golden” computer, you can create a code integrity policy and decide how to manage that policy. You can merge code integrity policies to create a broader policy or a master policy, or you can manage and deploy each policy individually.
|
||||||
|
|
||||||
|
3. **Audit the code integrity policy and capture information about applications that are outside the policy**. We recommend that you use “audit mode” to carefully test each code integrity policy before you enforce it. With audit mode, no application is blocked—the policy just logs an event whenever an application outside the policy is started. Later, you can expand the policy to allow these applications, as needed.
|
||||||
|
|
||||||
|
4. **Create a “catalog file” for unsigned line-of-business (LOB) applications**. Use the Package Inspector tool to create and sign a catalog file for your unsigned LOB applications. In later steps, you can merge the catalog file's signature into your code integrity policy so that applications in the catalog will be allowed by the policy.
|
||||||
|
|
||||||
|
5. **Capture needed policy information from the event log, and merge information into the existing policy as needed**. After a code integrity policy has been running for a time in audit mode, the event log will contain information about applications that are outside the policy. To expand the policy so that it allows for these applications, use Windows PowerShell commands to capture the needed policy information from the event log, and then merge that information into the existing policy. You can merge code integrity policies from other sources also, for flexibility in how you create your final code integrity policies.
|
||||||
|
|
||||||
|
6. **Deploy code integrity policies and catalog files**. After you confirm that you have completed all the preceding steps, you can begin deploying catalog files and taking code integrity policies out of audit mode. We strongly recommend that you begin this process with a test group of users. This provides a final quality-control validation before you deploy the catalog files and code integrity policies more broadly.
|
||||||
|
|
||||||
|
7. **Enable desired hardware security features**. Hardware-based security features—also called virtualization-based security (VBS) features—strengthen the protections offered by code integrity policies.
|
||||||
|
|
||||||
|
For more information about implementing Device Guard, see:
|
||||||
|
|
||||||
|
- [Planning and getting started on the Device Guard deployment process](https://technet.microsoft.com/itpro/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process)
|
||||||
|
- [Device Guard deployment guide](http://technet.microsoft.com/itpro/windows/keep-secure/device-guard-deployment-guide)
|
||||||
|
|
||||||
|
### AppLocker management
|
||||||
|
|
||||||
|
You can manage AppLocker in Windows 10 Enterprise by using Group Policy. Group Policy requires that the you have AD DS and that the Windows 10 Enterprise devices are joined to the your AD DS domain. You can create AppLocker rules by using Group Policy, and then target those rules to the appropriate devices.
|
||||||
|
|
||||||
|
For more information about AppLocker management by using Group Policy, see [AppLocker deployment guide](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-policies-deployment-guide).
|
||||||
|
|
||||||
|
### App-V
|
||||||
|
|
||||||
|
App-V requires an App-V server infrastructure to support App-V clients. The primary App-V components that the you must have are as follows:
|
||||||
|
|
||||||
|
- **App-V server**. The App-V server provides App-V management, virtualized app publishing, app streaming, and reporting services. Each of these services can be run on one server or can be run individually on multiple servers. For example, you could have multiple streaming servers. App-V clients contact App-V servers to determine which apps are published to the user or device, and then run the virtualized app from the server.
|
||||||
|
|
||||||
|
- **App-V sequencer**. The App-V sequencer is a typical client device that is used to sequence (capture) apps and prepare them for hosting from the App-V server. You install apps on the App-V sequencer, and the App-V sequencer software determines the files and registry settings that are changed during app installation. Then the sequencer captures these settings to create a virtualized app.
|
||||||
|
|
||||||
|
- **App-V client**. The App-V client must be enabled on any client device on which apps will be run from the App-V server. These will be the Windows 10 Enterprise E3 devices.
|
||||||
|
|
||||||
|
For more information about implementing the App-V server, App-V sequencer, and App-V client, see the following resources:
|
||||||
|
|
||||||
|
- [Getting Started with App-V for Windows 10](https://technet.microsoft.com/itpro/windows/manage/appv-getting-started)
|
||||||
|
- [Deploying the App-V server](https://technet.microsoft.com/itpro/windows/manage/appv-deploying-the-appv-server)
|
||||||
|
- [Deploying the App-V Sequencer and Configuring the Client](https://technet.microsoft.com/itpro/windows/manage/appv-deploying-the-appv-sequencer-and-client)
|
||||||
|
|
||||||
|
### UE-V
|
||||||
|
UE-V requires server- and client-side components that you you’ll need to download, activate, and install. These components include:
|
||||||
|
|
||||||
|
- **UE-V service**. The UE-V service (when enabled on devices) monitors registered applications and Windows for any settings changes, then synchronizes those settings between devices.
|
||||||
|
|
||||||
|
- **Settings packages**. Settings packages created by the UE-V service store application settings and Windows settings. Settings packages are built, locally stored, and copied to the settings storage location.
|
||||||
|
|
||||||
|
- **Settings storage location**. This location is a standard network share that your users can access. The UE-V service verifies the location and creates a hidden system folder in which to store and retrieve user settings.
|
||||||
|
|
||||||
|
- **Settings location templates**. Settings location templates are XML files that UE-V uses to monitor and synchronize desktop application settings and Windows desktop settings between user computers. By default, some settings location templates are included in UE-V. You can also create, edit, or validate custom settings location templates by using the UE-V template generator. Settings location templates are not required for Windows applications.
|
||||||
|
|
||||||
|
- **Universal Windows applications list**. UE-V determines which Windows applications are enabled for settings synchronization using a managed list of applications. By default, this list includes most Windows applications.
|
||||||
|
|
||||||
|
For more information about deploying UE-V, see the following resources:
|
||||||
|
|
||||||
|
- [User Experience Virtualization (UE-V) for Windows 10 overview](https://technet.microsoft.com/itpro/windows/manage/uev-for-windows)
|
||||||
|
- [Get Started with UE-V](https://technet.microsoft.com/itpro/windows/manage/uev-getting-started)
|
||||||
|
- [Prepare a UE-V Deployment](https://technet.microsoft.com/itpro/windows/manage/uev-prepare-for-deployment)
|
||||||
|
|
||||||
|
### Managed User Experience
|
||||||
|
|
||||||
|
The Managed User Experience feature is a set of Windows 10 Enterprise edition features and corresponding settings that you can use to manage user experience. Table 2 describes the Managed User Experience settings (by category), which are only available in Windows 10 Enterprise edition. The management methods used to configure each feature depend on the feature. Some features are configured by using Group Policy, while others are configured by using Windows PowerShell, Deployment Image Servicing and Management (DISM), or other command-line tools. For the Group Policy settings, you must have AD DS with the Windows 10 Enterprise devices joined to your AD DS domain.
|
||||||
|
|
||||||
|
*Table 2. Managed User Experience features*
|
||||||
|
|
||||||
|
| Feature | Description |
|
||||||
|
|------------------|-----------------|
|
||||||
|
| Start layout customization | You can deploy a customized Start layout to users in a domain. No reimaging is required, and the Start layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start layouts for different departments or organizations, with minimal management overhead.<br>For more information on these settings, see [Customize Windows 10 Start and taskbar with Group Policy](http://technet.microsoft.com/itpro/windows/manage/customize-windows-10-start-screens-by-using-group-policy). |
|
||||||
|
| Unbranded boot | You can suppress Windows elements that appear when Windows starts or resumes and can suppress the crash screen when Windows encounters an error from which it cannot recover.<br>For more information on these settings, see [Unbranded Boot](http://msdn.microsoft.com/library/windows/hardware/mt571997(v=vs.85).aspx). |
|
||||||
|
| Custom logon | You can use the Custom Logon feature to suppress Windows 10 UI elements that relate to the Welcome screen and shutdown screen. For example, you can suppress all elements of the Welcome screen UI and provide a custom logon UI. You can also suppress the Blocked Shutdown Resolver (BSDR) screen and automatically end applications while the OS waits for applications to close before a shutdown.<br>For more information on these settings, see [Custom Logon](http://msdn.microsoft.com/library/windows/hardware/mt571990(v=vs.85).aspx). |
|
||||||
|
| Shell launcher | Enables Assigned Access to run only a classic Windows app via Shell Launcher to replace the shell.<br>For more information on these settings, see [Shell Launcher](http://msdn.microsoft.com/library/windows/hardware/mt571994(v=vs.85).aspx). |
|
||||||
|
| Keyboard filter | You can use Keyboard Filter to suppress undesirable key presses or key combinations. Normally, users can use certain Windows key combinations like Ctrl+Alt+Delete or Ctrl+Shift+Tab to control a device by locking the screen or using Task Manager to close a running application. This is not desirable on devices intended for a dedicated purpose.<br>For more information on these settings, see [Keyboard Filter](http://msdn.microsoft.com/library/windows/hardware/mt587088(v=vs.85).aspx). |
|
||||||
|
| Unified write filter | You can use Unified Write Filter (UWF) on your device to help protect your physical storage media, including most standard writable storage types that are supported by Windows, such as physical hard disks, solid-state drives, internal USB devices, external SATA devices, and so on. You can also use UWF to make read-only media appear to the OS as a writable volume.<br>For more information on these settings, see [Unified Write Filter](http://msdn.microsoft.com/library/windows/hardware/mt572001(v=vs.85).aspx). |
|
||||||
|
|
||||||
|
## Related topics
|
||||||
|
|
||||||
|
[Connect domain-joined devices to Azure AD for Windows 10 experiences](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-devices-group-policy/)
|
||||||
|
|
||||||
|
[Compare Windows 10 editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare)
|
||||||
|
|
||||||
|
[Windows for business](https://www.microsoft.com/en-us/windowsforbusiness/default.aspx)
|
||||||
@ -36,10 +36,6 @@ Here's a high-level overview on how the LSA is isolated by using virtualization-
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
## New and changed functionality
|
|
||||||
|
|
||||||
To see what was added or changed in Credential Guard, see [What's new in Credential Guard?](../whats-new/credential-guard.md).
|
|
||||||
|
|
||||||
## Hardware and software requirements
|
## Hardware and software requirements
|
||||||
|
|
||||||
The PC must meet the following hardware and software requirements to use Credential Guard:
|
The PC must meet the following hardware and software requirements to use Credential Guard:
|
||||||
@ -221,14 +217,23 @@ If you have to remove Credential Guard on a PC, you need to do the following:
|
|||||||
|
|
||||||
1. From an elevated command prompt, type the following commands:
|
1. From an elevated command prompt, type the following commands:
|
||||||
``` syntax
|
``` syntax
|
||||||
|
|
||||||
mountvol X: /s
|
mountvol X: /s
|
||||||
|
|
||||||
copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y
|
copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y
|
||||||
|
|
||||||
bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader
|
bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader
|
||||||
|
|
||||||
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi"
|
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi"
|
||||||
|
|
||||||
bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}
|
bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}
|
||||||
|
|
||||||
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO
|
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO
|
||||||
|
|
||||||
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:
|
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:
|
||||||
|
|
||||||
mountvol X: /d
|
mountvol X: /d
|
||||||
|
|
||||||
```
|
```
|
||||||
2. Restart the PC.
|
2. Restart the PC.
|
||||||
3. Accept the prompt to disable Credential Guard.
|
3. Accept the prompt to disable Credential Guard.
|
||||||
@ -281,16 +286,20 @@ DG_Readiness_Tool_v2.0.ps1 -Ready
|
|||||||
- Passwords are still weak so we recommend that your organization deploy Credential Guard and move away from passwords and to other authentication methods, such as physical smart cards, virtual smart cards, Microsoft Passport, or Microsoft Passport for Work.
|
- Passwords are still weak so we recommend that your organization deploy Credential Guard and move away from passwords and to other authentication methods, such as physical smart cards, virtual smart cards, Microsoft Passport, or Microsoft Passport for Work.
|
||||||
- Some 3rd party Security Support Providers (SSPs and APs) might not be compatible with Credential Guard. Credential Guard does not allow 3rd party SSPs to ask for password hashes from LSA. However, SSPs and APs still get notified of the password when a user logs on and/or changes their password. Any use of undocumented APIs within custom SSPs and APs are not supported. We recommend that custom implementations of SSPs/APs are tested against Credential Guard to ensure that the SSPs and APs do not depend on any undocumented or unsupported behaviors. For example, using the KerbQuerySupplementalCredentialsMessage API is not supported. You should not replace the NTLM or Kerberos SSPs with custom SSPs and APs. For more info, see [Restrictions around Registering and Installing a Security Package](http://msdn.microsoft.com/library/windows/desktop/dn865014.aspx) on MSDN.
|
- Some 3rd party Security Support Providers (SSPs and APs) might not be compatible with Credential Guard. Credential Guard does not allow 3rd party SSPs to ask for password hashes from LSA. However, SSPs and APs still get notified of the password when a user logs on and/or changes their password. Any use of undocumented APIs within custom SSPs and APs are not supported. We recommend that custom implementations of SSPs/APs are tested against Credential Guard to ensure that the SSPs and APs do not depend on any undocumented or unsupported behaviors. For example, using the KerbQuerySupplementalCredentialsMessage API is not supported. You should not replace the NTLM or Kerberos SSPs with custom SSPs and APs. For more info, see [Restrictions around Registering and Installing a Security Package](http://msdn.microsoft.com/library/windows/desktop/dn865014.aspx) on MSDN.
|
||||||
- As the depth and breadth of protections provided by Credential Guard are increased, subsequent releases of Windows 10 with Credential Guard running may impact scenarios that were working in the past. For example, Credential Guard may block the use of a particular type of credential or a particular component to prevent malwar efrom taking advantage of vulnerabilities. Therefore, we recommend that scenarios required for operations in an organization are tested before upgrading a device that has Credential Guard running.
|
- As the depth and breadth of protections provided by Credential Guard are increased, subsequent releases of Windows 10 with Credential Guard running may impact scenarios that were working in the past. For example, Credential Guard may block the use of a particular type of credential or a particular component to prevent malwar efrom taking advantage of vulnerabilities. Therefore, we recommend that scenarios required for operations in an organization are tested before upgrading a device that has Credential Guard running.
|
||||||
- If you are using Wi-Fi and VPN end points that are based on MS-CHAPv2, they are subject to similar attacks as NTLMv1. We recommend that organizations use certificated-based authentication for Wi-Fi and VPN connections.
|
|
||||||
- Starting with Windows 10, version 1511, domain credentials that are stored with Credential Manager are protected with Credential Guard. Credential Manager allows you to store credentials, such as user names and passwords that you use to log on to websites or other computers on a network. The following considerations apply to the Credential Guard protections for Credential Manager:
|
- Starting with Windows 10, version 1511, domain credentials that are stored with Credential Manager are protected with Credential Guard. Credential Manager allows you to store credentials, such as user names and passwords that you use to log on to websites or other computers on a network. The following considerations apply to the Credential Guard protections for Credential Manager:
|
||||||
- Credentials saved by Remote Desktop Services cannot be used to remotely connect to another machine without supplying the password. Attempts to use saved credentials will fail, displaying the error message "Logon attempt failed".
|
- Credentials saved by Remote Desktop Services cannot be used to remotely connect to another machine without supplying the password. Attempts to use saved credentials will fail, displaying the error message "Logon attempt failed".
|
||||||
- Applications that extract derived domain credentials from Credential Manager will no longer be able to use those credentials.
|
- Applications that extract derived domain credentials from Credential Manager will no longer be able to use those credentials.
|
||||||
- You cannot restore credentials using the Credential Manager control panel if the credentials were backed up from a PC that has Credential Guard turned on. If you need to back up your credentials, you must do this before you enable Credential Guard. Otherwise, you won't be able to restore those credentials.
|
- You cannot restore credentials using the Credential Manager control panel if the credentials were backed up from a PC that has Credential Guard turned on. If you need to back up your credentials, you must do this before you enable Credential Guard. Otherwise, you won't be able to restore those credentials.
|
||||||
- Credential Guard uses hardware security so some features, such as Windows To Go, are not supported.
|
- Credential Guard uses hardware security so some features, such as Windows To Go, are not supported.
|
||||||
|
|
||||||
|
### NTLM & CHAP Considerations
|
||||||
|
|
||||||
|
When you enable Credential Guard, you can no longer use NTLM v1 authentication. If you are using WiFi and VPN endpoints that are based on MS-CHAPv2, they are subject to similar attacks as NTLMv1. We recommend that organizations use certificated-based authentication for WiFi and VPN connections.
|
||||||
|
|
||||||
### Kerberos Considerations
|
### Kerberos Considerations
|
||||||
|
|
||||||
When you enable Credential Guard, you can no longer use Kerberos unconstrained delegation. Unconstrained delegation could allow attackers to extract Kerberos keys from the isolated LSA process. You must use constrained or resource-based Kerberos delegation instead.
|
When you enable Credential Guard, you can no longer use Kerberos unconstrained delegation or DES encryption. Unconstrained delegation could allow attackers to extract Kerberos keys from the isolated LSA process. You must use constrained or resource-based Kerberos delegation instead.
|
||||||
|
|
||||||
## Scenarios not protected by Credential Guard
|
## Scenarios not protected by Credential Guard
|
||||||
|
|
||||||
@ -311,34 +320,39 @@ Some ways to store credentials are not protected by Credential Guard, including:
|
|||||||
|
|
||||||
Credential Guard can provide mitigations against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, reusing previously stolen credentials prior to Device Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigations also need to be deployed to make the domain environment more robust.
|
Credential Guard can provide mitigations against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, reusing previously stolen credentials prior to Device Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigations also need to be deployed to make the domain environment more robust.
|
||||||
|
|
||||||
Credential theft attacks allow the attacker to steal secrets from one device and use them from another device. By deploying authentication policies with compound authentication in Windows Server 2012 R2 or later domains, users can be restricted to only sign on from specific domain-joined devices. However, since devices also use shared secrets for authentication, attackers can steal those secrets as well. By deploying device certificates with Credential Guard, authentication policies can require that the device authenticates with its private key. This prevents shared secrets on stolen devices to be used with stolen user passwords or Kerberos secret keys to sign on as the user.
|
### Restricting domain users to specific domain-joined devices
|
||||||
|
|
||||||
Device certificate authentication has the following requirements:
|
Credential theft attacks allow the attacker to steal secrets from one device and use them from another device. If a user can sign on multiple devices then any device could be used to steal credentials. How do you ensure that users only sign on with devices with Credential Guard? By deploying authentication policies which restrict them to specific domain-joined device that have been configured with Credential Guard. For the domain controller to know what device a user is signing on from, Kerberos armoring must be used.
|
||||||
|
|
||||||
- Device domains are Windows Server 2012 or higher and all domain controllers have certificates, which satisfy strict KDC validation (KDC EKU present and the DNS domain name matches the DNSName field of the SubjectAltName (SAN) extension).
|
#### Kerberos armoring
|
||||||
|
|
||||||
|
Kerberos armoring is part of RFC 6113. When a device supports Kerberos armoring, its TGT is used to protect the user's proof of possession which can mitigate offline dictionary attacks. Kerberos armoring also provides the additional benefit of signed KDC errors this mitigates tampering which can result in things such as downgrade attacks.
|
||||||
|
|
||||||
|
**To enable Kerberos armoring for restricting domain users to specific domain-joined devices**
|
||||||
|
|
||||||
|
- Users need to be in domains which are running Windows Server 2012 R2 or higher
|
||||||
|
- All the domain controllers in these domains must be configured to support Kerberos armoring. Set the **KDC support for claims, compound authentication, and Kerberos armoring** Group Policy setting to either **Supported** or **Always provide claims**.
|
||||||
|
- All the devices with Credential Guard which the users will be restricted to must be configured to support Kerberos armoring. Enable the **Kerberos client support for claims, compound authentication and Kerberos armoring** Group Policy settings under **Computer Configuration** -> **Administrative Templates** -> **System** -> **Kerberos**.
|
||||||
|
|
||||||
|
#### Protecting domain-joined device secrets
|
||||||
|
|
||||||
|
Since domain-joined devices also use shared secrets for authentication, attackers can steal those secrets as well. By deploying device certificates with Credential Guard, the private key can be protected. Then authentication policies can require that users sign on devices which authenticate using those certificates. This prevents shared secrets on stolen from the device to be used with stolen user credentials to sign on as the user.
|
||||||
|
|
||||||
|
Domain-joined device certificate authentication has the following requirements:
|
||||||
|
- Devices' accounts are in Windows Server 2012 domain funcational level or higher domains.
|
||||||
|
- All domain controllers in those domains have KDC certificates which satisfy strict KDC validation certificate requirements:
|
||||||
|
- KDC EKU present
|
||||||
|
- DNS domain name matches the DNSName field of the SubjectAltName (SAN) extension
|
||||||
- Windows 10 devices have the CA issuing the domain controller certificates in the enterprise store.
|
- Windows 10 devices have the CA issuing the domain controller certificates in the enterprise store.
|
||||||
- A process is established to ensure the identity and trustworthiness of the device in a similar manner as you would establish the identity and trustworthiness of a user before issuing them a smartcard.
|
- A process is established to ensure the identity and trustworthiness of the device in a similar manner as you would establish the identity and trustworthiness of a user before issuing them a smartcard.
|
||||||
|
|
||||||
### Additional Group Policy settings
|
##### Deploying domain-joined device certificates
|
||||||
|
|
||||||
There are a few Group Policy settings that you can enable that provide more protection against credential attacks:
|
To guarantee that certificates with the issuance policy required are only on the devices these users must use, they must be deployed manually on each device. The same security procedures used for issuing smart cards to users should be applied to device certificates.
|
||||||
|
|
||||||
- On the domain controllers, configure the KDC support for claims, compound authentication, and Kerberos armoring system by using Group Policy. Set the **KDC support for claims, compound authentication, and Kerberos armoring** Group Policy setting to either **Supported** or **Always provide claims**.
|
For example, let's say you wanted to use the High Assurance policy only on these devices. Using a Windows Server Enterprise certificate authority, you would create a new template.
|
||||||
- On devices running Windows 10, you can turn it on by using Group Policy as well. To do this, enable the **Kerberos client support for claims, compound authentication and Kerberos armoring** & **Always send compound authentication first system** Group Policy settings under **Computer Configuration** -> **Administrative Templates** -> **System** -> **Kerberos**.
|
|
||||||
|
|
||||||
### Compound authentication
|
**Creating a new certificate template**
|
||||||
|
|
||||||
Compound authentication adds the device identity to the user’s during authentication to the domain and resources. Without compound authentication, only the user’s secrets are validated. With compound authentication, the Kerberos client has to have both the user’s and device’s secrets.
|
|
||||||
Enabling compound authentication also enables Kerberos armoring, which provides two additional benefits:
|
|
||||||
|
|
||||||
- User authentication on domain-joined devices will be armored. This means that network captures will contain encrypted Kerberos initial authentication. Without the appropriate device key, Kerberos AS-REQs are protected against offline dictionary attacks.
|
|
||||||
- KDC errors are signed, which provides protection against error spoofing attacks.
|
|
||||||
|
|
||||||
### Deploying machine certificates
|
|
||||||
|
|
||||||
If the domain controllers in your organization are running Windows Server 2016, devices running Windows 10 will automatically enroll a machine certificate when Credential Guard is enabled and the PC is joined to the domain.
|
|
||||||
If the domain controllers are running Windows Server 2012 R2, the machine certificates must be provisioned manually on each device. You can do this by creating a certificate template on the domain controller or certificate authority and deploying the machine certificates to each device.
|
|
||||||
The same security procedures used for issuing smart cards to users should be applied to machine certificates.
|
|
||||||
|
|
||||||
1. From the Certificate Manager console, right-click **Certificate Templates**, and then click **Manage.**
|
1. From the Certificate Manager console, right-click **Certificate Templates**, and then click **Manage.**
|
||||||
2. Right-click **Workstation Authentication**, and then click **Duplicate Template**.
|
2. Right-click **Workstation Authentication**, and then click **Duplicate Template**.
|
||||||
@ -352,7 +366,11 @@ The same security procedures used for issuing smart cards to users should be app
|
|||||||
8. Under **Issuance Policies**, click**High Assurance**.
|
8. Under **Issuance Policies**, click**High Assurance**.
|
||||||
9. On the **Subject name** tab, clear the **DNS name** check box, and then select the **User Principal Name (UPN)** check box.
|
9. On the **Subject name** tab, clear the **DNS name** check box, and then select the **User Principal Name (UPN)** check box.
|
||||||
|
|
||||||
On devices that are running Credential Guard, enroll the devices using the machine authentication certificate by running the following command:
|
Then on the devices that are running Credential Guard, enroll the devices using the certificate you just created.
|
||||||
|
|
||||||
|
**Enrolling devices in a certificate**
|
||||||
|
|
||||||
|
Run the following command:
|
||||||
``` syntax
|
``` syntax
|
||||||
CertReq -EnrollCredGuardCert MachineAuthentication
|
CertReq -EnrollCredGuardCert MachineAuthentication
|
||||||
```
|
```
|
||||||
@ -360,53 +378,68 @@ CertReq -EnrollCredGuardCert MachineAuthentication
|
|||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> You must restart the device after enrolling the machine authentication certificate.
|
> You must restart the device after enrolling the machine authentication certificate.
|
||||||
|
|
||||||
### Link the issuance policies to a group
|
#### How a certificate issuance policy can be used for access control
|
||||||
|
|
||||||
|
Beginning with the Windows Server 2008 R2 domain functional level, domain controllers support for authentication mechanism assurance provides a way to map certificate issuance policy OIDs to universal security groups. Windows Server 2012 domain controllers with claim support can map them to claims. To learn more about authentication mechanism assurance, see [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](https://technet.microsoft.com/en-us/library/dd378897(v=ws.10).aspx) on TechNet.
|
||||||
|
|
||||||
|
**To see the issuance policies available**
|
||||||
|
|
||||||
By using an authentication policy, you can ensure that users only sign into devices that are running Credential Guard. Before you deploy the authentication policy though, you must first run a couple of scripts that set up your environment.
|
|
||||||
- The [get-IssuancePolicy.ps1](#bkmk-getscript) shows all of the issuance policies that are available on the certificate authority.
|
- The [get-IssuancePolicy.ps1](#bkmk-getscript) shows all of the issuance policies that are available on the certificate authority.
|
||||||
From a Windows PowerShell command prompt, run the following command:
|
From a Windows PowerShell command prompt, run the following command:
|
||||||
|
|
||||||
``` syntax
|
``` syntax
|
||||||
.\get-IssuancePolicy.ps1 –LinkedToGroup:All
|
.\get-IssuancePolicy.ps1 –LinkedToGroup:All
|
||||||
```
|
```
|
||||||
|
|
||||||
|
**To link a issuance policy to a universal security group**
|
||||||
|
|
||||||
- The [set-IssuancePolicyToGroupLink.ps1](#bkmk-setscript) creates a Universal security group, creates an organizational unit, and links the issuance policy to that Universal security group.
|
- The [set-IssuancePolicyToGroupLink.ps1](#bkmk-setscript) creates a Universal security group, creates an organizational unit, and links the issuance policy to that Universal security group.
|
||||||
From a Windows PowerShell command prompt, run the following command:
|
From a Windows PowerShell command prompt, run the following command:
|
||||||
``` syntax
|
``` syntax
|
||||||
.\set-IssuancePolicyToGroupLink.ps1 –IssuancePolicyName:”<name of issuance policy>” –groupOU:”<Name of OU to create>” –groupName:”<name of Universal security group to create>”
|
.\set-IssuancePolicyToGroupLink.ps1 –IssuancePolicyName:"<name of issuance policy>" –groupOU:"<Name of OU to create>" –groupName:”<name of Universal security group to create>"
|
||||||
```
|
```
|
||||||
|
|
||||||
### Deploy the authentication policy
|
#### Restricting user sign on
|
||||||
|
|
||||||
Before setting up the authentication policy, you should log any failed attempt to apply an authentication policy on the KDC. To do this in Event Viewer, navigate to **Applications and Services Logs\\Microsoft\\Windows\\Authentication, right-click AuthenticationPolicyFailures-DomainController**, and then click **Enable Log**.
|
So we now have the following:
|
||||||
|
|
||||||
Now you can set up an authentication policy to use Credential Guard.
|
- Created a special certificate issuance policy to identify devices which meet the deployment criteria required for the user to be able to sign on
|
||||||
|
- Mapped that policy to a universal security group or claim
|
||||||
|
- Provided a way for domain controllers to get the device authorization data during user sign on using Kerberos armoring-
|
||||||
|
so what is left to do is configuring the access check on the domain controllers. This is done with authentication policies.
|
||||||
|
|
||||||
**To add an authentication policy for Credential Guard**
|
Authentication policies have the following requirements:
|
||||||
|
- User accounts are in a Windows Server 2012 domain functional level or higher domain.
|
||||||
|
|
||||||
1. Ensure that your domain controllers are running at least the Windows Server 2012 R2 domain functional level.
|
**Creating an authentication policy restricting to the specific universal security group**
|
||||||
2. Create a security group that will be used to identify the PCs that will have this authentication policy applied to them.
|
|
||||||
3. Add the computer account to this security group.
|
|
||||||
4. Open Active Directory Administrative Center.
|
|
||||||
5. Click **Authentication**, click **New**, and then click **Authentication Policy**.
|
|
||||||
6. In the **Display name** box, enter a name for this authentication policy.
|
|
||||||
7. Under the **Accounts** heading, click **Add**.
|
|
||||||
8. In the **Select Users, Computers, or Service Accounts** dialog box, type the name of the user account, and then click **OK**.
|
|
||||||
9. Under the **User** heading, click the **Edit** button that applies to user account.
|
|
||||||
10. Click **Add a condition**.
|
|
||||||
11. In the **Edit Access Control Conditions** box, ensure that it reads **User** > **Group** > **Member of each** > **Value**, and then click **Add items**.
|
|
||||||
12. In the **Select Users, Computers, or Service Accounts** dialog box, type the name of the security group that you created with the set-IssuancePolicyToGroupLink script, and then click **OK**.
|
|
||||||
13. Click **OK** to close the **Edit Access Control Conditions** box.
|
|
||||||
14. Click **OK** to create the authentication policy.
|
|
||||||
15. Close Active Directory Administrative Center.
|
|
||||||
|
|
||||||
|
1. Open Active Directory Administrative Center.
|
||||||
|
2. Click **Authentication**, click **New**, and then click **Authentication Policy**.
|
||||||
|
3. In the **Display name** box, enter a name for this authentication policy.
|
||||||
|
4. Under the **Accounts** heading, click **Add**.
|
||||||
|
5. In the **Select Users, Computers, or Service Accounts** dialog box, type the name of the user account you with to restrict, and then click **OK**.
|
||||||
|
6. Under the **User Sign On** heading, click the **Edit** button.
|
||||||
|
7. Click **Add a condition**.
|
||||||
|
8. In the **Edit Access Control Conditions** box, ensure that it reads **User** > **Group** > **Member of each** > **Value**, and then click **Add items**.
|
||||||
|
9. In the **Select Users, Computers, or Service Accounts** dialog box, type the name of the universal security group that you created with the set-IssuancePolicyToGroupLink script, and then click **OK**.
|
||||||
|
10. Click **OK** to close the **Edit Access Control Conditions** box.
|
||||||
|
11. Click **OK** to create the authentication policy.
|
||||||
|
12. Close Active Directory Administrative Center.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> When authentication policies in enforcement mode are deployed with Credential Guard, users will not be able to sign in using devices that do not have the machine authentication certificate provisioned. This applies to both local and remote sign in scenarios.
|
> When the authentication policy enforces policy restrictions, users will not be able to sign on using devices that do not have a certificate with the appropriate issuance policy deployed. This applies to both local and remote sign on scenarios. Therefore, it is strongly recommended to first only audit policy restrictions to ensure you don't have unexpected failures.
|
||||||
|
|
||||||
### Appendix: Scripts
|
##### Discovering authentication failures due to authentication policies
|
||||||
|
|
||||||
|
To make tracking authentication failures due to authentication policies easier, an operational log exists with just those events. To enable the logs on the domain controllers, in Event Viewer, navigate to **Applications and Services Logs\\Microsoft\\Windows\\Authentication, right-click AuthenticationPolicyFailures-DomainController**, and then click **Enable Log**.
|
||||||
|
|
||||||
|
To learn more about authentication policy events, see [Authentication Policies and Authentication Policy Silos](https://technet.microsoft.com/en-us/library/dn486813(v=ws.11).aspx) on TechNet.
|
||||||
|
|
||||||
|
## Appendix: Scripts
|
||||||
|
|
||||||
Here is a list of scripts that are mentioned in this topic.
|
Here is a list of scripts that are mentioned in this topic.
|
||||||
|
|
||||||
#### <a href="" id="bkmk-getscript"></a>Get the available issuance policies on the certificate authority
|
### <a href="" id="bkmk-getscript"></a>Get the available issuance policies on the certificate authority
|
||||||
|
|
||||||
Save this script file as get-IssuancePolicy.ps1.
|
Save this script file as get-IssuancePolicy.ps1.
|
||||||
|
|
||||||
@ -597,7 +630,7 @@ write-host "There are no issuance policies which are not mapped to groups"
|
|||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter.
|
> If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter.
|
||||||
|
|
||||||
#### <a href="" id="bkmk-setscript"></a>Link an issuance policy to a group
|
### <a href="" id="bkmk-setscript"></a>Link an issuance policy to a group
|
||||||
|
|
||||||
Save the script file as set-IssuancePolicyToGroupLink.ps1.
|
Save the script file as set-IssuancePolicyToGroupLink.ps1.
|
||||||
|
|
||||||
|
|||||||
@ -89,7 +89,7 @@ When the sample is collected, Windows Defender ATP runs the file in is a secure
|
|||||||
A progress bar is displayed and provides information on the different stages of the analysis. You can then view the report when the analysis is done.
|
A progress bar is displayed and provides information on the different stages of the analysis. You can then view the report when the analysis is done.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> Depending on machine availability, sample collection time can vary. There is a 1-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 machine reporting at that time. You can re-submit files for deep analysis to get fresh data on the file.
|
> Depending on machine availability, sample collection time can vary. There is a 3-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 machine reporting at that time. You can re-submit files for deep analysis to get fresh data on the file.
|
||||||
|
|
||||||
## View deep analysis report
|
## View deep analysis report
|
||||||
|
|
||||||
|
|||||||
@ -20,6 +20,7 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro
|
- Windows 10 Pro
|
||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
>For more info about Windows 10 Enterprise Edition features and functionality, see [Windows 10 Enterprise edition](https://www.microsoft.com/en-us/WindowsForBusiness/buy).
|
||||||
|
|
||||||
Windows Defender Advanced Threat Protection (Windows Defender ATP) is a security service that enables enterprise customers to detect, investigate, and respond to advanced threats on their networks.
|
Windows Defender Advanced Threat Protection (Windows Defender ATP) is a security service that enables enterprise customers to detect, investigate, and respond to advanced threats on their networks.
|
||||||
|
|
||||||
|
|||||||
@ -12,6 +12,11 @@ author: jdeckerMS
|
|||||||
|
|
||||||
This topic lists new and updated topics in the [Manage and update Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md).
|
This topic lists new and updated topics in the [Manage and update Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md).
|
||||||
|
|
||||||
|
## September 2016
|
||||||
|
|
||||||
|
| New or changed topic | Description |
|
||||||
|
| --- | --- |
|
||||||
|
| [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Added content for Windows Server 2016 |
|
||||||
|
|
||||||
## August 2016
|
## August 2016
|
||||||
|
|
||||||
|
|||||||
File diff suppressed because it is too large
Load Diff
Binary file not shown.
|
Before Width: | Height: | Size: 59 KiB |
@ -2,7 +2,7 @@
|
|||||||
title: Manage connections from Windows operating system components to Microsoft services (Windows 10)
|
title: Manage connections from Windows operating system components to Microsoft services (Windows 10)
|
||||||
description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider.
|
description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider.
|
||||||
ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9
|
ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9
|
||||||
keywords: privacy, manage connections to Microsoft
|
keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
@ -15,6 +15,7 @@ author: brianlic-msft
|
|||||||
**Applies to**
|
**Applies to**
|
||||||
|
|
||||||
- Windows 10
|
- Windows 10
|
||||||
|
- Windows Server 2016
|
||||||
|
|
||||||
If you're looking for content on what each telemetry level means and how to configure it in your organization, see [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md).
|
If you're looking for content on what each telemetry level means and how to configure it in your organization, see [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md).
|
||||||
|
|
||||||
@ -22,127 +23,14 @@ Learn about the network connections that Windows components make to Microsoft an
|
|||||||
|
|
||||||
If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure telemetry at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article.
|
If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure telemetry at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article.
|
||||||
|
|
||||||
Some of the network connections discussed in this article can be managed in Windows 10 Mobile, Windows 10 Mobile Enterprise, Windows 10, version 1507, and Windows 10, version 1511. However, you must use Windows 10 Enterprise, version 1607 or Windows 10 Education, version 1607 to manage them all.
|
You can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft network endpoints as described in this article to help prevent Windows from sending any data to Microsoft. There are many reason why these communications are enabled by default, such as updating malware definitions and maintain current certificate revocation lists, which is why we strongly recommend against this. This data helps us deliver a secure, reliable, and more delightful personalized experience.
|
||||||
|
|
||||||
You can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft services as described in this article to prevent Windows from sending any data to Microsoft. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience.
|
We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com.
|
||||||
|
|
||||||
We are always working on improving Windows 10 for our customers. We invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows 10 work better for your organization.
|
|
||||||
|
|
||||||
Here's what's covered in this article:
|
## What's new in Windows 10, version 1607 and Windows Server 2016
|
||||||
|
|
||||||
- [Info management settings](#bkmk-othersettings)
|
Here's a list of changes that were made to this article for Windows 10, version 1607 and Windows Server 2016:
|
||||||
|
|
||||||
- [1. Certificate trust lists](#certificate-trust-lists)
|
|
||||||
|
|
||||||
- [2. Cortana](#bkmk-cortana)
|
|
||||||
|
|
||||||
- [2.1 Cortana Group Policies](#bkmk-cortana-gp)
|
|
||||||
|
|
||||||
- [2.2 Cortana MDM policies](#bkmk-cortana-mdm)
|
|
||||||
|
|
||||||
- [2.3 Cortana Windows Provisioning](#bkmk-cortana-prov)
|
|
||||||
|
|
||||||
- [3. Date & Time](#bkmk-datetime)
|
|
||||||
|
|
||||||
- [4. Device metadata retrieval](#bkmk-devinst)
|
|
||||||
|
|
||||||
- [5. Font streaming](#font-streaming)
|
|
||||||
|
|
||||||
- [6. Insider Preview builds](#bkmk-previewbuilds)
|
|
||||||
|
|
||||||
- [7. Internet Explorer](#bkmk-ie)
|
|
||||||
|
|
||||||
- [7.1 Internet Explorer Group Policies](#bkmk-ie-gp)
|
|
||||||
|
|
||||||
- [7.2 ActiveX control blocking](#bkmk-ie-activex)
|
|
||||||
|
|
||||||
- [8. Live Tiles](#live-tiles)
|
|
||||||
|
|
||||||
- [9. Mail synchronization](#bkmk-mailsync)
|
|
||||||
|
|
||||||
- [10. Microsoft Account](#bkmk-microsoft-account)
|
|
||||||
|
|
||||||
- [11. Microsoft Edge](#bkmk-edge)
|
|
||||||
|
|
||||||
- [11.1 Microsoft Edge Group Policies](#bkmk-edgegp)
|
|
||||||
|
|
||||||
- [11.2 Microsoft Edge MDM policies](#bkmk-edge-mdm)
|
|
||||||
|
|
||||||
- [11.3 Microsoft Edge Windows Provisioning](#bkmk-edge-prov)
|
|
||||||
|
|
||||||
- [12. Network Connection Status Indicator](#bkmk-ncsi)
|
|
||||||
|
|
||||||
- [13. Offline maps](#bkmk-offlinemaps)
|
|
||||||
|
|
||||||
- [14. OneDrive](#bkmk-onedrive)
|
|
||||||
|
|
||||||
- [15. Preinstalled apps](#bkmk-preinstalledapps)
|
|
||||||
|
|
||||||
- [16. Settings > Privacy](#bkmk-settingssection)
|
|
||||||
|
|
||||||
- [16.1 General](#bkmk-priv-general)
|
|
||||||
|
|
||||||
- [16.2 Location](#bkmk-priv-location)
|
|
||||||
|
|
||||||
- [16.3 Camera](#bkmk-priv-camera)
|
|
||||||
|
|
||||||
- [16.4 Microphone](#bkmk-priv-microphone)
|
|
||||||
|
|
||||||
- [16.5 Notifications](#bkmk-priv-notifications)
|
|
||||||
|
|
||||||
- [16.6 Speech, inking, & typing](#bkmk-priv-speech)
|
|
||||||
|
|
||||||
- [16.7 Account info](#bkmk-priv-accounts)
|
|
||||||
|
|
||||||
- [16.8 Contacts](#bkmk-priv-contacts)
|
|
||||||
|
|
||||||
- [16.9 Calendar](#bkmk-priv-calendar)
|
|
||||||
|
|
||||||
- [16.10 Call history](#bkmk-priv-callhistory)
|
|
||||||
|
|
||||||
- [16.11 Email](#bkmk-priv-email)
|
|
||||||
|
|
||||||
- [16.12 Messaging](#bkmk-priv-messaging)
|
|
||||||
|
|
||||||
- [16.13 Radios](#bkmk-priv-radios)
|
|
||||||
|
|
||||||
- [16.14 Other devices](#bkmk-priv-other-devices)
|
|
||||||
|
|
||||||
- [16.15 Feedback & diagnostics](#bkmk-priv-feedback)
|
|
||||||
|
|
||||||
- [16.16 Background apps](#bkmk-priv-background)
|
|
||||||
|
|
||||||
- [17. Software Protection Platform](#bkmk-spp)
|
|
||||||
|
|
||||||
- [18. Sync your settings](#bkmk-syncsettings)
|
|
||||||
|
|
||||||
- [19. Teredo](#bkmk-teredo)
|
|
||||||
|
|
||||||
- [20. Wi-Fi Sense](#bkmk-wifisense)
|
|
||||||
|
|
||||||
- [21. Windows Defender](#bkmk-defender)
|
|
||||||
|
|
||||||
- [22. Windows Media Player](#bkmk-wmp)
|
|
||||||
|
|
||||||
- [23. Windows spotlight](#bkmk-spotlight)
|
|
||||||
|
|
||||||
- [24. Windows Store](#bkmk-windowsstore)
|
|
||||||
|
|
||||||
- [25. Windows Update Delivery Optimization](#bkmk-updates)
|
|
||||||
|
|
||||||
- [25.1 Settings > Update & security](#bkmk-wudo-ui)
|
|
||||||
|
|
||||||
- [25.2 Delivery Optimization Group Policies](#bkmk-wudo-gp)
|
|
||||||
|
|
||||||
- [25.3 Delivery Optimization MDM policies](#bkmk-wudo-mdm)
|
|
||||||
|
|
||||||
- [25.4 Delivery Optimization Windows Provisioning](#bkmk-wudo-prov)
|
|
||||||
|
|
||||||
- [26. Windows Update](#bkmk-wu)
|
|
||||||
|
|
||||||
## What's new in Windows 10, version 1607
|
|
||||||
|
|
||||||
Here's a list of changes that were made to this article for Windows 10, version 1607:
|
|
||||||
|
|
||||||
- Added instructions on how to turn off speech recognition and speech synthesis model updates in [14.5 Speech, inking, & typing](#bkmk-priv-speech).
|
- Added instructions on how to turn off speech recognition and speech synthesis model updates in [14.5 Speech, inking, & typing](#bkmk-priv-speech).
|
||||||
- Added instructions on how to turn off flip ahead with an Internet Explorer Group Policy.
|
- Added instructions on how to turn off flip ahead with an Internet Explorer Group Policy.
|
||||||
@ -156,17 +44,117 @@ Here's a list of changes that were made to this article for Windows 10, version
|
|||||||
- Turn off unsolicited network traffic on the Offline Maps settings page
|
- Turn off unsolicited network traffic on the Offline Maps settings page
|
||||||
- Turn off all Windows spotlight features
|
- Turn off all Windows spotlight features
|
||||||
|
|
||||||
## <a href="" id="bkmk-othersettings"></a>Info management settings
|
## <a href="" id="bkmk-othersettings"></a>Settings
|
||||||
|
|
||||||
|
|
||||||
This section lists the components that make network connections to Microsoft services automatically. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all of these connections. We strongly recommend against this, as this data helps us deliver a secure, reliable, and more delightful personalized experience.
|
The following sections list the components that make network connections to Microsoft services by default. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all of these connections.
|
||||||
|
|
||||||
The settings in this section assume you are using Windows 10, version 1607. They will also be included in the next update for the Long Term Servicing Branch.
|
If you're running Windows 10, they will be included in the next update for the Long Term Servicing Branch.
|
||||||
|
|
||||||
See the following table for a summary of the management settings. For more info, see its corresponding section.
|
### Settings for Windows 10 Enterprise, version 1607
|
||||||
|
|
||||||
|
See the following table for a summary of the management settings for Windows 10 Enterprise, version 1607.
|
||||||
|
|
||||||
|
| Setting | UI | Group Policy | MDM policy | Registry | Command line |
|
||||||
|
| - | :-: | :-: | :-: | :-: | :-: |
|
||||||
|
| [1. Certificate trust lists](#certificate-trust-lists) | |  | | | |
|
||||||
|
| [2. Cortana and Search](#bkmk-cortana) |  |  |  | |  |
|
||||||
|
| [3. Date & Time](#bkmk-datetime) |  | | |  | |
|
||||||
|
| [4. Device metadata retrieval](#bkmk-devinst) | |  | | | |
|
||||||
|
| [5. Font streaming](#font-streaming) | | | |  | |
|
||||||
|
| [6. Insider Preview builds](#bkmk-previewbuilds) |  |  |  | |  |
|
||||||
|
| [7. Internet Explorer](#bkmk-ie) |  |  | | | |
|
||||||
|
| [8. Live Tiles](#live-tiles) | |  | | | |
|
||||||
|
| [9. Mail synchronization](#bkmk-mailsync) |  | |  | | |
|
||||||
|
| [10. Microsoft Account](#bkmk-microsoft-account) | | | |  | |
|
||||||
|
| [11. Microsoft Edge](#bkmk-edge) |  |  |  | |  |
|
||||||
|
| [12. Network Connection Status Indicator](#bkmk-ncsi) | |  | | | |
|
||||||
|
| [13. Offline maps](#bkmk-offlinemaps) |  |  | | | |
|
||||||
|
| [14. OneDrive](#bkmk-onedrive) | |  | |  | |
|
||||||
|
| [15. Preinstalled apps](#bkmk-preinstalledapps) |  | | | |  |
|
||||||
|
| [16. Settings > Privacy](#bkmk-settingssection) | | | | | |
|
||||||
|
| [16.1 General](#bkmk-priv-general) |  |  |  |  | |
|
||||||
|
| [16.2 Location](#bkmk-priv-location) |  |  |  | | |
|
||||||
|
| [16.3 Camera](#bkmk-priv-camera) |  |  |  | | |
|
||||||
|
| [16.4 Microphone](#bkmk-priv-microphone) |  |  | | | |
|
||||||
|
| [16.5 Notifications](#bkmk-priv-notifications) |  |  | | | |
|
||||||
|
| [16.6 Speech, inking, & typing](#bkmk-priv-speech) |  |  |  |  | |
|
||||||
|
| [16.7 Account info](#bkmk-priv-accounts) |  |  | | | |
|
||||||
|
| [16.8 Contacts](#bkmk-priv-contacts) |  |  | | | |
|
||||||
|
| [16.9 Calendar](#bkmk-priv-calendar) |  |  | | | |
|
||||||
|
| [16.10 Call history](#bkmk-priv-callhistory) |  |  | | | |
|
||||||
|
| [16.11 Email](#bkmk-priv-email) |  |  | | | |
|
||||||
|
| [16.12 Messaging](#bkmk-priv-messaging) |  |  | | | |
|
||||||
|
| [16.13 Radios](#bkmk-priv-radios) |  |  | | | |
|
||||||
|
| [16.14 Other devices](#bkmk-priv-other-devices) |  |  | |  | |
|
||||||
|
| [16.15 Feedback & diagnostics](#bkmk-priv-feedback) |  |  |  |  | |
|
||||||
|
| [16.16 Background apps](#bkmk-priv-background) |  | | | | |
|
||||||
|
| [17. Software Protection Platform](#bkmk-spp) | |  |  | | |
|
||||||
|
| [18. Sync your settings](#bkmk-syncsettings) |  |  |  | | |
|
||||||
|
| [19. Teredo](#bkmk-teredo) | | | | |  |
|
||||||
|
| [20. Wi-Fi Sense](#bkmk-wifisense) |  |  | |  | |
|
||||||
|
| [21. Windows Defender](#bkmk-defender) | |  |  |  | |
|
||||||
|
| [22. Windows Media Player](#bkmk-wmp) |  | | | |  |
|
||||||
|
| [23. Windows spotlight](#bkmk-spotlight) |  |  | | | |
|
||||||
|
| [24. Windows Store](#bkmk-windowsstore) | |  | | | |
|
||||||
|
| [25. Windows Update Delivery Optimization](#bkmk-updates) |  |  |  | | |
|
||||||
|
| [26. Windows Update](#bkmk-wu) |  |  |  | | |
|
||||||
|
|
||||||
|
### Settings for Windows Server 2016 with Desktop Experience
|
||||||
|
|
||||||
|
See the following table for a summary of the management settings for Windows Server 2016 with Desktop Experience.
|
||||||
|
|
||||||
|
| Setting | UI | Group Policy | Registry | Command line |
|
||||||
|
| - | :-: | :-: | :-: | :-: |
|
||||||
|
| [1. Certificate trust lists](#certificate-trust-lists) | |  |  | |
|
||||||
|
| [2. Cortana and Search](#bkmk-cortana) |  |  | | |
|
||||||
|
| [3. Date & Time](#bkmk-datetime) |  | |  | |
|
||||||
|
| [4. Device metadata retrieval](#bkmk-devinst) | |  | | |
|
||||||
|
| [5. Font streaming](#font-streaming) | | |  | |
|
||||||
|
| [6. Insider Preview builds](#bkmk-previewbuilds) |  |  | | |
|
||||||
|
| [7. Internet Explorer](#bkmk-ie) |  |  | | |
|
||||||
|
| [8. Live Tiles](#live-tiles) | |  | | |
|
||||||
|
| [10. Microsoft Account](#bkmk-microsoft-account) | | |  | |
|
||||||
|
| [12. Network Connection Status Indicator](#bkmk-ncsi) | |  | | |
|
||||||
|
| [14. OneDrive](#bkmk-onedrive) | |  | | |
|
||||||
|
| [16. Settings > Privacy](#bkmk-settingssection) | | | | |
|
||||||
|
| [16.1 General](#bkmk-priv-general) |  |  |  | |
|
||||||
|
| [17. Software Protection Platform](#bkmk-spp) | |  | | |
|
||||||
|
| [19. Teredo](#bkmk-teredo) | | | |  |
|
||||||
|
| [21. Windows Defender](#bkmk-defender) | |  |  | |
|
||||||
|
| [22. Windows Media Player](#bkmk-wmp) | | | |  |
|
||||||
|
| [24. Windows Store](#bkmk-windowsstore) | |  | | |
|
||||||
|
| [26. Windows Update](#bkmk-wu) | |  |  | |
|
||||||
|
|
||||||
|
### Settings for Windows Server 2016 Server Core
|
||||||
|
|
||||||
|
See the following table for a summary of the management settings for Windows Server 2016 Server Core.
|
||||||
|
|
||||||
|
| Setting | Group Policy | Registry | Command line |
|
||||||
|
| - | :-: | :-: | :-: | :-: | :-: |
|
||||||
|
| [1. Certificate trust lists](#certificate-trust-lists) |  |  | |
|
||||||
|
| [3. Date & Time](#bkmk-datetime) | |  | |
|
||||||
|
| [5. Font streaming](#font-streaming) | |  | |
|
||||||
|
| [12. Network Connection Status Indicator](#bkmk-ncsi) |  | | |
|
||||||
|
| [17. Software Protection Platform](#bkmk-spp) |  | | |
|
||||||
|
| [19. Teredo](#bkmk-teredo) | | |  |
|
||||||
|
| [21. Windows Defender](#bkmk-defender) |  |  | |
|
||||||
|
| [26. Windows Update](#bkmk-wu) |  |  | |
|
||||||
|
|
||||||
|
### Settings for Windows Server 2016 Nano Server
|
||||||
|
|
||||||
|
See the following table for a summary of the management settings for Windows Server 2016 Nano Server.
|
||||||
|
|
||||||
|
| Setting | Registry | Command line |
|
||||||
|
| - | :-: | :-: | :-: | :-: | :-: |
|
||||||
|
| [1. Certificate trust lists](#certificate-trust-lists) |  | |
|
||||||
|
| [3. Date & Time](#bkmk-datetime) |  | |
|
||||||
|
| [19. Teredo](#bkmk-teredo) | |  |
|
||||||
|
| [26. Windows Update](#bkmk-wu) |  | |
|
||||||
|
|
||||||
|
## Settings
|
||||||
|
|
||||||
|
Use the following sections for more information about how to configure each setting.
|
||||||
|
|
||||||
### <a href="" id="certificate-trust-lists"></a>1. Certificate trust lists
|
### <a href="" id="certificate-trust-lists"></a>1. Certificate trust lists
|
||||||
|
|
||||||
@ -174,40 +162,45 @@ A certificate trust list is a predefined list of items, such as a list of certif
|
|||||||
|
|
||||||
To turn off the automatic download of an updated certificate trust list, you can turn off automatic root updates, which also includes the disallowed certificate list and the pin rules list.
|
To turn off the automatic download of an updated certificate trust list, you can turn off automatic root updates, which also includes the disallowed certificate list and the pin rules list.
|
||||||
|
|
||||||
|
For Windows 10, Windows Server 2016 with Desktop Experience, and Windows Server 2016 Server Core:
|
||||||
|
|
||||||
- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Automatic Root Certificates Update**
|
- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Automatic Root Certificates Update**
|
||||||
|
|
||||||
-or-
|
-or-
|
||||||
|
|
||||||
- Create a REG\_DWORD registry setting called **DisableRootAutoUpdate** in **HKEY\_LOCAL\_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\DisableRootAutoUpdate**, with a value of 1.
|
- Create the registry path **HKEY\_LOCAL\_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot** and then add a REG\_DWORD registry setting, called **DisableRootAutoUpdate**, with a value of 1.
|
||||||
|
|
||||||
After that, do the following in a Group Policy:
|
-or-
|
||||||
|
|
||||||
1. Navigate to **Computer Configuration** > **Windows Settings** > **Security Settings** > **Public Key Policies**.
|
1. Navigate to **Computer Configuration** > **Windows Settings** > **Security Settings** > **Public Key Policies**.
|
||||||
2. Double-click **Certificate Path Validation Settings**.
|
2. Double-click **Certificate Path Validation Settings**.
|
||||||
3. On the **Network Retrieval** tab, select the **Define these policy settings** check box.
|
3. On the **Network Retrieval** tab, select the **Define these policy settings** check box.
|
||||||
4. Clear the **Automatically update certificates in the Microsoft Root Certificate Program (recommended)** check box, and then click **OK**.
|
4. Clear the **Automatically update certificates in the Microsoft Root Certificate Program (recommended)** check box, and then click **OK**.
|
||||||
|
|
||||||
|
On Windows Server 2016 Nano Server:
|
||||||
|
|
||||||
### <a href="" id="bkmk-cortana"></a>2. Cortana
|
- Create the registry path **HKEY\_LOCAL\_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot** and then add a REG\_DWORD registry setting, called **DisableRootAutoUpdate**, with a value of 1.
|
||||||
|
|
||||||
|
### <a href="" id="bkmk-cortana"></a>2. Cortana and Search
|
||||||
|
|
||||||
Use either Group Policy or MDM policies to manage settings for Cortana. For more info, see [Cortana, Search, and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730683).
|
Use either Group Policy or MDM policies to manage settings for Cortana. For more info, see [Cortana, Search, and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730683).
|
||||||
|
|
||||||
### <a href="" id="bkmk-cortana-gp"></a>2.1 Cortana Group Policies
|
### <a href="" id="bkmk-cortana-gp"></a>2.1 Cortana and Search Group Policies
|
||||||
|
|
||||||
Find the Cortana Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Search**.
|
Find the Cortana Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Search**.
|
||||||
|
|
||||||
| Policy | Description |
|
| Policy | Description |
|
||||||
|------------------------------------------------------|---------------------------------------------------------------------------------------|
|
|------------------------------------------------------|---------------------------------------------------------------------------------------|
|
||||||
| Allow Cortana | Choose whether to let Cortana install and run on the device. |
|
| Allow Cortana | Choose whether to let Cortana install and run on the device.<br/><br/>Disable this policy to turn off Cortana. |
|
||||||
| Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results. |
|
| Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results.<br/><br/>Disable this policy to block access to location information for Cortana. |
|
||||||
| Do not allow web search | Choose whether to search the web from Windows Desktop Search. <br /> Default: Disabled|
|
| Do not allow web search | Choose whether to search the web from Windows Desktop Search.<br/><br/>Enable this policy to remove the option to search the Internet from Cortana. |
|
||||||
| Don't search the web or display web results in Search| Choose whether to search the web from Cortana. |
|
| Don't search the web or display web results in Search| Choose whether to search the web from Cortana.<br/><br/>Enable this policy to stop web queries and results from showing in Search. |
|
||||||
| Set what information is shared in Search | Control what information is shared with Bing in Search. |
|
| Set what information is shared in Search | Control what information is shared with Bing in Search.<br/><br/>If you enable this policy and set it to **Anonymous info**, usage information will be shared but not search history, Microsoft Account information, or specific location. |
|
||||||
|
|
||||||
In Windows 10, version 1507 and Windows 10, version 1511, When you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic.
|
In Windows 10, version 1507 and Windows 10, version 1511, when you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic.
|
||||||
|
|
||||||
>[!IMPORTANT]
|
>[!IMPORTANT]
|
||||||
>These steps are not required for devices running Windows 10, version 1607.
|
>These steps are not required for devices running Windows 10, version 1607 or Windows Server 2016.
|
||||||
|
|
||||||
1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** > **Windows Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**.
|
1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** > **Windows Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**.
|
||||||
|
|
||||||
@ -235,19 +228,15 @@ In Windows 10, version 1507 and Windows 10, version 1511, When you enable the **
|
|||||||
|
|
||||||
If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. Fiddler is a network proxy and Windows Firewall does not block proxy traffic. You should use a network traffic analyzer, such as WireShark or Message Analyzer.
|
If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. Fiddler is a network proxy and Windows Firewall does not block proxy traffic. You should use a network traffic analyzer, such as WireShark or Message Analyzer.
|
||||||
|
|
||||||
### <a href="" id="bkmk-cortana-mdm"></a>2.2 Cortana MDM policies
|
### <a href="" id="bkmk-cortana-mdm"></a>2.2 Cortana and Search MDM policies
|
||||||
|
|
||||||
The following Cortana MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
|
For Windows 10 only, the following Cortana MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
|
||||||
|
|
||||||
| Policy | Description |
|
| Policy | Description |
|
||||||
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
|
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
|
||||||
| Experience/AllowCortana | Choose whether to let Cortana install and run on the device. |
|
| Experience/AllowCortana | Choose whether to let Cortana install and run on the device. |
|
||||||
| Search/AllowSearchToUseLocation | Choose whether Cortana and Search can provide location-aware search results. <br /> Default: Allowed|
|
| Search/AllowSearchToUseLocation | Choose whether Cortana and Search can provide location-aware search results. <br /> Default: Allowed|
|
||||||
|
|
||||||
### <a href="" id="bkmk-cortana-prov"></a>2.3 Cortana Windows Provisioning
|
|
||||||
|
|
||||||
To use Windows Imaging and Configuration Designer (ICD) to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies** to find **Experience** > **AllowCortana** and **Search** > **AllowSearchToUseLocation**.
|
|
||||||
|
|
||||||
### <a href="" id="bkmk-datetime"></a>3. Date & Time
|
### <a href="" id="bkmk-datetime"></a>3. Date & Time
|
||||||
|
|
||||||
You can prevent Windows from setting the time automatically.
|
You can prevent Windows from setting the time automatically.
|
||||||
@ -264,20 +253,23 @@ To prevent Windows from retrieving device metadata from the Internet, apply the
|
|||||||
|
|
||||||
### <a href="" id="font-streaming"></a>5. Font streaming
|
### <a href="" id="font-streaming"></a>5. Font streaming
|
||||||
|
|
||||||
Starting with Windows 10, fonts that are included in Windows but that are not stored on the local device can be downloaded on demand.
|
Fonts that are included in Windows but that are not stored on the local device can be downloaded on demand.
|
||||||
|
|
||||||
To turn off font streaming, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1.
|
To turn off font streaming, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1.
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> This may change in future versions of Windows.
|
|
||||||
|
|
||||||
### <a href="" id="bkmk-previewbuilds"></a>6. Insider Preview builds
|
### <a href="" id="bkmk-previewbuilds"></a>6. Insider Preview builds
|
||||||
|
|
||||||
|
The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> This setting stops communication with the Windows Insider Preview service that checks for new builds. Windows Insider Preview builds only apply to Windows 10 and are not available for Windows Server 2016.
|
||||||
|
|
||||||
To turn off Insider Preview builds for a released version of Windows 10:
|
To turn off Insider Preview builds for a released version of Windows 10:
|
||||||
|
|
||||||
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**.
|
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**.
|
||||||
|
|
||||||
To turn off Insider Preview builds for an Insider Preview version of Windows 10:
|
To turn off Insider Preview builds for Windows 10:
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds.
|
> If you're running a preview version of Windows 10, you must roll back to a released version before you can turn off Insider Preview builds.
|
||||||
@ -310,11 +302,7 @@ To turn off Insider Preview builds for an Insider Preview version of Windows 10:
|
|||||||
|
|
||||||
### <a href="" id="bkmk-ie"></a>7. Internet Explorer
|
### <a href="" id="bkmk-ie"></a>7. Internet Explorer
|
||||||
|
|
||||||
Use Group Policy to manage settings for Internet Explorer.
|
Use Group Policy to manage settings for Internet Explorer. You can find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**.
|
||||||
|
|
||||||
### <a href="" id="bkmk-ie-gp"></a>7.1 Internet Explorer Group Policies
|
|
||||||
|
|
||||||
Find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**.
|
|
||||||
|
|
||||||
| Policy | Description |
|
| Policy | Description |
|
||||||
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
|
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
|
||||||
@ -331,7 +319,7 @@ There are two more Group Policy objects that are used by Internet Explorer:
|
|||||||
| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Internet Control Panel** > **Advanced Page** | Turn off the flip ahead with page prediction feature | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website. <br /> Default: Enabled |
|
| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Internet Control Panel** > **Advanced Page** | Turn off the flip ahead with page prediction feature | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website. <br /> Default: Enabled |
|
||||||
| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **RSS Feeds** | Turn off background synchronization for feeds and Web Slices | Choose whether to have background synchronization for feeds and Web Slices. <br /> Default: Enabled |
|
| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **RSS Feeds** | Turn off background synchronization for feeds and Web Slices | Choose whether to have background synchronization for feeds and Web Slices. <br /> Default: Enabled |
|
||||||
|
|
||||||
### <a href="" id="bkmk-ie-activex"></a>7.2 ActiveX control blocking
|
### <a href="" id="bkmk-ie-activex"></a>7.1 ActiveX control blocking
|
||||||
|
|
||||||
ActiveX control blocking periodically downloads a new list of out-of-date ActiveX controls that should be blocked. You can turn this off by changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero).
|
ActiveX control blocking periodically downloads a new list of out-of-date ActiveX controls that should be blocked. You can turn this off by changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero).
|
||||||
|
|
||||||
@ -414,9 +402,6 @@ The following Microsoft Edge MDM policies are available in the [Policy CSP](http
|
|||||||
| Browser/AllowSearchSuggestionsinAddressBar | Choose whether the address bar shows search suggestions.. <br /> Default: Allowed |
|
| Browser/AllowSearchSuggestionsinAddressBar | Choose whether the address bar shows search suggestions.. <br /> Default: Allowed |
|
||||||
| Browser/AllowSmartScreen | Choose whether SmartScreen is turned on or off. <br /> Default: Allowed |
|
| Browser/AllowSmartScreen | Choose whether SmartScreen is turned on or off. <br /> Default: Allowed |
|
||||||
|
|
||||||
### <a href="" id="bkmk-edge-prov"></a>11.3 Microsoft Edge Windows Provisioning
|
|
||||||
|
|
||||||
Use Windows ICD to create a provisioning package with the settings for these policies, go to **Runtime settings** > **Policies**.
|
|
||||||
|
|
||||||
For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](http://technet.microsoft.com/library/mt270204.aspx).
|
For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](http://technet.microsoft.com/library/mt270204.aspx).
|
||||||
|
|
||||||
@ -424,7 +409,7 @@ For a complete list of the Microsoft Edge policies, see [Available policies for
|
|||||||
|
|
||||||
Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. For more info about NCSI, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx).
|
Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. For more info about NCSI, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx).
|
||||||
|
|
||||||
In versions of Windows 10 prior to Windows 10, version 1607, the URL was http://www.msftncsi.com.
|
In versions of Windows 10 prior to Windows 10, version 1607 and Windows Server 2016, the URL was http://www.msftncsi.com.
|
||||||
|
|
||||||
You can turn off NCSI through Group Policy:
|
You can turn off NCSI through Group Policy:
|
||||||
|
|
||||||
@ -671,6 +656,10 @@ To turn off **Let apps on my other devices open apps and continue experiences on
|
|||||||
|
|
||||||
- Turn off the feature in the UI.
|
- Turn off the feature in the UI.
|
||||||
|
|
||||||
|
-or-
|
||||||
|
|
||||||
|
- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Group Policy** > **Continue experiences on this device**.
|
||||||
|
|
||||||
To turn off **Let apps on my other devices use Bluetooth to open apps and continue experiences on this device**:
|
To turn off **Let apps on my other devices use Bluetooth to open apps and continue experiences on this device**:
|
||||||
|
|
||||||
- Turn off the feature in the UI.
|
- Turn off the feature in the UI.
|
||||||
@ -1048,12 +1037,18 @@ To turn off **Let apps run in the background**:
|
|||||||
|
|
||||||
Enterprise customers can manage their Windows activation status with volume licensing using an on-premise Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by doing one of the following:
|
Enterprise customers can manage their Windows activation status with volume licensing using an on-premise Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by doing one of the following:
|
||||||
|
|
||||||
|
For Windows 10:
|
||||||
|
|
||||||
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Activation**
|
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Activation**
|
||||||
|
|
||||||
-or-
|
-or-
|
||||||
|
|
||||||
- Apply the Licensing/DisallowKMSClientOnlineAVSValidation MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is disabled (default) and 1 is enabled.
|
- Apply the Licensing/DisallowKMSClientOnlineAVSValidation MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is disabled (default) and 1 is enabled.
|
||||||
|
|
||||||
|
For Windows Server 2016 with Desktop Experience or Windows Server 2016 Server Core:
|
||||||
|
|
||||||
|
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Activation**
|
||||||
|
|
||||||
The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS.
|
The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS.
|
||||||
|
|
||||||
### <a href="" id="bkmk-syncsettings"></a>18. Sync your settings
|
### <a href="" id="bkmk-syncsettings"></a>18. Sync your settings
|
||||||
@ -1122,7 +1117,7 @@ You can disconnect from the Microsoft Antimalware Protection Service.
|
|||||||
|
|
||||||
-or-
|
-or-
|
||||||
|
|
||||||
- Apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
|
- For Windows 10 only, apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
|
||||||
|
|
||||||
-or-
|
-or-
|
||||||
|
|
||||||
@ -1138,7 +1133,7 @@ You can stop sending file samples back to Microsoft.
|
|||||||
|
|
||||||
-or-
|
-or-
|
||||||
|
|
||||||
- Apply the Defender/SubmitSamplesConsent MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where:
|
- For Windows 10 only, apply the Defender/SubmitSamplesConsent MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where:
|
||||||
|
|
||||||
- **0**. Always prompt.
|
- **0**. Always prompt.
|
||||||
|
|
||||||
@ -1160,7 +1155,7 @@ You can stop downloading definition updates:
|
|||||||
|
|
||||||
- Disable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to nothing.
|
- Disable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to nothing.
|
||||||
|
|
||||||
You can stop Enhanced Notifications:
|
For Windows 10 only, you can stop Enhanced Notifications:
|
||||||
|
|
||||||
- Turn off the feature in the UI.
|
- Turn off the feature in the UI.
|
||||||
|
|
||||||
@ -1168,7 +1163,7 @@ You can also use the registry to turn off Malicious Software Reporting Tool tele
|
|||||||
|
|
||||||
### <a href="" id="bkmk-wmp"></a>22. Windows Media Player
|
### <a href="" id="bkmk-wmp"></a>22. Windows Media Player
|
||||||
|
|
||||||
To remove Windows Media Player:
|
To remove Windows Media Player on Windows 10:
|
||||||
|
|
||||||
- From the **Programs and Features** control panel, click **Turn Windows features on or off**, under **Media Features**, clear the **Windows Media Player** check box, and then click **OK**.
|
- From the **Programs and Features** control panel, click **Turn Windows features on or off**, under **Media Features**, clear the **Windows Media Player** check box, and then click **OK**.
|
||||||
|
|
||||||
@ -1176,6 +1171,10 @@ To remove Windows Media Player:
|
|||||||
|
|
||||||
- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer**
|
- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer**
|
||||||
|
|
||||||
|
To remove Windows Media Player on Windows Server 2016:
|
||||||
|
|
||||||
|
- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer**
|
||||||
|
|
||||||
### <a href="" id="bkmk-spotlight"></a>23. Windows spotlight
|
### <a href="" id="bkmk-spotlight"></a>23. Windows spotlight
|
||||||
|
|
||||||
Windows spotlight provides features such as different background images and text on the lock screen, suggested apps, Microsoft account notifications, and Windows tips. You can control it by using the user interface or through Group Policy.
|
Windows spotlight provides features such as different background images and text on the lock screen, suggested apps, Microsoft account notifications, and Windows tips. You can control it by using the user interface or through Group Policy.
|
||||||
@ -1219,7 +1218,7 @@ For more info, see [Windows Spotlight on the lock screen](../manage/windows-spot
|
|||||||
|
|
||||||
### <a href="" id="bkmk-windowsstore"></a>24. Windows Store
|
### <a href="" id="bkmk-windowsstore"></a>24. Windows Store
|
||||||
|
|
||||||
You can turn off the ability to launch apps from the Windows Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Windows Store will be disabled.
|
You can turn off the ability to launch apps from the Windows Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Windows Store will be disabled. On Windows Server 2016, this will block Windows Store calls from Universal Windows Apps.
|
||||||
|
|
||||||
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Windows Store**.
|
- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Windows Store**.
|
||||||
|
|
||||||
@ -1301,7 +1300,7 @@ You can turn off automatic updates by doing one of the following. This is not re
|
|||||||
|
|
||||||
-or-
|
-or-
|
||||||
|
|
||||||
- Apply the Update/AllowAutoUpdate MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where:
|
- For Windows 10 only, apply the Update/AllowAutoUpdate MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where:
|
||||||
|
|
||||||
- **0**. Notify the user before downloading the update.
|
- **0**. Notify the user before downloading the update.
|
||||||
|
|
||||||
|
|||||||
@ -37,8 +37,8 @@ The name of the folder in which you store the mandatory profile must use the cor
|
|||||||
| Windows Vista</br>Windows 7 | Windows Server 2008</br>Windows Server 2008 R2 | v2 |
|
| Windows Vista</br>Windows 7 | Windows Server 2008</br>Windows Server 2008 R2 | v2 |
|
||||||
| Windows 8 | Windows Server 2012 | v3 |
|
| Windows 8 | Windows Server 2012 | v3 |
|
||||||
| Windows 8.1 | Windows Server 2012 R2 | v4 |
|
| Windows 8.1 | Windows Server 2012 R2 | v4 |
|
||||||
| Windows 10, versions 1507 and 1511 | Windows Server 2016 | v5 |
|
| Windows 10, versions 1507 and 1511 | N/A | v5 |
|
||||||
| Windows 10, version 1607 (also known as the Anniversary Update) | N/A | v6 |
|
| Windows 10, version 1607 (also known as the Anniversary Update) | Windows Server 2016 | v6 |
|
||||||
|
|
||||||
For more information, see [Deploy Roaming User Profiles, Appendix B](https://technet.microsoft.com/library/jj649079.aspx) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](https://support.microsoft.com/kb/3056198).
|
For more information, see [Deploy Roaming User Profiles, Appendix B](https://technet.microsoft.com/library/jj649079.aspx) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](https://support.microsoft.com/kb/3056198).
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user