Windows 10

Source: https://docs.microsoft.com/en-us/windows/windows-10/  last updated 01March2018

Windows 10

• Windows 10 and Windows 10 Mobile
  • Get started
  • What's new
    • What's new in Windows 10, version 1709
    • What's new in Windows 10, version 1703
    • What's new in Windows 10, version 1607
    • What's new in Windows 10, versions 1507 and 1511
  • Deployment
    • What's new in Windows 10 deployment
    • Windows 10 deployment scenarios
    • Windows 10 Subscription Activation
      • Windows 10 Enterprise E3 in CSP
      • Configure VDA for Subscription Activation
      • Deploy Windows 10 Enterprise licenses
    • Resolve Windows 10 upgrade errors
      • Submit Windows 10 upgrade errors
    • Deploy Windows 10
      • Overview of Windows Auto Pilot
      • Windows 10 upgrade paths
        • Windows 10 downgrade paths
      • Windows 10 edition upgrade
      • Windows 10 volume license media
      • Windows 10 deployment test lab
        • Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit
        • Deploy Windows 10 in a test lab using System Center Configuration Manager
      • Plan for Windows 10 deployment
        • Windows 10 Enterprise FAQ for IT Pros
        • Windows 10 deployment considerations
        • Windows 10 compatibility
        • Windows 10 infrastructure requirements
        • Volume Activation [client]
          • Plan for volume activation [client]
          • Activate using Key Management Service [client]
          • Activate using Active Directory-based activation [client]
          • Activate clients running Windows 10
          • Monitor activation [client]
          • Use the Volume Activation Management Tool [client]
          • Appendix: Information sent to Microsoft during activation [client]
        • Application Compatibility Toolkit (ACT) Technical Reference
          • SUA User's Guide
            • Using the SUA Wizard
            • Using the SUA Tool
              • Tabs on the SUA Tool Interface
              • Showing Messages Generated by the SUA Tool
              • Applying Filters to Data in the SUA Tool
              • Fixing Applications by Using the SUA Tool
          • Compatibility Administrator User's Guide
            • Using the Compatibility Administrator Tool
              • Available Data Types and Operators in Compatibility Administrator
              • Searching for Fixed Applications in Compatibility Administrator
              • Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator
              • Creating a Custom Compatibility Fix in Compatibility Administrator
              • Creating a Custom Compatibility Mode in Compatibility Administrator
              • Creating an App Help Message in Compatibility Administrator
              • Viewing the Events Screen in Compatibility Administrator
              • Enabling and Disabling Compatibility Fixes in Compatibility Administrator
              • Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator
            • Managing Application-Compatibility Fixes and Custom Fix Databases
              • Understanding and Using Compatibility Fixes
              • Compatibility Fix Database Management Strategies and Deployment
              • Testing Your Application Mitigation Packages
            • Using the Sdbinst. exe Command-Line Tool
          • Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista
        • Change history for Plan for Windows 10 deployment
      • Deploy Windows 10 with the Microsoft Deployment Toolkit
        • Get started with the Microsoft Deployment Toolkit (MDT)
          • Key features in MDT
          • MDT Lite Touch components
          • Prepare for deployment with MDT
        • Create a Windows 10 reference image
        • Deploy a Windows 10 image using MDT
        • Build a distributed environment for Windows 10 deployment
        • Refresh a Windows 7 computer with Windows 10
        • Replace a Windows 7 computer with a Windows 10 computer
        • Perform an in-place upgrade to Windows 10 with MDT
        • Configure MDT settings
          • Set up MDT for Bit Locker
          • Configure MDT deployment share rules
          • Configure MDT for User Exit scripts
          • Simulate a Windows 10 deployment in a test environment
          • Use the MDT database to stage Windows 10 deployment information
          • Assign applications using roles in MDT
          • Use web services in MDT
          • Use Orchestrator runbooks with MDT
      • Deploy Windows 10 with System Center 2012 R2 Configuration Manager
        • Integrate Configuration Manager with MDT
        • Prepare for Zero Touch Installation of Windows 10 with Configuration Manager
        • Create a custom Windows PE boot image with Configuration Manager
        • Add a Windows 10 operating system image using Configuration Manager
        • Create an application to deploy with Windows 10 using Configuration Manager
        • Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager
        • Create a task sequence with Configuration Manager and MDT
        • Finalize the operating system configuration for Windows 10 deployment with Configuration Manager
        • Deploy Windows 10 using PXE and Configuration Manager
        • Monitor the Windows 10 deployment with Configuration Manager
        • Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager
        • Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager
        • Perform an in-place upgrade to Windows 10 using Configuration Manager
      • Windows 10 deployment tools
        • Windows 10 deployment scenarios and tools
        • Convert MBR partition to GPT
        • Configure a PXE server to load Windows PE
        • Windows ADK for Windows 10 scenarios for IT Pros
        • Deploy Windows To Go in your organization
          • Windows To Go: feature overview
            • Best practice recommendations for Windows To Go
            • Deployment considerations for Windows To Go
            • Prepare your organization for Windows To Go
            • Security and data protection considerations for Windows To Go
            • Windows To Go: frequently asked questions
        • Volume Activation Management Tool (VAMT) Technical Reference
          • Introduction to VAMT
          • Active Directory-Based Activation Overview
          • Install and Configure VAMT
            • VAMT Requirements
            • Install VAMT
            • Configure Client Computers
          • Add and Manage Products
            • Add and Remove Computers
            • Update Product Status
            • Remove Products
          • Manage Product Keys
            • Add and Remove a Product Key
            • Install a Product Key
            • Install a KMS Client Key
          • Manage Activations
            • Perform Online Activation
            • Perform Proxy Activation
            • Perform KMS Activation
            • Perform Local Reactivation
            • Activate an Active Directory Forest Online
            • Activate by Proxy an Active Directory Forest
          • Manage VAMT Data
            • Import and Export VAMT Data
            • Use VAMT in Windows Power Shell
          • VAMT Step-by-Step Scenarios
            • Scenario 1: Online Activation
            • Scenario 2: Proxy Activation
            • Scenario 3: KMS Client Activation
          • VAMT Known Issues
        • User State Migration Tool (USMT) Technical Reference
          • User State Migration Tool (USMT) Overview Topics
            • User State Migration Tool (USMT) Overview
            • Getting Started with the User State Migration Tool (USMT)
            • Windows Upgrade and Migration Considerations
          • User State Migration Tool (USMT) How-to topics
            • Exclude Files and Settings
            • Extract Files from a Compressed USMT Migration Store
            • Include Files and Settings
            • Migrate Application Settings
            • Migrate EFS Files and Certificates
            • Migrate User Accounts
            • Reroute Files and Settings
            • Verify the Condition of a Compressed Migration Store
          • User State Migration Tool (USMT) Troubleshooting
            • Common Issues
            • Frequently Asked Questions
            • Log Files
            • Return Codes
            • USMT Resources
          • User State Migration Toolkit (USMT) Reference
            • USMT Requirements
            • USMT Best Practices
            • How USMT Works
            • Plan Your Migration
              • Common Migration Scenarios
              • What Does USMT Migrate?
              • Choose a Migration Store Type
                • Migration Store Types Overview
                • Estimate Migration Store Size
                • Hard-Link Migration Store
                • Migration Store Encryption
              • Determine What to Migrate
                • Identify Users
                • Identify Applications Settings
                • Identify Operating System Settings
                • Identify File Types, Files, and Folders
              • Test Your Migration
            • User State Migration Tool (USMT) Command-line Syntax
              • Scan State Syntax
              • Load State Syntax
              • Usmt Utils Syntax
            • USMT XML Reference
              • Understanding Migration XML Files
              • Config. xml File
              • Customize USMT XML Files
              • Custom XML Examples
              • Conflicts and Precedence
              • General Conventions
              • XML File Requirements
              • Recognized Environment Variables
              • XML Elements Library
            • Offline Migration Reference
      • Install fonts in Windows 10
      • Change history for deploy Windows 10
    • Update Windows 10
      • Quick guide to Windows as a service
      • Overview of Windows as a service
      • Prepare servicing strategy for Windows 10 updates
      • Build deployment rings for Windows 10 updates
      • Assign devices to servicing channels for Windows 10 updates
      • Optimize Windows 10 update delivery
        • Configure Delivery Optimization for Windows 10 updates
        • Configure Branch Cache for Windows 10 updates
      • Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile
      • Deploy updates using Windows Update for Business
        • Configure Windows Update for Business
        • Integrate Windows Update for Business with management solutions
        • Walkthrough: use Group Policy to configure Windows Update for Business
        • Walkthrough: use Intune to configure Windows Update for Business
      • Deploy Windows 10 updates using Windows Server Update Services
      • Deploy Windows 10 updates using System Center Configuration Manager
      • Manage device restarts after updates
      • Manage additional Windows Update settings
      • Windows Insider Program for Business
        • Windows Insider Program for Business Frequently Asked Questions
        • Olympia Corp enrollment
      • Change history for Update Windows 10
    • Windows Analytics
      • Manage Windows upgrades with Upgrade Readiness
        • Upgrade Readiness architecture
        • Upgrade Readiness requirements
        • Get started with Upgrade Readiness
          • Upgrade Readiness deployment script
        • Use Upgrade Readiness to manage Windows upgrades
          • Upgrade overview
          • Step 1: Identify apps
          • Step 2: Resolve issues
          • Step 3: Deploy Windows
          • Additional insights
        • Troubleshoot Upgrade Readiness
      • Monitor Windows Updates with Update Compliance
        • Get started with Update Compliance
        • Use Update Compliance
          • Need Attention! report
          • Security Update Status report
          • Feature Update Status report
          • Windows Defender AV Status report
          • Update Compliance Perspectives
      • Device Health
        • Get started with Device Health
        • Using Device Health
    • Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management
    • Architectural planning posters for Windows 10
  • Configuration
    • Configure Windows diagnostic data in your organization
    • Diagnostic Data Viewer Overview
    • Windows 10, version 1709 basic level Windows diagnostic events and fields
    • Windows 10, version 1703 basic level Windows diagnostic events and fields
    • Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics
    • Windows 10, version 1709 diagnostic data for the Full telemetry level
    • Windows 10, version 1703 diagnostic data for the Full telemetry level
    • Beginning your General Data Protection Regulation (GDPR) journey for Windows 10
    • Manage connections from Windows operating system components to Microsoft services
    • Manage Windows 10 connection endpoints
    • Manage Wi-Fi Sense in your company
    • Configure kiosk and shared devices running Windows 10 desktop editions
      • Set up a shared or guest PC with Windows 10
      • Set up a kiosk on Windows 10 Pro, Enterprise, or Education
      • Guidelines for choosing an app for assigned access (kiosk mode)
      • Create a Windows 10 kiosk that runs multiple apps
        • Troubleshoot multi-app kiosk
        • Use App Locker to create a Windows 10 kiosk that runs multiple apps
        • Multi-app kiosk XML reference
    • Configure Windows 10 Mobile devices
      • Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise
      • Use Windows Configuration Designer to configure Windows 10 Mobile devices
        • NFC-based device provisioning
        • Barcode provisioning and the package splitter tool
      • Use the Lockdown Designer app to create a Lockdown XML file
      • Configure Windows 10 Mobile using Lockdown XML
      • Settings and quick actions that can be locked down in Windows 10 Mobile
      • Product IDs in Windows 10 Mobile
      • Start layout XML for mobile editions of Windows 10 (reference)
    • Configure cellular settings for tablets and PCs
    • Configure Start, taskbar, and lock screen
      • Configure Windows Spotlight on the lock screen
      • Manage Windows 10 and Microsoft Store tips, tricks, and suggestions
      • Manage Windows 10 Start and taskbar layout
        • Configure Windows 10 taskbar
        • Customize and export Start layout
        • Add image for secondary tiles
        • Start layout XML for desktop editions of Windows 10 (reference)
        • Customize Windows 10 Start and taskbar with Group Policy
        • Customize Windows 10 Start and taskbar with provisioning packages
        • Customize Windows 10 Start and taskbar with mobile device management (MDM)
        • Changes to Start policies in Windows 10
    • Cortana integration in your business or enterprise
      • Testing scenarios using Cortana in your business or organization
        • Test scenario 1 - Sign-in to Azure AD and use Cortana to manage the notebook
        • Test scenario 2 - Perform a quick search with Cortana at work
        • Test scenario 3 - Set a reminder for a specific location using Cortana at work
        • Test scenario 4 - Use Cortana at work to find your upcoming meetings
        • Test scenario 5 - Use Cortana to send email to a co-worker
        • Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email
        • Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device
      • Set up and test Cortana with Office 365 in your organization
      • Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization
      • Set up and test Cortana for Power BI in your organization
      • Set up and test custom voice commands in Cortana for your organization
      • Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization
      • Send feedback about Cortana at work back to Microsoft
    • Configure access to Microsoft Store
    • Accessibility information for IT Pros
    • Provisioning packages for Windows 10
      • How provisioning works in Windows 10
      • Introduction to configuration service providers (CSPs)
      • Install Windows Configuration Designer
      • Create a provisioning package
      • Apply a provisioning package
      • Settings changed when you uninstall a provisioning package
      • Provision PCs with common settings for initial deployment (desktop wizard)
      • Provision PCs with apps
      • Use a script to install a desktop app in provisioning packages
      • Create a provisioning package with multivariant settings
      • Power Shell cmdlets for provisioning Windows 10 (reference)
      • Windows Configuration Designer command-line interface (reference)
      • Windows Configuration Designer provisioning settings (reference)
        • Accounts
        • ADMXIngestion
        • Application Management
        • Assigned Access
        • Automatic Time
        • Browser
        • Call And Messaging Enhancement
        • Calling
        • Cell Core
        • Cellular
        • Certificates
        • CleanPC
        • Connections
        • Connectivity Profiles
        • Country And Region
        • Desktop Background And Colors
        • Developer Setup
        • Device Form Factor
        • Device Info
        • Device Management
        • DMClient
        • Edition Upgrade
        • Embedded Lockdown Profiles
        • Firewall Configuration
        • First Experience
        • Folders
        • Hot Spot
        • Initial Setup
        • Internet Explorer
        • Licensing
        • Maps
        • Messaging
        • Modem Configurations
        • Multivariant
        • Network Proxy
        • Network QOSPolicy
        • NFC
        • OOBE
        • Other Assets
        • Personalization
        • Policies
        • Provisioning Commands
        • SharedPC
        • Shell
        • SMISettings
        • Start
        • Startup App
        • Startup Background Tasks
        • Surface Hub Management
        • Tablet Mode
        • Take ATest
        • Text Input
        • Theme
        • Unified Write Filter
        • Universal App Install
        • Universal App Uninstall
        • Usb Errors OEMOverride
        • Weak Charger
        • Windows Team Settings
        • WLAN
        • Workplace
    • Lockdown features from Windows Embedded 8.1 Industry
    • User Experience Virtualization (UE-V) for Windows
      • Get Started with UE-V
        • What's New in UE-V for Windows 10, version 1607
        • User Experience Virtualization Release Notes
        • Upgrade to UE-V for Windows 10
      • Prepare a UE-V Deployment
        • Deploy Required UE-V Features
        • Deploy UE-V for use with Custom Applications
      • Administering UE-V
        • Manage Configurations for UE-V
          • Configuring UE-V with Group Policy Objects
          • Configuring UE-V with System Center Configuration Manager
          • Administering UE-V with Windows Power Shell and WMI
            • Managing the UE-V Service and Packages with Windows Power Shell and WMI
            • Managing UE-V Settings Location Templates Using Windows Power Shell and WMI
        • Working with Custom UE-V Templates and the UE-V Template Generator
        • Manage Administrative Backup and Restore in UE-V
        • Changing the Frequency of UE-V Scheduled Tasks
        • Migrating UE-V Settings Packages
        • Using UE-V with Application Virtualization Applications
      • Troubleshooting UE-V
      • Technical Reference for UE-V
        • Sync Methods for UE-V
        • Sync Trigger Events for UE-V
        • Synchronizing Microsoft Office with UE-V
        • Application Template Schema Reference for UE-V
        • Security Considerations for UE-V
    • Change history for Configure Windows 10
  • Client management
    • Administrative Tools in Windows 10
    • Create mandatory user profiles
    • Connect to remote Azure Active Directory-joined PC
    • Join Windows 10 Mobile to Azure Active Directory
    • New policies for Windows 10
    • Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education
    • Manage the Settings app with Group Policy
    • Reset a Windows 10 Mobile device
    • Transitioning to modern management
    • Windows 10 Mobile deployment and management guide
    • Windows libraries
    • Mobile device management for solution providers
    • Change history for Client management
• Application management
  • Sideload apps
  • Remove background task resource restrictions
  • Enable or block Windows Mixed Reality apps in the enterprise
  • Application Virtualization (App-V) for Windows
    • Getting Started with App-V
      • What's new in App-V for Windows 10, version 1703 and earlier
        • Release Notes for App-V for Windows 10, version 1607
        • Release Notes for App-V for Windows 10, version 1703
      • Evaluating App-V
      • High Level Architecture for App-V
    • Planning for App-V
      • Preparing Your Environment for App-V
        • App-V Prerequisites
        • App-V Security Considerations
      • Planning to Deploy App-V
        • App-V Supported Configurations
        • App-V Capacity Planning
        • Planning for High Availability with App-V
        • Planning to Deploy App-V with an Electronic Software Distribution System
        • Planning for the App-V Server Deployment
        • Planning for the App-V Sequencer and Client Deployment
        • Planning for Using App-V with Office
        • Planning to Use Folder Redirection with App-V
      • App-V Planning Checklist
    • Deploying App-V
      • Deploying the App-V Sequencer and Configuring the Client
        • About Client Configuration Settings
        • Enable the App-V desktop client
        • How to Install the Sequencer
      • Deploying the App-V Server
        • How to Deploy the App-V Server
        • How to Deploy the App-V Server Using a Script
        • How to Deploy the App-V Databases by Using SQL Scripts
        • How to Install the Publishing Server on a Remote Computer
        • How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services
        • How to install the Management Server on a Standalone Computer and Connect it to the Database
        • About App-V Reporting
        • How to install the Reporting Server on a Standalone Computer and Connect it to the Database
      • App-V Deployment Checklist
      • Deploying Microsoft Office 2016 by Using App-V
      • Deploying Microsoft Office 2013 by Using App-V
      • Deploying Microsoft Office 2010 by Using App-V
    • Operations for App-V
      • Creating and Managing App-V Virtualized Applications
        • Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer)
        • Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)
        • Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)
        • Manually sequence a new app using Microsoft Application Virtualization Sequencer (App-V Sequencer)
        • How to Modify an Existing Virtual Application Package
        • How to Create and Use a Project Template
        • How to Create a Package Accelerator
        • How to Create a Virtual Application Package Using an App-V Package Accelerator
      • Administering App-V Virtual Applications by Using the Management Console
        • About App-V Dynamic Configuration
        • How to Connect to the Management Console
        • How to Add or Upgrade Packages by Using the Management Console
        • How to Configure Access to Packages by Using the Management Console
        • How to Publish a Package by Using the Management Console
        • How to Delete a Package in the Management Console
        • How to Add or Remove an Administrator by Using the Management Console
        • How to Register and Unregister a Publishing Server by Using the Management Console
        • How to Create a Custom Configuration File by Using the App-V Management Console
        • How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console
        • How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console
        • How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console
      • Managing Connection Groups
        • About the Connection Group Virtual Environment
        • About the Connection Group File
        • How to Create a Connection Group
        • How to Create a Connection Group with User-Published and Globally Published Packages
        • How to Delete a Connection Group
        • How to Publish a Connection Group
        • How to Make a Connection Group Ignore the Package Version
        • How to Allow Only Administrators to Enable Connection Groups
      • Deploying App-V Packages by Using Electronic Software Distribution (ESD)
        • How to deploy App-V Packages Using Electronic Software Distribution
        • How to Enable Only Administrators to Publish Packages by Using an ESD
      • Using the App-V Client Management Console
        • Automatically clean-up unpublished packages on the App-V client
      • Migrating to App-V from a Previous Version
        • How to Convert a Package Created in a Previous Version of App-V
      • Maintaining App-V
        • How to Move the App-V Server to Another Computer
      • Administering App-V by Using Windows Power Shell
        • How to Load the Windows Power Shell Cmdlets for App-V and Get Cmdlet Help
        • How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows Power Shell
        • How to Manage Connection Groups on a Stand-alone Computer by Using Windows Power Shell
        • How to Modify Client Configuration by Using Windows Power Shell
        • How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server
        • How to Apply the User Configuration File by Using Windows Power Shell
        • How to Apply the Deployment Configuration File by Using Windows Power Shell
        • How to Sequence a Package by Using Windows Power Shell
        • How to Create a Package Accelerator by Using Windows Power Shell
        • How to Enable Reporting on the App-V Client by Using Windows Power Shell
        • How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows Power Shell
    • Troubleshooting App-V
    • Technical Reference for App-V
      • Available Mobile Device Management (MDM) settings for App-V
      • Performance Guidance for Application Virtualization
      • Application Publishing and Client Interaction
      • Viewing App-V Server Publishing Metadata
      • Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications
  • Service Host process refactoring
  • Per-user services in Windows
  • Disabling System Services in Windows Server
  • Understand apps in Windows 10
  • Deploy app upgrades on Windows 10 Mobile
  • Change history for Application management
• Security
  • Identity and access management
    • Access Control Overview
      • Dynamic Access Control Overview
      • Security identifiers
      • Security Principals
      • Local Accounts
      • Active Directory Accounts
      • Microsoft Accounts
      • Service Accounts
      • Active Directory Security Groups
      • Special Identities
    • Configure S/MIME for Windows 10 and Windows 10 Mobile
    • Enterprise Certificate Pinning
    • Install digital certificates on Windows 10 Mobile
    • How hardware-based containers help protect Windows 10
    • Protect derived domain credentials with Credential Guard
      • How Credential Guard works
      • Credential Guard Requirements
      • Manage Credential Guard
      • Credential Guard protection limits
      • Considerations when using Credential Guard
      • Credential Guard: Additional mitigations
      • Credential Guard: Known issues
    • Protect Remote Desktop credentials with Remote Credential Guard
    • Smart Cards
      • How Smart Card Sign-in Works in Windows
        • Smart Card Architecture
        • Certificate Requirements and Enumeration
        • Smart Card and Remote Desktop Services
        • Smart Cards for Windows Service
        • Certificate Propagation Service
        • Smart Card Removal Policy Service
      • Smart Card Tools and Settings
        • Smart Cards Debugging Information
        • Smart Card Group Policy and Registry Settings
        • Smart Card Events
      • User Account Control
        • How User Account Control works
        • User Account Control security policy settings
        • User Account Control Group Policy and registry key settings
      • Virtual Smart Cards
        • Understanding and Evaluating Virtual Smart Cards
          • Get Started with Virtual Smart Cards: Walkthrough Guide
          • Use Virtual Smart Cards
          • Deploy Virtual Smart Cards
          • Evaluate Virtual Smart Card Security
        • Tpmvscmgr
    • VPN technical guide
      • VPN connection types
      • VPN routing decisions
      • VPN authentication options
      • VPN and conditional access
      • VPN name resolution
      • VPN auto-triggered profile options
      • VPN security features
      • VPN profile options
      • How to configure Diffie Hellman protocol over IKEv2 VPN connections
      • How to use single sign-on (SSO) over VPN and Wi-Fi connections
      • Windows 10 credential theft mitigation guide abstract
    • Windows Firewall with Advanced Security
      • Isolating Microsoft Store Apps on Your Network
      • Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server 2012
      • Windows Firewall with Advanced Security Administration with Windows Power Shell
      • Windows Firewall with Advanced Security Design Guide
        • Understanding the Windows Firewall with Advanced Security Design Process
        • Identifying Your Windows Firewall with Advanced Security Deployment Goals
          • Protect Devices from Unwanted Network Traffic
          • Restrict Access to Only Trusted Devices
          • Require Encryption When Accessing Sensitive Network Resources
          • Restrict Access to Only Specified Users or Computers
        • Mapping Your Deployment Goals to a Windows Firewall with Advanced Security Design
          • Basic Firewall Policy Design
          • Domain Isolation Policy Design
          • Server Isolation Policy Design
          • Certificate-based Isolation Policy Design
        • Evaluating Windows Firewall with Advanced Security Design Examples
          • Firewall Policy Design Example
          • Domain Isolation Policy Design Example
          • Server Isolation Policy Design Example
          • Certificate-based Isolation Policy Design Example
        • Designing a Windows Firewall with Advanced Security Strategy
          • Gathering the Information You Need
            • Gathering Information about Your Current Network Infrastructure
            • Gathering Information about Your Active Directory Deployment
            • Gathering Information about Your Computers
            • Gathering Other Relevant Information
          • Determining the Trusted State of Your Computers
        • Planning Your Windows Firewall with Advanced Security Design
          • Planning Settings for a Basic Firewall Policy
          • Planning Domain Isolation Zones
            • Exemption List
            • Isolated Domain
            • Boundary Zone
            • Encryption Zone
          • Planning Server Isolation Zones
          • Planning Certificate-based Authentication
            • Documenting the Zones
            • Planning Group Policy Deployment for Your Isolation Zones
              • Planning Isolation Groups for the Zones
              • Planning Network Access Groups
              • Planning the GPOs
                • Firewall GPOs
                  • GPO_DOMISO_Firewall
                • Isolated Domain GPOs
                  • GPO_DOMISO_Isolated Domain_Clients
                  • GPO_DOMISO_Isolated Domain_Servers
                • Boundary Zone GPOs
                  • GPO_DOMISO_Boundary
                • Encryption Zone GPOs
                  • GPO_DOMISO_Encryption
                • Server Isolation GPOs
              • Planning GPO Deployment
        • Appendix A: Sample GPO Template Files for Settings Used in this Guide
      • Windows Firewall with Advanced Security Deployment Guide
        • Planning to Deploy Windows Firewall with Advanced Security
        • Implementing Your Windows Firewall with Advanced Security Design Plan
        • Checklist: Creating Group Policy Objects
        • Checklist: Implementing a Basic Firewall Policy Design
        • Checklist: Configuring Basic Firewall Settings
        • Checklist: Creating Inbound Firewall Rules
        • Checklist: Creating Outbound Firewall Rules
        • Checklist: Implementing a Domain Isolation Policy Design
          • Checklist: Configuring Rules for the Isolated Domain
          • Checklist: Configuring Rules for the Boundary Zone
          • Checklist: Configuring Rules for the Encryption Zone
          • Checklist: Configuring Rules for an Isolated Server Zone
        • Checklist: Implementing a Standalone Server Isolation Policy Design
          • Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone
          • Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone
        • Checklist: Implementing a Certificate-based Isolation Policy Design
        • Procedures Used in This Guide
          • Add Production Devices to the Membership Group for a Zone
          • Add Test Devices to the Membership Group for a Zone
          • Assign Security Group Filters to the GPO
          • Change Rules from Request to Require Mode
          • Configure Authentication Methods
          • Configure Data Protection (Quick Mode) Settings
          • Configure Group Policy to Autoenroll and Deploy Certificates
          • Configure Key Exchange (Main Mode) Settings
          • Configure the Rules to Require Encryption
          • Configure the Windows Firewall Log
          • Configure the Workstation Authentication Certificate Template
          • Configure Windows Firewall to Suppress Notifications When a Program Is Blocked
          • Confirm That Certificates Are Deployed Correctly
          • Copy a GPO to Create a New GPO
          • Create a Group Account in Active Directory
          • Create a Group Policy Object
          • Create an Authentication Exemption List Rule
          • Create an Authentication Request Rule
          • Create an Inbound ICMP Rule
          • Create an Inbound Port Rule
          • Create an Inbound Program or Service Rule
          • Create an Outbound Port Rule
          • Create an Outbound Program or Service Rule
          • Create Inbound Rules to Support RPC
          • Create WMI Filters for the GPO
          • Enable Predefined Inbound Rules
          • Enable Predefined Outbound Rules
          • Exempt ICMP from Authentication
          • Link the GPO to the Domain
          • Modify GPO Filters to Apply to a Different Zone or Version of Windows
          • Open the Group Policy Management Console to IP Security Policies
          • Open the Group Policy Management Console to Windows Firewall
          • Open the Group Policy Management Console to Windows Firewall with Advanced Security
          • Open Windows Firewall with Advanced Security
          • Restrict Server Access to Members of a Group Only
          • Turn on Windows Firewall and Configure Default Behavior
          • Verify That Network Traffic Is Authenticated
    • Windows Hello for Business
  • Threat protection
    • The Windows Defender Security Center app
      • Customize the Windows Defender Security Center app for your organization
      • Hide Windows Defender Security Center app notifications
      • Virus and threat protection
      • Device performance and health
      • Firewall and network protection
      • App and browser control
      • Family options
    • Windows Defender Advanced Threat Protection
      • Get started
        • Minimum requirements
        • Validate licensing and complete setup
        • Troubleshoot subscription and portal access issues
        • Preview features
        • Data storage and privacy
        • Assign user access to the portal
      • Onboard endpoints and set up access
        • Configure client endpoints
          • Configure endpoints using Group Policy
          • Configure endpoints using System Center Configuration Manager
          • Configure endpoints using Mobile Device Management tools
            • Configure endpoints using Microsoft Intune
          • Configure endpoints using a local script
          • Configure non-persistent virtual desktop infrastructure (VDI) machines
        • Configure server endpoints
        • Configure non-Windows endpoints
        • Run a detection test on a newly onboarded endpoint
        • Configure proxy and Internet connectivity settings
        • Troubleshoot onboarding issues
      • Understand the Windows Defender ATP portal
        • Portal overview
        • View the Security operations dashboard
        • View the Security analytics dashboard
      • Investigate and remediate threats
        • Alerts queue
          • View and organize the Alerts queue
          • Manage alerts
          • Investigate alerts
          • Investigate files
          • Investigate machines
          • Investigate an IP address
          • Investigate a domain
          • Investigate a user account
        • Machines list
          • View and organize the Machines list
          • Manage machine group and tags
          • Alerts related to this machine
          • Machine timeline
            • Search for specific events
            • Filter events from a specific date
            • Export machine timeline events
            • Navigate between pages
        • Take response actions
          • Take response actions on a machine
            • Collect investigation package
            • Run antivirus scan
            • Restrict app execution
            • Remove app restriction
            • Isolate machines from the network
            • Release machine from isolation
            • Check activity details in Action center
          • Take response actions on a file
            • Stop and quarantine files in your network
            • Remove file from quarantine
            • Block files in your network
            • Remove file from blocked list
            • Check activity details in Action center
            • Deep analysis
              • Submit files for analysis
              • View deep analysis reports
              • Troubleshoot deep analysis
      • API and SIEM support
        • Pull alerts to your SIEM tools
          • Enable SIEM integration
          • Configure Splunk to pull alerts
          • Configure HP Arc Sight to pull alerts
          • Windows Defender ATP alert API fields
          • Pull alerts using REST API
          • Troubleshoot SIEM tool integration issues
        • Use the threat intelligence API to create custom alerts
          • Understand threat intelligence concepts
          • Enable the custom threat intelligence application
          • Create custom threat intelligence alerts
          • Power Shell code examples
          • Python code examples
          • Experiment with custom threat intelligence alerts
          • Troubleshoot custom threat intelligence issues
        • Use the Windows Defender ATP exposed APIs
          • Supported Windows Defender ATP APIs
            • Actor
              • Get actor information
              • Get actor related alerts
            • Alerts
              • Get alerts
              • Get alert information by ID
              • Get alert related actor information
              • Get alert related domain information
              • Get alert related file information
              • Get alert related IP information
              • Get alert related machine information
            • Domain
              • Get domain related alerts
              • Get domain related machines
              • Get domain statistics
              • Is domain seen in organization
            • File
              • Block file API
              • Get file information
              • Get file related alerts
              • Get file related machines
              • Get file statistics
              • Get File Actions collection API
              • Unblock file API
            • IP
              • Get IP related alerts
              • Get IP related machines
              • Get IP statistics
              • Is IP seen in organization
            • Machines
              • Collect investigation package API
              • Find machine information by IP
              • Get machines
              • Get File Machine Action object API
              • Get File Machine Actions collection API
              • Get machine by ID
              • Get machine log on users
              • Get machine related alerts
              • Get Machine Action object API
              • Get Machine Actions collection API
              • Get machines
              • Get package SAS URI API
              • Isolate machine API
              • Release machine from isolation API
              • Remove app restriction API
              • Request sample API
              • Restrict app execution API
              • Run antivirus scan API
              • Stop and quarantine file API
            • User
              • Get alert related user information
              • Get user information
              • Get user related alerts
              • Get user related machines
      • Reporting
        • Create and build Power BI reports using Windows Defender ATP data
      • Check service health and sensor state
        • Check sensor state
          • Fix unhealthy sensors
          • Inactive machines
          • Misconfigured machines
        • Check service health
      • Configure Windows Defender ATP preferences settings
        • Update general settings
        • Enable advanced features
        • Enable preview experience
        • Configure email notifications
        • Enable SIEM integration
        • Enable Threat intel API
        • Enable and create Power BI reports using Windows Defender ATP data
        • Enable Security Analytics security controls
      • Configure Windows Defender ATP time zone settings
      • Access the Windows Defender ATP Community Center
      • Troubleshoot Windows Defender ATP
        • Review events and errors on endpoints with Event Viewer
      • Windows Defender Antivirus compatibility with Windows Defender ATP
    • Windows Defender Antivirus in Windows 10
      • Windows Defender AV in the Windows Defender Security Center app
      • Windows Defender AV on Windows Server 2016
      • Windows Defender Antivirus compatibility
        • Use limited periodic scanning in Windows Defender AV
      • Evaluate Windows Defender Antivirus protection
      • Deploy, manage updates, and report on Windows Defender Antivirus
        • Deploy and enable Windows Defender Antivirus
          • Deployment guide for VDI environments
        • Report on Windows Defender Antivirus protection
          • Troubleshoot Windows Defender Antivirus reporting in Update Compliance
        • Manage updates and apply baselines
          • Manage protection and definition updates
          • Manage when protection updates should be downloaded and applied
          • Manage updates for endpoints that are out of date
          • Manage event-based forced updates
          • Manage updates for mobile devices and VMs
      • Configure Windows Defender Antivirus features
        • Utilize Microsoft cloud-delivered protection
          • Enable cloud-delivered protection
          • Specify the cloud-delivered protection level
          • Configure and validate network connections
          • Enable the Block at First Sight feature
          • Configure the cloud block timeout period
        • Configure behavioral, heuristic, and real-time protection
          • Detect and block Potentially Unwanted Applications
          • Enable and configure always-on protection and monitoring
        • Configure end-user interaction with Windows Defender AV
          • Configure the notifications that appear on endpoints
          • Prevent users from seeing or interacting with the user interface
          • Prevent or allow users to locally modify policy settings
      • Customize, initiate, and review the results of scans and remediation
        • Configure and validate exclusions in Windows Defender AV scans
          • Configure and validate exclusions based on file name, extension, and folder location
          • Configure and validate exclusions for files opened by processes
          • Configure exclusions in Windows Defender AV on Windows Server 2016
        • Configure scanning options in Windows Defender AV
        • Configure remediation for scans
        • Configure scheduled scans
        • Configure and run scans
        • Review scan results
        • Run and review the results of a Windows Defender Offline scan
      • Review event logs and error codes to troubleshoot issues
      • Reference topics for management and configuration tools
        • Use Group Policy settings to configure and manage Windows Defender AV
        • Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV
        • Use Power Shell cmdlets to configure and manage Windows Defender AV
        • Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV
        • Use the mpcmdrun. exe commandline tool to configure and manage Windows Defender AV
    • Windows Defender Exploit Guard
      • Evaluate Windows Defender Exploit Guard
        • Use auditing mode to evaluate Windows Defender Exploit Guard
        • View Exploit Guard events
      • Exploit protection
        • Comparison with Enhanced Mitigation Experience Toolkit
        • Evaluate Exploit protection
        • Enable Exploit protection
        • Customize Exploit protection
          • Import, export, and deploy Exploit protection configurations
      • Attack surface reduction
        • Evaluate Attack surface reduction
        • Enable Attack surface reduction
        • Customize Attack surface reduction
        • Troubleshoot Attack surface reduction rules
      • Network Protection
        • Evaluate Network Protection
        • Enable Network Protection
        • Troubleshoot Network protection
      • Controlled folder access
        • Evaluate Controlled folder access
        • Enable Controlled folder access
        • Customize Controlled folder access
    • Windows Defender Application Control
    • Enable HVCI
    • App Locker
      • Administer App Locker
        • Maintain App Locker policies
        • Edit an App Locker policy
        • Test and update an App Locker policy
        • Deploy App Locker policies by using the enforce rules setting
        • Use the App Locker Windows Power Shell cmdlets
        • Use App Locker and Software Restriction Policies in the same domain
        • Optimize App Locker performance
        • Monitor app usage with App Locker
        • Manage packaged apps with App Locker
        • Working with App Locker rules
          • Create a rule that uses a file hash condition
          • Create a rule that uses a path condition
          • Create a rule that uses a publisher condition
          • Create App Locker default rules
          • Add exceptions for an App Locker rule
          • Create a rule for packaged apps
          • Delete an App Locker rule
          • Edit App Locker rules
          • Enable the DLL rule collection
          • Enforce App Locker rules
          • Run the Automatically Generate Rules wizard
        • Working with App Locker policies
          • Configure the Application Identity service
          • Configure an App Locker policy for audit only
          • Configure an App Locker policy for enforce rules
          • Display a custom URL message when users try to run a blocked app
          • Export an App Locker policy from a GPO
          • Export an App Locker policy to an XML file
          • Import an App Locker policy from another computer
          • Import an App Locker policy into a GPO
          • Add rules for packaged apps to existing App Locker rule-set
          • Merge App Locker policies by using Set-Applocker Policy
          • Merge App Locker policies manually
          • Refresh an App Locker policy
          • Test an App Locker policy by using Test-App Locker Policy
      • App Locker design guide
        • Understand App Locker policy design decisions
        • Determine your application control objectives
        • Create a list of apps deployed to each business group
          • Document your app list
        • Select the types of rules to create
          • Document your App Locker rules
        • Determine the Group Policy structure and rule enforcement
          • Understand App Locker enforcement settings
          • Understand App Locker rules and enforcement setting inheritance in Group Policy
          • Document the Group Policy structure and App Locker rule enforcement
        • Plan for App Locker policy management
          • Document your application control management processes
        • Create your App Locker planning document
      • App Locker deployment guide
        • Understand the App Locker policy deployment process
        • Requirements for Deploying App Locker Policies
        • Use Software Restriction Policies and App Locker policies
        • Create Your App Locker policies
          • Create Your App Locker rules
        • Deploy the App Locker policy into production
          • Use a reference device to create and maintain App Locker policies
            • Determine which apps are digitally signed on a reference device
            • Configure the App Locker reference device
      • App Locker technical reference
        • What Is App Locker?
        • Requirements to use App Locker
        • App Locker policy use scenarios
        • How App Locker works
          • Understanding App Locker rule behavior
          • Understanding App Locker rule exceptions
          • Understanding App Locker rule collections
          • Understanding App Locker allow and deny actions on rules
          • Understanding App Locker rule condition types
            • Understanding the publisher rule condition in App Locker
            • Understanding the path rule condition in App Locker
            • Understanding the file hash rule condition in App Locker
          • Understanding App Locker default rules
            • Executable rules in App Locker
            • Windows Installer rules in App Locker
            • Script rules in App Locker
            • DLL rules in App Locker
            • Packaged apps and packaged app installer rules in App Locker
        • App Locker architecture and components
        • App Locker processes and interactions
        • App Locker functions
        • Security considerations for App Locker
        • Tools to Use with App Locker
          • Using Event Viewer with App Locker
        • App Locker Settings
    • Control the health of Windows 10-based devices
    • Device Guard deployment guide
      • Introduction to Device Guard: virtualization-based security and WDAC
      • Requirements and deployment planning guidelines for Device Guard
      • Planning and getting started on the Device Guard deployment process
      • Deploy WDAC
        • Optional: Create a code signing certificate for WDAC
        • Deploy WDAC: policy rules and file rules
        • Steps to deploy WDAC
        • Deploy catalog files to support WDAC
        • Deploy Managed Installer for Device Guard
      • Deploy Device Guard: enable virtualization-based security
    • Windows Defender Smart Screen
      • Available Windows Defender Smart Screen Group Policy and mobile device management (MDM) settings
      • Set up and use Windows Defender Smart Screen on individual devices
    • Windows Defender Application Guard
      • System requirements for Windows Defender Application Guard
      • Prepare and install Windows Defender Application Guard
      • Configure the Group Policy settings for Windows Defender Application Guard
      • Testing scenarios using Windows Defender Application Guard in your business or organization
      • Frequently Asked Questions - Windows Defender Application Guard
    • Mitigate threats by using Windows 10 security features
    • Override Process Mitigation Options to help enforce app-related security policies
    • Use Windows Event Forwarding to help with intrusion detection
    • Block untrusted fonts in an enterprise
    • Security auditing
      • Basic security audit policies
        • Create a basic audit policy for an event category
        • Apply a basic audit policy on a file or folder
        • View the security event log
        • Basic security audit policy settings
          • Audit account logon events
          • Audit account management
          • Audit directory service access
          • Audit logon events
          • Audit object access
          • Audit policy change
          • Audit privilege use
          • Audit process tracking
          • Audit system events
      • Advanced security audit policies
        • Planning and deploying advanced security audit policies
        • Advanced security auditing FAQ
          • Which editions of Windows support advanced audit policy configuration
        • Using advanced security auditing options to monitor dynamic access control objects
          • Monitor the central access policies that apply on a file server
          • Monitor the use of removable storage devices
          • Monitor resource attribute definitions
          • Monitor central access policy and rule definitions
          • Monitor user and device claims during sign-in
          • Monitor the resource attributes on files and folders
          • Monitor the central access policies associated with files and folders
          • Monitor claim types
        • Advanced security audit policy settings
          • Audit Credential Validation
            • Event 4774 S, F: An account was mapped for logon.
            • Event 4775 F: An account could not be mapped for logon.
            • Event 4776 S, F: The computer attempted to validate the credentials for an account.
            • Event 4777 F: The domain controller failed to validate the credentials for an account.
          • Audit Kerberos Authentication Service
            • Event 4768 S, F: A Kerberos authentication ticket, TGT, was requested.
            • Event 4771 F: Kerberos pre-authentication failed.
            • Event 4772 F: A Kerberos authentication ticket request failed.
          • Audit Kerberos Service Ticket Operations
            • Event 4769 S, F: A Kerberos service ticket was requested.
            • Event 4770 S: A Kerberos service ticket was renewed.
            • Event 4773 F: A Kerberos service ticket request failed.
          • Audit Other Account Logon Events
          • Audit Application Group Management
          • Audit Computer Account Management
            • Event 4741 S: A computer account was created.
            • Event 4742 S: A computer account was changed.
            • Event 4743 S: A computer account was deleted.
          • Audit Distribution Group Management
            • Event 4749 S: A security-disabled global group was created.
            • Event 4750 S: A security-disabled global group was changed.
            • Event 4751 S: A member was added to a security-disabled global group.
            • Event 4752 S: A member was removed from a security-disabled global group.
            • Event 4753 S: A security-disabled global group was deleted.
          • Audit Other Account Management Events
            • Event 4782 S: The password hash an account was accessed.
            • Event 4793 S: The Password Policy Checking API was called.
          • Audit Security Group Management
            • Event 4731 S: A security-enabled local group was created.
            • Event 4732 S: A member was added to a security-enabled local group.
            • Event 4733 S: A member was removed from a security-enabled local group.
            • Event 4734 S: A security-enabled local group was deleted.
            • Event 4735 S: A security-enabled local group was changed.
            • Event 4764 S: A group’s type was changed.
            • Event 4799 S: A security-enabled local group membership was enumerated.
          • Audit User Account Management
            • Event 4720 S: A user account was created.
            • Event 4722 S: A user account was enabled.
            • Event 4723 S, F: An attempt was made to change an account's password.
            • Event 4724 S, F: An attempt was made to reset an account's password.
            • Event 4725 S: A user account was disabled.
            • Event 4726 S: A user account was deleted.
            • Event 4738 S: A user account was changed.
            • Event 4740 S: A user account was locked out.
            • Event 4765 S: SID History was added to an account.
            • Event 4766 F: An attempt to add SID History to an account failed.
            • Event 4767 S: A user account was unlocked.
            • Event 4780 S: The ACL was set on accounts which are members of administrators groups.
            • Event 4781 S: The name of an account was changed.
            • Event 4794 S, F: An attempt was made to set the Directory Services Restore Mode administrator password.
            • Event 4798 S: A user's local group membership was enumerated.
            • Event 5376 S: Credential Manager credentials were backed up.
            • Event 5377 S: Credential Manager credentials were restored from a backup.
          • Audit DPAPI Activity
            • Event 4692 S, F: Backup of data protection master key was attempted.
            • Event 4693 S, F: Recovery of data protection master key was attempted.
            • Event 4694 S, F: Protection of auditable protected data was attempted.
            • Event 4695 S, F: Unprotection of auditable protected data was attempted.
          • Audit PNP Activity
            • Event 6416 S: A new external device was recognized by the System.
            • Event 6419 S: A request was made to disable a device.
            • Event 6420 S: A device was disabled.
            • Event 6421 S: A request was made to enable a device.
            • Event 6422 S: A device was enabled.
            • Event 6423 S: The installation of this device is forbidden by system policy.
            • Event 6424 S: The installation of this device was allowed, after having previously been forbidden by policy.
          • Audit Process Creation
            • Event 4688 S: A new process has been created.
            • Event 4696 S: A primary token was assigned to process.
          • Audit Process Termination
            • Event 4689 S: A process has exited.
          • Audit RPC Events
            • Event 5712 S: A Remote Procedure Call, RPC, was attempted.
          • Audit Detailed Directory Service Replication
            • Event 4928 S, F: An Active Directory replica source naming context was established.
            • Event 4929 S, F: An Active Directory replica source naming context was removed.
            • Event 4930 S, F: An Active Directory replica source naming context was modified.
            • Event 4931 S, F: An Active Directory replica destination naming context was modified.
            • Event 4934 S: Attributes of an Active Directory object were replicated.
            • Event 4935 F: Replication failure begins.
            • Event 4936 S: Replication failure ends.
            • Event 4937 S: A lingering object was removed from a replica.
          • Audit Directory Service Access
            • Event 4662 S, F: An operation was performed on an object.
            • Event 4661 S, F: A handle to an object was requested.
          • Audit Directory Service Changes
            • Event 5136 S: A directory service object was modified.
            • Event 5137 S: A directory service object was created.
            • Event 5138 S: A directory service object was undeleted.
            • Event 5139 S: A directory service object was moved.
            • Event 5141 S: A directory service object was deleted.
          • Audit Directory Service Replication
            • Event 4932 S: Synchronization of a replica of an Active Directory naming context has begun.
            • Event 4933 S, F: Synchronization of a replica of an Active Directory naming context has ended.
          • Audit Account Lockout
            • Event 4625 F: An account failed to log on.
          • Audit User/Device Claims
            • Event 4626 S: User/Device claims information.
          • Audit Group Membership
            • Event 4627 S: Group membership information.
          • Audit IPsec Extended Mode
          • Audit IPsec Main Mode
          • Audit IPsec Quick Mode
          • Audit Logoff
            • Event 4634 S: An account was logged off.
            • Event 4647 S: User initiated logoff.
          • Audit Logon
            • Event 4624 S: An account was successfully logged on.
            • Event 4625 F: An account failed to log on.
            • Event 4648 S: A logon was attempted using explicit credentials.
            • Event 4675 S: SIDs were filtered.
          • Audit Network Policy Server
          • Audit Other Logon/Logoff Events
            • Event 4649 S: A replay attack was detected.
            • Event 4778 S: A session was reconnected to a Window Station.
            • Event 4779 S: A session was disconnected from a Window Station.
            • Event 4800 S: The workstation was locked.
            • Event 4801 S: The workstation was unlocked.
            • Event 4802 S: The screen saver was invoked.
            • Event 4803 S: The screen saver was dismissed.
            • Event 5378 F: The requested credentials delegation was disallowed by policy.
            • Event 5632 S, F: A request was made to authenticate to a wireless network.
            • Event 5633 S, F: A request was made to authenticate to a wired network.
          • Audit Special Logon
            • Event 4964 S: Special groups have been assigned to a new logon.
            • Event 4672 S: Special privileges assigned to new logon.
          • Audit Application Generated
          • Audit Certification Services
          • Audit Detailed File Share
            • Event 5145 S, F: A network share object was checked to see whether client can be granted desired access.
          • Audit File Share
            • Event 5140 S, F: A network share object was accessed.
            • Event 5142 S: A network share object was added.
            • Event 5143 S: A network share object was modified.
            • Event 5144 S: A network share object was deleted.
            • Event 5168 F: SPN check for SMB/SMB2 failed.
          • Audit File System
            • Event 4656 S, F: A handle to an object was requested.
            • Event 4658 S: The handle to an object was closed.
            • Event 4660 S: An object was deleted.
            • Event 4663 S: An attempt was made to access an object.
            • Event 4664 S: An attempt was made to create a hard link.
            • Event 4985 S: The state of a transaction has changed.
            • Event 5051: A file was virtualized.
            • Event 4670 S: Permissions on an object were changed.
          • Audit Filtering Platform Connection
            • Event 5031 F: The Windows Firewall Service blocked an application from accepting incoming connections on the network.
            • Event 5150: The Windows Filtering Platform blocked a packet.
            • Event 5151: A more restrictive Windows Filtering Platform filter has blocked a packet.
            • Event 5154 S: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
            • Event 5155 F: The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
            • Event 5156 S: The Windows Filtering Platform has permitted a connection.
            • Event 5157 F: The Windows Filtering Platform has blocked a connection.
            • Event 5158 S: The Windows Filtering Platform has permitted a bind to a local port.
            • Event 5159 F: The Windows Filtering Platform has blocked a bind to a local port.
          • Audit Filtering Platform Packet Drop
            • Event 5152 F: The Windows Filtering Platform blocked a packet.
            • Event 5153 S: A more restrictive Windows Filtering Platform filter has blocked a packet.
          • Audit Handle Manipulation
            • Event 4690 S: An attempt was made to duplicate a handle to an object.
          • Audit Kernel Object
            • Event 4656 S, F: A handle to an object was requested.
            • Event 4658 S: The handle to an object was closed.
            • Event 4660 S: An object was deleted.
            • Event 4663 S: An attempt was made to access an object.
          • Audit Other Object Access Events
            • Event 4671: An application attempted to access a blocked ordinal through the TBS.
            • Event 4691 S: Indirect access to an object was requested.
            • Event 5148 F: The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.
            • Event 5149 F: The DoS attack has subsided and normal processing is being resumed.
            • Event 4698 S: A scheduled task was created.
            • Event 4699 S: A scheduled task was deleted.
            • Event 4700 S: A scheduled task was enabled.
            • Event 4701 S: A scheduled task was disabled.
            • Event 4702 S: A scheduled task was updated.
            • Event 5888 S: An object in the COM+ Catalog was modified.
            • Event 5889 S: An object was deleted from the COM+ Catalog.
            • Event 5890 S: An object was added to the COM+ Catalog.
          • Audit Registry
            • Event 4663 S: An attempt was made to access an object.
            • Event 4656 S, F: A handle to an object was requested.
            • Event 4658 S: The handle to an object was closed.
            • Event 4660 S: An object was deleted.
            • Event 4657 S: A registry value was modified.
            • Event 5039: A registry key was virtualized.
            • Event 4670 S: Permissions on an object were changed.
          • Audit Removable Storage
          • Audit SAM
            • Event 4661 S, F: A handle to an object was requested.
          • Audit Central Access Policy Staging
            • Event 4818 S: Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy.
          • Audit Audit Policy Change
            • Event 4670 S: Permissions on an object were changed.
            • Event 4715 S: The audit policy, SACL, on an object was changed.
            • Event 4719 S: System audit policy was changed.
            • Event 4817 S: Auditing settings on object were changed.
            • Event 4902 S: The Per-user audit policy table was created.
            • Event 4906 S: The Crash OnAudit Fail value has changed.
            • Event 4907 S: Auditing settings on object were changed.
            • Event 4908 S: Special Groups Logon table modified.
            • Event 4912 S: Per User Audit Policy was changed.
            • Event 4904 S: An attempt was made to register a security event source.
            • Event 4905 S: An attempt was made to unregister a security event source.
          • Audit Authentication Policy Change
            • Event 4706 S: A new trust was created to a domain.
            • Event 4707 S: A trust to a domain was removed.
            • Event 4716 S: Trusted domain information was modified.
            • Event 4713 S: Kerberos policy was changed.
            • Event 4717 S: System security access was granted to an account.
            • Event 4718 S: System security access was removed from an account.
            • Event 4739 S: Domain Policy was changed.
            • Event 4864 S: A namespace collision was detected.
            • Event 4865 S: A trusted forest information entry was added.
            • Event 4866 S: A trusted forest information entry was removed.
            • Event 4867 S: A trusted forest information entry was modified.
          • Audit Authorization Policy Change
            • Event 4703 S: A user right was adjusted.
            • Event 4704 S: A user right was assigned.
            • Event 4705 S: A user right was removed.
            • Event 4670 S: Permissions on an object were changed.
            • Event 4911 S: Resource attributes of the object were changed.
            • Event 4913 S: Central Access Policy on the object was changed.
          • Audit Filtering Platform Policy Change
          • Audit MPSSVC Rule-Level Policy Change
            • Event 4944 S: The following policy was active when the Windows Firewall started.
            • Event 4945 S: A rule was listed when the Windows Firewall started.
            • Event 4946 S: A change has been made to Windows Firewall exception list. A rule was added.
            • Event 4947 S: A change has been made to Windows Firewall exception list. A rule was modified.
            • Event 4948 S: A change has been made to Windows Firewall exception list. A rule was deleted.
            • Event 4949 S: Windows Firewall settings were restored to the default values.
            • Event 4950 S: A Windows Firewall setting has changed.
            • Event 4951 F: A rule has been ignored because its major version number was not recognized by Windows Firewall.
            • Event 4952 F: Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.
            • Event 4953 F: Windows Firewall ignored a rule because it could not be parsed.
            • Event 4954 S: Windows Firewall Group Policy settings have changed. The new settings have been applied.
            • Event 4956 S: Windows Firewall has changed the active profile.
            • Event 4957 F: Windows Firewall did not apply the following rule.
            • Event 4958 F: Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer.
          • Audit Other Policy Change Events
            • Event 4714 S: Encrypted data recovery policy was changed.
            • Event 4819 S: Central Access Policies on the machine have been changed.
            • Event 4826 S: Boot Configuration Data loaded.
            • Event 4909: The local policy settings for the TBS were changed.
            • Event 4910: The group policy settings for the TBS were changed.
            • Event 5063 S, F: A cryptographic provider operation was attempted.
            • Event 5064 S, F: A cryptographic context operation was attempted.
            • Event 5065 S, F: A cryptographic context modification was attempted.
            • Event 5066 S, F: A cryptographic function operation was attempted.
            • Event 5067 S, F: A cryptographic function modification was attempted.
            • Event 5068 S, F: A cryptographic function provider operation was attempted.
            • Event 5069 S, F: A cryptographic function property operation was attempted.
            • Event 5070 S, F: A cryptographic function property modification was attempted.
            • Event 5447 S: A Windows Filtering Platform filter has been changed.
            • Event 6144 S: Security policy in the group policy objects has been applied successfully.
            • Event 6145 F: One or more errors occurred while processing security policy in the group policy objects.
          • Audit Sensitive Privilege Use
            • Event 4673 S, F: A privileged service was called.
            • Event 4674 S, F: An operation was attempted on a privileged object.
            • Event 4985 S: The state of a transaction has changed.
          • Audit Non Sensitive Privilege Use
            • Event 4673 S, F: A privileged service was called.
            • Event 4674 S, F: An operation was attempted on a privileged object.
            • Event 4985 S: The state of a transaction has changed.
          • Audit Other Privilege Use Events
            • Event 4985 S: The state of a transaction has changed.
          • Audit IPsec Driver
          • Audit Other System Events
            • Event 5024 S: The Windows Firewall Service has started successfully.
            • Event 5025 S: The Windows Firewall Service has been stopped.
            • Event 5027 F: The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy.
            • Event 5028 F: The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy.
            • Event 5029 F: The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy.
            • Event 5030 F: The Windows Firewall Service failed to start.
            • Event 5032 F: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.
            • Event 5033 S: The Windows Firewall Driver has started successfully.
            • Event 5034 S: The Windows Firewall Driver was stopped.
            • Event 5035 F: The Windows Firewall Driver failed to start.
            • Event 5037 F: The Windows Firewall Driver detected critical runtime error. Terminating.
            • Event 5058 S, F: Key file operation.
            • Event 5059 S, F: Key migration operation.
            • Event 6400: Branch Cache: Received an incorrectly formatted response while discovering availability of content.
            • Event 6401: Branch Cache: Received invalid data from a peer. Data discarded.
            • Event 6402: Branch Cache: The message to the hosted cache offering it data is incorrectly formatted.
            • Event 6403: Branch Cache: The hosted cache sent an incorrectly formatted response to the client.
            • Event 6404: Branch Cache: Hosted cache could not be authenticated using the provisioned SSL certificate.
            • Event 6405: Branch Cache: %2 instances of event id %1 occurred.
            • Event 6406: %1 registered to Windows Firewall to control filtering for the following: %2.
            • Event 6407: 1%.
            • Event 6408: Registered product %1 failed and Windows Firewall is now controlling the filtering for %2.
            • Event 6409: Branch Cache: A service connection point object could not be parsed.
          • Audit Security State Change
            • Event 4608 S: Windows is starting up.
            • Event 4616 S: The system time was changed.
            • Event 4621 S: Administrator recovered system from Crash OnAudit Fail.
          • Audit Security System Extension
            • Event 4610 S: An authentication package has been loaded by the Local Security Authority.
            • Event 4611 S: A trusted logon process has been registered with the Local Security Authority.
            • Event 4614 S: A notification package has been loaded by the Security Account Manager.
            • Event 4622 S: A security package has been loaded by the Local Security Authority.
            • Event 4697 S: A service was installed in the system.
          • Audit System Integrity
            • Event 4612 S: Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.
            • Event 4615 S: Invalid use of LPC port.
            • Event 4618 S: A monitored security event pattern has occurred.
            • Event 4816 S: RPC detected an integrity violation while decrypting an incoming message.
            • Event 5038 F: Code integrity determined that the image hash of a file is not valid.
            • Event 5056 S: A cryptographic self-test was performed.
            • Event 5062 S: A kernel-mode cryptographic self-test was performed.
            • Event 5057 F: A cryptographic primitive operation failed.
            • Event 5060 F: Verification operation failed.
            • Event 5061 S, F: Cryptographic operation.
            • Event 6281 F: Code Integrity determined that the page hashes of an image file are not valid.
            • Event 6410 F: Code integrity determined that a file does not meet the security requirements to load into a process.
          • Other Events
            • Event 1100 S: The event logging service has shut down.
            • Event 1102 S: The audit log was cleared.
            • Event 1104 S: The security log is now full.
            • Event 1105 S: Event log automatic backup.
            • Event 1108 S: The event logging service encountered an error while processing an incoming event published from %1.
          • Appendix A: Security monitoring recommendations for many audit events
          • Registry (Global Object Access Auditing)
          • File System (Global Object Access Auditing)
    • Security policy settings
      • Administer security policy settings
        • Network List Manager policies
      • Configure security policy settings
      • Security policy settings reference
        • Account Policies
          • Password Policy
            • Enforce password history
            • Maximum password age
            • Minimum password age
            • Minimum password length
            • Password must meet complexity requirements
            • Store passwords using reversible encryption
          • Account Lockout Policy
            • Account lockout duration
            • Account lockout threshold
            • Reset account lockout counter after
          • Kerberos Policy
            • Enforce user logon restrictions
            • Maximum lifetime for service ticket
            • Maximum lifetime for user ticket
            • Maximum lifetime for user ticket renewal
            • Maximum tolerance for computer clock synchronization
        • Audit Policy
        • Security Options
          • Accounts: Administrator account status
          • Accounts: Block Microsoft accounts
          • Accounts: Guest account status
          • Accounts: Limit local account use of blank passwords to console logon only
          • Accounts: Rename administrator account
          • Accounts: Rename guest account
          • Audit: Audit the access of global system objects
          • Audit: Audit the use of Backup and Restore privilege
          • Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings
          • Audit: Shut down system immediately if unable to log security audits
          • DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax
          • DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax
          • Devices: Allow undock without having to log on
          • Devices: Allowed to format and eject removable media
          • Devices: Prevent users from installing printer drivers
          • Devices: Restrict CD-ROM access to locally logged-on user only
          • Devices: Restrict floppy access to locally logged-on user only
          • Domain controller: Allow server operators to schedule tasks
          • Domain controller: LDAP server signing requirements
          • Domain controller: Refuse machine account password changes
          • Domain member: Digitally encrypt or sign secure channel data (always)
          • Domain member: Digitally encrypt secure channel data (when possible)
          • Domain member: Digitally sign secure channel data (when possible)
          • Domain member: Disable machine account password changes
          • Domain member: Maximum machine account password age
          • Domain member: Require strong (Windows 2000 or later) session key
          • Interactive logon: Display user information when the session is locked
          • Interactive logon: Don't display last signed-in
          • Interactive logon: Don't display username at sign-in
          • Interactive logon: Do not require CTRL+ALT+DEL
          • Interactive logon: Machine account lockout threshold
          • Interactive logon: Machine inactivity limit
          • Interactive logon: Message text for users attempting to log on
          • Interactive logon: Message title for users attempting to log on
          • Interactive logon: Number of previous logons to cache (in case domain controller is not available)
          • Interactive logon: Prompt user to change password before expiration
          • Interactive logon: Require Domain Controller authentication to unlock workstation
          • Interactive logon: Require smart card
          • Interactive logon: Smart card removal behavior
          • Microsoft network client: Digitally sign communications (always)
          • Microsoft network client: Digitally sign communications (if server agrees)
          • Microsoft network client: Send unencrypted password to third-party SMB servers
          • Microsoft network server: Amount of idle time required before suspending session
          • Microsoft network server: Attempt S4U2Self to obtain claim information
          • Microsoft network server: Digitally sign communications (always)
          • Microsoft network server: Digitally sign communications (if client agrees)
          • Microsoft network server: Disconnect clients when logon hours expire
          • Microsoft network server: Server SPN target name validation level
          • Network access: Allow anonymous SID/Name translation
          • Network access: Do not allow anonymous enumeration of SAM accounts
          • Network access: Do not allow anonymous enumeration of SAM accounts and shares
          • Network access: Do not allow storage of passwords and credentials for network authentication
          • Network access: Let Everyone permissions apply to anonymous users
          • Network access: Named Pipes that can be accessed anonymously
          • Network access: Remotely accessible registry paths
          • Network access: Remotely accessible registry paths and subpaths
          • Network access: Restrict anonymous access to Named Pipes and Shares
          • Network access: Restrict clients allowed to make remote calls to SAM
          • Network access: Shares that can be accessed anonymously
          • Network access: Sharing and security model for local accounts
          • Network security: Allow Local System to use computer identity for NTLM
          • Network security: Allow Local System NULL session fallback
          • Network security: Allow PKU2U authentication requests to this computer to use online identities
          • Network security: Configure encryption types allowed for Kerberos Win7 only
          • Network security: Do not store LAN Manager hash value on next password change
          • Network security: Force logoff when logon hours expire
          • Network security: LAN Manager authentication level
          • Network security: LDAP client signing requirements
          • Network security: Minimum session security for NTLM SSP based (including secure RPC) clients
          • Network security: Minimum session security for NTLM SSP based (including secure RPC) servers
          • Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication
          • Network security: Restrict NTLM: Add server exceptions in this domain
          • Network security: Restrict NTLM: Audit incoming NTLM traffic
          • Network security: Restrict NTLM: Audit NTLM authentication in this domain
          • Network security: Restrict NTLM: Incoming NTLM traffic
          • Network security: Restrict NTLM: NTLM authentication in this domain
          • Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers
          • Recovery console: Allow automatic administrative logon
          • Recovery console: Allow floppy copy and access to all drives and folders
          • Shutdown: Allow system to be shut down without having to log on
          • Shutdown: Clear virtual memory pagefile
          • System cryptography: Force strong key protection for user keys stored on the computer
          • System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing
          • System objects: Require case insensitivity for non-Windows subsystems
          • System objects: Strengthen default permissions of internal system objects (e. g. Symbolic Links)
          • System settings: Optional subsystems
          • System settings: Use certificate rules on Windows executables for Software Restriction Policies
          • User Account Control: Admin Approval Mode for the Built-in Administrator account
          • User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop
          • User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
          • User Account Control: Behavior of the elevation prompt for standard users
          • User Account Control: Detect application installations and prompt for elevation
          • User Account Control: Only elevate executables that are signed and validated
          • User Account Control: Only elevate UIAccess applications that are installed in secure locations
          • User Account Control: Run all administrators in Admin Approval Mode
          • User Account Control: Switch to the secure desktop when prompting for elevation
          • User Account Control: Virtualize file and registry write failures to per-user locations
        • Advanced security audit policy settings
        • User Rights Assignment
          • Access Credential Manager as a trusted caller
          • Access this computer from the network
          • Act as part of the operating system
          • Add workstations to domain
          • Adjust memory quotas for a process
          • Allow log on locally
          • Allow log on through Remote Desktop Services
          • Back up files and directories
          • Bypass traverse checking
          • Change the system time
          • Change the time zone
          • Create a pagefile
          • Create a token object
          • Create global objects
          • Create permanent shared objects
          • Create symbolic links
          • Debug programs
          • Deny access to this computer from the network
          • Deny log on as a batch job
          • Deny log on as a service
          • Deny log on locally
          • Deny log on through Remote Desktop Services
          • Enable computer and user accounts to be trusted for delegation
          • Force shutdown from a remote system
          • Generate security audits
          • Impersonate a client after authentication
          • Increase a process working set
          • Increase scheduling priority
          • Load and unload device drivers
          • Lock pages in memory
          • Log on as a batch job
          • Log on as a service
          • Manage auditing and security log
          • Modify an object label
          • Modify firmware environment values
          • Perform volume maintenance tasks
          • Profile single process
          • Profile system performance
          • Remove computer from docking station
          • Replace a process level token
          • Restore files and directories
          • Shut down the system
          • Synchronize directory service data
          • Take ownership of files or other objects
    • Windows security baselines
      • Security Compliance Toolkit
      • Get support
    • Windows 10 Mobile security guide
    • Change history for Threat protection
  • Information protection
    • Bit Locker
      • Overview of Bit Locker Device Encryption in Windows 10
      • Bit Locker frequently asked questions (FAQ)
      • Prepare your organization for Bit Locker: Planning and policies
      • Bit Locker basic deployment
      • Bit Locker: How to deploy on Windows Server 2012 and later
      • Bit Locker: Management recommendations for enterprises
      • Bit Locker: How to enable Network Unlock
      • Bit Locker: Use Bit Locker Drive Encryption Tools to manage Bit Locker
      • Bit Locker: Use Bit Locker Recovery Password Viewer
      • Bit Locker Group Policy settings
      • BCD settings and Bit Locker
      • Bit Locker Recovery Guide
      • Protect Bit Locker from pre-boot attacks
        • Types of attacks for volume encryption keys
        • Bit Locker Countermeasures
        • Choose the Right Bit Locker Countermeasure
      • Protecting cluster shared volumes and storage area networks with Bit Locker
    • Protect your enterprise data using Windows Information Protection (WIP)
      • Create a Windows Information Protection (WIP) policy using Microsoft Intune
        • Create a Windows Information Protection (WIP) policy using the classic console for Microsoft Intune
          • Deploy your Windows Information Protection (WIP) policy using the classic console for Microsoft Intune
          • Associate and deploy a VPN policy for Windows Information Protection (WIP) using the classic console for Microsoft Intune
        • Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune
          • Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune
          • Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune
        • Create a Windows Information Protection (WIP) policy with MAM using the Azure portal for Microsoft Intune
      • Create a Windows Information Protection (WIP) policy using System Center Configuration Manager
        • Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager
      • Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate
      • Determine the Enterprise Context of an app running in Windows Information Protection (WIP)
      • Mandatory tasks and settings required to turn on Windows Information Protection (WIP)
      • Testing scenarios for Windows Information Protection (WIP)
      • Limitations while using Windows Information Protection (WIP)
      • How to collect Windows Information Protection (WIP) audit event logs
      • General guidance and best practices for Windows Information Protection (WIP)
        • Enlightened apps for use with Windows Information Protection (WIP)
        • Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)
        • Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)
        • Using Outlook Web Access with Windows Information Protection (WIP)
  • Hardware-based protection
    • Encrypted Hard Drive
    • How hardware-based containers help protect Windows 10
    • Secure the Windows 10 boot process
    • Trusted Platform Module
      • Trusted Platform Module Overview
      • TPM fundamentals
      • How Windows 10 uses the TPM
      • TPM Group Policy settings
      • Back up the TPM recovery information to AD DS
      • Manage TPM commands
      • Manage TPM lockout
      • Change the TPM owner password
      • View status, clear, or troubleshoot the TPM
      • Understanding PCR banks on TPM 2.0 devices
      • TPM recommendations
• Troubleshooting
  • Update History
    • Windows 10 Version 1709 update history
    • Windows 10 Version 1703 update history
    • Windows 10 Version 1607 update history
    • Windows 10 Version 1511 update history
    • Windows 10 (initial version released July 2015)
  • Top support solutions for Windows 10
    • Solutions related to installing Windows updates or hotfixes
      • Understanding the Windowsupdate.log file for advanced users
      • You can't install updates on a Windows-based computer
      • Get-WindowsUpdateLog
      • How to read the Windowsupdate.log file
      • Can't download updates from Windows Update from behind a firewall or proxy server
      • Computer staged from a SysPrepped image doesn't receive WSUS updates
      • Servicing stack update for Windows 10 Version 1703: June 13, 2017
      • Servicing stack update for Windows 10 Version 1607 and Windows Server 2016: March 14, 2017
    • Solutions related to Bugchecks or Stop Errors
      • Troubleshooting Stop error problems for IT Pros
      • How to use Windows Recovery Environment (WinRE) to troubleshoot common startup issues
      • How to troubleshoot Windows-based computer freeze issues
      • Understanding Bugchecks
      • Understanding Crash Dump Files
    • Solutions related to installing or upgrading Windows
      • Resolve Windows 10 upgrade errors : Technical information for IT Pros
      • Windows OOBE fails when you start a new Windows-based computer for the first time
      • "0xc1800118" error when you push Windows 10 Version 1607 by using WSUS
      • 0xC1900101 error when Windows 10 upgrade fails after the second system restart
      • Updates fix in-place upgrade to Windows 10 version 1607 problem
      • OOBE update for Windows 10 Version 1703: May 9, 2017
      • OOBE update for Windows 10 Version 1607: May 30, 2017
      • OOBE update for Windows 10 Version 1511: May 30, 2017
    • Solutions related to configuring or managing the Start menu
      • Manage Windows 10 Start and taskbar layout
      • Customize and export Start layout
      • Changes to Group Policy settings for Windows 10 Start
      • Preinstalled system applications and Start menu may not work when you upgrade to Windows 10, Version 1511
      • Start menu shortcuts aren't immediately accessible in Windows Server 2016
      • Troubleshoot problems opening the Start menu or Cortana
      • Modern apps are blocked by security software when you start the applications on Windows 10 Version 1607
    • Solutions related to wireless networking and 802.1X authentication
      • Windows 10 devices can't connect to an 802.1X environment
      • Windows 10 wireless connection displays "Limited" status
      • Computer that has VPN software installed can't detect wireless network after upgrading to Windows 10
  • Manage clients in Windows 10
    • Administrative Tools in Windows 10
    • Create mandatory user profiles
    • Connect to remote Azure Active Directory-joined PC
    • Join Windows 10 Mobile to Azure Active Directory
    • New policies for Windows 10
    • Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education
    • Manage the Settings app with Group Policy
    • Reset a Windows 10 Mobile device
    • Transitioning to modern management
    • Windows 10 Mobile deployment and management guide
    • Windows libraries
    • Mobile device management for solution providers
    • Change history for Client management
• Other Windows client versions
  • Windows IT Pro client
    • Windows 8/8.1
    • Windows 7
    • Windows Vista
    • Windows XP
    • Windows Phone
  • Windows Server
    • Windows Server 2012 R2 and 2012
    • Windows Server 2008 R2 and 2008
    • Windows Server 2000
    • Windows Multipoint Server
    • Windows Home Server
    • Windows HPC Server
    • Windows Server Essentials
    • Windows Server Storage Solutions
    • Windows Power Shell 1.0
  • Windows app development
    • Windows 8
    • Windows Phone Silverlight
  • Windows hardware
    • Hardware Certification Kit
    • Windows Logo Kit
    • Windows Server Essentials Assessment and Deployment Kit
    • Additional hardware documentation
  • Internet Explorer
    • Internet Explorer for Developers
    • Internet Explorer for IT Pros